The previous commit fixed the dependency resolution failure that had kept
Python tests red since ~2026-08-19 -- and then did not run it, because
the workflow's path filter lists "requirements.txt" while the root file
is a SYMLINK into meta/. GitHub matches filters against the path as git
records it, so editing the real file matched nothing and the red result
stayed pinned to an older commit.
A gate that cannot be triggered by the change it gates is the same class
of problem as the two found earlier today: it reports a stale answer and
looks fine.
Both spellings are now listed, in the push and pull_request filters.
The other root symlinks -- pyproject.toml, run.sh, lint_python.sh,
.fvmrc -- are in no workflow filter today, so they carry the same latent
trap if one is ever added.
CI_GREEN_SKIP=1: the baseline is red only from the pre-fix Python tests
run this commit exists to make reachable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
Python tests has been red since ~2026-08-19, failing in "Install
dependencies" with pip's resolution-too-deep. That is an install failure,
not a test failure -- which means no Python test has actually run in CI
for days, on a repo whose Python bar is 100% branch coverage.
The CI log names the cause: the resolver backtracks through Brotli
1.0.6 -> 1.0.4 -> 1.0.1 and asgiref 3.8.0 -> 3.7.1 -> 3.6.0, all dragged
in by mitmproxy>=10.0, then gives up. Nothing imports it: `git grep
mitmproxy` finds it only in a pacman whitelist and a docs file, and
check_requirements_sync.py passes without it.
Reproduced and fixed locally rather than guessed, on Python 3.11.11 with
pip 26.2.1 -- the versions CI uses:
pip install --dry-run -r <with mitmproxy> exit 1, resolution-too-deep
pip install --dry-run -r <without mitmproxy> exit 0
Left standing: 78 of the 80 requirements are unpinned >= ranges, so this
can recur the next time a package with a wide dependency graph is added.
CI_GREEN_SKIP=1: this commit IS the fix for the red baseline.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
The original handoff's scope is obsolete: job 1 is done, and job 2 was
deliberately dropped rather than completed. Prepends the outcome and the
numbers rather than rewriting the file, because its kcov/jail notes are
still the reference for measuring a lib on purpose.
Also records the two traps that cost the most time this session: never
`git reset --hard` to undo a probe commit (it discards unstaged work --
recoverable from ~/.cache/pre-commit/patch*), and read a gate's predicate
rather than its header comment, which in this repo was a full day stale
and produced a confidently wrong scope estimate.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
check_shell_coverage.sh has existed for a while and was never in
.pre-commit-config.yaml, so nothing ran it: a new shell library with no
suite beside it could land freely. Wiring it was unaffordable while the
gate measured a jail-run 100% bar (--all took over 600s). After 578c4a6c
dropped that, --all is 0.31s and the per-file mode this hook uses is
milliseconds, so it goes in.
Also fixes a bug 578c4a6c introduced: the failure path still interpolated
${COVERAGE_BAR}, which that commit deleted, so every rejection printed
"COVERAGE_BAR: unbound variable" and advised a 100% line-coverage bar
that no longer exists. The message now describes what is enforced.
Three libs blocked the wiring -- meta/scripts/lib/shell_coverage_{bar,
case_runner,jail_setup}.sh, the code that BUILDS the jail, and so the one
corner of the repo the jail cannot measure itself. They are pure
file-writers, so they get a suite that calls them against a temp $JAIL
and asserts on what was written: 48 assertions, nothing mounted, no
unshare, no kcov.
Several assertions check that an emitted file contains an UNEXPANDED
${BASH_SOURCE} or $1 -- the whole point of the quoted heredocs the jail
relies on. Written as single-quoted literals that is SC2016 on every
line, so the needles compose the dollar from an exported constant
instead. No suppressions were added.
check_shell_coverage.sh --all: 3 BLOCK -> 0 BLOCK
hook, repo-wide: 0.16s
new suite: 48 assertions, green
Proved the ratchet still bites: an untested lib dropped into
mtk_root/lib is refused with "needs: .../tests/run_all.sh". Probe removed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
bca70b67 (2026-08-22) turned the shell ratchet from "a run_all.sh exists
beside this lib" into a measured 100% line-coverage bar, run through the
kcov+userns jail. It works -- dot_resolver_install.sh really does measure
39/39 -- but the price is one hand-written test file per lib: fixes/lib
took 34 test files for 22 libs, the jail runs serially at 37-90s a pass
(concurrent jails give false failures), and most libs need a production
seam added before they can be driven at all.
That put the remaining 84 exempt libs at several days of work, for a
repo of personal automation scripts. User's call today: not worth it.
python_pkg keeps its 100% branch bar, which is already met -- 2101 tests,
100.00%, zero missing statements or branches. The difference is the
instrument: pytest-cov is fast, reliable and parallel; the shell jail is
none of those.
Also tried and rejected, recorded in the file: a middle option where the
suite must MENTION the lib by name, closing the empty-suite hole the
100% bar was reaching for. It newly BLOCKED 68 libs sitting in
directories that already have suites -- 38 in utils/lib alone -- because
those passed the old presence check and so were never allowlisted, and
seed_allowlist refuses to grow by design. Tightening a ratchet with no
way to grandfather the existing tree turns it into a wall.
The jail is not deleted; it is still the tool for measuring a lib on
purpose, and ci_mirror.sh still runs jailed suites.
check_shell_coverage.sh --all: >600s -> 0.31s
BLOCK entries: 3, all pre-existing meta/scripts/lib
coverage-tooling libs
allowlist: unchanged at 84 (--seed correctly
refused to add the 3)
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
Endurain API keys are upload-only by design: the scope allow-list is
frozenset({"activities:upload"}), enforced in both validate_api_key_scopes
and the create schema, and the activities read route is mounted with
validate_access_token rather than validate_access_token_or_api_key. A key
therefore fails at authentication before any scope check, so the HTTP
dedupe check added in 325d5a8b could never succeed and every pass fell
back to the ledger alone. Verified against v0.19.0; upstream documents no
plan to widen the allow-list.
Read the start times out of postgres instead. The container publishes no
host port, so this goes through docker exec -- no new dependency and no
port opened just to read four rows. The HTTP path is still tried first so
the supported route resumes working on its own if the allow-list ever
grows.
None and [] are kept strictly apart: a dead container, timeout or non-zero
exit means "could not ask" and returns to the ledger, while an empty result
set is a real answer. Conflating them would re-upload everything on any
docker hiccup, which is the bug the dedupe check exists to prevent.
Proven with an empty ledger: the known-duplicate TCX was skipped and the
activity count held at 4, and the same file WAS imported with
ENDURAIN_NO_DB=1, so the check is what blocks it. The duplicate that
negative control created was removed afterwards.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GbYEnfGnf1988cdFdGebot
`git push` took ~130s because ci-mirror re-ran `pre-commit --all-files`
plus every lib/tests suite on every push, regardless of what changed.
The larger problem found while measuring it: ci_mirror.sh invoked
pytest_changed_packages.py with no arguments, and that script returns 0
on empty argv because it is normally a pre-commit hook fed staged paths.
