diff --git a/frontend/src/components/custom-rules.tsx b/frontend/src/components/custom-rules.tsx
index c2194ab..5d897ab 100644
--- a/frontend/src/components/custom-rules.tsx
+++ b/frontend/src/components/custom-rules.tsx
@@ -43,18 +43,18 @@ declare const Classification: {
 /**
  * Determines whether to block or allow the activity.
  */
-type TerminationModeType = "none" | "block" | "paused" | "allow";
+type EnforcementActionType = "none" | "block" | "paused" | "allow";
 
 /**
  * Global constant for termination mode values.
- * Use these values when returning a TerminationDecision.
+ * Use these values when returning a EnforcementDecision.
  * @example
  * return {
- *   terminationMode: TerminationMode.Block,
- *   terminationReasoning: "Blocked during focus hours"
+ *   enforcementAction: EnforcementAction.Block,
+ *   enforcementReason: "Blocked during focus hours"
  * };
  */
-declare const TerminationMode: {
+declare const EnforcementAction: {
   readonly None: "none";
   readonly Block: "block";
   readonly Paused: "paused";
@@ -62,13 +62,13 @@ declare const TerminationMode: {
 };
 
 /**
- * Decision returned from the terminationMode function.
+ * Decision returned from the enforcementDecision function.
  */
-interface TerminationDecision {
-  /** The termination mode to apply. Use TerminationMode constants. */
-  terminationMode: TerminationModeType;
+interface EnforcementDecision {
+  /** The termination mode to apply. Use EnforcementAction constants. */
+  enforcementAction: EnforcementActionType;
   /** Human-readable explanation for why this decision was made. */
-  terminationReasoning: string;
+  enforcementReason: string;
 }
 
 /**
@@ -84,7 +84,7 @@ interface ClassificationDecision {
 /**
  * Provides context for the current rule execution including usage data.
  */
-interface Context {
+interface UsageContext {
   /** The display name of the application (e.g., 'Safari', 'Slack'). */
   readonly appName?: string;
   /** The application's bundle identifier (e.g., 'com.apple.Safari'). */
@@ -107,8 +107,8 @@ interface Context {
    * @returns Total minutes of usage in the specified time window
    * @example
    * // Block if used more than 30 minutes in the last hour
-   * if (ctx.minutesUsedInPeriod(60) > 30) {
-   *   return { terminationMode: TerminationMode.Block, terminationReasoning: 'Usage limit exceeded' };
+   * if (context.minutesUsedInPeriod(60) > 30) {
+   *   return { enforcementAction: EnforcementAction.Block, enforcementReason: 'Usage limit exceeded' };
    * }
    */
   minutesUsedInPeriod(minutes: number): number;
@@ -278,31 +278,31 @@ const starterRulesTS = `/**
  *
  * @example
  * // Classify all GitHub activity as productive
- * if (ctx.domain === 'github.com') {
+ * if (context.domain === 'github.com') {
  *   return {
  *     classification: Classification.Productive,
  *     classificationReasoning: 'GitHub is a development tool'
  *   };
  * }
  */
-export function classify(ctx: Context): ClassificationDecision | undefined {
+export function classify(context: UsageContext): ClassificationDecision | undefined {
   return undefined;
 }
 
 /**
  * Custom termination logic (blocking).
- * Return a TerminationDecision to override the default, or undefined to keep the default.
+ * Return a EnforcementDecision to override the default, or undefined to keep the default.
  *
  * @example
  * // Block social media after 10 PM in London
- * if (ctx.domain === 'twitter.com' && now(Timezone.Europe_London).getHours() >= 22) {
+ * if (context.domain === 'twitter.com' && now(Timezone.Europe_London).getHours() >= 22) {
  *   return {
- *     terminationMode: TerminationMode.Block,
- *     terminationReasoning: 'Social media blocked after 10 PM'
+ *     enforcementAction: EnforcementAction.Block,
+ *     enforcementReason: 'Social media blocked after 10 PM'
  *   };
  * }
  */
-export function terminationMode(ctx: Context): TerminationDecision | undefined {
+export function enforcementDecision(context: UsageContext): EnforcementDecision | undefined {
   return undefined;
 }
 `;
@@ -451,7 +451,7 @@ export function CustomRules() {
             size="sm"
             className="h-7 px-3 bg-violet-600 hover:bg-violet-500 text-white text-[11px] font-bold rounded-lg transition-all"
           >
-            Upgrade Now
+            Get Plus
           </Button>
         </div>
       )}
diff --git a/frontend/src/components/execution-logs.tsx b/frontend/src/components/execution-logs.tsx
index c6c0597..06e9dbb 100644
--- a/frontend/src/components/execution-logs.tsx
+++ b/frontend/src/components/execution-logs.tsx
@@ -263,9 +263,9 @@ export function ExecutionLogsSheet({
               Classify
             </Button>
             <Button
-              variant={typeFilter === "termination_mode" ? "secondary" : "ghost"}
+              variant={typeFilter === "enforcement_action" ? "secondary" : "ghost"}
               size="sm"
-              onClick={() => setTypeFilter("termination_mode")}
+              onClick={() => setTypeFilter("enforcement_action")}
               className="h-7 px-2 text-[10px] font-medium"
             >
               Terminate
diff --git a/frontend/src/components/usage-item.tsx b/frontend/src/components/usage-item.tsx
index 5f25020..bed1f23 100644
--- a/frontend/src/components/usage-item.tsx
+++ b/frontend/src/components/usage-item.tsx
@@ -1,5 +1,6 @@
 import React, { useState } from "react";
 import { Link } from "@tanstack/react-router";
+import { Browser } from "@wailsio/runtime";
 import {
   IconWorld,
   IconAppWindow,
@@ -16,8 +17,9 @@ import {
   TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { useUsageStore } from "@/stores/usage-store";
+import { useAccountStore } from "@/stores/account-store";
 import type { ApplicationUsage } from "../../bindings/github.com/focusd-so/focusd/internal/usage/models";
-import { TerminationMode } from "../../bindings/github.com/focusd-so/focusd/internal/usage/models";
+import { EnforcementAction } from "../../bindings/github.com/focusd-so/focusd/internal/usage/models";
 
 export function isDistracting(classification?: string | null): boolean {
   if (!classification) return false;
@@ -135,7 +137,7 @@ export function formatClassificationSource(
   }
 }
 
-export function formatTerminationModeSource(
+export function formatEnforcementSource(
   source?: string | null,
   reasoning?: string | null
 ): {
@@ -252,7 +254,7 @@ export function ClassificationReasoningLabel({
   isPausedDistraction,
   isCurrentlyPaused,
   onResume,
-  terminationSource,
+  enforcementSource,
 }: {
   usage: ApplicationUsage;
   icon?: string;
@@ -262,7 +264,7 @@ export function ClassificationReasoningLabel({
   isPausedDistraction?: boolean;
   isCurrentlyPaused?: boolean;
   onResume?: () => void;
-  terminationSource?: {
+  enforcementSource?: {
     label: string;
     icon: string;
     description: string;
@@ -272,11 +274,11 @@ export function ClassificationReasoningLabel({
   if (!usage.classification_source) return null;
 
   const isCustomRulesAllow =
-    usage.termination_mode === TerminationMode.TerminationModeAllow &&
-    usage.termination_mode_source === "custom_rules";
+    usage.enforcement_action === EnforcementAction.EnforcementActionAllow &&
+    usage.enforcement_source === "custom_rules";
 
   const isCustomRulesClassification =
-    usage.classification_reasoning && usage.termination_mode_source === "custom_rules";
+    usage.classification_reasoning && usage.enforcement_source === "custom_rules";
 
   // Determine the label text based on priority
   const getLabelText = (): string => {
@@ -284,13 +286,13 @@ export function ClassificationReasoningLabel({
       return "was paused by user";
     }
     if (isCustomRulesAllow) {
-      return usage.termination_reasoning || "set by custom rules";
+      return usage.enforcement_reason || "set by custom rules";
     }
     if (isCustomRulesClassification) {
       return usage.classification_reasoning!;
     }
     if (isAllowedDistraction) {
-      return usage.termination_reasoning || "user allowed distraction";
+      return usage.enforcement_reason || "user allowed distraction";
     }
     return description;
   };
@@ -299,9 +301,9 @@ export function ClassificationReasoningLabel({
   const shouldBeLink = isCustomRulesAllow || isCustomRulesClassification || isLink;
 
   const labelText = getLabelText();
-  const prefixLabel = terminationSource?.label;
+  const prefixLabel = enforcementSource?.label;
   const displayText = prefixLabel ? `${prefixLabel}: ${labelText}` : labelText;
-  const displayIcon = isPausedDistraction ? <IconPlayerPause className="w-3 h-3 text-yellow-500/70" /> : <span className="text-[10px] opacity-70">{terminationSource?.icon || icon}</span>;
+  const displayIcon = isPausedDistraction ? <IconPlayerPause className="w-3 h-3 text-yellow-500/70" /> : <span className="text-[10px] opacity-70">{enforcementSource?.icon || icon}</span>;
 
   // Handle paused distraction display with optional resume button
   if (isPausedDistraction) {
@@ -330,8 +332,8 @@ export function ClassificationReasoningLabel({
   return (
     <span className="text-[10px] text-muted-foreground/50 flex items-center gap-1.5">
       {displayIcon}
-      {shouldBeLink || terminationSource?.isLink ? (
-        <TruncatedLabel className="max-w-[300px]">
+      {shouldBeLink || enforcementSource?.isLink ? (
+        <TruncatedLabel className="max-w-[170px] sm:max-w-[260px]">
           <Link
             to="/settings"
             search={{ tab: "rules" }}
@@ -341,7 +343,7 @@ export function ClassificationReasoningLabel({
           </Link>
         </TruncatedLabel>
       ) : (
-        <TruncatedLabel className="max-w-[300px]">{displayText}</TruncatedLabel>
+        <TruncatedLabel className="max-w-[170px] sm:max-w-[260px]">{displayText}</TruncatedLabel>
       )}
     </span>
   );
@@ -387,6 +389,7 @@ export function UsageItem({ usage }: { usage: ApplicationUsage }) {
   const isGrayTheme = isNeutralOrSystem(usage.classification);
   const resumeProtection = useUsageStore((state) => state.resumeProtection);
   const currentPause = useUsageStore((state) => state.currentPause);
+  const checkoutLink = useAccountStore((state) => state.checkoutLink);
   const [showLogs, setShowLogs] = useState(false);
 
   // Check if there's currently an active pause
@@ -395,12 +398,12 @@ export function UsageItem({ usage }: { usage: ApplicationUsage }) {
   // Check if this is a paused distraction
   const isPausedDistraction =
     isDistractingEvent &&
-    usage.termination_mode === TerminationMode.TerminationModePaused;
+    usage.enforcement_action === EnforcementAction.EnforcementActionPaused;
 
   const isAllowedDistraction =
     isDistractingEvent &&
-    usage.termination_mode === TerminationMode.TerminationModeAllow &&
-    (usage.termination_mode_source === "custom_rules" || usage.termination_mode_source === "whitelist");
+    usage.enforcement_action === EnforcementAction.EnforcementActionAllow &&
+    (usage.enforcement_source === "custom_rules" || usage.enforcement_source === "whitelist");
 
   // Combined flag for yellow styling
   const isYellowTheme = isPausedDistraction || isAllowedDistraction;
@@ -413,8 +416,8 @@ export function UsageItem({ usage }: { usage: ApplicationUsage }) {
     usage.classification_reasoning
   );
 
-  const termSource = formatTerminationModeSource(
-    usage.termination_mode_source,
+  const termSource = formatEnforcementSource(
+    usage.enforcement_source,
     usage.classification_reasoning
   );
 
@@ -424,27 +427,68 @@ export function UsageItem({ usage }: { usage: ApplicationUsage }) {
       ? usage.ended_at - usage.started_at
       : null;
 
