Test ubuntu_perf_more.sh to 100%: allowlist 93 -> 92

Seventh of the 16 untested fixes/lib libs and the first of the ubuntu-perf
pair, which gets its own harness here. 24 assertions; 32/32 = 100.00%
through run_all.sh on the first measurement, confirmed at --min 100 (exit 0),
then cleared with the real gate and no exemption.

Two absolute paths had to move behind env overrides, defaulting to the real
ones: fix_journal writes /etc/systemd/journald.conf.d/size-limit.conf and
run_undo globs /root for undo scripts. Binding those in the jail was rejected
for the same reason as bt_pairing.sh's udev rule -- run_all.sh runs UN-jailed
in ci_mirror.sh and in CI, so a bind mount protects the coverage run and
nothing else. JOURNALD_CONF_DIR and UNDO_DIR follow the UDEV_RULES_DIR
precedent.

Proof the suite is safe where it runs un-jailed: after a bare run_all.sh the
real /etc/systemd/journald.conf.d/size-limit.conf still carries its 2026-03-02
mtime, a genuine artifact of a past production run, and no
undo_ubuntu_performance_*.sh exists in /root.

Worth noting for the rest of the family: run_undo ends in `exit`, so its cases
run inside an explicit subshell. A command substitution already provides one,
so the exit ends only that subshell rather than the whole test file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/superpowers/evidence/ubuntu-perf-more-coverage-2026-08-22.json

@@ -0,0 +1,51 @@
+{
+  "intent": "Test linux_configuration/scripts/single_use/fixes/lib/ubuntu_perf_more.sh to 100% line coverage and take it off the shell-coverage allowlist, seventh of the 16 untested fixes/lib libs and the first of the ubuntu-performance pair.",
+  "scope": [
+    "linux_configuration/scripts/single_use/fixes/lib/ubuntu_perf_more.sh (two env overrides for its absolute write/read targets)",
+    "linux_configuration/scripts/single_use/fixes/lib/tests/ubuntu_perf_harness.sh (new family harness)",
+    "linux_configuration/scripts/single_use/fixes/lib/tests/test_ubuntu_perf_more.sh (new, 24 assertions)",
+    "meta/shell-coverage-allowlist.txt (one line removed)",
+    "Non-goal: ubuntu_perf_fixes.sh, the 215-line other half of this family"
+  ],
+  "changes": [
+    "Added JOURNALD_CONF_DIR and UNDO_DIR overrides to ubuntu_perf_more.sh, defaulting to /etc/systemd/journald.conf.d and /root respectively. fix_journal writes a journald drop-in and run_undo globs /root for undo scripts; both are absolute, and lib/tests/run_all.sh runs UN-jailed in ci_mirror.sh and in CI, so a bind mount would have protected only the coverage run. Same env-override seam bt_pairing.sh uses for UDEV_RULES_DIR.",
+    "Added ubuntu_perf_harness.sh: sources lib_test_core.sh and the real scripts/lib/common.sh, points UNDO_SCRIPT at the tmpdir, and redefines add_undo verbatim from fix_ubuntu_performance.sh, which owns it rather than any lib.",
+    "Added test_ubuntu_perf_more.sh covering fix_journal (first run writing the cap, an already-configured drop-in that must be skipped, and a drop-in capping a DIFFERENT size that must be rewritten), fix_snap_startup (timer enabled and already disabled), and run_undo (no script present, a script that runs, and several scripts where the most recent must win).",
+    "run_undo ends in `exit`, so each of its cases runs inside an explicit subshell: a command substitution already provides one, so the exit ends only that subshell rather than the whole test file."
+  ],
+  "verification": [
+    {
+      "command": "bash linux_configuration/scripts/single_use/fixes/lib/tests/run_all.sh",
+      "result": "pass",
+      "evidence": "ubuntu_perf_more: 24 passed, 0 failed. All fixes lib test files passed, so the six libs cleared so far and the eight pacman_hook_stall suites stay green."
+    },
+    {
+      "command": "bash meta/scripts/shell_coverage_jail.sh --subject linux_configuration/scripts/single_use/fixes/lib/tests/run_all.sh --measure ubuntu_perf_more.sh --min 1 --fail-on-case-error -- \"\"",
+      "result": "pass",
+      "evidence": "ubuntu_perf_more.sh: 32/32 lines = 100.00% on the first measurement. No 'outside kcov's line set' lines reported."
+    },
+    {
+      "command": "bash meta/scripts/shell_coverage_jail.sh --subject linux_configuration/scripts/single_use/fixes/lib/tests/run_all.sh --measure ubuntu_perf_more.sh --min 100 --fail-on-case-error -- \"\"",
+      "result": "pass",
+      "evidence": "ubuntu_perf_more.sh: 32/32 lines = 100.00%, exit code 0. Second matching run at the --min 100 bar."
+    },
+    {
+      "command": "bash meta/scripts/check_shell_coverage.sh linux_configuration/scripts/single_use/fixes/lib/ubuntu_perf_more.sh",
+      "result": "pass",
+      "evidence": "'check_shell_coverage.sh: every checked shell library meets the coverage bar', exit 0, with the allowlist line already removed so the lib had no exemption."
+    },
+    {
+      "command": "ls -la /etc/systemd/journald.conf.d/ after a bare (un-jailed) run of run_all.sh",
+      "result": "pass",
+      "evidence": "size-limit.conf still dated 2026-03-02, i.e. a genuine artifact of a past production run, untouched by the suite. No undo_ubuntu_performance_*.sh exists in /root. This is the check that proves the suite is safe where it actually runs un-jailed; the jail cannot give it."
+    }
+  ],
+  "risks": [
+    "fix_journal restarts systemd-journald and run_undo executes an arbitrary shell script. Both are exercised only through stubs and a tmpdir: systemctl is stubbed by the harness, and the undo script the test runs is one the test wrote into UNDO_DIR. Nothing in this suite can restart a real service or run a real /root script.",
+    "The two new overrides mean a future caller could redirect a production journald drop-in by exporting JOURNALD_CONF_DIR. That matches the existing UDEV_RULES_DIR precedent in bt_pairing.sh, and the defaults are unchanged, so the entry script's behaviour is identical."
+  ],
+  "rollback": [
+    "git revert the commit; that restores the ubuntu_perf_more.sh allowlist line, removes the two overrides and deletes the harness and test file together.",
+    "After rollback, run bash linux_configuration/scripts/single_use/fixes/lib/tests/run_all.sh and confirm the remaining suites pass, then bash meta/scripts/check_shell_coverage.sh to confirm the gate is green with ubuntu_perf_more.sh exempt again."
+  ]
+}

