Surviving a reboot
Three days in, I found the first hole in the wall: restarting the phone. iOS clears every shield on reboot, and the schedule won't fire again for a window that's already underway, so a block you were in the middle of never came back.
Cactus now checks on launch whether a rule should be active and puts the shields back itself.