The pre-push python stage has therefore been running ZERO tests and
reporting success. Behind it sat a genuinely failing test, fixed in
ff3ea99a. The stage is now passed the changed paths and actually runs.
Scope, keeping the guarantee that a red push cannot reach GitHub:
* pre-commit runs over the push range, read from PRE_COMMIT_FROM_REF /
PRE_COMMIT_TO_REF, which the pre-push hook already resolves from the
refs git hands it -- the remote's real shas, so unlike origin/main
they cannot go stale and silently empty the range.
* an unknown range, or a change to the gate's own machinery, forces a
full sweep, so a new rule cannot land while checking only its own diff.
* only the lib/tests suites whose tree the push touched are run; a
change to scripts/lib/ or to a suite's lib_test_core.sh fans out to
all of them.
* pre-commit and pytest run concurrently. The jailed shell gate stays
serial: concurrent jails produce false failures.
* an unchanged tree short-circuits on a recorded tree hash.
This also restores intent that was already in the config:
session-autopsy-hook-mutations is `files:`-scoped to two files precisely
because it costs 50s, and --all-files was overriding that on every push.
Measured, against a ~130s baseline:
docs-only push 7.6s
python push 25.3s (includes a 22s stage that never ran)
one shell suite 43.6s (37s of it is the fixes/lib suite)
all-suites widening 52s
re-push, unchanged 0.005s
Proved it still gates: a deliberately broken python assertion and a
deliberately broken shell assertion were each refused with exit 1, and
the green-tree cache is not written on failure. Both probes reverted.
Split into ci_mirror_range.sh and ci_mirror_shell.sh for the 250-line
cap; both are sourced-only, so they follow the repo's convention of
`# shellcheck shell=bash` with no shebang and no exec bit.
CI_GREEN_SKIP=1: main is red only from 04cc5fa2, the deliberate shell
probe above, which is already reverted here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
Reverts the temporary broken assertion used to prove the pre-push gate
refuses a red shell suite (it did: exit 1).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
Two adb devices are normally attached (USB phone + a network target), so
the importer correctly refused to guess which one to pull from. Pin
ENDURAIN_ADB_SERIAL in the unit; verified with a real run that now
reports "pulled 5 file(s) from the phone".
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GbYEnfGnf1988cdFdGebot
test_passes_store_and_repo_root asserted
env["PYTHONPATH"].endswith("testsAndMisc"), which is a property of the
checkout's directory name rather than of the code. It fails in any
worktree, which is where ci-mirror runs its gates.
Assert against the value reindex.py actually computes,
Path(reindex.__file__).resolve().parents[2]. Exact equality is a
stronger check than the suffix match it replaces.
This was invisible until now because ci-mirror invoked
pytest_changed_packages.py with no arguments, and that script returns 0
on empty argv -- so the pre-push pytest stage never ran. The next commit
fixes the invocation.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
RunnerUp can now upload to Endurain directly as well as through the WebDAV
inbox, and the two paths cannot see each other: the same run landed twice
(activities 14 and 15, identical start time, distances differing only by
tcx/gpx rounding). The ledger only knows what this importer handled, so it
could not catch it.
Add a third dedupe check that asks Endurain what it already holds, queried
once per run. Endurain exposes no query-by-start-time endpoint, so a page of
recent activities is fetched and compared client-side, with a +/-120s
tolerance: the file for activity 15 embeds 21:51:04Z while the server stored
21:51:05Z, so exact equality misses the very duplicate that motivated this.
A failed or unauthorised query returns None, never an empty list, so it can
never be read as "nothing matches" and upload on the strength of it.
Export filenames are parsed as LOCAL wall-clock time. RunnerUp_2026-08-14-
00-58-45_Running is 2026-08-13 22:58:45 UTC; reading it as UTC would move a
late-evening run onto the wrong day and defeat the comparison.
Also fix the adb fallback, which broke the moment a second device attached:
phone_attached() returned true if ANY device was in the 'device' state, then
every bare adb call failed with "more than one device/emulator" as a warning
on a path nobody watches. The serial is now resolved once and threaded into
every call as -s. Ambiguity is settled by configuration, never by guessing --
several devices and no ENDURAIN_ADB_SERIAL means the fallback is skipped.
The remote check stays inert until the API key is granted activities:read;
until then it falls back to the ledger, which is the previous behaviour.
85 tests, 100% branch coverage on all four modules, no suppressions. The
oversized test modules are split by concern to stay under the 250-line cap.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GbYEnfGnf1988cdFdGebot
Two jobs for the next session. Job 1 is the push gate: pre-push is ~130s,
almost all of it ci-mirror, while pre-commit is already 4.8s. The prompt
says plainly that a clean-venv install plus --all-files plus two suites
cannot fit in 10s, and asks for stage timings BEFORE proposing anything,
then lists four options with what each actually costs -- three that keep
the guarantee and one (drop ci-mirror from pre-push) that trades it.
Job 2 is the coverage ask. It leads with the finding that ~12 gated
shell libs outside fixes/lib fail the gate today, which is worse than an
exemption: the gate believes it is checking them. Then the 84 allowlist
entries, then Python. It also says to report the real scope first,
because "100% covered" is several days of work and the user should see
the shape before it is spent.
Carries forward what cost hours last session: verify an edit landed
before trusting it, run the suite from a clean checkout before pushing,
never run two jails at once, and audit any instrument predicate
repo-wide rather than in one directory.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The deletion did not survive the seam-restore commit, so the exemption
was still in place and the gate was passing on it rather than on
coverage. Measured 76/76 = 100.00% with the gate's own jail flags, in a
detached worktree -- the main tree aborts the jail right now because
another agent is editing python_pkg/endurain_import concurrently and the
tree fingerprint reads that as a write escaping the jail.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Three changes, none of which touch what a single test asserts:
thorium_repairs.sh's `sleep 4` becomes `sleep ${THORIUM_STARTUP_WAIT:-4}`
and the harness sets 0.2s. Three cases were each paying four real
seconds to watch a stubbed browser stay up; the stub sleeps 30s, so the
`kill -0` check is unchanged. That file: 17.0s -> 5.6s.
_t_hide was the rest of it. It walks PATH and creates a symlink per
executable -- ~13.5k here, 4.6s a build -- and the suite has ~16
distinct tool sets. Now the full farm is built ONCE and `cp -al`
hard-links it per set, with only the hidden names deleted from the copy.
The cache also moved out of $TEST_TMPDIR, which is per-file, into a
run-scoped dir run_all.sh creates and removes, so it survives between
files.
110s -> 98s (sleep) -> 85s (shared cache) -> 37s (hard-linked farm).
645 OK, 0 FAIL throughout. The cases that only pass when a tool is
genuinely unfindable -- install_pyroveil's missing-dependency arms,
fix_aggressive without sqlite3 -- still pass, which is what proves the
farm is still hiding rather than quietly returning a full PATH.
lib_test_core.sh hit exactly 250 lines, so _t_hide and the farm move to
lib_test_path.sh (194 + 67).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Committed unformatted in 558883f2, which makes the pre-push prettier
hook fail for anyone pushing afterwards. Formatting only: 9 lines
reflowed, no content touched.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The seams were applied, verified and measured, but never reached the
commit: cb1e8c53 shipped the file with its hardcoded /etc/X11,
/etc/profile and /home/$SUDO_USER paths. ci-mirror caught it by running
the suite from a clean checkout, where the tests read the REAL system
files -- the RenderAccel assertion failed against this machine's actual
xorg config, which says "disabled", and the pyroveil clone path came
back as /home/testuser rather than the tmpdir.
