The original handoff's scope is obsolete: job 1 is done, and job 2 was
deliberately dropped rather than completed. Prepends the outcome and the
numbers rather than rewriting the file, because its kcov/jail notes are
still the reference for measuring a lib on purpose.
Also records the two traps that cost the most time this session: never
`git reset --hard` to undo a probe commit (it discards unstaged work --
recoverable from ~/.cache/pre-commit/patch*), and read a gate's predicate
rather than its header comment, which in this repo was a full day stale
and produced a confidently wrong scope estimate.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
Two jobs for the next session. Job 1 is the push gate: pre-push is ~130s,
almost all of it ci-mirror, while pre-commit is already 4.8s. The prompt
says plainly that a clean-venv install plus --all-files plus two suites
cannot fit in 10s, and asks for stage timings BEFORE proposing anything,
then lists four options with what each actually costs -- three that keep
the guarantee and one (drop ci-mirror from pre-push) that trades it.
Job 2 is the coverage ask. It leads with the finding that ~12 gated
shell libs outside fixes/lib fail the gate today, which is worse than an
exemption: the gate believes it is checking them. Then the 84 allowlist
entries, then Python. It also says to report the real scope first,
because "100% covered" is several days of work and the user should see
the shape before it is spent.
Carries forward what cost hours last session: verify an edit landed
before trusting it, run the suite from a clean checkout before pushing,
never run two jails at once, and audit any instrument predicate
repo-wide rather than in one directory.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
81/81 lines through run_all.sh at --min 100, exit 0, and
check_shell_coverage.sh passes with the allowlist line already deleted.
59 assertions over 14 cases across all four functions: the sysctl
drop-in with both the "already applied" skip and the documented-default
fallback for an unreadable sysctl; both NVIDIA branches, since the
helper-service path and the standalone fallback write different units
and different undo lines; earlyoom install / already-installed /
config-backup; and fix_failed_sssd for none, all five and exactly one
failed unit -- that last one matters because the detection loop breaks
at the first failure while the masking loop re-checks each unit, so a
naive implementation would mask all five.
The four write targets are now behind overrides defaulting to the real
paths. The add_undo lines deliberately KEEP their literal /etc paths and
are asserted to: the undo script runs on the real system, so seaming
those would have written an undo that removes nothing. Neither
/etc/sysctl.d/99-performance-tuning.conf nor /etc/default/earlyoom
exists after the suite runs.
bt_audio.sh re-measured at 127/127 with the new files present -- that
canary runs after every addition to this suite now, because a test file
silently broke it once already.
The handoff is rewritten for the one remaining lib.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Updates state after arch_perf_fixes.sh and ubuntu_perf_more.sh landed:
allowlist 98 -> 91, seven libs cleared, 14 commits, and a fixes/lib/tests
suite of 22 files and ~330 assertions.
Adds the second instrument finding of the session to the list a future
session must know about: multi-line ARRAY LITERAL elements and their closing
paren are not statements, because bash reports the whole assignment at its
opening line. That took arch_perf_fixes.sh 93.48% -> 100%, and it is
load-bearing for the work that remains -- thorium_repairs.sh has four such
arrays and ubuntu_perf_fixes.sh one.
Also flags that the seven libs measured by an EARLIER session (dwm_config,
aw_autostart, rpi_nc_install, transcribe_*, clean_audio_filters,
pacman_hook_stall_setup) all predate both instrument fixes, so their recorded
percentages are stale and several may already be at 100%. Re-measure before
writing a single test for them.
Drops the "Not caused by this campaign" note about the red Python tests CI to
stay under the 250-line cap; it is unchanged and already in project memory.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The pre-push prettier hook rejected the hand-formatted markdown, which the
handoff itself warns about. Content unchanged; still exactly 250 lines.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Rewrites the handoff for the state after five libs were cleared (98 -> 93).
Corrections to the previous handoff, both of which cost time to discover:
- the "arch perf six" do NOT share one entry script. They span four:
optimize_arch_desktop.sh, diagnose_arch_performance.sh,
fix_arch_performance.sh and nvidia_troubleshoot.sh. The table now names
the owner of each remaining lib.
- `_t_unstub` was described as already existing in the pacman harness. It did
not exist anywhere. It does now, in lib_test_core.sh, along with _t_hide,
_t_stub_stdin, _t_stub_cat and _t_stub_writes.