+  const classificationSandboxContext =
+    (usage as any).classification_sandbox_context ?? (usage as any).sandbox_context;
+  const classificationSandboxResponse =
+    (usage as any).classification_sandbox_response ?? (usage as any).sandbox_response;
+  const classificationSandboxLogs =
+    (usage as any).classification_sandbox_logs ?? (usage as any).sandbox_logs;
+
+  const enforcementSandboxContext = (usage as any).enforcement_sandbox_context;
+  const enforcementSandboxResponse = (usage as any).enforcement_sandbox_response;
+  const enforcementSandboxLogs = (usage as any).enforcement_sandbox_logs;
+
+  const hasSandboxResult = (response?: string | null) => {
+    if (!response) return false;
+    const normalized = response.trim().toLowerCase();
+    return normalized !== "" && normalized !== "no response" && normalized !== "null";
+  };
+
+  const hasClassificationSandbox =
+    hasSandboxResult(classificationSandboxResponse);
+  const hasEnforcementSandbox = hasSandboxResult(enforcementSandboxResponse);
+  const hasAnySandbox = hasClassificationSandbox || hasEnforcementSandbox;
+
   // Detect script execution that was ignored (Free tier)
   let sandboxDecision: any = null;
   try {
-    if (usage.sandbox_response && usage.sandbox_response !== "no response") {
-      sandboxDecision = JSON.parse(usage.sandbox_response);
+    if (enforcementSandboxResponse && enforcementSandboxResponse !== "no response") {
+      sandboxDecision = JSON.parse(enforcementSandboxResponse);
+    } else if (classificationSandboxResponse && classificationSandboxResponse !== "no response") {
+      sandboxDecision = JSON.parse(classificationSandboxResponse);
     }
   } catch (e) {
     // ignore
   }
 
+  const actualDidBlock = usage.enforcement_action === EnforcementAction.EnforcementActionBlock;
+  let scriptDidBlock = false;
+  let hasScriptDecision = false;
+  if (sandboxDecision) {
+    if (sandboxDecision.enforcementAction === "block") {
+      scriptDidBlock = true;
+      hasScriptDecision = true;
+    } else if (sandboxDecision.enforcementAction === "allow") {
+      scriptDidBlock = false;
+      hasScriptDecision = true;
+    } else if (sandboxDecision.classification) {
+      scriptDidBlock = isDistracting(sandboxDecision.classification);
+      hasScriptDecision = true;
+    }
+  }
+
   const isIgnoredRule =
-    !!sandboxDecision &&
+    hasScriptDecision &&
     usage.classification_source !== "custom_rules" &&
-    usage.termination_mode_source !== "custom_rules";
+    usage.enforcement_source !== "custom_rules" &&
+    scriptDidBlock !== actualDidBlock;
 
   return (
     <div
       className={`flex flex-col p-1.5 rounded-lg border transition-all ${theme.container}`}
     >
-      <div className="flex items-center justify-between w-full">
-        <div className="flex items-center gap-2 truncate">
+      <div className="flex items-start justify-between w-full gap-2 min-w-0">
+        <div className="flex min-w-0 flex-1 items-center gap-2">
           {/* Icon Container */}
           <div
             className={`w-8 h-8 rounded-md flex items-center justify-center overflow-hidden shrink-0 ${theme.iconBg}`}
@@ -467,7 +511,7 @@ export function UsageItem({ usage }: { usage: ApplicationUsage }) {
           </div>
 
           {/* Text Content */}
-          <div className="flex flex-col truncate">
+          <div className="flex min-w-0 flex-1 flex-col truncate">
             <TruncatedLabel className="text-xs font-semibold text-foreground truncate leading-tight">
               {usage.application?.hostname || usage.application?.name || "Unknown"}
             </TruncatedLabel>
@@ -487,17 +531,53 @@ export function UsageItem({ usage }: { usage: ApplicationUsage }) {
                 </Link>
               )}
               <span className="text-muted-foreground/40 text-[10px]">—</span>
-              <TruncatedLabel className="text-[10px] text-muted-foreground truncate max-w-[250px]">
+              <TruncatedLabel className="text-[10px] text-muted-foreground truncate max-w-[130px] sm:max-w-[210px] lg:max-w-[250px]">
                 {usage.window_title || (isWeb ? "Browsing" : "Using app")}
               </TruncatedLabel>
             </div>
+            {isIgnoredRule && (
+              <div className="self-start text-[9px] text-purple-400/80 bg-purple-500/5 px-1.5 py-0.5 rounded border border-purple-500/10 mt-1 flex items-center gap-1 animate-in fade-in slide-in-from-left-1 duration-500">
+                <IconTerminal className="w-2.5 h-2.5 shrink-0" />
+                <span className="truncate">
+                  Script would have{" "}
+                  <span className="font-semibold uppercase text-purple-400">
+                    {scriptDidBlock ? "blocked" : "allowed"}
+                  </span>{" "}
+                  this on paid tiers.
+                </span>
+                <div className="flex items-center gap-1.5 shrink-0">
+                  {checkoutLink && (
+                    <>
+                      <button
+                        onClick={(e) => {
+                          e.stopPropagation();
+                          Browser.OpenURL(checkoutLink);
+                        }}
+                        className="underline hover:text-purple-300 font-medium whitespace-nowrap"
+                      >
+                        Get Plus
+                      </button>
+                      <span className="text-purple-500/40">·</span>
+                    </>
+                  )}
+                  <Link
+                    to="/settings"
+                    search={{ tab: "rules" }}
+                    className="underline hover:text-purple-300 font-medium whitespace-nowrap"
+                    onClick={(e) => e.stopPropagation()}
+                  >
+                    Activate custom rules
+                  </Link>
+                </div>
+              </div>
+            )}
           </div>
         </div>
 
         {/* Right Side Group */}
-        <div className="flex items-center gap-2 shrink-0">
-          <div className="flex flex-col items-end gap-1">
-            <div className="flex items-center gap-1.5">
+        <div className="flex min-w-0 items-start gap-2 pl-1">
+          <div className="flex min-w-0 flex-col items-end gap-1">
+            <div className="flex flex-wrap items-center justify-end gap-1">
               {durationSeconds != null && durationSeconds >= 0 && (
                 <div className="flex items-center gap-1.5">
                   <span className="text-xs font-semibold text-foreground/90 tabular-nums">
@@ -537,36 +617,14 @@ export function UsageItem({ usage }: { usage: ApplicationUsage }) {
               isPausedDistraction={isPausedDistraction}
               isCurrentlyPaused={isCurrentlyPaused}
               onResume={resumeProtection}
-              terminationSource={
+              enforcementSource={
                 termSource?.label === "custom rules" ? termSource : null
               }
             />
-            {isIgnoredRule && (
-              <div className="text-[9px] text-purple-400/80 bg-purple-500/5 px-1.5 py-0.5 rounded border border-purple-500/10 mt-1 flex items-center gap-1 animate-in fade-in slide-in-from-right-1 duration-500">
-                <IconTerminal className="w-2.5 h-2.5 shrink-0" />
-                <span className="truncate">
-                  Script would have{" "}
-                  <span className="font-semibold uppercase text-purple-400">
-                    {sandboxDecision.terminationMode && sandboxDecision.terminationMode !== "none"
-                      ? sandboxDecision.terminationMode
-                      : sandboxDecision.classification}
-                  </span>{" "}
-                  this.{" "}
-                  <Link
-                    to="/settings"
-                    search={{ tab: "rules" }}
-                    className="underline hover:text-purple-300 font-medium"
-                    onClick={(e) => e.stopPropagation()}
-                  >
-                    Upgrade to Pro
-                  </Link>
-                </span>
-              </div>
-            )}
           </div>
 
           {/* Sandbox Logs Toggle */}
-          {(usage.sandbox_context || usage.sandbox_response || usage.sandbox_logs) && (
+          {hasAnySandbox && (
             <button
               onClick={(e) => {
                 e.stopPropagation();
@@ -591,34 +649,81 @@ export function UsageItem({ usage }: { usage: ApplicationUsage }) {
       {/* Expanded Logs */}
       {showLogs && (
         <div className="w-full mt-2 pt-2 border-t border-border/20 space-y-3">
-          <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
-            <div>
-              <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 block">
-                Context
-              </span>
-              <pre className="text-[10px] text-muted-foreground/70 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
-                {tryParseJSON(usage.sandbox_context)}
-              </pre>
-            </div>
-            <div>
-              <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 block">
-                Response
+          {hasClassificationSandbox && (
+            <div className="space-y-3">
+              <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 block">
+                Classification Sandbox
               </span>
-              <pre className="text-[10px] text-green-400/60 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
-                {tryParseJSON(usage.sandbox_response)}
-              </pre>
+
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
+                <div>
+                  <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 block">
+                    Context
+                  </span>
+                  <pre className="text-[10px] text-muted-foreground/70 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
+                    {tryParseJSON(classificationSandboxContext)}
+                  </pre>
+                </div>
+                <div>
+                  <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 block">
+                    Response
+                  </span>
+                  <pre className="text-[10px] text-green-400/60 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
+                    {tryParseJSON(classificationSandboxResponse)}
+                  </pre>
+                </div>
+              </div>
+
+              {classificationSandboxLogs && classificationSandboxLogs !== "null" && (
+                <div>
+                  <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 flex items-center gap-1">
+                    <IconTerminal className="w-3 h-3" />
+                    Console Logs
+                  </span>
+                  <pre className="text-[10px] text-yellow-400/60 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
+                    {formatSandboxLogs(classificationSandboxLogs)}
+                  </pre>
+                </div>
+              )}
             </div>
-          </div>
+          )}
 
-          {usage.sandbox_logs && usage.sandbox_logs !== "null" && (
-            <div>
-              <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 flex items-center gap-1">
-                <IconTerminal className="w-3 h-3" />
-                Console Logs
+          {hasEnforcementSandbox && (
+            <div className="space-y-3">
+              <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 block">
+                Enforcement Sandbox
               </span>
-              <pre className="text-[10px] text-yellow-400/60 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
-                {formatSandboxLogs(usage.sandbox_logs)}
-              </pre>
+
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
+                <div>
+                  <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 block">
+                    Context
+                  </span>
+                  <pre className="text-[10px] text-muted-foreground/70 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
+                    {tryParseJSON(enforcementSandboxContext)}
+                  </pre>
+                </div>
+                <div>
+                  <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 block">
+                    Response
+                  </span>
+                  <pre className="text-[10px] text-green-400/60 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
+                    {tryParseJSON(enforcementSandboxResponse)}
+                  </pre>
+                </div>
+              </div>
+
+              {enforcementSandboxLogs && enforcementSandboxLogs !== "null" && (
+                <div>
+                  <span className="text-[9px] font-bold uppercase tracking-wider text-muted-foreground/40 mb-1 flex items-center gap-1">
+                    <IconTerminal className="w-3 h-3" />
+                    Console Logs
+                  </span>
+                  <pre className="text-[10px] text-yellow-400/60 bg-background/30 rounded p-1.5 overflow-x-auto max-h-[150px] overflow-y-auto font-mono whitespace-pre-wrap break-all border border-border/10">
+                    {formatSandboxLogs(enforcementSandboxLogs)}
+                  </pre>
+                </div>
+              )}
             </div>
           )}
         </div>
diff --git a/frontend/src/routes/__root.tsx b/frontend/src/routes/__root.tsx
index bbd79a4..f54147a 100644
--- a/frontend/src/routes/__root.tsx
+++ b/frontend/src/routes/__root.tsx
@@ -83,7 +83,7 @@ function RootLayout() {
           </div>
           {!import.meta.env.DEV && <AccountStatus />}
         </header>
-        <div className="flex flex-1 flex-col h-full overflow-hidden">
+        <div className="flex flex-1 flex-col min-h-0 overflow-hidden">
           <Outlet />
         </div>
       </SidebarInset>
diff --git a/frontend/src/routes/activity.tsx b/frontend/src/routes/activity.tsx
index b6e46bb..06f8b15 100644
--- a/frontend/src/routes/activity.tsx
+++ b/frontend/src/routes/activity.tsx
@@ -33,7 +33,7 @@ import {
   TruncatedLabel,
   formatSmartDate,
   formatClassificationSource,
-  formatTerminationModeSource,
+  formatEnforcementSource,
 } from "@/components/usage-item";
 import type { ApplicationUsage } from "../../bindings/github.com/focusd-so/focusd/internal/usage/models";
 
@@ -379,8 +379,8 @@ function BlockedUsageItem({ item }: { item: BlockedUsageDisplay }) {
   const statusColor = isAllowed ? "text-yellow-500" : "text-red-500";
   const iconColor = isAllowed ? "text-yellow-500/60" : "text-red-500/60";
 