The local run passed only because a stale seamed copy was sitting in the
measurement worktree. Re-applied and grepped back immediately, which is
the documented rule for exactly this failure mode.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
76/76 lines through run_all.sh at --min 100, exit 0. 45 assertions over
15 cases across all four functions.
XORG_CONF and XORG_CONF_D are plain globals ASSIGNED inside
configure_xorg, so the default had to move to the assignment itself --
exporting a value from the harness alone would have been overwritten on
entry. PROFILE_FILE and USER_HOME take the ordinary `${VAR:-default}`
form. The real /etc/X11/xorg.conf.d/20-nvidia.conf keeps its Jun 2025
mtime and ~/pyroveil does not exist after the suite runs.
configure_xorg's RenderAccel value is asserted to be "true" AND asserted
never to be "false": the lib's own comment records that "false" forces
software rendering and pins Xorg above 30% CPU, so that is a regression
worth a dedicated negative assertion.
install_pyroveil's prompt could not be asserted on its text -- bash
writes a `read -p` prompt straight to the terminal, so it never reaches
captured output. The branches are distinguished by the non-interactive
arm's "Auto-installing" line instead, which is observable.
bt_audio.sh re-measured at 127/127 with the new files present.
That is all eight libs from the original handoff: arch_sysctl (banked as
unmeasurable and quarantined), arch_cpu, arch_hardware, thorium_repairs,
hosts_guard_migrate, hosts_guard_rollback, ubuntu_perf_fixes and
nvidia_config. Allowlist 91 -> 84.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Stands up Endurain behind the existing Caddy edge and imports RunnerUp
activities into it. Endurain is a VIEWER: screen-locker's workout gate still
reads the phone over adb and is untouched here, because a WebDAV drop folder is
spoofable by anything that can write to ~/cloud and must not become a
screen-unlock authority.
Primary path is phone -> WebDAV (existing dufs) -> ~/cloud/RunnerUp/ ->
importer -> Endurain, with an adb pull as fallback when a run has not been
uploaded yet. A systemd user timer runs the importer every 15 min.
Findings that shaped the implementation, each verified against the running
system rather than assumed:
- Endurain moved to Codeberg; the GitHub repo is a read-only mirror stale at
v0.17.7 against v0.19.0. The image is pulled from Codeberg.
- postgres:18 moved PGDATA to /var/lib/postgresql/18/docker. Upstream's compose
example still mounts the pre-18 path, which fails as an unexplained
"container is unhealthy"; the real cause is only visible in docker logs.
- Endurain seeds a hardcoded admin/admin via an Alembic migration with no env
override, and endurain.kuhy.duckdns.org already resolved publicly. Publishing
is therefore a separate script that refuses to install the Caddy site while
those credentials still work.
- Endurain performs NO duplicate detection, so the importer owns dedupe on two
axes: a content hash, and an activity key that collapses the .gpx/.tcx pair
RunnerUp writes for a single run (different bytes, same run).
- Ambiguous uploads (5xx/timeout) are never re-queued, since the activity may
already have been committed; only definite 4xx rejections are staged for
retry. The importer exits non-zero so the timer surfaces the problem.
- RunnerUp has no background sync at all, so every upload is a manual tap.
- Its WebDAV synchronizer needs HTTPS with a real cert (Android blocks
cleartext at targetSdk 36; self-signed is broken upstream) and a URL with no
trailing slash, and cannot MKCOL against dufs - so the inbox must pre-exist.
The phone gets a dufs credential scoped to /RunnerUp, verified unable to read
Keepass or gdrive_backups.
Verified: 52 tests at 100% branch coverage; the timer imports 4 real runs and
re-runs create zero duplicates; https://endurain.kuhy.duckdns.org serves 200
with a valid cert and the other edge sites are unaffected; screen-locker's
suite still passes 1090 tests at 100% coverage.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GbYEnfGnf1988cdFdGebot
81/81 lines through run_all.sh at --min 100, exit 0, and
check_shell_coverage.sh passes with the allowlist line already deleted.
59 assertions over 14 cases across all four functions: the sysctl
drop-in with both the "already applied" skip and the documented-default
fallback for an unreadable sysctl; both NVIDIA branches, since the
helper-service path and the standalone fallback write different units
and different undo lines; earlyoom install / already-installed /
config-backup; and fix_failed_sssd for none, all five and exactly one
failed unit -- that last one matters because the detection loop breaks
at the first failure while the masking loop re-checks each unit, so a
naive implementation would mask all five.
The four write targets are now behind overrides defaulting to the real
paths. The add_undo lines deliberately KEEP their literal /etc paths and
are asserted to: the undo script runs on the real system, so seaming
those would have written an undo that removes nothing. Neither
/etc/sysctl.d/99-performance-tuning.conf nor /etc/default/earlyoom
exists after the suite runs.
bt_audio.sh re-measured at 127/127 with the new files present -- that
canary runs after every addition to this suite now, because a test file
silently broke it once already.
The handoff is rewritten for the one remaining lib.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
hosts_guard_migrate.sh 81/81 and hosts_guard_rollback.sh 65/65, both
100.00% through run_all.sh at --min 100, and check_shell_coverage.sh
passes with each allowlist line already deleted.
82 assertions over 36 cases in three files sharing one harness: all four
validate_requirements refusals, plugin installation, the mount-collapse
loop in every arm (clears, fails, hits its 20-iteration bound, dry-run),
per-instance migration for both the bind-mounted and the plugin flavour,
and do_migrate's refusal to retire the legacy pacman hooks when nothing
registered -- the arm that exists so a failed migration cannot leave the
files with no unlock hook at all.
INSTRUMENT FIX: rollback measured 97.01% with lines 69 and 108
uncovered, both `done <redirect>` closing a loop. Reproduced minimally:
in a three-iteration loop ending `done >"$1"`, the body reports hits=3
and the `done` line hits=0, because bash attributes the redirected
compound statement to the loop's OPENING line. That is the same defect
_CLOSING_BRACE_OP already handles for `} |`, so _LOOP_END_OP is its
twin. The redirect is required by the pattern: a bare `done` stays in
the denominator, so genuinely uncovered loops are still caught.
Audited as the instrument notes demand -- every newly excluded line
printed with its text -- and it is exactly those two lines across all of
fixes/lib. Acceptance pair unchanged and exact: dot_resolver_install.sh
39/39, rpi_nc_ca.sh 73/73.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
75/75 lines through run_all.sh at --min 100, exit 0, and
check_shell_coverage.sh passes with the allowlist line already deleted
so the pass cannot come from the exemption.
55 assertions over 23 cases: all five profile repairs plus test_thorium,
including every dry-run arm, the partial singleton-lock case, a corrupt
database and the sqlite3-absent path. The lib needed NO production
change -- it already takes every path from $THORIUM_CONFIG_DIR, so
pointing that one variable at the tmpdir confines it completely.