Also corrects an arithmetic slip in this session's own commit messages: they
read "95 -> 93" and so on, one low, because they counted total file lines
rather than entries (the allowlist holds 13 comment lines). The diff against
503ba1fc is the authority: five removals, 98 -> 93. Noted in the handoff so
the next session does not inherit the drift.
New material worth carrying forward:
- work the jail in a detached worktree, copying one-way INTO it. Copying out
is how this session silently reverted its own uncommitted harness edit,
twice, and briefly misattributed it to another agent.
- shfmt reformats staged shell files and WILL change a lib's denominator. It
rewrote bt_audio.sh's one-line blocks and invalidated a 100% measurement
taken minutes earlier. Re-measure after pre-commit touches anything.
- the backslash-continuation predicate is narrower than "has a backslash":
only a continued ASSIGNMENT caps a lib, because bash attributes those to
the last line of the run and a continued COMMAND to its first.
- two production bugs were found by writing tests, both dead branches. Check
whether an untestable-looking branch is reachable at all before working
around it.
- a background commit reported "completed (exit code 0)" while the commit
itself had aborted on the file-length cap. Check the result, not the
notification.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Retargets the handoff from 're-measure the allowlist' (done) to the work that
is actually left: writing test suites for the 16 libs in fixes/lib that have
none, to 100% line coverage.
Includes the size-ordered table, the family groupings (bluetooth four, arch
perf six, hosts guard two) so shared stubs get reused, the two entry scripts
that source them, and what they actually call -- systemctl, bluetoothctl,
pacman, sysctl, nvidia-*, apt-get.
Says explicitly NOT to build a new harness: fixes/lib/tests already has a
205-line lib harness, a 142-line entry harness and eight test files to copy
from, and jscpd fails the commit above 2% duplication.
Records the three-step bar the five cleared libs met -- measure 100.00%,
re-measure at --min 100, then run the real gate with no exemption -- so the
next session does not have to re-derive why one reading is not enough.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Allowlist 103 -> 98. Each of the five was measured twice, the second run
gating at --min 100, then confirmed through the real check_shell_coverage.sh
with no exemption -- all exit 0.
States the reusable bar explicitly (two matching runs, the second at
--min 100, then the real gate) so the next session does not have to re-derive
why one reading is not enough.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds the measured table so the next session starts from fourteen known
numbers instead of re-deriving them. Seven libs are at 100.00% and are
allowlist-removal candidates; they are deliberately NOT removed yet, because
fixes/lib's suites drive watch_forever timing loops and a timing-dependent
suite can vary its line set run to run (dwm_config.sh was seen to). Reproduce
each at --min 100 twice before editing the allowlist.
Also settles a question the run_all.sh commit raised: allowlist entries are
static per-file lines, so adding fixes/lib/tests/run_all.sh did NOT start
failing the 16 untested libs there. check_shell_coverage.sh on one of them
still exits 0. The allowlist header's "every file in that directory is
enforced" describes intent, not current mechanics.
Two traps recorded, both hit this session:
- Editing ANY file while a measurement runs aborts it with "a write escaped
the jail". The jail fingerprints git status before each case, so an
unrelated doc edit trips it. False alarm; cost two runs, the second time
after I had already diagnosed the first.
- A sweep's output file buffers, so pgrep is the liveness signal, not file
growth. A measurement silent for minutes is usually still running.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The handoff recorded fixes/lib as having "no harness at all". It already had
8 test files and 2 harnesses. What was missing is run_all.sh -- the subject
is_covered() actually builds, and the only thing the gate measures through.
All 8 test files pass through it.
No jail_args beside it, deliberately: the harness confines every write to its
own `mktemp -d` and intercepts external commands with a PATH stub dir, and
grep finds no absolute write to /etc, /var or /usr in any of the tests. So it
runs bare, like the transcribe suite.
First measurement through it: pacman_hook_stall_usage.sh is 1/1 = 100.00%.
That denominator is honest, not broken -- the lib is a single usage() whose
body is one `cat <<EOF` heredoc plus `exit 0`, and heredoc content is data
rather than statements.
16 of the 22 libs there still have no tests at all. That is now the largest
block of real test-writing work left in the campaign.
