testsAndMisc/docs
Krzysztof kuhy Rudnicki 309f4c8d42 Repair live self-repair broken by the flatten and extractions
Five live mechanisms were silently pointing at paths that no longer exist.
None of them announced it; each degraded to a log line or a missing file.

- hosts-file-monitor.service is ACTIVE and watches /etc/hosts for tampering,
  but its embedded installer path was the pre-flatten scripts/ one. It logged
  "Hosts install script not found" 37 times: it detected tampering it could
  not repair.
- dns-blocklist-refresh.service (enabled, next run 00:01) named a deleted
  single_use/features/ path, as did media-organizer.service under utils/.
- setup_periodic_system.sh read all TEN of its templates from
  periodic_background/system-maintenance/, which has held nothing but
  untracked .pyc and .coverage residue since system-maintenance was
  extracted. Every install of a service, timer or script was reading a file
  that was not there.
- /etc/sudoers.d/hosts-install-no-passwd granted NOPASSWD on the old hosts
  installer path.

Running the fixed dns unit then caught a bug the static checks missed: under
systemd there is no SUDO_USER and `id -un` is root, so the new resolver
returned /root/hosts-blocker and the service died with "Feed generator not
found". extracted_repo_home() now handles the bare-root case by falling back
to the owner of the lib file itself. Verified across all four invocation
modes: as the user, via sudo, as root with SUDO_USER unset, and with an
explicit *_DIR override.

The service now reports "Feed refreshed and dnsmasq reloaded (189038 lines)".
/etc/hosts is untouched throughout -- still 176888 lines, still chattr +i,
still bind-mounted by its guard.

Live artifacts were patched via validated temp files, never in-place: the
sudoers drop-in was checked with `visudo -cf` before install, and every
original is backed up under /var/tmp/*.pre-{extract,fix}.

Stale live references: 8 -> 2. The 2 that remain name digital_wellbeing
paths and can only be fixed when that unit is extracted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
2026-08-23 20:39:59 +02:00
..
explanations Dissolve linux_configuration/scripts/ and single_use/ 2026-08-23 18:53:30 +02:00
superpowers Repair live self-repair broken by the flatten and extractions 2026-08-23 20:39:59 +02:00
agent-harness-evaluation-2026-08-18.md docs/agent-harness-evaluation-2026-08-18.md: fix prettier formatting 2026-08-18 21:08:01 +02:00
app-split-recipes.md Add docs/app-split-recipes.md; update the handoff to 78 left 2026-08-16 20:51:38 +02:00
device-owner-wipe-checklist.md inFakt is SMS-only 2FA, so the wipe cannot strand the account 2026-08-10 20:04:06 +02:00
dns-filtering-parked.md Park phone DNS filtering: Private DNS fails closed, so the PC cannot host it 2026-08-05 10:05:16 +02:00
kcov-under-report.md Apply prettier formatting to docs/kcov-under-report.md 2026-08-22 14:35:35 +02:00
mcp-shortlist.html docs: add MCP server security-triage shortlist 2026-07-17 19:16:31 +02:00
python-split-recipes.md Apply prettier to the handoff and recipe docs 2026-08-16 18:27:18 +02:00
restructure-live-state.md Flatten i3-configuration and misc/testsAndMisc-bash 2026-08-23 19:02:18 +02:00
shared-checkout-safety.md Retarget the handoff on verifiability; split out the shared-checkout doc 2026-08-16 23:10:25 +02:00
shell-split-harness.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-recipes.md Extract the hosts blocker into its own repo 2026-08-23 20:30:18 +02:00
shell-split-verification.md Prove kcov's under-report is TWO defects, one of them a numerator bug 2026-08-22 13:57:33 +02:00
syncyomi-restore-runbook.md Dissolve linux_configuration/scripts/ and single_use/ 2026-08-23 18:53:30 +02:00