Quarantine the arch_sysctl cases: they broke bt_audio's measurement

check_shell_coverage.sh was RED on main. bt_audio.sh is off the
allowlist at 127/127, and commit 7c14cfca -- which added
test_arch_sysctl.sh -- made kcov stop registering it entirely, so the
gate failed on a lib nothing had touched.

Bisected by measuring bt_audio.sh at three commits: a2b23521 127/127,
afe6ac3a 127/127, 7c14cfca "kcov instrumented no lines". Removing that
one test file restores 127/127 with every other new file still in the
suite (arch_cpu, arch_hardware x2, thorium x2), and arch_cpu.sh
re-measures at 57/57 alongside it.

Both plausible causes inside lib_test_core.sh were ruled out by
reverting each on its own in a throwaway worktree: `export out` and the
_t_hide farm cache each left bt_audio broken while the file was
present. Neutering the file's body while keeping the source line does
NOT reproduce it either, so the trigger is cumulative rather than one
construct, and it is not understood.

The file keeps all 23 assertions and still passes when run directly; it
just leaves the test_*.sh glob run_all.sh iterates. That costs nothing
measurable, because arch_sysctl.sh has never measured through the jail
in the first place -- it reports "instrumented no lines" on its own,
like nc_php.sh -- and it stays on the allowlist.

The header records the bisect and what to re-verify before anyone
un-quarantines it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/superpowers/evidence/quarantine-arch-sysctl-cases-2026-08-22.json

@@ -0,0 +1,53 @@
+{
+  "intent": "Restore bt_audio.sh's coverage measurement by taking the arch_sysctl test file out of run_all.sh's glob, after discovering that its presence made the shell coverage gate fail on a lib that is off the allowlist.",
+  "scope": [
+    "linux_configuration/scripts/single_use/fixes/lib/tests/test_arch_sysctl.sh renamed to arch_sysctl_quarantined_cases.sh",
+    "Non-goal: deleting or weakening any assertion -- all 23 still run and still pass",
+    "Non-goal: arch_sysctl.sh's allowlist entry, which stays because the lib was never measurable"
+  ],
+  "changes": [
+    "Renamed the file out of the test_*.sh glob that run_all.sh iterates, so the suite no longer loads it",
+    "Rewrote its header to record the bisection, the ruled-out causes, how to run the cases directly, and what to re-verify before ever un-quarantining it"
+  ],
+  "verification": [
+    {
+      "command": "bash meta/scripts/check_shell_coverage.sh .../fixes/lib/bt_audio.sh (before the rename)",
+      "result": "fail",
+      "evidence": "EXIT 1, 'bt_audio.sh below the coverage bar'. bt_audio.sh is OFF the allowlist at 127/127, so commit 7c14cfca had left the gate red on main."
+    },
+    {
+      "command": "shell_coverage_jail.sh --measure bt_audio.sh, with and without the file in the suite",
+      "result": "pass",
+      "evidence": "Without it: bt_audio.sh 127/127 = 100.00% and arch_cpu.sh 57/57 = 100.00%, with every other new test file present. With it: 'kcov instrumented no lines'."
+    },
+    {
+      "command": "git bisect by measuring bt_audio.sh at three commits",
+      "result": "pass",
+      "evidence": "a2b23521 127/127, afe6ac3a 127/127, 7c14cfca broken -- isolating the change to the commit that added this test file."
+    },
+    {
+      "command": "Independently reverting each lib_test_core.sh change in a throwaway worktree",
+      "result": "pass",
+      "evidence": "Removing `export out` alone left bt_audio broken; removing the _t_hide farm cache alone left it broken. Neither is the cause; the test file's presence is."
+    },
+    {
+      "command": "bash linux_configuration/scripts/single_use/fixes/lib/tests/arch_sysctl_quarantined_cases.sh",
+      "result": "pass",
+      "evidence": "arch_sysctl: 23 passed, 0 failed -- the cases are correct and still runnable, just not part of the measured suite."
+    },
+    {
+      "command": "bash linux_configuration/scripts/single_use/fixes/lib/tests/run_all.sh",
+      "result": "pass",
+      "evidence": "All fixes lib test files passed."
+    }
+  ],
+  "risks": [
+    "23 assertions no longer run in CI, because the suite runner only picks up test_*.sh. They are a manual invocation away and the header says so.",
+    "The underlying kcov behaviour is not understood: a single case, or the file with its body neutered, does NOT reproduce it, so the trigger is cumulative rather than one construct. Any future test file added to this suite can do the same thing to another cleared lib.",
+    "Mitigation for that risk is procedural: re-measure every off-allowlist lib in this directory after adding any test file, not just the new lib."
+  ],
+  "rollback": [
+    "git mv arch_sysctl_quarantined_cases.sh back to test_arch_sysctl.sh",
+    "Then re-measure bt_audio.sh through run_all.sh and confirm 127/127 BEFORE committing; the gate will otherwise go red on main again."
+  ]
+}

linux_configuration/scripts/single_use/fixes/lib/tests/arch_sysctl_quarantined_cases.sh

@@ -1,11 +1,36 @@
 #!/usr/bin/env bash
-# lib/tests/test_arch_sysctl.sh — tests for arch_sysctl.sh.
+# lib/tests/arch_sysctl_quarantined_cases.sh — 23 GREEN assertions for
+# arch_sysctl.sh, deliberately OUTSIDE the test_*.sh glob that run_all.sh
+# iterates. Not dead code, and not broken: run it directly and it passes.
+#
+# WHY IT IS QUARANTINED
+#
+# While this file was named test_arch_sysctl.sh, its presence in the suite
+# made kcov stop registering bt_audio.sh entirely -- a lib that is OFF the
+# allowlist at 127/127, so check_shell_coverage.sh went red on main. Bisected:
+#
+#   a2b23521 (session start)      bt_audio 127/127
+#   afe6ac3a (shfmt reformat)     bt_audio 127/127
+#   7c14cfca (this file lands)    bt_audio "kcov instrumented no lines"
+#
+# Removing this one file restores bt_audio to 127/127 with every other new
+# test file (arch_cpu, arch_hardware x2, thorium x2) still present. Both
+# candidate causes inside lib_test_core.sh were ruled out by reverting each
+# independently in a throwaway worktree: `export out` and the _t_hide farm
+# cache each left bt_audio broken while this file was present.
+#
+# The cost of keeping it is therefore a gated lib's measurement; the benefit
+# is nil, because arch_sysctl.sh has NEVER measured through the jail (it
+# reports "kcov instrumented no lines" on its own too, like nc_php.sh). It
+# stays on meta/shell-coverage-allowlist.txt.
+#
+# TO RUN THESE CASES:
+#   bash linux_configuration/scripts/single_use/fixes/lib/tests/arch_sysctl_quarantined_cases.sh
+#
+# TO UN-QUARANTINE: rename back to test_arch_sysctl.sh, then re-measure
+# bt_audio.sh through run_all.sh and confirm it is still 127/127 BEFORE
+# committing. Do not assume a kcov upgrade fixed it.
 #
-# Both functions share a shape: probe every parameter with `sysctl -n`, set
-# needs_update when any current value differs from the wanted one, skip when
-# nothing differs AND the drop-in already exists, otherwise write the drop-in
-# and reload. The cases below walk each arm of that shape for both functions,
-# plus tweak_network_sysctl's modprobe guard.
 set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"