linux_configuration/scripts/single_use/fixes/lib/tests/test_ubuntu_perf_more.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Tests for lib/ubuntu_perf_more.sh: fix_journal, fix_snap_startup and run_undo.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=ubuntu_perf_harness.sh
+. "${SCRIPT_DIR}/ubuntu_perf_harness.sh"
+
+# shellcheck source=../ubuntu_perf_more.sh
+. "${FIXES_DIR}/lib/ubuntu_perf_more.sh"
+
+# --- fix_journal ------------------------------------------------------------
+
+# First run: the drop-in does not exist, so it is written and journald
+# restarted. JOURNALD_CONF_DIR points into the tmpdir, so /etc is untouched.
+ubuntu_reset
+fix_journal
+dropin="${JOURNALD_CONF_DIR}/size-limit.conf"
+_t_contains "$(cat "$dropin" 2>/dev/null)" "SystemMaxUse=300M" \
+	"fix_journal: writes the 300M size cap into the journald drop-in"
+_t_contains "$(cat "$dropin" 2>/dev/null)" "[Journal]" \
+	"fix_journal: writes a valid [Journal] section header"
+_t_contains "$(_t_calls)" "journalctl --vacuum-size=300M" \
+	"fix_journal: vacuums the existing journal down to the cap"
+_t_contains "$(_t_calls)" "systemctl restart systemd-journald" \
+	"fix_journal: restarts journald so the cap takes effect"
+_t_contains "$(_t_undo)" "rm -f /etc/systemd/journald.conf.d/size-limit.conf" \
+	"fix_journal: records how to remove the drop-in in the undo script"
+_t_contains "$(_t_undo)" "systemctl restart systemd-journald" \
+	"fix_journal: records the journald restart in the undo script"
+
+# Second run with the cap already in place: nothing is rewritten.
+ubuntu_reset
+mkdir -p "${JOURNALD_CONF_DIR}"
+printf '[Journal]\nSystemMaxUse=300M\n' >"${JOURNALD_CONF_DIR}/size-limit.conf"
+out="$(fix_journal 2>&1)"
+_t_contains "$out" "already configured" \
+	"fix_journal: skips when the size cap is already configured"
+_t_eq "" "$(_t_calls)" "fix_journal: runs no command when the cap already exists"
+_t_eq "" "$(_t_undo)" "fix_journal: adds no undo step when it changed nothing"
+
+# A drop-in that exists but caps a DIFFERENT size is rewritten.
+ubuntu_reset
+mkdir -p "${JOURNALD_CONF_DIR}"
+printf '[Journal]\nSystemMaxUse=1G\n' >"${JOURNALD_CONF_DIR}/size-limit.conf"
+fix_journal
+_t_contains "$(cat "${JOURNALD_CONF_DIR}/size-limit.conf")" "SystemMaxUse=300M" \
+	"fix_journal: rewrites a drop-in that caps a different size"
+
+# --- fix_snap_startup -------------------------------------------------------
+
+# The timer is enabled: it gets disabled and stopped, and an undo recorded.
+ubuntu_reset
+_t_stub systemctl 'exit 0'
+fix_snap_startup
+_t_contains "$(_t_calls)" "systemctl disable snapd.snap-repair.timer" \
+	"fix_snap_startup: disables the snap repair timer when it is enabled"
+_t_contains "$(_t_calls)" "systemctl stop snapd.snap-repair.timer" \
+	"fix_snap_startup: stops the snap repair timer as well as disabling it"
+_t_contains "$(_t_undo)" "systemctl enable snapd.snap-repair.timer" \
+	"fix_snap_startup: records how to re-enable the timer in the undo script"
+
+# Already disabled: nothing to do.
+ubuntu_reset
+_t_stub systemctl 'exit 1'
+out="$(fix_snap_startup 2>&1)"
+_t_contains "$out" "already disabled" \
+	"fix_snap_startup: reports a timer that is already disabled"
+_t_lacks "$(_t_calls)" "systemctl disable" \
+	"fix_snap_startup: does not re-disable an already-disabled timer"
+_t_eq "" "$(_t_undo)" "fix_snap_startup: adds no undo step when it changed nothing"
+
+# --- run_undo ---------------------------------------------------------------
+#
+# run_undo ends in `exit`, so each case runs it in a subshell -- a command
+# substitution already provides one, and the exit only ends that subshell.
+# UNDO_DIR points into the tmpdir, so the real /root is never read.
+
+ubuntu_reset
+out="$( (run_undo) 2>&1)"
+rc=$?
+_t_eq "1" "$rc" "run_undo: exits non-zero when no undo script exists"
+_t_contains "$out" "No undo script found" \
+	"run_undo: reports that no undo script was found"
+
+ubuntu_reset
+cat >"${UNDO_DIR}/undo_ubuntu_performance_20260101_000000.sh" <<'UNDO'
+#!/bin/bash
+echo "undo script ran"
+UNDO
+out="$( (run_undo) 2>&1)"
+rc=$?
+_t_eq "0" "$rc" "run_undo: exits 0 after running the undo script"
+_t_contains "$out" "undo script ran" "run_undo: actually executes the undo script"
+_t_contains "$out" "All changes reversed" "run_undo: reports success"
+_t_contains "$out" "Reboot recommended" "run_undo: recommends a reboot afterwards"
+
+# With several undo scripts present, the most recent one is chosen.
+ubuntu_reset
+echo 'echo "older"' >"${UNDO_DIR}/undo_ubuntu_performance_20260101_000000.sh"
+sleep 0.01
+echo 'echo "newest"' >"${UNDO_DIR}/undo_ubuntu_performance_20260601_120000.sh"
+touch -d '2026-01-01' "${UNDO_DIR}/undo_ubuntu_performance_20260101_000000.sh"
+out="$( (run_undo) 2>&1)"
+_t_contains "$out" "newest" "run_undo: picks the most recent undo script"
+_t_lacks "$out" "older" "run_undo: does not run an older undo script"
+
+echo
+echo "ubuntu_perf_more: ${PASS} passed, ${FAIL} failed"
+((FAIL == 0))