The gate's per-case timeout moves from the jail's 120s default to 600s.
That default is a hang-catcher, not a performance budget, and this suite
has outgrown it: 76s bare at 25 test files, 93s at 27, and kcov roughly
doubles it. The symptom was a lib FAILING the gate while measuring
perfectly -- bt_audio.sh printed "127/127 lines = 100.00%" and then
"warn: case timed out after 120s", which --fail-on-case-error turned
into a non-zero exit. bt_audio.sh and arch_cpu.sh both pass now.
The cost, recorded in the evidence: a genuine hang takes 10 minutes per
pass to surface instead of 2. test_thorium's `read -r -p` is exactly
that shape, so every case here feeds it stdin explicitly.
This also settles the quarantine in b2779059. Re-adding the arch_sysctl
cases still yields "kcov instrumented no lines" for bt_audio at a 600s
timeout with no timeout warning, so runtime was never that file's
problem and the quarantine stands for the reason its header gives.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
check_shell_coverage.sh was RED on main. bt_audio.sh is off the
allowlist at 127/127, and commit 7c14cfca -- which added
test_arch_sysctl.sh -- made kcov stop registering it entirely, so the
gate failed on a lib nothing had touched.
Bisected by measuring bt_audio.sh at three commits: a2b23521 127/127,
afe6ac3a 127/127, 7c14cfca "kcov instrumented no lines". Removing that
one test file restores 127/127 with every other new file still in the
suite (arch_cpu, arch_hardware x2, thorium x2), and arch_cpu.sh
re-measures at 57/57 alongside it.
Both plausible causes inside lib_test_core.sh were ruled out by
reverting each on its own in a throwaway worktree: `export out` and the
_t_hide farm cache each left bt_audio broken while the file was
present. Neutering the file's body while keeping the source line does
NOT reproduce it either, so the trigger is cumulative rather than one
construct, and it is not understood.
The file keeps all 23 assertions and still passes when run directly; it
just leaves the test_*.sh glob run_all.sh iterates. That costs nothing
measurable, because arch_sysctl.sh has never measured through the jail
in the first place -- it reports "instrumented no lines" on its own,
like nc_php.sh -- and it stays on the allowlist.
The header records the bisect and what to re-verify before anyone
un-quarantines it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
clean_shadow_files() assumed UEFI with an ESP mounted at /boot. On a
BIOS/GRUB system with no ESP, /boot is a plain directory on the root
filesystem holding the only kernel the machine has -- and neither existing
guard catches it: findmnt /boot is empty (GUARD 1 passes) and there is no
EFI/ or loader/ (GUARD 2 passes). boot-repair therefore read the real
vmlinuz-linux and initramfs-linux.img as "orphaned kernel file(s)
shadowing the ESP" and deleted them, leaving the machine unbootable.
Measured 2026-08-22 in a vmbox BIOS/GRUB sandbox, not theorised: after
sudo boot-repair the guest never booted again.
GUARD 3: if /sys/firmware/efi does not exist the system booted via BIOS,
so there is no ESP and nothing in /boot can be a shadow. warn + return 1,
matching the existing guards' tone and exit convention. Overridable with
the existing --esp DEVICE -- naming the ESP by hand asserts the firmware
assumption the guard otherwise checks -- rather than adding a new flag.
The check goes through rpath(), so a --root fixture declares its own
firmware type and the case is testable without a VM. On the live UEFI
machine it resolves to the real /sys path, so behaviour there is unchanged.
Audit of the other BIOS-unsafe paths (none destructive, left alone):
* mount_esp(): resolve_esp_device fails with no /boot fstab entry, so it
reports and does not mount. Non-destructive.
* sync_kernel_image()/rebuild_initramfs(): gated behind boot_is_mounted,
which is false on BIOS, so they never write.
* check_fstab_options(): reports "no /boot entry" -- noise on BIOS, but
it writes nothing.
* run_preflight(): aborts every kernel upgrade on a BIOS box. Fail-closed
and non-destructive, so out of scope here.
Tests: three cases in tests/lib/boot_repair_bios_cases.sh (new file; the
existing case lib is at the 250-line cap) -- the guard refuses and explains,
--esp overrides it, and a UEFI fixture still cleans shadows as before.
Verified failing without the guard (38/4) and passing with it (42/0).
Sandbox: BIOS guest keeps both kernel files, says why, and still boots
afterwards (uname -r 7.1.9-arch1-2 after a clean poweroff). shellcheck clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdyMBGCrGVGDWtJ9xe48f3
com.metrolist.music was on the day allowlist but missing from the night
list, so it was hidden between 23:00 and 05:00. Add it to
night_allowed_packages in focus_owner's policy asset (the list the
installed Device Owner app actually enforces) and mirror it into
phone_focus_mode's NIGHT_WHITELIST so the two sources do not drift.
policy.json ships as a bundled Flutter asset, so the edit is inert until
the APK is rebuilt: deployed via phone_deploy.sh (build 4,
data-preserving install -r, Device Owner intact).
Verified on the phone at 23:1x device time with the curfew live:
hidden=true before, hidden=false after, and Metrolist launches and holds
the foreground across several enforcer ticks.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U7Wzqp2ub6gW5uVBH5qmhn
94/94 lines through run_all.sh at --min 100, exit 0. 42 assertions over
26 cases across all five functions, including both boot-loader flavours
and the no-boot-loader path.
PRODUCTION BUG, found by writing the tests and confirmed against this
host: tweak_journal's regex required a space before the unit, but
journalctl prints "305.5M in the file system" with no separator. The
size check never matched, so the vacuum was unreachable and a
multi-gigabyte journal would never have been trimmed. This is the third
instance of the same defect -- arch_perf_report.sh:36,65 carried it too
-- so the fix is identical: the separator is now optional. One case
asserts the spaced form still matches, making this a widening.
The mitigation tweak edits the boot loader, so /boot/loader/entries,
/etc/default/grub and grub.cfg are now behind overrides defaulting to
the real paths. This machine's boot configuration is never touched.
_t_hide gets a cache: it symlinks every executable on PATH (13.5k here)
and was rebuilding that farm on every call, which took the suite to 92s
and pushed a jail case past its 120s timeout. Now 77s, and arch_cpu.sh
re-measures at 57/57 so the shared change cost nothing.
The cases are split across two files because a single one was 307 lines
and file-length-cap rejected the first commit attempt.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
57/57 lines, measured through run_all.sh and confirmed a second time at
--min 100 so a shortfall would exit non-zero. check_shell_coverage.sh
passes with the exemption removed.
28 assertions over 14 cases: no cpufreq at all, every core already
tuned, the mixed case where only some cores lag, cpupower absent /
unconfigured / already configured, and all three I/O scheduler targets
(none for NVMe, mq-deadline for SATA SSD, bfq for spinning disks).
The sysfs reads and the two /etc write targets are now behind overrides
defaulting to the real paths, so the tests can present hardware this
host does not have -- a rotational disk -- without touching anything.
One assertion initially passed for the wrong reason: _t_hide keeps
$FAKE_BIN on PATH by design, so the harness's own cpupower stub still
satisfied has_cmd and the "not installed" branch never ran. Unstubbing
before hiding is now explicit, and the case fails if that is lost.
