testsAndMisc/docs
Krzysztof kuhy Rudnicki 08f3c764b2
Some checks are pending
Pre-commit checks / pre-commit (push) Waiting to run
Shell tests / shell-tests (push) Waiting to run
Shell tests / arch-tests (push) Waiting to run
check_and_enable_services: a warning must never mask an error
Eight checks assigned status="warning" unconditionally, so a check running
later in the same function overwrote the status="error" an earlier one had
set. The five other sites in this family already guard the assignment with
`if [[ $status != "error" ]]`, so this was an inconsistency, not a design.

Only half of it was load-bearing, and the two halves fail differently:

  services_units.sh (4 sites) reports through report_and_fix, which repairs
  ONLY on "error". A downgrade there meant no repair ran at all. The is-active
  check is the LAST status assignment in each of the three functions, so it
  could mask any error above it -- in check_periodic_systems, three separate
  is-enabled checks. A timer that was both disabled and inactive, which is the
  ordinary shape of a broken timer, was reported and then left broken.

  services_hosts.sh (4 sites) gates its own repair on `status != "ok"`, so the
  repair still ran. There the bug printed a real error as a yellow [!] warning
  and understated the summary row.

Demonstrated rather than argued, against a simulated broken machine (timer
disabled AND inactive, unit files present):

  without the guards:  status=warning, repair ran 0 times
  with the guards:     status=error,   repair ran 1 time

The seven assertions that previously pinned the broken behaviour now assert
the correct behaviour; they were rewritten first and failed, then the guards
made them pass. Two further cases cover the masking shape directly: a broken
guard-lib instance must still be repaired when a later check warns.

`--status --dry-run` output is still byte-identical to rev 6691cb26, because
this machine has no disabled timer and no missing pacman hook -- the buggy
path is never taken here, which is precisely why it went unnoticed. The A/B
above is the evidence the live diff cannot provide.

222 assertions across 10 files. services_units.sh holds 100% coverage;
services_hosts.sh rises from 86.05% to 93.02%. test_services_hosts.sh needed
splitting twice to stay under the 250-line cap (hosts_fix, resolved), and
stage_hosts_ok moved into the harness so both new files can use it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3PzGc75gBcdxP3PkHXGcV
2026-08-21 14:16:01 +02:00
..
explanations session_autopsy: badge counts only significant candidates; zero-token aliases 2026-07-25 18:05:49 +02:00
superpowers check_and_enable_services: a warning must never mask an error 2026-08-21 14:16:01 +02:00
agent-harness-evaluation-2026-08-18.md docs/agent-harness-evaluation-2026-08-18.md: fix prettier formatting 2026-08-18 21:08:01 +02:00
app-split-recipes.md Add docs/app-split-recipes.md; update the handoff to 78 left 2026-08-16 20:51:38 +02:00
device-owner-wipe-checklist.md inFakt is SMS-only 2FA, so the wipe cannot strand the account 2026-08-10 20:04:06 +02:00
dns-filtering-parked.md Park phone DNS filtering: Private DNS fails closed, so the PC cannot host it 2026-08-05 10:05:16 +02:00
mcp-shortlist.html docs: add MCP server security-triage shortlist 2026-07-17 19:16:31 +02:00
python-split-recipes.md Apply prettier to the handoff and recipe docs 2026-08-16 18:27:18 +02:00
shared-checkout-safety.md Retarget the handoff on verifiability; split out the shared-checkout doc 2026-08-16 23:10:25 +02:00
shell-split-harness.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-recipes.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-verification.md shell: split clean_audio, enforce_vbox_hosts and migrate_hosts_guard 2026-08-17 14:27:57 +02:00
syncyomi-restore-runbook.md syncyomi_guard: refuse a collapsed payload as the new good copy 2026-08-10 15:33:18 +02:00