linux_configuration/scripts/single_use/fixes/lib/tests/ubuntu_perf_harness.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# lib/tests/ubuntu_perf_harness.sh — shared setup for the ubuntu performance
+# lib tests (ubuntu_perf_more.sh, ubuntu_perf_fixes.sh).
+#
+# Sourced, not executed. Builds on lib_test_core.sh and adds what these libs
+# read from their entry script, fix_ubuntu_performance.sh:
+#
+#   * UNDO_SCRIPT, pointed into the throwaway tmpdir, and add_undo which
+#     appends to it -- both live in the entry script, not in any lib;
+#   * the real log_*/has_cmd helpers, via scripts/lib/common.sh.
+#
+# JOURNALD_CONF_DIR and UNDO_DIR are the overrides ubuntu_perf_more.sh exposes
+# so its two absolute write targets (/etc/systemd/journald.conf.d and /root)
+# stay out of reach. run_all.sh runs UN-jailed in ci_mirror.sh and in CI, so a
+# bind mount would protect only the coverage run.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FIXES_DIR="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+REPO_ROOT="$(cd "${FIXES_DIR}/../../../.." && pwd)"
+
+# shellcheck source=lib_test_core.sh
+. "${SCRIPT_DIR}/lib_test_core.sh"
+
+# shellcheck source=../../../../lib/common.sh
+. "${REPO_ROOT}/linux_configuration/scripts/lib/common.sh"
+
+# --- globals and helpers owned by fix_ubuntu_performance.sh -----------------
+
+# Read by the libs under test, never by this harness, so static analysis
+# cannot see the use; export makes the intent explicit.
+export UNDO_SCRIPT="${TEST_TMPDIR}/undo.sh"
+export JOURNALD_CONF_DIR="${TEST_TMPDIR}/journald.conf.d"
+export UNDO_DIR="${TEST_TMPDIR}/undo_dir"
+
+# Verbatim from fix_ubuntu_performance.sh.
+add_undo() {
+	echo "$1" >>"$UNDO_SCRIPT"
+}
+
+_ubuntu_default_stubs() {
+	local tool
+	for tool in systemctl journalctl snap apt-get update-grub sysctl \
+		swapoff swapon; do
+		_t_stub "$tool" 'exit 0'
+	done
+}
+
+# ubuntu_reset — start a test group from "nothing has happened yet".
+ubuntu_reset() {
+	_t_reset_calls
+	rm -rf "${JOURNALD_CONF_DIR}" "${UNDO_DIR}"
+	mkdir -p "${JOURNALD_CONF_DIR}" "${UNDO_DIR}"
+	: >"$UNDO_SCRIPT"
+	_t_full_path
+	_ubuntu_default_stubs
+}
+
+# _t_undo — the undo script's contents this round.
+_t_undo() {
+	cat "$UNDO_SCRIPT" 2>/dev/null || true
+}
+
+ubuntu_reset