This also settles arch_sysctl.sh's diagnosis: it uses this same
harness, so the harness is not why it cannot be measured.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
23 assertions over 8 cases covering both tweak_vm_sysctl and
tweak_network_sysctl: the skip path, the write-when-the-drop-in-is-
missing path that a naive "nothing to do" check gets wrong, the
value-differs path, an unreadable-sysctl path, and the tcp_bbr guard.
arch_desktop_harness.sh is the third family harness, supplying the
globals and apply_tweak that live in optimize_arch_desktop.sh rather
than in any lib. arch_cpu.sh and arch_hardware.sh will reuse it.
SYSCTL_DROPIN_DIR defaults to the real /etc/sysctl.d, matching the
seam ubuntu_perf_more.sh and arch_perf_fixes.sh already carry; the
suite runs un-jailed in ci_mirror.sh and CI, so a bind mount would
protect nothing. Both real drop-ins keep their Mar 2 mtimes.
_t_run lands in lib_test_core.sh because `out="$(func)"` forks a
subshell and kcov never registers a lib whose first execution happens
inside one -- measured as 0 lines via $( ) against 54 lines via a
direct call.
arch_sysctl.sh STAYS on the coverage allowlist: it still reports "kcov
instrumented no lines" through the jail, while ubuntu_perf_more.sh
measures 32/32 in the same worktree and the same invocation. The tests
are real and green; the coverage number is not yet obtainable, and the
exemption may only come off once it is.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
shfmt runs on every staged shell file and rewrites drifted libs, which
moves coverage denominators and invalidates measurements taken minutes
earlier. Landing the reformat first makes every number measured from
here the number that survives pre-commit.
thorium_repairs.sh converts from 2-space indent to tabs; the other two
only lose runs of blank lines. `git diff -w` shows no token changed,
shellcheck is clean, and the 20-file suite stays green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Updates state after arch_perf_fixes.sh and ubuntu_perf_more.sh landed:
allowlist 98 -> 91, seven libs cleared, 14 commits, and a fixes/lib/tests
suite of 22 files and ~330 assertions.
Adds the second instrument finding of the session to the list a future
session must know about: multi-line ARRAY LITERAL elements and their closing
paren are not statements, because bash reports the whole assignment at its
opening line. That took arch_perf_fixes.sh 93.48% -> 100%, and it is
load-bearing for the work that remains -- thorium_repairs.sh has four such
arrays and ubuntu_perf_fixes.sh one.
Also flags that the seven libs measured by an EARLIER session (dwm_config,
aw_autostart, rpi_nc_install, transcribe_*, clean_audio_filters,
pacman_hook_stall_setup) all predate both instrument fixes, so their recorded
percentages are stale and several may already be at 100%. Re-measure before
writing a single test for them.
Drops the "Not caused by this campaign" note about the red Python tests CI to
stay under the 250-line cap; it is unchanged and already in project memory.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Fourth flavour of defect (a) found this session, after multi-line quotes,
`} |` and the backslash-continued assignment. bash reports a multi-line array
assignment at its OPENING line and never emits the element lines or the
closing paren, so kcov instrumenting them inflates the denominator:
+L3 items=('one' 'two') # opened line 3, closed line 6
# lines 4, 5, 6: never emitted
The rule is therefore symmetric with the existing multi-line-quote case: the
opening line is the statement, everything up to the closing paren is data.
_closes_array() finds that paren by recomputing quote state per candidate, so
an element like "a(b)" does not end the literal early.
Measured effect through fixes/lib/tests/run_all.sh:
arch_perf_fixes.sh 93.48% -> 100.00% (43/43)
bt_audio.sh 100.00% -> 100.00% (127/127)
arch_perf_report.sh 100.00% -> 100.00% (59/59)
arch_perf_probes.sh 100.00% -> 100.00% (93/93)
ubuntu_perf_more.sh 100.00% -> 100.00% (32/32)
bt_report.sh 100.00% -> 100.00% (37/37)
bt_pairing.sh 100.00% -> 100.00% (65/65)
One gained, six held, none went DOWN. Acceptance test unchanged:
dot_resolver_install.sh 39/39 and rpi_nc_ca.sh 73/73. arch_perf_fixes.sh
therefore comes off the allowlist in the same commit, confirmed by the real
gate with no exemption.
The fail-open check, since over-detection INFLATES coverage: the old and new
predicates were diffed over every allowlisted lib plus the six cleared ones,
printing each newly excluded line WITH its text. All 91 across 10 libs are
array elements or closing parens -- common.sh's tool tables, packages.sh's
associative arrays, arch_sysctl.sh's sysctl maps, thorium_repairs.sh's four
path lists, ubuntu_perf_fixes.sh's sssd units, and so on. No statement caught.
Tests cover both directions, including three negatives: a single-line
`x=(a b)`, an element containing a parenthesis, and `x=$(echo hi)` which is a
command substitution rather than an array. Module stays at 100% branch
coverage.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Eighth of the 16 untested fixes/lib libs. 22 assertions; 43/46 = 93.48%. The
lib STAYS on the allowlist -- see the artifact below.
Third instance of the same dead branch. Line 16 matched on
`([0-9]+\.?[0-9]*)\ G`, a required space before the unit, while journalctl
prints "4.2G" with no separator, so the vacuum could never run. Fixed to an
optional space, as in arch_perf_report.sh.
This one differs from that earlier fix and the difference was confirmed with
the user before landing: arch_perf_report.sh's vacuum sits behind
--apply-safe-fixes, but THIS one runs whenever fix_arch_performance.sh runs.
So the fix makes an unflagged destructive action live -- the script will now
really vacuum the journal to 300M once it passes a gigabyte. That is the
function's evident intent, since its next act is to write a permanent 300M
cap, and the user approved it explicitly.
Three absolute paths moved behind overrides defaulting to the real ones:
JOURNALD_CONF_DIR, SYSTEMD_UNIT_DIR (fix_media_organizer writes
/etc/systemd/system/media-organizer.service) and ORGANIZE_SCRIPT_CANDIDATES.
Verified afterwards that the real unit file still carries its 2026-07-25
mtime and the journald drop-in its 2026-03-02 one, i.e. a bare un-jailed
run_all.sh touched neither.
The three uncovered lines (68-70) are the element lines of a multi-line array
literal. `PS4` + `set -x` on a minimal case shows bash reporting the whole
assignment at its OPENING line and never emitting the elements or the closing
paren, so they are data, not statements -- a fourth flavour of defect (a),
after multi-line quotes, `} |` and the backslash-continued assignment. The
array is provably used: the loop on the next line iterates it and the
media-organizer assertions pass.
Worth fixing, unlike the bt_adapter one-liner: the form appears in three of
the remaining untested libs (thorium_repairs.sh has four) and in nine
allowlisted libs repo-wide. That lands as its own commit next.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Seventh of the 16 untested fixes/lib libs and the first of the ubuntu-perf
pair, which gets its own harness here. 24 assertions; 32/32 = 100.00%
through run_all.sh on the first measurement, confirmed at --min 100 (exit 0),
then cleared with the real gate and no exemption.