-  const termSource = formatTerminationModeSource(
-    usage.termination_mode_source,
+  const termSource = formatEnforcementSource(
+    usage.enforcement_source,
     usage.classification_reasoning
   );
 
diff --git a/frontend/src/routes/screen-time/screentime.tsx b/frontend/src/routes/screen-time/screentime.tsx
index f83f0de..e05d456 100644
--- a/frontend/src/routes/screen-time/screentime.tsx
+++ b/frontend/src/routes/screen-time/screentime.tsx
@@ -144,14 +144,14 @@ function ScreenTimePage() {
             size="sm"
             className={cn(
               "h-8 text-xs gap-2 transition-all",
-              screenTimeFilters.TerminationMode === "block"
+              screenTimeFilters.EnforcementAction === "block"
                 ? "bg-red-500/10 border-red-500/30 text-red-500 hover:bg-red-500/20"
                 : "opacity-60"
             )}
             onClick={() =>
               setScreenTimeFilters({
-                TerminationMode:
-                  screenTimeFilters.TerminationMode === "block"
+                EnforcementAction:
+                  screenTimeFilters.EnforcementAction === "block"
                     ? undefined
                     : ("block" as any),
               })
diff --git a/frontend/src/stores/usage-store.ts b/frontend/src/stores/usage-store.ts
index c039140..91f8ee5 100644
--- a/frontend/src/stores/usage-store.ts
+++ b/frontend/src/stores/usage-store.ts
@@ -7,7 +7,7 @@ import type {
   DayInsights,
   UsageAggregation,
 } from "../../bindings/github.com/focusd-so/focusd/internal/usage/models";
-import { TerminationMode, GetUsageListOptions } from "../../bindings/github.com/focusd-so/focusd/internal/usage/models";
+import { EnforcementAction, GetUsageListOptions } from "../../bindings/github.com/focusd-so/focusd/internal/usage/models";
 import {
   GetWhitelist,
   Whitelist,
@@ -120,7 +120,7 @@ export const useUsageStore = create<UsageState>()((set, get) => ({
       const updated = [usage, ...filtered].slice(0, 100);
 
       const blocked = new Map(state.blockedItems);
-      if (usage.termination_mode === TerminationMode.TerminationModeBlock) {
+      if (usage.enforcement_action === EnforcementAction.EnforcementActionBlock) {
         const key =
           usage.application?.hostname ||
           usage.application?.bundle_id ||
@@ -144,12 +144,14 @@ export const useUsageStore = create<UsageState>()((set, get) => ({
   initSubscription: () => {
     if (get().isSubscribed) return;
 
-    Events.On("usage:update", (event: { data: ApplicationUsage }) => {
+    Events.On("usage:update", (event) => {
+      if (!event.data) return;
       console.log("usage update", event.data);
       get().addUsage(event.data);
     });
 
-    Events.On("protection:status", (event: { data: ProtectionPause }) => {
+    Events.On("protection:status", (event) => {
+      if (!event.data) return;
       console.log("protection status update", event.data);
       set({ currentPause: event.data.id > 0 ? event.data : null });
     });
@@ -176,7 +178,7 @@ export const useUsageStore = create<UsageState>()((set, get) => ({
       });
       const blockedItemsOptions = new GetUsageListOptions({
         Date: new Date(),
-        TerminationMode: TerminationMode.TerminationModeBlock,
+        EnforcementAction: EnforcementAction.EnforcementActionBlock,
       });
       const [usages, blockedItems] = await Promise.all([
         GetUsageList(recentUsagesOptions),
@@ -355,4 +357,3 @@ useUsageStore.getState().initSubscription();
 useUsageStore.getState().initProtectionStore();
 useUsageStore.getState().fetchRecentUsages();
 useUsageStore.getState().fetchWhitelist();
-
diff --git a/internal/usage/account_tier.go b/internal/usage/account_tier.go
new file mode 100644
index 0000000..832f5b2
--- /dev/null
+++ b/internal/usage/account_tier.go
@@ -0,0 +1,14 @@
+package usage
+
+import apiv1 "github.com/focusd-so/focusd/gen/api/v1"
+
+func hasCustomRulesExecutionAccess(tier apiv1.DeviceHandshakeResponse_AccountTier) bool {
+	switch tier {
+	case apiv1.DeviceHandshakeResponse_ACCOUNT_TIER_TRIAL,
+		apiv1.DeviceHandshakeResponse_ACCOUNT_TIER_PLUS,
+		apiv1.DeviceHandshakeResponse_ACCOUNT_TIER_PRO:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/internal/usage/classifier_custom_rules_test.go b/internal/usage/classifier_custom_rules_test.go
index 1403541..1431692 100644
--- a/internal/usage/classifier_custom_rules_test.go
+++ b/internal/usage/classifier_custom_rules_test.go
@@ -17,7 +17,7 @@ var customRulesApps = `
 * Custom classification logic.
 * Return a ClassificationDecision to override the default, or undefined to keep the default.
 */
-export function classify(ctx: Context): ClassificationDecision | undefined {
+export function classify(context: UsageContext): ClassificationDecision | undefined {
 	console.log("should capture this");
 
 	if (now().getHours() == 10 && now().getMinutes() > 0 && now().getMinutes() < 30) {
@@ -30,7 +30,7 @@ export function classify(ctx: Context): ClassificationDecision | undefined {
 
 	console.log("and this too");
 
-	if (ctx.appName == "Slack") {
+	if (context.appName == "Slack") {
 		return {
 			classification: Classification.Neutral,
 			classificationReasoning: "Slack is a neutral app",
@@ -40,7 +40,7 @@ export function classify(ctx: Context): ClassificationDecision | undefined {
 
 	console.log("also this");
 
-	if (ctx.minutesSinceLastBlock >= 20 && ctx.minutesUsedSinceLastBlock < 5 && ctx.appName == "Discord") {
+	if (context.minutesSinceLastBlock >= 20 && context.minutesUsedSinceLastBlock < 5 && context.appName == "Discord") {
 		return {
 			classification: Classification.Neutral,
 			classificationReasoning: "Allow using 5 mins every 20 mins",
@@ -53,16 +53,16 @@ export function classify(ctx: Context): ClassificationDecision | undefined {
 
 /**
 * Custom termination logic (blocking).
-* Return a TerminationDecision to override the default, or undefined to keep the default.
+* Return a EnforcementDecision to override the default, or undefined to keep the default.
 */
-export function terminationMode(ctx: Context): TerminationDecision | undefined {
+export function enforcementDecision(context: UsageContext): EnforcementDecision | undefined {
 	
 }
 `
 
 var customRulesWithMinutesUsedInPeriod = `
-export function classify(ctx: Context): ClassificationDecision | undefined {
-	const minutesUsed = ctx.minutesUsedInPeriod(60);
+export function classify(context: UsageContext): ClassificationDecision | undefined {
+	const minutesUsed = context.minutesUsedInPeriod(60);
 	
 	if (minutesUsed > 30) {
 		return {
@@ -81,9 +81,9 @@ export function classify(ctx: Context): ClassificationDecision | undefined {
 `
 
 var customRulesWebsite = `
-export function classify(ctx: Context): ClassificationDecision | undefined {
+export function classify(context: UsageContext): ClassificationDecision | undefined {
 	// Match by domain
-	if (ctx.domain === "youtube.com") {
+	if (context.domain === "youtube.com") {
 		return {
 			classification: Classification.Distracting,
 			classificationReasoning: "YouTube is distracting",
@@ -92,7 +92,7 @@ export function classify(ctx: Context): ClassificationDecision | undefined {
 	}
 	
 	// Match by hostname (subdomain-aware)
-	if (ctx.hostname === "docs.google.com") {
+	if (context.hostname === "docs.google.com") {
 		return {
 			classification: Classification.Productive,
 			classificationReasoning: "Google Docs is productive",
@@ -101,7 +101,7 @@ export function classify(ctx: Context): ClassificationDecision | undefined {
 	}
 	
 	// Match by path
-	if (ctx.hostname === "github.com" && ctx.path.startsWith("/pulls")) {
+	if (context.hostname === "github.com" && context.path.startsWith("/pulls")) {
 		return {
 			classification: Classification.Productive,
 			classificationReasoning: "Reviewing pull requests",
@@ -110,7 +110,7 @@ export function classify(ctx: Context): ClassificationDecision | undefined {
 	}
 	
 	// Match by full URL
-	if (ctx.url === "https://twitter.com/home") {
+	if (context.url === "https://twitter.com/home") {
 		return {
 			classification: Classification.Distracting,
 			classificationReasoning: "Twitter home feed",
diff --git a/internal/usage/harness_test.go b/internal/usage/harness_test.go
index e1774cc..efc7589 100644
--- a/internal/usage/harness_test.go
+++ b/internal/usage/harness_test.go
@@ -35,8 +35,9 @@ type usageHarness struct {
 }
 
 type usageHarnessConfig struct {
-	customRulesJS string
-	llmResponse   usage.ClassificationResponse
+	customRulesJS  string
+	llmResponse    usage.ClassificationResponse
+	llmResponseRaw *string
 }
 
 type usageHarnessOption func(*usageHarnessConfig)
@@ -53,6 +54,12 @@ func withDummyLLMResponse(resp usage.ClassificationResponse) usageHarnessOption
 	}
 }
 
+func withDummyLLMResponseRaw(resp string) usageHarnessOption {
+	return func(cfg *usageHarnessConfig) {
+		cfg.llmResponseRaw = &resp
+	}
+}
+
 func newUsageHarness(t *testing.T, opts ...usageHarnessOption) *usageHarness {
 	t.Helper()
 
@@ -344,19 +351,19 @@ func assertUsageClassification(t *testing.T, classification usage.Classification
 	}
 }
 
-func assertTerminationMode(t *testing.T, mode usage.TerminationMode) func(*usage.ApplicationUsage) {
+func assertEnforcementAction(t *testing.T, mode usage.EnforcementAction) func(*usage.ApplicationUsage) {
 	t.Helper()
 
 	return func(u *usage.ApplicationUsage) {
-		require.Equal(t, mode, u.TerminationMode)
+		require.Equal(t, mode, u.EnforcementAction)
 	}
 }
 
-func assertTerminationModeSource(t *testing.T, source usage.TerminationModeSource) func(*usage.ApplicationUsage) {
+func assertEnforcementSource(t *testing.T, source usage.EnforcementSource) func(*usage.ApplicationUsage) {
 	t.Helper()
 
 	return func(u *usage.ApplicationUsage) {
-		require.Equal(t, source, fromPtr(u.TerminationSource))
+		require.Equal(t, source, fromPtr(u.EnforcementSource))
 	}
 }
 
@@ -391,11 +398,17 @@ func overrideTestConfig(t *testing.T, cfg usageHarnessConfig) {
 		snapshot[key] = viperValue{isSet: viper.IsSet(key), value: viper.Get(key)}
 	}
 
-	llmRespJSON, err := json.Marshal(cfg.llmResponse)
-	require.NoError(t, err)
+	llmRespJSON := ""
+	if cfg.llmResponseRaw != nil {
+		llmRespJSON = *cfg.llmResponseRaw
+	} else {
+		respJSON, err := json.Marshal(cfg.llmResponse)
+		require.NoError(t, err)
+		llmRespJSON = string(respJSON)
+	}
 
 	viper.Set("classification_llm_provider", settings.LLMProviderDummy)
-	viper.Set("dummy_classification_response", string(llmRespJSON))
+	viper.Set("dummy_classification_response", llmRespJSON)
 
 	if cfg.customRulesJS == "" {
 		viper.Set("custom_rules_js", []string{})
diff --git a/internal/usage/insights_basic.go b/internal/usage/insights_basic.go
index 5d7660f..8d3b1bf 100644
--- a/internal/usage/insights_basic.go
+++ b/internal/usage/insights_basic.go
@@ -6,17 +6,17 @@ import (
 )
 
 type GetUsageListOptions struct {
-	Date            *time.Time
-	Page            *int
-	PageSize        *int
-	StartedAt       *time.Time
-	EndedAt         *time.Time
-	TerminationMode *TerminationMode
-	Classification  *Classification
-	ApplicationID   *int64
-	ApplicationName *string
-	Hostname        *string
-	BundleID        *string
+	Date              *time.Time
+	Page              *int
+	PageSize          *int
+	StartedAt         *time.Time
+	EndedAt           *time.Time
+	EnforcementAction *EnforcementAction
+	Classification    *Classification
+	ApplicationID     *int64
+	ApplicationName   *string
+	Hostname          *string
+	BundleID          *string
 }
 
 type UsageAggregation struct {
@@ -50,8 +50,8 @@ func (s *Service) GetUsageList(options GetUsageListOptions) ([]ApplicationUsage,
 	if options.EndedAt != nil {
 		query = query.Where("ended_at <= ?", options.EndedAt.Unix())
 	}
-	if options.TerminationMode != nil {
-		query = query.Where("termination_mode = ?", *options.TerminationMode)
+	if options.EnforcementAction != nil {
+		query = query.Where("enforcement_action = ?", *options.EnforcementAction)
 	}
 	if options.Classification != nil {
 		query = query.Where("classification = ?", *options.Classification)
@@ -98,8 +98,8 @@ func (s *Service) GetUsageAggregation(options GetUsageListOptions) ([]UsageAggre
 	if options.EndedAt != nil {
 		query = query.Where("ended_at <= ?", options.EndedAt.Unix())
 	}
-	if options.TerminationMode != nil {
-		query = query.Where("termination_mode = ?", *options.TerminationMode)
+	if options.EnforcementAction != nil {
+		query = query.Where("enforcement_action = ?", *options.EnforcementAction)
 	}
 	if options.Classification != nil {
 		query = query.Where("classification = ?", *options.Classification)
diff --git a/internal/usage/insights_basic_test.go b/internal/usage/insights_basic_test.go
index 7fbfda9..be01b43 100644
--- a/internal/usage/insights_basic_test.go
+++ b/internal/usage/insights_basic_test.go
@@ -523,7 +523,7 @@ func TestGetUsageList_NoMatchesWithNarrowWindow(t *testing.T) {
 	require.Len(t, result, 0, "no usages should match a narrow window with no data")
 }
 