Also rewrites NEXT_SESSION_PROMPT.md, whose central claim ("the instrument is
the bottleneck, not the tests") stopped being true this session. The new one
leads with re-measuring the 103 allowlisted libs on the fixed instrument
before writing any new test.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Settles a question the campaign has worked around for three sessions:
rpi_nc_install.sh's 11.36% is an instrument failure, not a testing gap.
Measured against an independent instrument. Driving the lib under
PS4='+PS4:${BASH_SOURCE##*/}:${LINENO} ' with set -x traces 55 distinct lines
as executed, and 45 of them are lines kcov reports as UNCOVERED -- including
61, 62, 63, 66, 68, 102, 118 and 146. The lines run; kcov does not record
them.
That splits the problem in two, and they need different fixes:
(a) WRONG DENOMINATOR -- continuation lines of a multi-line quoted argument
counted as statements, which bash -x never calls executable at all.
Fixable in shell_coverage_report.py. Holds dwm_config.sh down.
(b) WRONG NUMERATOR -- ordinary statements executing unrecorded. Caps
rpi_nc_install.sh, and no test can move it.
The distinction is the point. A denominator filter is the obvious fix and I
nearly built one last session; it would have done nothing for (b).
Also confirmed no test can raise rpi_nc_install.sh: the file is one 227-line
function called twice, an `exit 88` sentinel proves the suite runs to
completion, and its assertions on save_config (line 219) and the password
message (line 227) PASS while kcov calls both lines uncovered.
kcov 43 is the current release, so upgrading is not an available fix.
The kcov material moved to docs/kcov-under-report.md (the 250-line cap), and
NEXT_SESSION_PROMPT.md now leads with the instrument work rather than the
next lib -- 201 in-scope libs, 98 passing, 103 exempt, and the instrument is
the bottleneck.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016sxxsDHWgdRhmdmzNMA6XM
Records what changed this session so the next one does not re-derive it:
- The allowlist dropped to 103. unity_handler.sh and transcribe_venv.sh both
measure 100% and are off it, verified through check_shell_coverage.sh with
the exemption deleted rather than by the measurement alone.
- The gate itself is now ready to arm: is_covered() reads jail_args and
passes --fail-on-case-error. Only the allowlist remains.
- Two directories have harnesses where one had none.
- The kcov problem is bounded, not solved: one artifact CONFIRMED, six
hypotheses DISPROVEN and listed so nobody retries them.
The trap list is rewritten around what actually cost time: measuring through
run_all.sh rather than a single file, --fail-on-case-error, the exit-sentinel
technique, and the two ways a stub silently fails to hide a tool.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016sxxsDHWgdRhmdmzNMA6XM
The old prompt still described Phase 3 as 'finish wiring the ratchet'
and presented the three scoping questions as open with a recommendation
to answer them as a presence-based lib-only ratchet. The user answered
all of them the other way on 2026-08-22 -- repo-wide, 100%, ALL files,
all three gates, hardest first -- and the ratchet has since been
converted to a measured 100% bar. A handoff that re-proposes a vetoed
design is worse than no handoff.
The new one carries what the next session actually needs: the settled
answers, the exact jail invocation, the four hardest remaining targets,
and the traps that cost this session real time -- stub shadowing that
drops coverage while tests still pass, stubs that must drain stdin or
materialise what the real tool creates, shfmt pushing a file over the
250-line cap after your own check passed, and the two-strike rule.
It also records the one UNSOLVED problem honestly: kcov mis-measures
rpi_nc_install.sh at 11.36% while the code provably runs, and the three
obvious explanations were each disproven against a minimal
reproduction. That is a hole in the campaign's primary instrument and
the next session should know before trusting a number.
Every figure in it was verified against the tree, not recalled.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DbD4nco3EgL1UFoZKmKsLE
115 -> 106 everywhere the count appears, 4 -> 5 suites, and the
"chipping away" section rewritten around what the scripts/lib batch
actually measured: the per-directory cost, the two isolation traps
(source-time $HOME writes, readonly double-source), and the reason to
mutation-test before reseeding rather than after.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The .pre-commit-config.yaml edit has been denied twice as a sensitive file,
so the paste belongs to the user. Record the exact block, its 6-space
indentation, its anchor point, and the measured gate behaviour so the next
session does not re-derive any of it.