Two absolute paths had to move behind env overrides, defaulting to the real
ones: fix_journal writes /etc/systemd/journald.conf.d/size-limit.conf and
run_undo globs /root for undo scripts. Binding those in the jail was rejected
for the same reason as bt_pairing.sh's udev rule -- run_all.sh runs UN-jailed
in ci_mirror.sh and in CI, so a bind mount protects the coverage run and
nothing else. JOURNALD_CONF_DIR and UNDO_DIR follow the UDEV_RULES_DIR
precedent.
Proof the suite is safe where it runs un-jailed: after a bare run_all.sh the
real /etc/systemd/journald.conf.d/size-limit.conf still carries its 2026-03-02
mtime, a genuine artifact of a past production run, and no
undo_ubuntu_performance_*.sh exists in /root.
Worth noting for the rest of the family: run_undo ends in `exit`, so its cases
run inside an explicit subshell. A command substitution already provides one,
so the exit ends only that subshell rather than the whole test file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The pre-push prettier hook rejected the hand-formatted markdown, which the
handoff itself warns about. Content unchanged; still exactly 250 lines.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Rewrites the handoff for the state after five libs were cleared (98 -> 93).
Corrections to the previous handoff, both of which cost time to discover:
- the "arch perf six" do NOT share one entry script. They span four:
optimize_arch_desktop.sh, diagnose_arch_performance.sh,
fix_arch_performance.sh and nvidia_troubleshoot.sh. The table now names
the owner of each remaining lib.
- `_t_unstub` was described as already existing in the pacman harness. It did
not exist anywhere. It does now, in lib_test_core.sh, along with _t_hide,
_t_stub_stdin, _t_stub_cat and _t_stub_writes.
Also corrects an arithmetic slip in this session's own commit messages: they
read "95 -> 93" and so on, one low, because they counted total file lines
rather than entries (the allowlist holds 13 comment lines). The diff against
503ba1fc is the authority: five removals, 98 -> 93. Noted in the handoff so
the next session does not inherit the drift.
New material worth carrying forward:
- work the jail in a detached worktree, copying one-way INTO it. Copying out
is how this session silently reverted its own uncommitted harness edit,
twice, and briefly misattributed it to another agent.
- shfmt reformats staged shell files and WILL change a lib's denominator. It
rewrote bt_audio.sh's one-line blocks and invalidated a 100% measurement
taken minutes earlier. Re-measure after pre-commit touches anything.
- the backslash-continuation predicate is narrower than "has a backslash":
only a continued ASSIGNMENT caps a lib, because bash attributes those to
the last line of the run and a continued COMMAND to its first.
- two production bugs were found by writing tests, both dead branches. Check
whether an untestable-looking branch is reachable at all before working
around it.
- a background commit reported "completed (exit code 0)" while the commit
itself had aborted on the file-length cap. Check the result, not the
notification.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sixth of the 16 untested fixes/lib libs, and the first with no dead branch to
fix -- the whole job was test-writing. 43 assertions across two files;
93/93 = 100.00% through run_all.sh, twice, the second at --min 100 (exit 0),
then cleared with the real gate confirming and no exemption.
The one genuine gap was check_memory_pressure's high-swap branch (lines
158-159), which fires only when swap is heavily used WHILE RAM is still
available -- a state this host does not happen to be in. The lib reads the
absolute /proc/meminfo, but every read goes through `awk`, so stubbing awk
supplies controlled figures without touching /proc: the stub answers on the
pattern being matched and execs the real awk for anything else. Both
directions are covered, including RAM genuinely exhausted, which must NOT be
flagged because it is not the stutter signature.
Everything else here is branch coverage of probes whose inputs are external
commands: failed systemd units, ACPI error counts, a CPU-hungry Xorg,
governors all-performance vs one-powersave vs unsupported, thermal
throttling excerpts, the TLP/power-profiles-daemon conflict in all three
combinations, and storage health with and without fstrim/smartctl.
lib_test_core.sh gains _t_stub_cat. "Print this fixture file" is by far the
commonest stub shape, and writing it inline forces every call site to embed
a literal ${LIB_TEST_DEV} that must not expand at write time -- SC2016 on
every use. Passing the fixture NAME as data removes the class outright, and
two earlier bluetooth test files are simplified onto it. All 21 test files
and three harnesses now lint clean with no suppression anywhere.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Both were already tested to their reachable ceiling earlier in this session
(a5b6663c, ffcf99f1) and held below 100% only by the closing-brace artifact
that d989cd7e removed. With the instrument corrected they measure:
bt_audio.sh 127/127 = 100.00%
arch_perf_report.sh 59/59 = 100.00%
both at --min 100 with exit 0, and check_shell_coverage.sh returns
"every checked shell library meets the coverage bar" with their allowlist
lines already gone, i.e. with no exemption. bt_report.sh and bt_pairing.sh
were gated in the same run to confirm the two libs cleared earlier did not
regress.
Note that the closing-brace exclusion is now load-bearing: reverting
d989cd7e without also restoring these two lines would turn every subsequent
commit red.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
continuation_lines() excluded the continuation lines of multi-line QUOTED
arguments but nothing else, so a line holding only a group's closing brace
and an operator -- `} |`, `} >>"$REPORT_FILE"` -- stayed in the denominator
while bash attributed no statement to it. That capped four fixes/lib libs
below 100% with no test able to move them.
Why the anchor makes this safe: bash attributes every command INSIDE a group
to its own line, and a pipe's right-hand side to its own line, leaving the
brace-plus-operator line with nothing. Anchoring the pattern on a LEADING
`}` therefore excludes only lines that can hold no statement. A one-liner
`{ echo a; } >file` begins with `{` and is untouched; a bare `}` closing a
function has no operator and is untouched.
Measured effect, all through fixes/lib/tests/run_all.sh:
bt_audio.sh 96.97% -> 100.00% (127/127)
arch_perf_report.sh 98.33% -> 100.00% (59/59)
bt_report.sh 100.00% -> 100.00% (37/37)
bt_pairing.sh 100.00% -> 100.00% (65/65)
bt_adapter.sh 98.55% -> 98.55% (68/69, capped by a different flavour)
Two gained, three held, none went DOWN -- the handoff's regression signal.
That is not luck: _measure computes covered_set = (executed|traced) &
denominator, so for a lib already at 100% the covered set IS the denominator
and removing a subset cannot lower it. The five gated pacman_hook_stall libs
are safe by the same arithmetic.
Acceptance test from the handoff passes unchanged: dot_resolver_install.sh
39/39 and rpi_nc_ca.sh 73/73, both 100.00%.
The fail-open check that actually matters, since over-detection INFLATES
coverage and could promote an untested lib: the new predicate was run over
every lib in the allowlist plus the cleared ones, printing each newly
excluded line WITH its text. All 17 across 10 libs are genuine
brace-plus-operator lines; no ordinary statement was caught.
Tests cover both directions, including the two negative cases (a bare `}`
and a single-line `{ ...; } >file`), keeping the module at 100% branch
coverage. The quote scanner moved into _quote_after() to stay under the
C901 complexity limit rather than suppressing it.