-func TestGetUsageList_TerminationModeFilter(t *testing.T) {
+func TestGetUsageList_EnforcementActionFilter(t *testing.T) {
 	service, db := setUpService(t)
 
 	starts := []time.Time{
@@ -532,80 +532,80 @@ func TestGetUsageList_TerminationModeFilter(t *testing.T) {
 		time.Date(2025, 6, 15, 12, 0, 0, 0, time.UTC),
 		time.Date(2025, 6, 15, 14, 0, 0, 0, time.UTC),
 	}
-	modes := []usage.TerminationMode{
-		usage.TerminationModeNone,
-		usage.TerminationModeBlock,
-		usage.TerminationModeAllow,
+	modes := []usage.EnforcementAction{
+		usage.EnforcementActionNone,
+		usage.EnforcementActionBlock,
+		usage.EnforcementActionAllow,
 	}
 	dur := 1800
 	for i := range starts {
 		endAt := starts[i].Unix() + int64(dur)
 		u := usage.ApplicationUsage{
-			StartedAt:       starts[i].Unix(),
-			EndedAt:         &endAt,
-			DurationSeconds: &dur,
-			Classification:  usage.ClassificationProductive,
-			TerminationMode: modes[i],
-			Application:     usage.Application{Name: "App"},
+			StartedAt:         starts[i].Unix(),
+			EndedAt:           &endAt,
+			DurationSeconds:   &dur,
+			Classification:    usage.ClassificationProductive,
+			EnforcementAction: modes[i],
+			Application:       usage.Application{Name: "App"},
 		}
 		require.NoError(t, db.Create(&u).Error)
 	}
 
 	result, err := service.GetUsageList(usage.GetUsageListOptions{
-		TerminationMode: withPtr(usage.TerminationModeBlock),
+		EnforcementAction: withPtr(usage.EnforcementActionBlock),
 	})
 	require.NoError(t, err)
 	require.Len(t, result, 1, "only blocked items should be returned")
-	require.Equal(t, usage.TerminationModeBlock, result[0].TerminationMode)
+	require.Equal(t, usage.EnforcementActionBlock, result[0].EnforcementAction)
 	require.Equal(t, starts[1].Unix(), result[0].StartedAt)
 }
 
-func TestGetUsageList_TerminationModeFilterNoMatches(t *testing.T) {
+func TestGetUsageList_EnforcementActionFilterNoMatches(t *testing.T) {
 	service, db := setUpService(t)
 
 	startAt := time.Date(2025, 6, 15, 10, 0, 0, 0, time.UTC)
 	endAt := startAt.Unix() + 1800
 	dur := 1800
 	u := usage.ApplicationUsage{
-		StartedAt:       startAt.Unix(),
-		EndedAt:         &endAt,
-		DurationSeconds: &dur,
-		Classification:  usage.ClassificationProductive,
-		TerminationMode: usage.TerminationModeNone,
-		Application:     usage.Application{Name: "App"},
+		StartedAt:         startAt.Unix(),
+		EndedAt:           &endAt,
+		DurationSeconds:   &dur,
+		Classification:    usage.ClassificationProductive,
+		EnforcementAction: usage.EnforcementActionNone,
+		Application:       usage.Application{Name: "App"},
 	}
 	require.NoError(t, db.Create(&u).Error)
 
 	result, err := service.GetUsageList(usage.GetUsageListOptions{
-		TerminationMode: withPtr(usage.TerminationModeBlock),
+		EnforcementAction: withPtr(usage.EnforcementActionBlock),
 	})
 	require.NoError(t, err)
 	require.Len(t, result, 0, "no rows should match an unused termination mode")
 }
 
-func TestGetUsageList_TerminationModeFilterCombinedWithDateRange(t *testing.T) {
+func TestGetUsageList_EnforcementActionFilterCombinedWithDateRange(t *testing.T) {
 	service, db := setUpService(t)
 
 	type seedUsage struct {
 		start time.Time
-		mode  usage.TerminationMode
+		mode  usage.EnforcementAction
 	}
 	seed := []seedUsage{
-		{start: time.Date(2025, 6, 15, 8, 0, 0, 0, time.UTC), mode: usage.TerminationModeBlock},
-		{start: time.Date(2025, 6, 15, 10, 0, 0, 0, time.UTC), mode: usage.TerminationModeNone},
-		{start: time.Date(2025, 6, 15, 14, 0, 0, 0, time.UTC), mode: usage.TerminationModeBlock},
-		{start: time.Date(2025, 6, 15, 18, 0, 0, 0, time.UTC), mode: usage.TerminationModeBlock},
+		{start: time.Date(2025, 6, 15, 8, 0, 0, 0, time.UTC), mode: usage.EnforcementActionBlock},
+		{start: time.Date(2025, 6, 15, 10, 0, 0, 0, time.UTC), mode: usage.EnforcementActionNone},
+		{start: time.Date(2025, 6, 15, 14, 0, 0, 0, time.UTC), mode: usage.EnforcementActionBlock},
+		{start: time.Date(2025, 6, 15, 18, 0, 0, 0, time.UTC), mode: usage.EnforcementActionBlock},
 	}
 	dur := 1800
 	for _, row := range seed {
 		endAt := row.start.Unix() + int64(dur)
 		u := usage.ApplicationUsage{
-			StartedAt:       row.start.Unix(),
-			EndedAt:         &endAt,
-			DurationSeconds: &dur,
-			Classification:  usage.ClassificationProductive,
-			TerminationMode: row.mode,
-			Application:     usage.Application{Name: "App"},
+			StartedAt:         row.start.Unix(),
+			EndedAt:           &endAt,
+			DurationSeconds:   &dur,
+			Classification:    usage.ClassificationProductive,
+			EnforcementAction: row.mode,
+			Application:       usage.Application{Name: "App"},
 		}
 		require.NoError(t, db.Create(&u).Error)
 	}
@@ -613,43 +613,43 @@ func TestGetUsageList_TerminationModeFilterCombinedWithDateRange(t *testing.T) {
 	startedAt := time.Date(2025, 6, 15, 9, 0, 0, 0, time.UTC)
 	endedAt := time.Date(2025, 6, 15, 16, 0, 0, 0, time.UTC)
 	result, err := service.GetUsageList(usage.GetUsageListOptions{
-		StartedAt:       withPtr(startedAt),
-		EndedAt:         withPtr(endedAt),
-		TerminationMode: withPtr(usage.TerminationModeBlock),
+		StartedAt:         withPtr(startedAt),
+		EndedAt:           withPtr(endedAt),
+		EnforcementAction: withPtr(usage.EnforcementActionBlock),
 	})
 	require.NoError(t, err)
 	require.Len(t, result, 1, "combined filters should return only the matching intersection")
-	require.Equal(t, usage.TerminationModeBlock, result[0].TerminationMode)
+	require.Equal(t, usage.EnforcementActionBlock, result[0].EnforcementAction)
 	require.Equal(t, time.Date(2025, 6, 15, 14, 0, 0, 0, time.UTC).Unix(), result[0].StartedAt)
 }
 
-func TestGetUsageList_TerminationModeNilIgnored(t *testing.T) {
+func TestGetUsageList_EnforcementActionNilIgnored(t *testing.T) {
 	service, db := setUpService(t)
 
 	starts := []time.Time{
 		time.Date(2025, 6, 15, 10, 0, 0, 0, time.UTC),
 		time.Date(2025, 6, 15, 11, 0, 0, 0, time.UTC),
 	}
-	modes := []usage.TerminationMode{
-		usage.TerminationModeBlock,
-		usage.TerminationModeNone,
+	modes := []usage.EnforcementAction{
+		usage.EnforcementActionBlock,
+		usage.EnforcementActionNone,
 	}
 	dur := 1200
 	for i := range starts {
 		endAt := starts[i].Unix() + int64(dur)
 		u := usage.ApplicationUsage{
-			StartedAt:       starts[i].Unix(),
-			EndedAt:         &endAt,
-			DurationSeconds: &dur,
-			Classification:  usage.ClassificationProductive,
-			TerminationMode: modes[i],
-			Application:     usage.Application{Name: "App"},
+			StartedAt:         starts[i].Unix(),
+			EndedAt:           &endAt,
+			DurationSeconds:   &dur,
+			Classification:    usage.ClassificationProductive,
+			EnforcementAction: modes[i],
+			Application:       usage.Application{Name: "App"},
 		}
 		require.NoError(t, db.Create(&u).Error)
 	}
 
 	result, err := service.GetUsageList(usage.GetUsageListOptions{
-		TerminationMode: nil,
+		EnforcementAction: nil,
 	})
 	require.NoError(t, err)
 	require.Len(t, result, 2, "nil termination mode should not filter results")
diff --git a/internal/usage/insights_daily_summary.go b/internal/usage/insights_daily_summary.go
index ec11cb2..1fadb66 100644
--- a/internal/usage/insights_daily_summary.go
+++ b/internal/usage/insights_daily_summary.go
@@ -238,8 +238,8 @@ func (s *Service) computeLLMDaySummaryInput(date time.Time) (LLMDaySummaryInput,
 }
 
 func (s *Service) enrichWithDBStats(input *LLMDaySummaryInput, date time.Time) {
-	blockMode := TerminationModeBlock
-	blockedUsages, err := s.GetUsageList(GetUsageListOptions{Date: &date, TerminationMode: &blockMode})
+	blockMode := EnforcementActionBlock
+	blockedUsages, err := s.GetUsageList(GetUsageListOptions{Date: &date, EnforcementAction: &blockMode})
 	if err == nil {
 		input.BlockedAttemptCount = len(blockedUsages)
 	}
diff --git a/internal/usage/insights_report.go b/internal/usage/insights_report.go
index 3ea82ec..c329f2a 100644
--- a/internal/usage/insights_report.go
+++ b/internal/usage/insights_report.go
@@ -54,11 +54,11 @@ func (s *Service) GetDayInsights(date time.Time) (DayInsights, error) {
 			insights.CommunicationBreakdown[key] = entry
 		}
 
-		if usage.TerminationMode == TerminationModeBlock {
+		if usage.EnforcementAction == EnforcementActionBlock {
 			insights.TopBlocked[usageDisplayName(usage)] += dur
 		}
 
-		if usage.Classification == ClassificationDistracting && usage.TerminationMode != TerminationModeBlock {
+		if usage.Classification == ClassificationDistracting && usage.EnforcementAction != EnforcementActionBlock {
 			insights.TopDistractions[usageDisplayName(usage)] += dur
 		}
 
diff --git a/internal/usage/protection.go b/internal/usage/protection.go
index 7779d72..6430040 100644
--- a/internal/usage/protection.go
+++ b/internal/usage/protection.go
@@ -1,14 +1,15 @@
 package usage
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"strings"
 	"time"
 
 	"gorm.io/gorm"
 
-	apiv1 "github.com/focusd-so/focusd/gen/api/v1"
 	"github.com/focusd-so/focusd/internal/identity"
 	"github.com/focusd-so/focusd/internal/settings"
 )
@@ -236,7 +237,7 @@ func (s *Service) RemoveWhitelist(id int64) error {
 	return s.db.Delete(&ProtectionWhitelist{}, id).Error
 }
 