Adds the one case the earlier table missed: `files: \.sh$` also matches
lib/tests/ and lib/payloads/ files, but the script self-filters them, so the
block needs no `exclude:` and cannot block its own test suites.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Three review findings, all before the hook is wired:
is_shell_lib excluded */lib/tests/* but not */tests/lib/*. Both are test
code; the second nesting made the gate demand tests/lib/tests/run_all.sh
for 10 helper files. It would have fired precisely while editing test
helpers to write the suites this ratchet asks for. Reseeded 125 -> 115.
--seed now refuses (exit 1) when a reseed would ADD an entry, instead of
a header comment asking nicely. It reads tracked files only, so an
unstaged probe seeds normally -- staging it produces the refusal with
the allowlist left byte-identical.
The parent commit's docs claimed an exempt file loses its exemption when
next modified. It does not: check_files exempts allowlisted paths
unconditionally, verified by staging an edit and getting exit 0. Fixed
the text, not the code -- making an edit trip the gate would block
routine work across 115 of 198 libraries, which is the repo-wide gate
this ratchet exists to avoid.
Also corrects the "a percentage is unreachable" rationale: commit
53e80462 reached 100% on an entry script with no suppressions. Presence
is still the right bar, because that took per-file mount analysis.
Measurement-only. No production file changed.
The gating question was whether the campaign's constraints are jointly
satisfiable: 100% line coverage over ALL .sh files with no suppressions.
Phase 1 measured effecting code at 0% under PATH shims, which implied
either forbidden suppressions or source seams in 17+46 files.
They are satisfiable. A user+mount namespace reaches 100% with zero
source changes: --map-root-user makes require_root fall through, and
bind-mounting each write target makes installer writes land in the jail.
setup_night_lockdown.sh went 81.58% (PATH shims) -> 86.84% (userns) ->
100.00% (38/38, all mounts).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3PzGc75gBcdxP3PkHXGcV
Replaces the Q1/Q2/Q3 grilling block with the answers the ratchet was
built under, flagged as cheaply vetoable since the hook is not yet
wired. Documents the one remaining step (the .pre-commit-config.yaml
entry, denied as a sensitive file) and corrects the file-count method:
`find` reports 565 .sh because it walks .venv and node_modules, which
is how the stale "roughly 487" got in here.
Phases 1 and 2 are done — the cap is at zero and enforced, and both CI gates
are wired — so the handoff now carries what a Phase 3 session needs instead.
Phase 3 opens with questions rather than work, because the scale (roughly 487
.sh files against a handful of lib/tests/ dirs) makes scope the user's call.
The coverage numbers Phase 1 actually measured are included so the "what bar"
question gets answered with evidence: decision logic reached 94%, while every
function that pkills, sudo-writes or installs sat at 0%. A 100% bar means
shimming sudo/pkill/systemctl/curl/npm across every installer, and that cost
belongs in front of the user before anyone starts writing tests.
Also records the traps that cost real time and are all still live: shfmt
corrupting hyphenated array subscripts, `# shellcheck` at the start of a
comment being parsed as a directive, verify_shell_split.sh being blind to
heredoc-internal functions, and the exec-bit staging rule.