Deliberately NOT fixed here: the backslash-continued ASSIGNMENT flavour that
caps bt_adapter.sh line 97. bash attributes those to the LAST line of the run
but a backslash-continued plain COMMAND to its FIRST, so that predicate needs
a command-vs-assignment distinction. One line in one lib; not worth the
landmine today.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Fifth of the 16 untested fixes/lib libs and the first of the arch-performance
group, which gets its own harness here. 38 assertions across two files. The
lib STAYS on the allowlist at 59/60 = 98.33%, measured twice.
The second dead branch this campaign has found, fixed here. Lines 36 and 65
matched on:
([0-9]+\.?[0-9]*)\ (G|M)
a REQUIRED space before the unit. journalctl actually prints "Archived and
active journals take up 305.5M in the file system." with no separator --
verified against the real binary on this machine. So check_journal_size could
never report a large journal and apply_safe_fixes could never vacuum one:
both were unreachable. The space is now optional, and tests cover the spaced
and unspaced forms so neither can rot.
NOTE: this makes a previously-dead DESTRUCTIVE action live. With
--apply-safe-fixes and a journal over a gigabyte, the entry script will now
really run `journalctl --vacuum-size=300M`. That is the flag's documented
purpose and it stays behind the flag, but it has never actually executed
before today.
Line 20, the one uncovered line, is `} >>"$REPORT_FILE"` -- the closing brace
of a redirected group. A minimal probe writes both inner lines to the file
while bash attributes no statement to the brace, and the report assertions
independently prove the group runs, since they read the text it writes. Same
defect (a) class as bt_audio's `} |`.
That form now caps four libs: bt_audio.sh, arch_perf_report.sh, and
arch_perf_probes.sh and nvidia_config.sh which are still untested. So the
continuation_lines() fix is worth landing after all -- as its own commit,
next, so a denominator change can be reverted without taking these tests
with it.
_t_hide and _t_full_path move from bt_harness.sh into lib_test_core.sh: they
are generic PATH plumbing and the arch harness needs them for the
"nvidia-smi is not installed" branch. All twelve existing suites re-run green
after the move.
One trap worth recording: apply_safe_fixes appends to the ACTIONS array, so
it must be called directly rather than inside "$(...)" -- a command
substitution runs it in a subshell where the appends die with it, and the
assertions read an empty array.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Fourth of the 16 untested fixes/lib libs, the largest at 214 lines, and the
last of the bluetooth family. 47 assertions across three files. The lib
STAYS on the allowlist: 128/132 = 96.97%, twice with the same line set.
The bug the tests found, fixed here. Line 21 read:
if timeout 3 _run_as_user wpctl status &>/dev/null; then
`timeout` is a binary and `_run_as_user` is a shell function that is never
exported, so this always failed with rc=127 -- "timeout: failed to run
command '_run_as_user'". check_pipewire_health therefore reported PipeWire
hung on EVERY run and restarted a healthy audio stack every time
fix_bluetooth.sh ran. The healthy branch was unreachable, which is why the
test for it could not be written without first noticing. Now
`_run_as_user timeout 3 wpctl status`: same bound, inside the sudo'd command.
Why 96.97% and not 100%. An earlier run of this suite read 99/99 = 100.00%,
and that number was wrong -- it measured the file before pre-commit's
`shfmt -w` reformatted it. shfmt rewrites the `{ ...; } \` + `| bluetoothctl`
one-liners into multi-line blocks ending in `} |`, which raises the
denominator 99 -> 132. Confirmed unavoidable by running shfmt against HEAD's
own copy: it rewrites there too, so reverting the reformat is not stable.
The four uncovered lines (90, 113, 137, 157) are each that `} |` -- the pipe
operator joining a block to bluetoothctl, not a statement. They do execute:
a `{ echo a; echo b; } | consumer` block writes every marker to a file even
though bash's xtrace never reports the left-hand side, because a pipe's LHS
runs in a subshell whose xtrace is not captured. kcov instruments them and
cannot attribute them; defect (a) in docs/kcov-under-report.md, third flavour.
Scope, measured: the continuation-pipe form appears ONLY in bt_adapter.sh
(pre-format) and bt_audio.sh (post-shfmt). None of the remaining twelve
untested libs carries either, so this does not block the campaign and the
detector fix stays off the critical path.
Also worth 90.91% -> 96.97% on its own: the bluetoothctl stubs now drain
stdin before exiting. Real bluetoothctl consumes its whole input; a stub
that read one line and exited closed the pipe early, so the writing block
took SIGPIPE partway through and its later lines never ran.
NOTE for whoever edits this file next: bt_audio.sh is now exactly 250 lines,
at the cap. The next change to it needs a split, not a comment trim.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Third of the 16 untested fixes/lib libs, and the first that does NOT come
off the allowlist. 68/69 = 98.55%, up from 45/69. The remaining line is
not a missing test:
PS4='+TRACE:${BASH_SOURCE##*/}:${LINENO} ' bash -x
shows bash attributing the whole multi-line dbus-send assignment in
_services_resolved to line 100, and never emitting line 97 at all. Line 97
is the OPENING line of a backslash-continued statement; kcov instruments
it, bash never attributes a statement to it. That is defect (a) in
docs/kcov-under-report.md -- a wrong denominator -- and no test can move it.
continuation_lines() in shell_coverage_lines.py already excludes such lines,
but only detects them by tracking QUOTE state, so a line ending in an
unquoted backslash slips through. Fixing that is deliberately left out of
this commit: it changes the denominator for every measured lib, and if it
regresses one of the libs now gated with no exemption, reverting a mixed
commit would throw away these tests too.
Scope of the problem, measured rather than guessed -- backslash
continuations are confined to the bluetooth family: bt_audio.sh 10,
bt_adapter.sh 7, bt_pairing.sh 3, pacman_hook_stall_summary.sh 2, and ZERO
in the other 12 remaining libs. So this caps bt_audio.sh next and then stops
mattering.
Also replaces the harness's _t_only_path with _t_hide. _t_only_path dropped
PATH to $FAKE_BIN alone, which hid grep, head and sort as well as the tool
under test -- so the "usbreset is not installed" case died in a cascade of
"command not found" and passed for the wrong reason instead of exercising
the fallback. _t_hide rebuilds PATH from symlinks to every real executable
except the named ones; verified directly that command -v usbreset is then
empty while grep and head still resolve.
bt_report.sh (37/37) and bt_pairing.sh (65/65) re-measured at --min 100,
both exit 0, so neither cleared lib regressed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Second of the 16 untested fixes/lib libs. 65/65 = 100.00% through
run_all.sh, twice, the second at --min 100 (exit 0), then cleared from the
allowlist and confirmed by the real gate with no exemption.
Two findings worth keeping:
- udevadm was NOT in the harness's stub list, so `udevadm control
--reload-rules` was reaching the REAL binary during the suite. A
prepended stub dir cannot hide a tool the host actually has. Caught by
asserting on the recorded call rather than by reading the code, which is
the argument for asserting on calls at all.