-// CalculateTerminationMode determines whether an application or website should be blocked, allowed, or paused based on classification, custom rules, protection status, and whitelist entries.
+// CalculateEnforcementDecision determines whether an application or website should be blocked, allowed, or paused based on classification, custom rules, protection status, and whitelist entries.
 //
 // This function evaluates multiple factors in order of priority:
 // 1. Custom rules (if configured) - highest priority
@@ -251,44 +252,44 @@ func (s *Service) RemoveWhitelist(id int64) error {
 //   - domain: The domain name extracted from the URL
 //   - url: The full URL being accessed
 //   - classification: The classification result indicating whether the usage is distracting
-//   - terminationMode: The requested termination mode (may be overridden by custom rules)
+//   - enforcementAction: The requested termination mode (may be overridden by custom rules)
 //
 // Returns:
-//   - TerminationDecision: A decision containing the mode (Allow/Block/Paused), reasoning, and source
+//   - EnforcementDecision: A decision containing the mode (Allow/Block/Paused), reasoning, and source
 //   - error: Database error if protection status or whitelist lookup fails
-func (s *Service) CalculateTerminationMode(ctx context.Context, appUsage *ApplicationUsage) (TerminationDecision, error) {
+func (s *Service) CalculateEnforcementDecision(ctx context.Context, appUsage *ApplicationUsage) (EnforcementDecision, error) {
 	classification := appUsage.Classification
 
-	customRulesDecision, err := s.calculateTerminationModeWithCustomRules(ctx, appUsage)
+	customRulesDecision, err := s.calculateEnforcementDecisionWithCustomRules(ctx, appUsage)
 	if err != nil {
-		return TerminationDecision{}, fmt.Errorf("failed to calculate termination mode with custom rules: %w", err)
+		return EnforcementDecision{}, fmt.Errorf("failed to calculate enforcement decision with custom rules: %w", err)
 	}
 
-	if customRulesDecision.Mode != "" && customRulesDecision.Mode != TerminationModeNone {
+	if customRulesDecision.Action != "" && customRulesDecision.Action != EnforcementActionNone {
 		tier := identity.GetAccountTier()
-		if tier != apiv1.DeviceHandshakeResponse_ACCOUNT_TIER_FREE {
+		if hasCustomRulesExecutionAccess(tier) {
 			return customRulesDecision, nil
 		}
 	}
 
 	if classification != ClassificationDistracting {
-		return TerminationDecision{
-			Mode:      TerminationModeAllow,
-			Reasoning: "non distracting usage",
-			Source:    TerminationModeSourceApplication,
+		return EnforcementDecision{
+			Action: EnforcementActionAllow,
+			Reason: "non distracting usage",
+			Source: EnforcementSourceApplication,
 		}, nil
 	}
 
 	protectionPause, err := s.GetProtectionStatus()
 	if err != nil {
-		return TerminationDecision{}, err
+		return EnforcementDecision{}, err
 	}
 
 	if protectionPause.ID > 0 {
-		return TerminationDecision{
-			Mode:      TerminationModeAllow,
-			Reasoning: "focus protection has been paused by the user",
-			Source:    TerminationModeSourcePaused,
+		return EnforcementDecision{
+			Action: EnforcementActionAllow,
+			Reason: "focus protection has been paused by the user",
+			Source: EnforcementSourcePaused,
 		}, nil
 	}
 
@@ -304,52 +305,114 @@ func (s *Service) CalculateTerminationMode(ctx context.Context, appUsage *Applic
 
 	if err := query.Limit(1).First(&whitelist).Error; err != nil {
 		if err != gorm.ErrRecordNotFound {
-			return TerminationDecision{}, err
+			return EnforcementDecision{}, err
 		}
 	}
 
 	if whitelist.ID > 0 {
-		return TerminationDecision{
-			Mode:      TerminationModeAllow,
-			Reasoning: "temporarily allowed usage by user",
-			Source:    TerminationModeSourceWhitelist,
+		return EnforcementDecision{
+			Action: EnforcementActionAllow,
+			Reason: "temporarily allowed usage by user",
+			Source: EnforcementSourceWhitelist,
 		}, nil
 	}
 
-	return TerminationDecision{
-		Mode:      TerminationModeBlock,
-		Reasoning: "distracting usage, focus protection is enabled",
-		Source:    TerminationModeSourceApplication,
+	return EnforcementDecision{
+		Action: EnforcementActionBlock,
+		Reason: "distracting usage, focus protection is enabled",
+		Source: EnforcementSourceApplication,
 	}, nil
 }
 
-func (s *Service) calculateTerminationModeWithCustomRules(_ context.Context, appUsage *ApplicationUsage) (TerminationDecision, error) {
+func (s *Service) calculateEnforcementDecisionWithCustomRules(_ context.Context, appUsage *ApplicationUsage) (EnforcementDecision, error) {
 	sandboxCtx := createSandboxContext(appUsage.Application.Name, appUsage.BrowserURL)
 	sandboxCtx.Classification = string(appUsage.Classification)
 
 	customRules := settings.GetCustomRulesJS()
 	if customRules == "" {
-		return TerminationDecision{Mode: TerminationModeNone}, nil
+		return EnforcementDecision{Action: EnforcementActionNone}, nil
+	}
+
+	contextJSON, err := json.Marshal(sandboxCtx)
+	if err != nil {
+		return EnforcementDecision{}, err
+	}
+
+	executionLog := SandboxExecutionLog{
+		Context:   string(contextJSON),
+		CreatedAt: time.Now().Unix(),
+		Type:      string(ExecutionLogTypeEnforcementAction),
+	}
+
+	if err := s.db.Create(&executionLog).Error; err != nil {
+		return EnforcementDecision{}, err
+	}
+
+	finalizeExecutionLog := func(decision *enforcementDecision, logs []string, invokeErr error) error {
+		if invokeErr != nil {
+			errMsg := invokeErr.Error()
+			executionLog.Error = &errMsg
+		}
+
+		if decision != nil {
+			respJSON, marshalErr := json.Marshal(decision)
+			if marshalErr != nil {
+				errMsg := fmt.Errorf("failed to marshal response: %w", marshalErr).Error()
+				executionLog.Error = &errMsg
+			} else {
+				respJSONStr := string(respJSON)
+				executionLog.Response = &respJSONStr
+			}
+		} else {
+			txt := "no response"
+			executionLog.Response = &txt
+		}
+
+		finishedAt := time.Now().Unix()
+		executionLog.FinishedAt = &finishedAt
+
+		b := new(bytes.Buffer)
+		if err := json.NewEncoder(b).Encode(logs); err != nil {
+			return err
+		}
+		executionLog.Logs = b.String()
+
+		appUsage.EnforcementSandboxContext = withPtr(executionLog.Context)
+		appUsage.EnforcementSandboxResponse = executionLog.Response
+		appUsage.EnforcementSandboxLogs = withPtr(executionLog.Logs)
+
+		if err := s.db.Save(&executionLog).Error; err != nil {
+			return err
+		}
+
+		return nil
 	}
 
 	// Create a new sandbox with the custom rules code
 	sb, err := newSandbox(customRules)
 	if err != nil {
-		return TerminationDecision{}, err
+		if logErr := finalizeExecutionLog(nil, nil, err); logErr != nil {
+			return EnforcementDecision{}, logErr
+		}
+		return EnforcementDecision{}, err
+	}
+
+	decision, logs, err := sb.invokeEnforcementDecision(sandboxCtx)
+	if logErr := finalizeExecutionLog(decision, logs, err); logErr != nil {
+		return EnforcementDecision{}, logErr
 	}
 
-	decision, err := sb.invokeTerminationMode(sandboxCtx)
 	if err != nil {
-		return TerminationDecision{}, err
+		return EnforcementDecision{}, err
 	}
 
 	if decision == nil {
-		return TerminationDecision{Mode: TerminationModeNone}, nil
+		return EnforcementDecision{Action: EnforcementActionNone}, nil
 	}
 
-	return TerminationDecision{
-		Mode:      TerminationMode(decision.TerminationMode),
-		Reasoning: decision.TerminationReasoning,
-		Source:    TerminationModeSourceCustomRules,
+	return EnforcementDecision{
+		Action: EnforcementAction(decision.EnforcementAction),
+		Reason: EnforcementReason(decision.EnforcementReason),
+		Source: EnforcementSourceCustomRules,
 	}, nil
 }
diff --git a/internal/usage/protection_test.go b/internal/usage/protection_test.go
index f88b936..a44b867 100644
--- a/internal/usage/protection_test.go
+++ b/internal/usage/protection_test.go
@@ -1,7 +1,11 @@
 package usage_test
 
 import (
+	"bytes"
 	"context"
+	"encoding/base64"
+	"encoding/json"
+	"strings"
 	"testing"
 	"time"
 
@@ -286,7 +290,8 @@ func setUpServiceWithSettings(t *testing.T, customRules string) (*usage.Service,
 
 	db, _ := gorm.Open(sqlite.Open(memoryDSN(t)), &gorm.Config{})
 
-	viper.SetDefault("custom_rules_js", []string{customRules})
+	encoded := base64.StdEncoding.EncodeToString([]byte(customRules))
+	viper.Set("custom_rules_js", []string{encoded})
 
 	service, err := usage.NewService(context.Background(), db)
 	require.NoError(t, err)
@@ -294,15 +299,15 @@ func setUpServiceWithSettings(t *testing.T, customRules string) (*usage.Service,
 	return service, db
 }
 
-func TestProtection_CalculateTerminationMode_CustomRules(t *testing.T) {
+func TestProtection_CalculateEnforcementDecision_CustomRules(t *testing.T) {
 
 	t.Run("ctx.appName is accessible", func(t *testing.T) {
 		customRules := `
-export function terminationMode(ctx) {
+export function enforcementDecision(ctx) {
 	if (ctx.appName == "Slack") {
 		return {
-			terminationMode: TerminationMode.Block,
-			terminationReasoning: "Slack is blocked by custom rule",
+			enforcementAction: EnforcementAction.Block,
+			enforcementReason: "Slack is blocked by custom rule",
 		}
 	}
 	return undefined;
@@ -310,23 +315,23 @@ export function terminationMode(ctx) {
 `
 		service, _ := setUpServiceWithSettings(t, customRules)
 
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationNeutral,
 			Application:    usage.Application{Name: "Slack"},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeBlock, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceCustomRules, decision.Source)
-		require.Equal(t, "Slack is blocked by custom rule", decision.Reasoning)
+		require.Equal(t, usage.EnforcementActionBlock, decision.Action)
+		require.Equal(t, usage.EnforcementSourceCustomRules, decision.Source)
+		require.Equal(t, "Slack is blocked by custom rule", decision.Reason)
 	})
 
 	t.Run("ctx.classification is accessible", func(t *testing.T) {
 		customRules := `
-export function terminationMode(ctx) {
+export function enforcementDecision(ctx) {
 	if (ctx.classification == "distracting") {
 		return {
-			terminationMode: TerminationMode.Block,
-			terminationReasoning: "distracting classification detected",
+			enforcementAction: EnforcementAction.Block,
+			enforcementReason: "distracting classification detected",
 		}
 	}
 	return undefined;
@@ -334,25 +339,25 @@ export function terminationMode(ctx) {
 `
 		service, _ := setUpServiceWithSettings(t, customRules)
 
