Update restructure status: 8 units out, flattening done

Depth 556 -> 104, tracked files 2295 -> ~1980. What remains is the guard
repoint (blocked on a permission I cannot grant myself), the two
subsystems behind it, and wiring the gates once the structural
violations are exempted by name.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
This commit is contained in:
Krzysztof Rudnicki 2026-08-23 19:14:46 +02:00
parent 0fb3e3eee2
commit 2cf62a2402

View File

@ -13,78 +13,80 @@ its CI workflow, the `app_icons` registry entry, and the paired
patterns at all).
**Extracted** to public repos, full history, each with CI it did not have here:
`reverse-survivors`, `kcd2-dice-solver` (cloned to `~/kcd2-dice-solver`),
`focus-owner`, `mtk-root` (took the four `mtk_*` libs and three suites that
lived in `lib/`).
`reverse-survivors`, `kcd2-dice-solver` (`~/kcd2-dice-solver`), `focus-owner`,
`mtk-root`, `system-maintenance` (`~/system-maintenance`), `android-guardian`
(`~/android-guardian`), `phone-focus-mode` (with `python_pkg/focus_policy`).
**Gates written, deliberately NOT wired**: `meta/scripts/check_directory_depth.sh`
(cap 2; exempts `third_party/`, `docs/superpowers/`, `.github/skills/` by prefix
and `lib/` / `tests/` by path segment). Violations 556 → 294.
**Flattened.** `linux_configuration/scripts/` and `single_use/` are gone;
categories sit directly under `linux_configuration/`. `i3-configuration` moved
out of `periodic_background` into `i3/` + `i3blocks/`, and
`misc/testsAndMisc-bash/` lost its redundant nesting.
Depth, tests and pre-commit verified green at every commit; nothing used
`--no-verify`.
**Length cap widened** to catch extensionless scripts, and `boot-repair` split
756 → 218 with four libs.
## Decisions taken this session
Depth violations **556 → 104**; tracked files **2295 → ~1980**. Every commit
green; nothing used `--no-verify`.
- **Depth cap is 2**, with `lib/` and `tests/` exempt — so the ~118 single_use
lib files stay put and step D only flattens entry scripts.
- **`meta/` is in scope** for the cap.
- **`lib/common.sh` STAYS.** Measured: 55 consumers, 51 of which remain
here. The `.githooks` use a _separate_ `common.sh`, so the ">2 units" rule
selects nothing worth moving. Deviation from the original instruction,
agreed after measurement.
- **`periodic_background/lib/` STAYS** — 9 files, one consumer
(`check_and_enable_services.sh`), not a shared library.
- New repos are **public**; vmbox pass required for **all four** subsystems.
## Remaining
## Remaining, in order
1. **The guard repoint** (deferred at your request). Two guard-lib instances
name plugin scripts by absolute path inside the repo. Plugins are ALREADY
installed at `/usr/local/share/guard-lib-plugins/`; the sequence is verified
in vmbox. The classifier blocks me from running it:
1. `hosts` — owns `/etc/guard-lib/targets/{resolved,nsswitch}.conf` plugin
paths. Confirm `guardctl status` after, not just that files moved.
2. `phone_focus_mode` + `python_pkg/focus_policy` — must come after `hosts`:
`deploy_phases.sh:73` executes hosts' `generate_hosts_file.sh`.
3. `digital_wellbeing` **last** — pacman wrapper, `chattr +i`, the 12
hardcoded orchestrator paths in `check_and_enable_services.sh:61-74` /
`setup_periodic_system.sh:20-23`, and now `heavy_job_lock.sh`, which moved
in with it. It also owns `test_shutdown_timer_monitor.sh`, the pair test
left behind here.
4. Step D: flatten the 207 remaining entry-script violations
(`single_use/**` is ~130 of them). Deduplicate the two Nextcloud
implementations first — ~2,780 lines for one capability.
5. Step E: wire both gates, close the `boot-repair` hole (756 lines, escapes
the 250-line cap because `is_source_file()` needs a dot in the filename),
prune `docs/superpowers/` churn.
```
sudo guardctl file-guard uninstall resolved --keep-canonical
sudo guardctl file-guard install resolved --target /etc/systemd/resolved.conf \
--plugin /usr/local/share/guard-lib-plugins/resolved-plugin.sh \
--also-watch /etc/systemd/resolved.conf.d
sudo guardctl file-guard uninstall nsswitch --keep-canonical
sudo guardctl file-guard install nsswitch --target /etc/nsswitch.conf \
--plugin /usr/local/share/guard-lib-plugins/nsswitch-plugin.sh
sudo guardctl file-guard enforce resolved && sudo guardctl file-guard enforce nsswitch
```
2. `hosts` extraction — blocked on (1). Its installer was already proven in
vmbox to run from an extracted layout with no monorepo path.