Notes that Python tests has been red since 2026-08-17 from a pip
resolution-too-deep failure that predates this campaign and is unrelated to
it — which is why python-tests.yml is not in check_ci_green.sh's required list.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3PzGc75gBcdxP3PkHXGcV
The three safe-tier files are done; all five remaining are deployment-trap
tier. Records what the last session actually learned rather than restating
the plan:
- the shfmt bug that killed the install_leechblock attempt (it silently
rewrites `[google-chrome-stable]` as `[google - chrome - stable]` in an
associative array, which would have broken browser detection outright), plus
the grep that catches it;
- the phase line-ranges and lib layout for install_leechblock that were
already verified byte-identical, so the next session can redo it quickly
rather than rediscovering them;
- the six-step method all three completed splits used, including the rule that
you never run an installer just to capture a baseline;
- ten sharp edges that each cost real time, from subshells stranding state to
kcov mis-attributing brace-group closers;
- the three latent defects fixed along the way, and the note that one of them
leaves two phantom entries in this machine's live unblock state file which
the next install will self-heal.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3PzGc75gBcdxP3PkHXGcV
Rewrites the driver doc as a self-contained fresh-session prompt:
supersedes the one-file-per-session pacing decision (user asked for
batching), adds an explicit "do not ask should I continue" preamble,
orders the remaining 8 shell files into a safe tier and a
deployment-trap tier, and points at the pacman_hook_stall_* family as
the worked reference split with harness + entry-harness pattern.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Records the three focus_owner splits (status_page_state.dart,
DevicePolicyBridge.kt, EnforcementRunner.kt) and the reusable Kotlin
split pattern -- internal helper classes as private delegate fields,
public API preserved as one-line wrappers, function references for
parent callbacks. Also flags the companion-object-called-by-test trap
and that everything remaining is shell, 4 of 8 deployment-trapped.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Marks focus_owner/lib/status_page_state.dart done (commit 47e05d1),
confirms focus_owner is live so it's off the dead-code-candidate list,
documents the heredoc-generated-script trap in
setup_midnight_shutdown.sh (breaks extract_shell_functions.py and
verify_shell_split.sh as-is, needs a hash-the-emitted-script
verification plan instead), and logs a dart_format_changed.sh path
bug hit this session (cd's into repo before git status, whose paths
are worktree-root-relative -- silently formats nothing).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Pre-commit checks, Shell tests, and Python tests are all green on
4a35be7. Documents the fix (librsvg2-bin) and the gh-run-rerun trap
hit along the way so a future session doesn't repeat it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Rewritten as a 4-phase recurring driver per user request: (0) fix current
CI red state — found Pre-commit checks AND Python tests both failing with
an identical, pre-existing coverage gap (python_pkg/artgate/routes/vector.py:156,
99.98% total, rsvg-convert missing on the GitHub Actions runner) that
predates this session by at least a day; Shell tests was also red from
this session's own archive commit, already fixed in e48f253 and confirmed
green — (1) drive the 11 remaining over-cap files to zero, same
dead-code-check-in-first pattern as every prior split — (2) only then wire
check_file_length.sh into pre-commit as a hard gate, plus a CI-green check
(mechanism deliberately left as an open question for the user: check the
latest main run, or extend the pre-push ci-mirror hook) — (3) a new,
separately-scoped repo-wide 100% shell coverage gate, measured at 487 .sh
files against only 14 existing lib/tests/ directories, explicitly flagged
as needing its own user confirmation and ratchet-vs-hard-gate decision
before starting given the scale.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
setup_hosts_guard.sh was NEXT_SESSION_PROMPT.md's next split target, but
live-machine inspection showed it (and 16 supporting files - enforce-*.sh,
6 systemd units, install_pacman_hooks.sh, pacman-hooks/, psychological/,
both READMEs) is fully retired in favor of guard-lib, migrated 2026-07-04.
User confirmed archive over split, then confirmed the larger 17-file scope
once the directory was surveyed. Full history preserved via git filter-repo,
live at github.com/kuhyx/testsAndMisc-archive/tree/main/linux_configuration/scripts/periodic_background/hosts/guard.
plugins/{nsswitch,resolved}-plugin.sh stay - they're guard-lib's live
plugins, referenced by absolute path from /etc/guard-lib/targets/*.conf.
check_and_enable_services.sh's check_hosts() rewritten to check guard-lib
state (guardctl file-guard status) instead of the retired units/scripts it
used to check and self-repair - verified live, now reports the hosts
service ok against the actual migrated machine instead of a false error.
copilot-instructions.md and one install.sh comment updated to match.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Confirmed live (not dead code) via the dead-code check-in before any code
was touched -- the last two candidates this pattern was tried on were both
archived instead. Kept run_one/cleanup/log_size/main together in the entry
script: a prior session (2527fb3) already proved splitting run_one out
produces a real SC2153/SC2034 pair since PACMAN_PID/LAST_ELAPSED cross the
EXIT trap, not a suppressible false positive.
Fixed a real bug found while writing tests: print_summary's inline awk had
a dead `NR == 0` guard (printf on an empty array still emits one blank
line), reachable via `-n 0`. Refactored mem_available_mb, descendant_pids/
kill_tree, capture_stall's two output blocks, and print_summary's median
calc after confirming empirically (bash -x tracing) that kcov's
xtrace-based coverage can never see a `done <redirect>`, `} >redirect`, or
inline-awk line -- user chose to fix the code over the coverage tool.
descendant_pids specifically needed an explicit-fd process substitution
(not a pipe) to keep its array mutation in the current shell.