linux_configuration/scripts/single_use/fixes/lib/ubuntu_perf_more.sh

@@ -9,8 +9,10 @@
 # Fix 6: Journal vacuum + permanent size cap
 # ===================================================================
 fix_journal() {
-	# Create permanent size cap via drop-in
-	local dropin_dir="/etc/systemd/journald.conf.d"
+	# Create permanent size cap via drop-in. JOURNALD_CONF_DIR defaults to the
+	# real path and is only overridden by the test suite, which must not write
+	# to /etc: lib/tests/run_all.sh runs un-jailed in ci_mirror.sh and in CI.
+	local dropin_dir="${JOURNALD_CONF_DIR:-/etc/systemd/journald.conf.d}"
 	local dropin_file="$dropin_dir/size-limit.conf"
 
 	if [[ -f $dropin_file ]] && grep -q 'SystemMaxUse=300M' "$dropin_file"; then
@@ -61,10 +63,10 @@ fix_snap_startup() {
 run_undo() {
 	local latest_undo
 	# shellcheck disable=SC2012
-	latest_undo=$(ls -1t /root/undo_ubuntu_performance_*.sh 2>/dev/null | head -1)
+	latest_undo=$(ls -1t "${UNDO_DIR:-/root}"/undo_ubuntu_performance_*.sh 2>/dev/null | head -1)
 
 	if [[ -z ${latest_undo:-} ]]; then
-		log_error "No undo script found in /root/"
+		log_error "No undo script found in ${UNDO_DIR:-/root}/"
 		exit 1
 	fi
 

meta/shell-coverage-allowlist.txt

@@ -84,7 +84,6 @@ linux_configuration/scripts/single_use/fixes/lib/nvidia_config.sh
 linux_configuration/scripts/single_use/fixes/lib/pacman_hook_stall_setup.sh
 linux_configuration/scripts/single_use/fixes/lib/thorium_repairs.sh
 linux_configuration/scripts/single_use/fixes/lib/ubuntu_perf_fixes.sh
-linux_configuration/scripts/single_use/fixes/lib/ubuntu_perf_more.sh
 linux_configuration/scripts/single_use/fresh-install/lib/packages.sh
 linux_configuration/scripts/single_use/lib/joplin_server.sh
 linux_configuration/scripts/single_use/misc/testsAndMisc-bash/lib/clean_audio_filters.sh