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationDistracting,
 			Application:    usage.Application{Name: "YouTube"},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeBlock, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceCustomRules, decision.Source)
-		require.Equal(t, "distracting classification detected", decision.Reasoning)
+		require.Equal(t, usage.EnforcementActionBlock, decision.Action)
+		require.Equal(t, usage.EnforcementSourceCustomRules, decision.Source)
+		require.Equal(t, "distracting classification detected", decision.Reason)
 	})
 
 	t.Run("ctx.hostname and ctx.domain are accessible", func(t *testing.T) {
 		// Note: parseURL strips "www." prefix, so "docs.google.com" stays as-is
 		// while domain is extracted via publicsuffix as "google.com"
 		customRules := `
-export function terminationMode(ctx) {
+export function enforcementDecision(ctx) {
 	if (ctx.hostname == "docs.google.com" && ctx.domain == "google.com") {
 		return {
-			terminationMode: TerminationMode.Block,
-			terminationReasoning: "Google Docs blocked via hostname/domain",
+			enforcementAction: EnforcementAction.Block,
+			enforcementReason: "Google Docs blocked via hostname/domain",
 		}
 	}
 	return undefined;
@@ -361,24 +366,24 @@ export function terminationMode(ctx) {
 		service, _ := setUpServiceWithSettings(t, customRules)
 
 		url := "https://docs.google.com/document/d/123"
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationDistracting,
 			BrowserURL:     &url,
 			Application:    usage.Application{Name: "Chrome"},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeBlock, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceCustomRules, decision.Source)
-		require.Equal(t, "Google Docs blocked via hostname/domain", decision.Reasoning)
+		require.Equal(t, usage.EnforcementActionBlock, decision.Action)
+		require.Equal(t, usage.EnforcementSourceCustomRules, decision.Source)
+		require.Equal(t, "Google Docs blocked via hostname/domain", decision.Reason)
 	})
 
 	t.Run("ctx.url and ctx.path are accessible", func(t *testing.T) {
 		customRules := `
-export function terminationMode(ctx) {
+export function enforcementDecision(ctx) {
 	if (ctx.url == "https://github.com/pulls" && ctx.path == "/pulls") {
 		return {
-			terminationMode: TerminationMode.Allow,
-			terminationReasoning: "PR reviews are allowed",
+			enforcementAction: EnforcementAction.Allow,
+			enforcementReason: "PR reviews are allowed",
 		}
 	}
 	return undefined;
@@ -387,53 +392,172 @@ export function terminationMode(ctx) {
 		service, _ := setUpServiceWithSettings(t, customRules)
 
 		url := "https://github.com/pulls"
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationDistracting,
 			BrowserURL:     &url,
 			Application:    usage.Application{Name: "Chrome"},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeAllow, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceCustomRules, decision.Source)
-		require.Equal(t, "PR reviews are allowed", decision.Reasoning)
+		require.Equal(t, usage.EnforcementActionAllow, decision.Action)
+		require.Equal(t, usage.EnforcementSourceCustomRules, decision.Source)
+		require.Equal(t, "PR reviews are allowed", decision.Reason)
 	})
 
 	t.Run("returns undefined falls through to default", func(t *testing.T) {
 		customRules := `
-export function terminationMode(ctx) {
+export function enforcementDecision(ctx) {
 	return undefined;
 }
 `
 		service, _ := setUpServiceWithSettings(t, customRules)
 
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationNeutral,
 			Application:    usage.Application{Name: "VSCode"},
 		})
 		require.NoError(t, err)
 		// When custom rules return undefined, falls through to default logic.
 		// Non-distracting classification results in Allow from the application source.
-		require.Equal(t, usage.TerminationModeAllow, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceApplication, decision.Source)
-		require.Equal(t, "non distracting usage", decision.Reasoning)
+		require.Equal(t, usage.EnforcementActionAllow, decision.Action)
+		require.Equal(t, usage.EnforcementSourceApplication, decision.Source)
+		require.Equal(t, "non distracting usage", decision.Reason)
 	})
 }
 
-func TestProtection_CalculateTerminationMode_ProtectionPaused(t *testing.T) {
+func TestProtection_CalculateEnforcementDecision_CustomRules_ExecutionLogs(t *testing.T) {
+	t.Run("stores enforcement response and console logs", func(t *testing.T) {
+		customRules := `
+export function enforcementDecision(ctx) {
+	console.log("enforcement executed", ctx.appName)
+	if (ctx.appName == "Slack") {
+		return {
+			enforcementAction: EnforcementAction.Block,
+			enforcementReason: "Slack is blocked by custom rule",
+		}
+	}
+	return undefined;
+}
+`
+		service, db := setUpServiceWithSettings(t, customRules)
+
+		appUsage := &usage.ApplicationUsage{
+			Classification: usage.ClassificationNeutral,
+			Application:    usage.Application{Name: "Slack"},
+		}
+
+		decision, err := service.CalculateEnforcementDecision(context.Background(), appUsage)
+		require.NoError(t, err)
+		require.NotEqual(t, usage.EnforcementActionNone, decision.Action)
+		require.NotNil(t, appUsage.EnforcementSandboxContext)
+		require.NotNil(t, appUsage.EnforcementSandboxResponse)
+		require.NotNil(t, appUsage.EnforcementSandboxLogs)
+
+		var log usage.SandboxExecutionLog
+		err = db.Where("type = ?", string(usage.ExecutionLogTypeEnforcementAction)).Order("id DESC").Limit(1).First(&log).Error
+		require.NoError(t, err)
+
+		require.NotNil(t, log.Response)
+		require.Nil(t, log.Error)
+		require.NotNil(t, log.FinishedAt)
+		require.Contains(t, strings.Trim(log.Logs, "\n"), "enforcement executed")
+
+		var response struct {
+			EnforcementAction string `json:"enforcementAction"`
+			EnforcementReason string `json:"enforcementReason"`
+		}
+		err = json.Unmarshal([]byte(*log.Response), &response)
+		require.NoError(t, err)
+		require.Equal(t, "block", response.EnforcementAction)
+		require.Equal(t, "Slack is blocked by custom rule", response.EnforcementReason)
+
+		require.Contains(t, log.Context, `"appName":"Slack"`)
+	})
+
+	t.Run("stores no response when decision is undefined", func(t *testing.T) {
+		customRules := `
+export function enforcementDecision(ctx) {
+	console.log("undefined decision for", ctx.appName)
+	return undefined;
+}
+`
+		service, db := setUpServiceWithSettings(t, customRules)
+
+		appUsage := &usage.ApplicationUsage{
+			Classification: usage.ClassificationNeutral,
+			Application:    usage.Application{Name: "VSCode"},
+		}
+
+		decision, err := service.CalculateEnforcementDecision(context.Background(), appUsage)
+		require.NoError(t, err)
+		require.Equal(t, usage.EnforcementActionAllow, decision.Action)
+		require.Equal(t, usage.EnforcementSourceApplication, decision.Source)
+		require.NotNil(t, appUsage.EnforcementSandboxContext)
+		require.NotNil(t, appUsage.EnforcementSandboxResponse)
+		require.NotNil(t, appUsage.EnforcementSandboxLogs)
+
+		var log usage.SandboxExecutionLog
+		err = db.Where("type = ?", string(usage.ExecutionLogTypeEnforcementAction)).Order("id DESC").Limit(1).First(&log).Error
+		require.NoError(t, err)
+
+		require.NotNil(t, log.Response)
+		require.Equal(t, "no response", *log.Response)
+		require.Nil(t, log.Error)
+		require.Contains(t, strings.Trim(log.Logs, "\n"), "undefined decision for")
+	})
+
+	t.Run("stores errors for failed enforcement execution", func(t *testing.T) {
+		customRules := `
+export function enforcementDecision(ctx) {
+	console.log("about to fail", ctx.appName)
+	throw new Error("enforcement fail");
+}
+`
+		service, db := setUpServiceWithSettings(t, customRules)
+
+		appUsage := &usage.ApplicationUsage{
+			Classification: usage.ClassificationNeutral,
+			Application:    usage.Application{Name: "Mail"},
+		}
+
+		_, err := service.CalculateEnforcementDecision(context.Background(), appUsage)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "failed to execute enforcementDecision")
+		require.NotNil(t, appUsage.EnforcementSandboxContext)
+		require.NotNil(t, appUsage.EnforcementSandboxResponse)
+		require.NotNil(t, appUsage.EnforcementSandboxLogs)
+
+		var log usage.SandboxExecutionLog
+		err = db.Where("type = ?", string(usage.ExecutionLogTypeEnforcementAction)).Order("id DESC").Limit(1).First(&log).Error
+		require.NoError(t, err)
+
+		require.NotNil(t, log.Error)
+		require.Contains(t, *log.Error, "enforcement fail")
+		require.NotNil(t, log.Response)
+		require.Equal(t, "no response", *log.Response)
+
+		var logs []string
+		err = json.NewDecoder(bytes.NewBufferString(log.Logs)).Decode(&logs)
+		require.NoError(t, err)
+		require.NotEmpty(t, logs)
+		require.Contains(t, strings.Join(logs, "\n"), "about to fail")
+	})
+}
+
+func TestProtection_CalculateEnforcementDecision_ProtectionPaused(t *testing.T) {
 	service, _ := setUpService(t)
 
 	protectionPause, err := service.PauseProtection(1000, "test")
 	require.NoError(t, err)
 	require.NotEqual(t, int64(0), protectionPause.ID)
 
-	decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+	decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 		Classification: usage.ClassificationDistracting,
 		Application:    usage.Application{Name: "YouTube"},
 	})
 	require.NoError(t, err)
-	require.Equal(t, usage.TerminationModeAllow, decision.Mode)
-	require.Equal(t, usage.TerminationModeSourcePaused, decision.Source)
-	require.Equal(t, "focus protection has been paused by the user", decision.Reasoning)
+	require.Equal(t, usage.EnforcementActionAllow, decision.Action)
+	require.Equal(t, usage.EnforcementSourcePaused, decision.Source)
+	require.Equal(t, "focus protection has been paused by the user", decision.Reason)
 }
 
 func TestProtection_AllowedByWhitelist(t *testing.T) {
@@ -443,14 +567,14 @@ func TestProtection_AllowedByWhitelist(t *testing.T) {
 		err := service.Whitelist("/usr/bin/app", "", 30*time.Minute)
 		require.NoError(t, err)
 
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationDistracting,
 			Application:    usage.Application{Name: "/usr/bin/app"},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeAllow, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceWhitelist, decision.Source)
-		require.Equal(t, "temporarily allowed usage by user", decision.Reasoning)
+		require.Equal(t, usage.EnforcementActionAllow, decision.Action)
+		require.Equal(t, usage.EnforcementSourceWhitelist, decision.Source)
+		require.Equal(t, "temporarily allowed usage by user", decision.Reason)
 	})
 
 	t.Run("whitelisted by executable path and hostname", func(t *testing.T) {
@@ -460,14 +584,14 @@ func TestProtection_AllowedByWhitelist(t *testing.T) {
 		require.NoError(t, err)
 
 		hostname := "example.com"
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationDistracting,
 			Application:    usage.Application{Name: "/usr/bin/app", Hostname: &hostname},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeAllow, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceWhitelist, decision.Source)
-		require.Equal(t, "temporarily allowed usage by user", decision.Reasoning)
+		require.Equal(t, usage.EnforcementActionAllow, decision.Action)
+		require.Equal(t, usage.EnforcementSourceWhitelist, decision.Source)
+		require.Equal(t, "temporarily allowed usage by user", decision.Reason)
 	})
 
 	t.Run("does not allow other hostnames in same browser", func(t *testing.T) {
@@ -477,13 +601,13 @@ func TestProtection_AllowedByWhitelist(t *testing.T) {
 		require.NoError(t, err)
 
 		youtube := "youtube.com"
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationDistracting,
 			Application:    usage.Application{Name: "Google Chrome", Hostname: &youtube},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeBlock, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceApplication, decision.Source)
+		require.Equal(t, usage.EnforcementActionBlock, decision.Action)
+		require.Equal(t, usage.EnforcementSourceApplication, decision.Source)
 	})
 
 	t.Run("strips www when evaluating whitelist", func(t *testing.T) {
@@ -493,13 +617,13 @@ func TestProtection_AllowedByWhitelist(t *testing.T) {
 		require.NoError(t, err)
 
 		hostname := "youtube.com"
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationDistracting,
 			Application:    usage.Application{Name: "Google Chrome", Hostname: &hostname},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeAllow, decision.Mode)
-		require.Equal(t, usage.TerminationModeSourceWhitelist, decision.Source)
+		require.Equal(t, usage.EnforcementActionAllow, decision.Action)
+		require.Equal(t, usage.EnforcementSourceWhitelist, decision.Source)
 	})
 
 	t.Run("subdomains remain distinct", func(t *testing.T) {
@@ -509,11 +633,11 @@ func TestProtection_AllowedByWhitelist(t *testing.T) {
 		require.NoError(t, err)
 
 		drive := "drive.google.com"
-		decision, err := service.CalculateTerminationMode(context.Background(), &usage.ApplicationUsage{
+		decision, err := service.CalculateEnforcementDecision(context.Background(), &usage.ApplicationUsage{
 			Classification: usage.ClassificationDistracting,
 			Application:    usage.Application{Name: "Google Chrome", Hostname: &drive},
 		})
 		require.NoError(t, err)
-		require.Equal(t, usage.TerminationModeBlock, decision.Mode)
+		require.Equal(t, usage.EnforcementActionBlock, decision.Action)
 	})
 }
diff --git a/internal/usage/sandbox.go b/internal/usage/sandbox.go
index 543a734..62373f8 100644
--- a/internal/usage/sandbox.go
+++ b/internal/usage/sandbox.go
@@ -18,10 +18,10 @@ type classificationDecision struct {
 	Tags                    []string `json:"tags"`
 }
 