Made PACMAN_BIN/PACMAN_LOG/CACHE_DIR/PACMAN_LOCK/LOAD_FLOOR_MB/
LOAD_MIN_FREE_MB env-overridable for testing. Caught and fixed, before it
ran unbounded, a --with-load test that would have dd'd 13-20+ GB into
/dev/shm using this box's real available memory.
56 lib-level + 13 entry-level PATH-shim/subprocess assertions, 0 failed.
The entry test itself grew past 250 lines while adding coverage and had to
be split into a shared harness plus two test files, mid-session.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Full history preserved via git filter-repo, including both pre-reorg
root paths (libre_translate.sh and the subtree-imported
Bash/libre_translate.sh) since both were genuine ancestors of the
current file. Live at
github.com/kuhyx/testsAndMisc-archive/tree/main/linux_configuration/scripts/single_use/misc/testsAndMisc-bash.
Asked the dead-code check-in before any split work started this time,
per the lesson from the plagiarism-tools session. NEXT_SESSION_PROMPT.md
now points at diagnose_pacman_hook_stall.sh.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Three of the old brief's own instructions did not survive contact:
- the config.sh fingerprint recipe CANNOT WORK. Four policy fields are
frozenset, so json.dumps(default=str) serialises them in per-process
iteration order; three runs gave three digests. Replaced with the repo's
own deterministic exporter (baseline 83e05e82) AND a diff of the sourced
environment, because the hash alone passed clean through both bugs hit
this session.
- extract_shell_functions.py does NOT reliably place its source line. It
got the position wrong three ways: before SCRIPT_DIR existed, before
STATE_DIR (every path then expanded against an empty prefix), and on a
nested re-source instead of the top-level one.
- "100% line coverage, always" now has a measured exception, and stating
it as an absolute is actively dangerous. daemon_apps.sh has five
uncovered `done <file` lines whose loops call pm; a reader who pipes
them -- as this session correctly did in curfew_net.sh, where the body
is pure -- reintroduces a measured 1-of-54 bug in the code that decides
which apps get disabled at home. It is now a PROHIBITION at the top of
the file, with the line numbers and mapfile as the only alternative.
Also new: the kcov artifact taxonomy with an explicit safe/unsafe column,
the mutation tooling and the rule that an equivalent mutation means dead
code to delete rather than a test to write, and the two hazards
phone_focus_mode now carries (config.sh at exactly 250 with fifteen
loader-pinned variables enforced only by a comment; deploy.sh's two
hardcoded lists now living in two files).
Two numbers were checked rather than recalled, and both were wrong in the
draft: 120 mutations across six specs, not 127; and TWO copies of the
Haversine, not three -- daemon_location.sh's calc_distance IS focus_daemon's
original, moved, which I had double-counted in an earlier commit message.
Running two mutation specs concurrently leaves a mutation applied and reads
as a survivor; that cost a false 16/17 here and is now written down.
295 -> 250 lines. The old brief counted itself among the over-cap files and
was 45 lines past the gate that never checks .md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Records the user's two standing decisions -- 100% line coverage always,
and keep splitting blind without a phone deploy -- and reorders the queue
so the monitor.sh coverage backfill comes first.
kcov works, so the brief now leads with how to measure and with the two
ways kcov fails silently: it must be handed the test script directly, and
per-line detail exists only in cov.xml.
Also corrects the previous brief where measurement contradicted it. The
claim that focus_policy's tests would catch a bad config.sh split is
false -- the pytest hook is types:[python], ci-mirror only covers changed
packages, and those tests use synthetic tmp_path fixtures rather than the
real file. A parse-fingerprint baseline replaces it. The
extract_shell_functions duplication warning is dropped, since the tool
was fixed. Ten over-cap files the brief has never covered are listed
explicitly as out of scope rather than left ambiguous.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
The user has decided all three of the questions the previous brief left
open: fix the _VENDOR_KW Intel bug, split the phone_focus_mode scripts
despite the deployment coupling, and restructure the three parked files.
Records them as instructions rather than open questions, with the specific
facts each needs.