- _disable_usb_autosuspend writes /etc/udev/rules.d/50-bluetooth-no-
autosuspend.rules. Binding /etc in the jail would have covered it, and
was rejected: run_all.sh runs UN-jailed in ci_mirror.sh and in the
shell-tests workflow, as its own header says, so a bind mount protects
the coverage run and leaves every bare run writing to a real root-owned
file. Instead the lib gained a UDEV_RULES_DIR override, defaulting to the
real path -- the same env-override seam pacman_hook_stall_harness.sh uses
for PACMAN_LOG/CACHE_DIR/PACMAN_LOCK.
Proof the suite is safe where it runs un-jailed: after a bare run_all.sh,
the real rule file still has its 2026-02-21 mtime (it is a genuine artifact
of a production run six months ago) and the probed power/control values are
unchanged. The jail cannot give that check.
fix_usb_autosuspend globs the real /sys/bus/usb/devices/*/ with no override,
so its branches are driven through stubbed lsusb output: ffff:ffff matches
nothing on any machine and reaches the not-found arm, while 046d:c077
(control=on) and 046d:0825 (control=auto) are read-only probes, each guarded
so the case self-skips with a note if the host state changes rather than
silently asserting nothing.
Split across two test files to stay under the 250-line cap; run_all.sh globs
test_*.sh, so splitting costs nothing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
First of the 16 untested fixes/lib libs. Measured 37/37 = 100.00% through
lib/tests/run_all.sh, twice, the second run at --min 100 (exit 0), then
removed from the allowlist and confirmed with the real gate and no
exemption.
Adds two reusable pieces rather than a per-family harness clone:
- lib_test_core.sh -- PASS/FAIL tally, _t_eq/_t_contains/_t_lacks, a
mktemp -d sandbox wiped on EXIT, a FAKE_BIN stub dir on PATH, and
_t_stub/_t_unstub. _t_unstub runs `hash -r`: deleting a stub file alone
does not drop bash's cached executable path, so the real binary would
never be reached again.
- bt_harness.sh -- sources the core, sources the real scripts/lib/common.sh
for the production log_*/has_cmd helpers (verified inert at source time),
and redefines _btctl and apply_fix verbatim from fix_bluetooth.sh, since
those live in the entry script rather than in any lib. Same trade-off
pacman_hook_stall_harness.sh already makes with log_size.
pacman_hook_stall_harness.sh is deliberately left alone: its six libs are
already off the allowlist, i.e. gated at 100% with no exemption, so
refactoring it onto the new core would risk banked work for no gain. jscpd
reads 1.6% against the hook's own flags, and **/lib/tests/** is excluded
from that scan anyway, so the duplication budget is not at stake.
_t_only_path exists because every tool these libs call (usbreset, pactl,
lsusb, ...) genuinely exists on an Arch desktop: a prepended stub dir
cannot exercise a "not installed" branch, so those cases drop PATH to
FAKE_BIN alone.
The three coverage runs were made in a detached worktree: a second session
was writing to this repo concurrently, and the jail aborts on any
working-tree delta during a run.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Focus Owner hides every package absent from the allowlist, so a newly
installed lyricanki was installed=true but hidden=true: absent from the
launcher and from `pm list packages`, and `am start` reported the activity
did not exist even though dumpsys listed its MAIN/LAUNCHER filter. Nothing
about the app itself was wrong.
policy.json is regenerated from config.sh by python_pkg.focus_policy, never
hand-edited.
Also drops com.android.launcher3 and com.android.camera2 from
SYSTEM_NEVER_DISABLE. That list is prefix-matched and both are strict
supersets of entries already in it, so coverage is byte-identical; this
keeps config.sh under the 250-line cap without weakening the policy.
com.android.settings stays: its only shorter match is com.android.se, an
accidental substring rather than intent.
Verified on the phone: signer matched so the Device Owner upgraded in
place, dpm still reports DeviceOwner, lyricanki flipped to hidden=false,
and workout_app + the dialer are untouched.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RAEChhK3sWGxd6ucsUQmcT
Retargets the handoff from 're-measure the allowlist' (done) to the work that
is actually left: writing test suites for the 16 libs in fixes/lib that have
none, to 100% line coverage.
Includes the size-ordered table, the family groupings (bluetooth four, arch
perf six, hosts guard two) so shared stubs get reused, the two entry scripts
that source them, and what they actually call -- systemctl, bluetoothctl,
pacman, sysctl, nvidia-*, apt-get.
Says explicitly NOT to build a new harness: fixes/lib/tests already has a
205-line lib harness, a 142-line entry harness and eight test files to copy
from, and jscpd fails the commit above 2% duplication.
Records the three-step bar the five cleared libs met -- measure 100.00%,
re-measure at --min 100, then run the real gate with no exemption -- so the
next session does not have to re-derive why one reading is not enough.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Allowlist 103 -> 98. Each of the five was measured twice, the second run
gating at --min 100, then confirmed through the real check_shell_coverage.sh
with no exemption -- all exit 0.
States the reusable bar explicitly (two matching runs, the second at
--min 100, then the real gate) so the next session does not have to re-derive
why one reading is not enough.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Each measured 100.00% through fixes/lib/tests/run_all.sh, twice, with the
second run gating at --min 100 so a shortfall would exit non-zero rather than
print a number I might misread:
pacman_hook_stall_capture.sh 59/59
pacman_hook_stall_load.sh 25/25
pacman_hook_stall_summary.sh 18/18
pacman_hook_stall_watch.sh 24/24
pacman_hook_stall_usage.sh 1/1
Two matching runs was the bar because this directory's suites drive
watch_forever timing loops, and a timing-dependent suite can vary its line
set between runs -- dwm_config.sh was observed doing exactly that. These five
did not vary.
pacman_hook_stall_setup.sh stays: 26/27 = 96.30%, uncovered line 7.
usage.sh's denominator of 1 is honest rather than broken. The lib is a single
usage() whose body is one `cat <<EOF` heredoc plus `exit 0`, and heredoc
content is data, not statements. Its tests assert on the rendered text, so
the behaviour is exercised even though only one line is instrumentable.
summary.sh has one off-set line (36). That cannot inflate the figure -- an
off-set line is by construction one the trace SAW EXECUTE -- but it does mean
the lib is measured over a subset of its statements.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds the measured table so the next session starts from fourteen known
numbers instead of re-deriving them. Seven libs are at 100.00% and are
allowlist-removal candidates; they are deliberately NOT removed yet, because
fixes/lib's suites drive watch_forever timing loops and a timing-dependent
suite can vary its line set run to run (dwm_config.sh was seen to). Reproduce
each at --min 100 twice before editing the allowlist.
Also settles a question the run_all.sh commit raised: allowlist entries are
static per-file lines, so adding fixes/lib/tests/run_all.sh did NOT start
failing the 16 untested libs there. check_shell_coverage.sh on one of them
still exits 0. The allowlist header's "every file in that directory is
enforced" describes intent, not current mechanics.
Two traps recorded, both hit this session:
- Editing ANY file while a measurement runs aborts it with "a write escaped
the jail". The jail fingerprints git status before each case, so an
unrelated doc edit trips it. False alarm; cost two runs, the second time
after I had already diagnosed the first.
- A sweep's output file buffers, so pgrep is the liveness signal, not file
growth. A measurement silent for minutes is usually still running.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