-// terminationDecision is returned from the termination function
-type terminationDecision struct {
-	TerminationMode      string `json:"terminationMode"`
-	TerminationReasoning string `json:"terminationReasoning"`
+// enforcementDecision is returned from the enforcement decision function
+type enforcementDecision struct {
+	EnforcementAction string `json:"enforcementAction"`
+	EnforcementReason string `json:"enforcementReason"`
 }
 
 // sandbox executes user-defined JavaScript rules using V8
@@ -72,7 +72,7 @@ func prepareScript(code string) (string, error) {
 	// Wrap the transpiled code with CommonJS environment and expose functions to globalThis
 	preparedScript := fmt.Sprintf(`
 // Define global constants for user scripts
-var TerminationMode = {
+var EnforcementAction = {
 	None: "none",
 	Block: "block",
 	Paused: "paused",
@@ -177,10 +177,10 @@ var module = { exports: exports };
 // Check both module.exports and exports for functions
 var _exported = module.exports || exports;
 if (_exported && typeof _exported.classify === 'function') { globalThis.__classify = _exported.classify; }
-if (_exported && typeof _exported.terminationMode === 'function') { globalThis.__terminationMode = _exported.terminationMode; }
+if (_exported && typeof _exported.enforcementDecision === 'function') { globalThis.__enforcementDecision = _exported.enforcementDecision; }
 // Also check for top-level function declarations (non-exported)
 if (typeof classify === 'function') { globalThis.__classify = classify; }
-if (typeof terminationMode === 'function') { globalThis.__terminationMode = terminationMode; }
+if (typeof enforcementDecision === 'function') { globalThis.__enforcementDecision = enforcementDecision; }
 
 // Polyfill console
 if (typeof console === 'undefined') {
@@ -466,13 +466,13 @@ func (s *sandbox) invokeClassify(ctx sandboxContext) (*classificationDecision, [
 	return &decision, s.logs, nil
 }
 
-// invokeTerminationMode executes the termination function and returns the result
+// invokeEnforcementDecision executes the enforcement decision function and returns the result
 // Returns nil if the function returns undefined
-func (s *sandbox) invokeTerminationMode(ctx sandboxContext) (*terminationDecision, error) {
+func (s *sandbox) invokeEnforcementDecision(ctx sandboxContext) (*enforcementDecision, []string, error) {
 	// Prepare script with function exports and helpers
 	preparedScript, err := prepareScript(s.code)
 	if err != nil {
-		return nil, fmt.Errorf("failed to prepare script: %w", err)
+		return nil, nil, fmt.Errorf("failed to prepare script: %w", err)
 	}
 
 	v8ctx := v8.NewContext(s.isolate)
@@ -480,23 +480,23 @@ func (s *sandbox) invokeTerminationMode(ctx sandboxContext) (*terminationDecisio
 
 	// Setup V8 context with __console_log and __getShiftedTimestamp
 	if err := s.setupContext(ctx, v8ctx); err != nil {
-		return nil, fmt.Errorf("failed to setup context: %w", err)
+		return nil, nil, fmt.Errorf("failed to setup context: %w", err)
 	}
 
 	// Execute the function
-	resultJSON, err := s.executeFunction(v8ctx, preparedScript, "__terminationMode", ctx)
+	resultJSON, err := s.executeFunction(v8ctx, preparedScript, "__enforcementDecision", ctx)
 	if err != nil {
-		return nil, fmt.Errorf("failed to execute terminationMode: %w", err)
+		return nil, s.logs, fmt.Errorf("failed to execute enforcementDecision: %w", err)
 	}
 
 	if resultJSON == "" {
-		return nil, nil
+		return nil, s.logs, nil
 	}
 
-	var decision terminationDecision
+	var decision enforcementDecision
 	if err := json.Unmarshal([]byte(resultJSON), &decision); err != nil {
-		return nil, fmt.Errorf("failed to parse termination decision: %w", err)
+		return nil, s.logs, fmt.Errorf("failed to parse enforcement decision: %w", err)
 	}
 
-	return &decision, nil
+	return &decision, s.logs, nil
 }
diff --git a/internal/usage/service.go b/internal/usage/service.go
index 7421385..87221b5 100644
--- a/internal/usage/service.go
+++ b/internal/usage/service.go
@@ -29,6 +29,10 @@ type Service struct {
 }
 
 func NewService(ctx context.Context, db *gorm.DB, options ...Option) (*Service, error) {
+	if err := migrateEnforcementColumns(db); err != nil {
+		return nil, fmt.Errorf("failed to migrate enforcement columns: %w", err)
+	}
+
 	if err := db.AutoMigrate(
 		&Application{},
 		&ApplicationUsage{},
@@ -52,6 +56,39 @@ func NewService(ctx context.Context, db *gorm.DB, options ...Option) (*Service,
 	return service, nil
 }
 
+func migrateEnforcementColumns(db *gorm.DB) error {
+	if db.Migrator().HasTable(&ApplicationUsage{}) {
+		renames := [][2]string{
+			{"termination_mode", "enforcement_action"},
+			{"termination_reasoning", "enforcement_reason"},
+			{"termination_mode_source", "enforcement_source"},
+			{"termination_mode_error", "enforcement_error"},
+			{"sandbox_context", "classification_sandbox_context"},
+			{"sandbox_response", "classification_sandbox_response"},
+			{"sandbox_logs", "classification_sandbox_logs"},
+		}
+
+		for _, pair := range renames {
+			oldCol, newCol := pair[0], pair[1]
+			if db.Migrator().HasColumn(&ApplicationUsage{}, oldCol) && !db.Migrator().HasColumn(&ApplicationUsage{}, newCol) {
+				if err := db.Migrator().RenameColumn(&ApplicationUsage{}, oldCol, newCol); err != nil {
+					return fmt.Errorf("failed to rename column %s to %s: %w", oldCol, newCol, err)
+				}
+			}
+		}
+	}
+
+	if db.Migrator().HasTable(&SandboxExecutionLog{}) {
+		if err := db.Model(&SandboxExecutionLog{}).
+			Where("type = ?", "termination_mode").
+			Update("type", string(ExecutionLogTypeEnforcementAction)).Error; err != nil {
+			return fmt.Errorf("failed to migrate sandbox execution log type values: %w", err)
+		}
+	}
+
+	return nil
+}
+
 func (s *Service) scheduleJobs(ctx context.Context) {
 	fn := func(ctx context.Context) error {
 		if err := s.removeOldSandboxExecutionLogs(ctx); err != nil {
diff --git a/internal/usage/service_usage.go b/internal/usage/service_usage.go
index 0398841..870b130 100644
--- a/internal/usage/service_usage.go
+++ b/internal/usage/service_usage.go
@@ -14,7 +14,6 @@ import (
 	"golang.org/x/net/publicsuffix"
 	"gorm.io/gorm"
 
-	apiv1 "github.com/focusd-so/focusd/gen/api/v1"
 	"github.com/focusd-so/focusd/internal/identity"
 )
 
@@ -107,28 +106,28 @@ func (s *Service) usageChanged(ctx context.Context, usage ApplicationUsage) (*Ap
 			}
 		}
 
-		usage.SandboxContext = withPtr(classification.SandboxContext)
-		usage.SandboxResponse = classification.SandboxResponse
-		usage.SandboxLogs = withPtr(classification.SandboxLogs)
+		usage.ClassificationSandboxContext = withPtr(classification.SandboxContext)
+		usage.ClassificationSandboxResponse = classification.SandboxResponse
+		usage.ClassificationSandboxLogs = withPtr(classification.SandboxLogs)
 	}
 
 	// calculate termination mode.
-	terminationMode, err := s.CalculateTerminationMode(ctx, &usage)
+	enforcementAction, err := s.CalculateEnforcementDecision(ctx, &usage)
 	if err != nil {
 		termErr := err.Error()
-		usage.TerminationMode = TerminationModeNone
-		usage.TerminationError = &termErr
+		usage.EnforcementAction = EnforcementActionNone
+		usage.EnforcementError = &termErr
 	}
 
-	usage.TerminationMode = terminationMode.Mode
-	usage.TerminationReasoning = withPtr(terminationMode.Reasoning)
-	usage.TerminationSource = withPtr(terminationMode.Source)
+	usage.EnforcementAction = enforcementAction.Action
+	usage.EnforcementReason = withPtr(enforcementAction.Reason)
+	usage.EnforcementSource = withPtr(enforcementAction.Source)
 
 	if err := s.db.Save(&usage).Error; err != nil {
 		return nil, fmt.Errorf("failed to save application usage: %w", err)
 	}
 
-	if usage.TerminationMode == TerminationModeBlock {
+	if usage.EnforcementAction == EnforcementActionBlock {
 		if err := s.closeApplicationUsage(&usage); err != nil {
 			return nil, fmt.Errorf("failed to close application usage: %w", err)
 		}
@@ -159,7 +158,7 @@ func (s *Service) classifyApplicationUsage(ctx context.Context, applicationUsage
 	}
 
 	tier := identity.GetAccountTier()
-	isPaid := tier != apiv1.DeviceHandshakeResponse_ACCOUNT_TIER_FREE
+	isPaid := hasCustomRulesExecutionAccess(tier)
 
 	if customRulesResp != nil && isPaid {
 		return customRulesResp, nil
@@ -168,7 +167,11 @@ func (s *Service) classifyApplicationUsage(ctx context.Context, applicationUsage
 	// Do obviously classification next, eg social media, news, shopping, etc.
 	classification, err := s.classifyObviously(ctx, applicationUsage.Application.Name, applicationUsage.BrowserURL)
 	if err != nil {
-		return nil, fmt.Errorf("failed to classify application usage with obviously: %w", err)
+		if customRulesResp == nil {
+			return nil, fmt.Errorf("failed to classify application usage with obviously: %w", err)
+		}
+
+		slog.Warn("failed to classify with obvious rules after custom rules; continuing to LLM fallback", "error", err)
 	}
 
 	if classification != nil {
@@ -183,6 +186,23 @@ func (s *Service) classifyApplicationUsage(ctx context.Context, applicationUsage
 	slog.Info("classifying application usage with LLM")
 	resp, err := s.ClassifyWithLLM(ctx, applicationUsage.Application.Name, applicationUsage.WindowTitle, applicationUsage.BrowserURL, applicationUsage.Application.BundleID, applicationUsage.Application.AppCategory)
 	if err != nil {
+		if customRulesResp != nil {
+			fallbackResp := &ClassificationResponse{
+				Classification:       ClassificationNone,
+				ClassificationSource: ClassificationSourceObviously,
+				Reasoning:            "Custom rules matched but fallback classification is unavailable",
+				ConfidenceScore:      0,
+				Tags:                 []string{"other"},
+				SandboxContext:       customRulesResp.SandboxContext,
+				SandboxResponse:      customRulesResp.SandboxResponse,
+				SandboxLogs:          customRulesResp.SandboxLogs,
+			}
+
+			slog.Warn("failed to classify with LLM after custom rules; returning sandbox-backed fallback", "error", err)
+
+			return fallbackResp, nil
+		}
+
 		return nil, fmt.Errorf("failed to classify application usage with LLM: %w", err)
 	}
 
diff --git a/internal/usage/service_usage_test.go b/internal/usage/service_usage_test.go
index 6f4b32f..94bae3c 100644
--- a/internal/usage/service_usage_test.go
+++ b/internal/usage/service_usage_test.go
@@ -82,8 +82,8 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 			assertUsageApplicationName(t, "Chrome"),
 			assertUsageHostname(t, "amazon.com"),
 			assertUsageClassification(t, usage.ClassificationDistracting),
-			assertTerminationMode(t, usage.TerminationModeBlock),
-			assertTerminationModeSource(t, usage.TerminationModeSourceApplication),
+			assertEnforcementAction(t, usage.EnforcementActionBlock),
+			assertEnforcementSource(t, usage.EnforcementSourceApplication),
 		).
 		AssertUpdateEventsCount(2)
 
@@ -96,8 +96,8 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 			assertUsageApplicationName(t, "Chrome"),
 			assertUsageHostname(t, "amazon.com"),
 			assertUsageClassification(t, usage.ClassificationDistracting),
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourcePaused),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourcePaused),
 		).
 		AssertUpdateEventsCount(2).
 		TitleChanged("Chrome", "Linkedin", withPtr("https://www.linkedin.com")).
@@ -105,8 +105,8 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 			assertUsageApplicationName(t, "Chrome"),
 			assertUsageHostname(t, "linkedin.com"),
 			assertUsageClassification(t, usage.ClassificationDistracting),
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourcePaused),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourcePaused),
 		).
 		AssertUpdateEventsCount(5)
 