For the phone splits, accepting the risk does not mean skipping the copy
lists: deploy.sh has two hardcoded per-file lists and never deploys lib/, so
the brief now spells out that both must grow and that the seam is a sibling
file. dns_enforcer.sh and lib/monitor.sh are called out first because both
have runnable tests, so those splits can be proved the way tether_enforcer
was. config.sh is flagged separately - focus_policy/loader.py parses it.
For the restructuring, notes that verify_shell_split.sh no longer applies
once code stops being a verbatim move, so each of the three needs a test or
a real run instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Python is done: every .py is under the cap. Over-cap 37 -> 25.
Rewrites the brief around what this session learned rather than restating
the old method: the two scripts that now do the mechanical half
(extract_shell_functions.py, verify_shell_split.sh, both validated before
use), the SC2034 writer/reader rule that decides where a shell seam can
fall, and the deployment triage - deploy.sh copies a hardcoded per-file list
and never deploys lib/, which rules out an entry+lib seam for 8 scripts.
Records the three parked files with the reason each resisted, so the next
session does not repeat four failed attempts on libre_translate, and carries
forward the vscode_optimizer _VENDOR_KW bug as pending a user decision.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Rewrites NEXT_SESSION_PROMPT.md against what is actually left: 37 files
(29 shell, 4 python, 2 kotlin, 1 dart) rather than the 40 it described,
with the system-maintenance python now finished.
Also drops it from 260 lines to 155, so the brief is no longer itself
over the cap it tracks. Over-cap 37 -> 36.
Carries forward the five traps that cost real time this session -
especially that a monkeypatch aimed at the wrong module made main() call
the real _run_since, read the machine's atop logs and hang the suite
rather than fail - and records the two shell blockers with the specific
thing that breaks and the order to do it in.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
The previous brief pointed at kcd2_dice_solver; those four files and twelve
more are done, so it was stale. The new one reflects what the user asked for
after seeing the stopping report: write the missing tests instead of stopping
at the coverage wall, change the source-text tests where a split needs it, and
delete the Flutter Windows scaffolding rather than working around it.
Also spells out the deployed-copy blocker in plain terms, since the previous
brief's phrasing did not land: install_leechblock.sh is copied to
/usr/local/share/digital_wellbeing/ and pacman_wrapper.sh:831 runs THAT copy on
every pacman invocation, so an entry+lib/ split breaks pacman on the live
machine. Verified the root-owned copy is still there.
Records the billsplit/windows/ deletion as a four-part job, not a git rm --
.gitignore carries two un-ignore rules for it and analysis_options.yaml
excludes it -- and flags macos/ and ios/ as the same question to ask rather
than assume.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
The shell-installer seam is close to exhausted: of the four candidates probed
last session, one was blocked by a deployed single-file copy, one was
unverifiable (239 of 336 lines never execute under trace), and one configured a
feature that had been dead for months. What is left there is expensive.
kcd2_dice_solver has four files over the cap and a far stronger verifier than
anything the shell harness produces: 288 vitest tests in ~4s, 100% branch
coverage enforced by config thresholds, and tsc+eslint. Verified all three
green at 5dce82f before writing this.
The brief front-loads the two things most likely to go wrong: that the project
has NO CI and is not in pre-commit, so the gate is local-only and a broken
split would push clean; and that splits should re-export from the original file
rather than rewrite imports, so the test files stay untouched and the
verification stays honest.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Probing found a blocker the trace structurally cannot see: a script that some
OTHER script copies elsewhere and runs from there cannot take an entry+lib/
shape, because the deployed entry's SCRIPT_DIR has no lib/ and dies on its
first source under set -e. The trace stays green because it runs the repo copy.
install_leechblock.sh is blocked on exactly this, and it is live, not
theoretical: install_pacman_wrapper.sh cp's it to
/usr/local/share/digital_wellbeing/, pacman_wrapper.sh:831 PREFERS that copy,
and auto_install_leechblock runs on every pacman invocation. It is otherwise
the best-conditioned target left (exit 0, 93 files, all hashes stable), which
is exactly why it needed the check rather than the trace.
setup_thorium_startup.sh is mechanically splittable — exit 0, all 8 steps
covered, no deployed copy — but should not be split, because what it configures
is dead. Thorium was removed in favour of chromium/librewolf;
/usr/local/bin/thorium-browser is now a leftover symlink to
browser-preexec-wrapper, which cannot resolve /usr/bin/thorium-browser and so
treats the URL as the binary. The enabled thorium-fitatu-startup.service has
been failing at every boot while reporting status=0/SUCCESS:
thorium-browser: line 33: /https://www.fitatu.com/app/planner: No such file
Also recorded: process spawning escapes --prefix the same way pkill does.