3. `digital_wellbeing` **last** — pacman wrapper, `chattr +i`, `heavy_job_lock.sh`
(moved in with it), and the 12 orchestrator paths in
`check_and_enable_services.sh` / `setup_periodic_system.sh`, which now point
at the NEW locations and will need updating again when it moves. It also owns
`linux_configuration/tests/test_shutdown_timer_monitor.sh`.
4. **Wire the gates.** `check_directory_depth.sh` exists and is a dry run only.
Before wiring, exempt the ~57 structural violations by name — `C/atop_agg/`
(a C project), `python_pkg/artgate/{routes,styles}/`, `misc/tools/`,
`dwm/{bin,patches}/`, `*/systemd/`, `*/hooks/` — the same way `lib/` and
`tests/` are exempt. Then add `check_repo_size.sh` counting source files only.
5. Prune `docs/superpowers/evidence|contracts` (673 files, the real growth
driver) and decide `.hippo/`'s fate.
6. Optional: deduplicate the two Nextcloud implementations in `features/`
(~2,780 lines for one capability).
## Traps already paid for
- **Run the thing, don't read it.** Repointing kcd2 surfaced three failures no
grep would have found: pnpm ignoring the `package.json` "pnpm" field, pnpm
refusing to purge `node_modules` without a TTY, and the Docker container
still bind-mounting the deleted monorepo path.
- **`/usr/local/bin` holds copies that name repo paths** — invisible to a repo
grep, and `periodic-system-maintenance.sh` runs hourly with three such paths
into digital_wellbeing and hosts. Any extraction of those two must
_reinstall_ it, not just edit the repo copy.
- **Removing a file can break a suite that stays.** Deleting `mtk_harness.sh`
broke `test_common_datetime.sh`, which sources it. Check both directions.
- **pre-commit's patch restore can silently revert an edit** made before the
commit — the `app_icons` change had to be applied twice. Re-grep after
committing.
- `shell-tests.yml` discovers _some_ suites by glob and names others in an
explicit list. A removal breaks the list (CI fails on the missing file) and
silently shrinks the glob. Check both.
- **Never let a test fall back to `/usr/local/bin`.** The installed copy can be
older than source — `shutdown-timer-monitor.sh` is, on this machine — so the
test compares an installer template against a binary it never generated. It
hung. Prefer a sibling checkout and SKIP when absent.
- Extractions keep surfacing pre-existing bugs. `update_android_hosts.sh`
pointed `GUARDIAN_MODULE_DIR` at a sibling that never existed. Fix them
rather than carrying them forward, and guard at the single funnel.
- **Run it, don't read it.** Repointing kcd2 hit three failures in a row (pnpm
ignoring the `package.json` field, no-TTY `node_modules` purge, a Docker mount
on the deleted path). `dice.kuhy.duckdns.org` now serves from the new repo.
- **`/usr/local/bin` holds copies naming repo paths** — invisible to a repo grep.
`report_live_state.sh` scans there now.
- **Removing a file can break a suite that stays** (`mtk_harness.sh`), and a
removal can silently shrink CI (`shell-tests.yml` uses TWO hand-maintained
lists plus a glob — check all three).
- **Never let a test fall back to `/usr/local/bin`**: the installed copy can be
stale, and the test then compares against a binary it never generated.
- **pre-commit's patch restore can revert an edit** made before the commit. The
`app_icons` and `AGENTS.md` changes each had to be applied twice.
- **Path rewrites need resolving, not reviewing.** Relative `source` depths
differ per file (`../../` vs `../../../`), `REPO_ROOT` walks a fixed number of
levels, `$VAR/scripts/...` prefixes hide from a naive regex, and
`# shellcheck source=` directives break independently of the code.
- **Sourcing top-level code is not a split.** boot-repair's report block has
`exit` calls; moving it broke 30 of 42 tests.
## Unrelated: syncyomi-guard is red
Failing since 00:00 on 2026-08-23, ~17h before this session — nothing to do
with the restructure. It is working as designed: the library collapsed from
2185 manga / 68902 chapters to 8 / 895. See the `syncyomi-restore-silent-partial`
memory; do NOT checkpoint the WAL before recovering. Newest snapshot in
`~/syncyomi/snapshots/` is 2026-08-15.
Failing since 00:00 on 2026-08-23, ~17h before this work started. It is working
as designed: the library collapsed from 2185 manga / 68902 chapters to 8 / 895.
See the `syncyomi-restore-silent-partial` memory; do NOT checkpoint the WAL
before recovering. Newest snapshot in `~/syncyomi/snapshots/` is 2026-08-15.