@@ -120,8 +120,8 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 			assertUsageApplicationName(t, "Chrome"),
 			assertUsageHostname(t, "amazon.com"),
 			assertUsageClassification(t, usage.ClassificationDistracting),
-			assertTerminationMode(t, usage.TerminationModeBlock),
-			assertTerminationModeSource(t, usage.TerminationModeSourceApplication),
+			assertEnforcementAction(t, usage.EnforcementActionBlock),
+			assertEnforcementSource(t, usage.EnforcementSourceApplication),
 		).
 		AssertUpdateEventsCount(3)
 
@@ -132,24 +132,24 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		AssertLastUsage(
 			assertUsageHostname(t, "amazon.com"),
 			assertUsageClassification(t, usage.ClassificationDistracting),
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourceWhitelist),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourceWhitelist),
 		).
 		TitleChanged("Chrome", "Linkedin", withPtr("https://www.linkedin.com")).
 		AssertPreviousUsage(assertUsageClosed(t)).
 		AssertLastUsage(
 			assertUsageHostname(t, "linkedin.com"),
 			assertUsageClassification(t, usage.ClassificationDistracting),
-			assertTerminationMode(t, usage.TerminationModeBlock),
-			assertTerminationModeSource(t, usage.TerminationModeSourceApplication),
+			assertEnforcementAction(t, usage.EnforcementActionBlock),
+			assertEnforcementSource(t, usage.EnforcementSourceApplication),
 		).
 		Await(time.Second*4).
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
 			assertUsageHostname(t, "amazon.com"),
 			assertUsageClassification(t, usage.ClassificationDistracting),
-			assertTerminationMode(t, usage.TerminationModeBlock),
-			assertTerminationModeSource(t, usage.TerminationModeSourceApplication),
+			assertEnforcementAction(t, usage.EnforcementActionBlock),
+			assertEnforcementSource(t, usage.EnforcementSourceApplication),
 		)
 
 	// 2. Manual Pause Resumption
@@ -157,15 +157,15 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		Pause(10, "test early resume").
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourcePaused),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourcePaused),
 		).
 		Await(time.Second).
 		Resume("user clicked resume").
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeBlock),
-			assertTerminationModeSource(t, usage.TerminationModeSourceApplication),
+			assertEnforcementAction(t, usage.EnforcementActionBlock),
+			assertEnforcementSource(t, usage.EnforcementSourceApplication),
 		)
 
 	// 3. Whitelist Overwriting / Extension
@@ -176,8 +176,8 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		Await(time.Second*3).
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourceWhitelist),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourceWhitelist),
 		)
 
 	// 4. Cross-Browser Whitelist
@@ -185,8 +185,8 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		TitleChanged("Safari", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
 			assertUsageApplicationName(t, "Safari"),
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourceWhitelist),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourceWhitelist),
 		)
 
 	// 5. Manual Whitelist Removal
@@ -194,8 +194,8 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		RemoveActiveWhitelists().
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeBlock),
-			assertTerminationModeSource(t, usage.TerminationModeSourceApplication),
+			assertEnforcementAction(t, usage.EnforcementActionBlock),
+			assertEnforcementSource(t, usage.EnforcementSourceApplication),
 		)
 
 	// 6. Pause Expiry While Whitelist Is Still Active
@@ -206,14 +206,14 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		Whitelist("Chrome", "https://www.amazon.com", 7*time.Second).
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourcePaused),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourcePaused),
 		).
 		Await(4*time.Second).
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourceWhitelist),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourceWhitelist),
 		)
 
 	// 7. Whitelist Expiry While Pause Is Still Active
@@ -224,14 +224,14 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		Await(3*time.Second).
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourcePaused),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourcePaused),
 		).
 		Await(6*time.Second).
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeBlock),
-			assertTerminationModeSource(t, usage.TerminationModeSourceApplication),
+			assertEnforcementAction(t, usage.EnforcementActionBlock),
+			assertEnforcementSource(t, usage.EnforcementSourceApplication),
 		)
 
 	// 8. Manual Resume Does Not Clear Active Whitelist
@@ -243,13 +243,13 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		Resume("user resumed protection manually").
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourceWhitelist),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourceWhitelist),
 		).
 		TitleChanged("Chrome", "Linkedin", withPtr("https://www.linkedin.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeBlock),
-			assertTerminationModeSource(t, usage.TerminationModeSourceApplication),
+			assertEnforcementAction(t, usage.EnforcementActionBlock),
+			assertEnforcementSource(t, usage.EnforcementSourceApplication),
 		)
 
 	// 9. Quick-Allow Input Shape Parity (hostname vs full URL)
@@ -260,12 +260,12 @@ func TestService_ProtectionPauseAndWhitelisting(t *testing.T) {
 		Whitelist("Chrome", "amazon.com", 6*time.Second).
 		TitleChanged("Chrome", "Amazon", withPtr("https://www.amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourceWhitelist),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourceWhitelist),
 		).
 		TitleChanged("Chrome", "Amazon", withPtr("https://amazon.com")).
 		AssertLastUsage(
-			assertTerminationMode(t, usage.TerminationModeAllow),
-			assertTerminationModeSource(t, usage.TerminationModeSourceWhitelist),
+			assertEnforcementAction(t, usage.EnforcementActionAllow),
+			assertEnforcementSource(t, usage.EnforcementSourceWhitelist),
 		)
 }
diff --git a/internal/usage/types_db.go b/internal/usage/types_db.go
index e638598..074f10c 100644
--- a/internal/usage/types_db.go
+++ b/internal/usage/types_db.go
@@ -17,8 +17,8 @@ type (
 )
 
 const (
-	ExecutionLogTypeClassification  ExecutionLogType = "classification"
-	ExecutionLogTypeTerminationMode ExecutionLogType = "termination_mode"
+	ExecutionLogTypeClassification    ExecutionLogType = "classification"
+	ExecutionLogTypeEnforcementAction ExecutionLogType = "enforcement_action"
 )
 
 // Application represents a unique application that has been used by the user
@@ -48,13 +48,13 @@ func (a Application) TableName() string {
 
 func (a Application) NewUsage(windowTitle string, browserURL *string) ApplicationUsage {
 	return ApplicationUsage{
-		ApplicationID:   a.ID,
-		Application:     a,
-		StartedAt:       time.Now().Unix(),
-		Classification:  ClassificationNone,
-		TerminationMode: TerminationModeNone,
-		WindowTitle:     windowTitle,
-		BrowserURL:      browserURL,
+		ApplicationID:     a.ID,
+		Application:       a,
+		StartedAt:         time.Now().Unix(),
+		Classification:    ClassificationNone,
+		EnforcementAction: EnforcementActionNone,
+		WindowTitle:       windowTitle,
+		BrowserURL:        browserURL,
 	}
 }
 
@@ -67,11 +67,11 @@ func NewIdleApplication() Application {
 
 type ApplicationUsage struct {
 	// mandatory fields
-	ID              int64           `json:"id" gorm:"primaryKey;autoIncrement;not null"`
-	WindowTitle     string          `json:"window_title" gorm:"not null"`
-	StartedAt       int64           `json:"started_at" gorm:"not null"`
-	Classification  Classification  `json:"classification" gorm:"index:idx_classification"`
-	TerminationMode TerminationMode `json:"termination_mode" gorm:"not null"`
+	ID                int64             `json:"id" gorm:"primaryKey;autoIncrement;not null"`
+	WindowTitle       string            `json:"window_title" gorm:"not null"`
+	StartedAt         int64             `json:"started_at" gorm:"not null"`
+	Classification    Classification    `json:"classification" gorm:"index:idx_classification"`
+	EnforcementAction EnforcementAction `json:"enforcement_action" gorm:"not null"`
 
 	// optional fields
 	BrowserURL      *string `json:"browser_url" gorm:"type:text"`
@@ -86,13 +86,17 @@ type ApplicationUsage struct {
 	DetectedProject              *string `gorm:"index:idx_detected_project" json:"detected_project"`
 	DetectedCommunicationChannel *string `gorm:"index:idx_detected_communication_channel" json:"detected_communication_channel"`
 
-	TerminationReasoning *string                `json:"termination_reasoning"`
-	TerminationSource    *TerminationModeSource `json:"termination_mode_source"`
-	TerminationError     *string                `gorm:"index:idx_termination_mode_error" json:"termination_mode_error"`
+	EnforcementReason *EnforcementReason `json:"enforcement_reason"`
+	EnforcementSource *EnforcementSource `json:"enforcement_source"`
+	EnforcementError  *string            `gorm:"index:idx_enforcement_error" json:"enforcement_error"`
 
-	SandboxContext  *string `json:"sandbox_context" gorm:"type:text;nullable"`
-	SandboxResponse *string `json:"sandbox_response" gorm:"type:text;nullable"`
-	SandboxLogs     *string `json:"sandbox_logs" gorm:"type:text;nullable"`
+	ClassificationSandboxContext  *string `json:"classification_sandbox_context" gorm:"type:text;nullable"`
+	ClassificationSandboxResponse *string `json:"classification_sandbox_response" gorm:"type:text;nullable"`
+	ClassificationSandboxLogs     *string `json:"classification_sandbox_logs" gorm:"type:text;nullable"`
+
+	EnforcementSandboxContext  *string `json:"enforcement_sandbox_context" gorm:"type:text;nullable"`
+	EnforcementSandboxResponse *string `json:"enforcement_sandbox_response" gorm:"type:text;nullable"`
+	EnforcementSandboxLogs     *string `json:"enforcement_sandbox_logs" gorm:"type:text;nullable"`
 
 	// relations
 	Tags          []ApplicationUsageTags `gorm:"foreignKey:UsageID" json:"tags"`
diff --git a/internal/usage/types_usage.go b/internal/usage/types_usage.go
index 2cc6d74..30cddb2 100644
--- a/internal/usage/types_usage.go
+++ b/internal/usage/types_usage.go
@@ -1,21 +1,23 @@
 package usage
 
 type (
-	TerminationMode       string
-	TerminationModeSource string
-	Classification        string
-	ClassificationSource  string
+	EnforcementAction    string
+	EnforcementSource    string
+	EnforcementReason    string
+	Classification       string
+	ClassificationSource string
 )
 
 const (
-	TerminationModeNone  TerminationMode = "none"
-	TerminationModeBlock TerminationMode = "block"
-	TerminationModeAllow TerminationMode = "allow"
+	EnforcementActionNone   EnforcementAction = "none"
+	EnforcementActionBlock  EnforcementAction = "block"
+	EnforcementActionPaused EnforcementAction = "paused"
+	EnforcementActionAllow  EnforcementAction = "allow"
 
-	TerminationModeSourceApplication TerminationModeSource = "application"
-	TerminationModeSourceCustomRules TerminationModeSource = "custom_rules"
-	TerminationModeSourceWhitelist   TerminationModeSource = "whitelist"
-	TerminationModeSourcePaused      TerminationModeSource = "paused"
+	EnforcementSourceApplication EnforcementSource = "application"
+	EnforcementSourceCustomRules EnforcementSource = "custom_rules"
+	EnforcementSourceWhitelist   EnforcementSource = "whitelist"
+	EnforcementSourcePaused      EnforcementSource = "paused"
 
 	ClassificationSourceUserSet           ClassificationSource = "user_set"
 	ClassificationSourceObviously         ClassificationSource = "obviously"
@@ -38,10 +40,10 @@ func (c Classification) IsProductiveOrDistracting() bool {
 	return c == ClassificationProductive || c == ClassificationDistracting
 }
 
-type TerminationDecision struct {
-	Mode      TerminationMode
-	Reasoning string
-	Source    TerminationModeSource
+type EnforcementDecision struct {
+	Action EnforcementAction
+	Reason EnforcementReason
+	Source EnforcementSource
 }
 
 type ClassificationResponse struct {
diff --git a/main.go b/main.go
index bd320e4..2e45e6b 100644
--- a/main.go
+++ b/main.go
@@ -158,7 +158,7 @@ func main() {
 			slog.Error("failed to handle title change", "error", err)
 		}
 
-		if appUsage.TerminationMode == usage.TerminationModeBlock {
+		if appUsage.EnforcementAction == usage.EnforcementActionBlock {
 			tags := usage.ApplicationTagsSlice(appUsage.Tags).Tags()
 			reasoning := ""
 			if appUsage.ClassificationReasoning != nil {