setup_thorium_startup.sh launches a browser mid-run; check ps after tracing
anything that starts a program.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Probed the two remaining candidates at HEAD instead of guessing:
nvidia_troubleshoot.sh is ruled OUT. Its trace dies at step 3 because
backup_file writes /etc/profile.backup.<stamp>, a new SIBLING in unbound /etc
— a file bind cannot cover siblings and bare /etc is refused. 239 of its 336
lines never execute, so keeping the unproven ones in the entry (the rule the
pacman split established) leaves the entry at ~265, still over the cap. The
file cannot satisfy both the rule and the goal.
install_leechblock.sh is the best-conditioned target left: exit 0, 93 files
written, and all 93 hashes byte-identical across two consecutive runs. Only
the echoed prefix path and curl's progress meter vary.
But it fires an unstubbed `pkill` at every Chromium-family browser. pkill is
not in the stub set and --prefix cannot contain it, because signals are not
filesystem writes. Two probe runs fired it, harmless only because no browser
happened to be open. That is now documented as its own trap, and the brief
tells the next session to pass --stub pkill and check for a live victim first.
Also recorded: for a target embedding $(date), diff the written files' CONTENTS
with the date normalized rather than falling back to comparing sizes — that
still catches a dropped line, which a size comparison does not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
`--bind-abs /usr/bin` overlays the directory bwrap needs to exec anything, so
the run dies with `execvp bash: No such file or directory` before the script
starts. A target whose last act replaces a binary there traces fine with every
other path bound and stops at that line with exit 1 on EPERM — usable as a
baseline (it is deterministic across runs), but blind to statements at or
after the failure, which is a constraint on where the seams can go.
Also noted: the absolute-path scanner misses a literal `ln -sf` target,
because it follows variables into `cat >`/`cp`.
The brief now targets install_pacman_wrapper.sh (316) with its baseline
already captured: 16 file hashes, one stubbed call, exit 1 at line 304.
Checked ahead of time that its source.sha256 drift manifest hashes only the
seven copied source files, not the installer, so a split leaves it stable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Last session landed the --prefix harness but split nothing, by design. This
points the next one at install_usage_monitoring.sh (290, over by 40) with the
facts needed to do it rather than rediscover them: the section-by-section seam
map, the five globals that cross those seams, and the 30-line reference trace
with the content hashes the split must reproduce.
Three hazards are file-specific and each was measured, not guessed:
- linux_configuration/tests/test_usage_monitoring_installer_efficiency.sh
greps the installer's SOURCE TEXT for the pmon heredoc. Moving that heredoc
into a lib breaks the test, and it is not in the pre-commit set, so nothing
reports it.
- REPO_DIR walks up five levels from $0 and is interpolated into the generated
catch-up script, so recomputing it at a different depth silently points the
generated file at the wrong repo while the trace still exits 0.
- Line 222 is an unquoted heredoc whose internal escaping is load-bearing.
The brief's own verification procedure had to be corrected: tracing the
baseline from a detached worktree makes REPO_DIR resolve to the worktree, which
changes the generated file's content and produces a convincing 2-line diff out
of nothing. Normalising the trace text does not help, because the path is
inside the hashed content. The baseline is captured in place instead, and that
workflow is verified to diff empty pre-split.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
Six remaining over-cap files write to /etc, $HOME/.local/bin and systemd
unit dirs by shell redirection, which no PATH stub can intercept -- so
they currently cannot be verified at all, only inspected. That blocks
most of what is left, including several of the named blockers.
The brief scopes one tooling job (a prefix redirect in
trace_shell_split.sh), states the constraints that must not be violated,
and records what was measured today: destinations are mostly $HOME-rooted
variables, so a HOME redirect covers a large share without touching the
scripts. Two cases that a bare HOME redirect will NOT catch are named
explicitly -- setup_thorium_startup.sh writes through `sudo -u mkdir -p`,
which the existing sudo stub swallows, and install_leechblock.sh uses
`rsync --delete`, which is destructive against a wrong root.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
