Krzysztof kuhy Rudnicki 782a6320af Let --rollback work on a freshly installed machine ... The previous commit made hosts-blocker's install.sh register the guard-lib instances itself, which is what finally gives a fresh machine real hosts enforcement. It also created a class of machine that --rollback refused to touch: the state dir it demanded, /var/lib/guard-lib-migration, is written by the one-shot migration, and a machine that never had a legacy layer has no such state. So --rollback exited 1 while the instances it exists to remove were live -- every freshly installed machine had no escape hatch at all. Rollback now proceeds whenever a guard-lib instance is registered, says plainly that there is no legacy layer to restore, and still refuses when there is genuinely nothing to roll back. The second half is worse and was only visible by running it. The existing re-assertion of chattr +i works by starting hosts-guard.service and hosts-bind-mount.service, neither of which exists on a fresh machine, so every systemctl cat skipped and the rollback finished with /etc/hosts holding no immutable flag and no bind mount -- less protected than before it ran. It now re-asserts immutability directly when no legacy unit did it. Verified in a pristine vmbox guest whose guards came from install_core_system.sh --all: dry-run and real rollback both exit 0, the three instances are uninstalled, shutdown-schedule (a different feature) is untouched, and /etc/hosts keeps ----i----------------- and all 178410 lines. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp		2026-08-24 12:57:24 +02:00
..
artifact-prune-mode-2026-08-23.json	Give the artifact cap a --prune escape hatch	2026-08-23 19:41:11 +02:00
cap-artifact-growth-2026-08-23.json	Cap artifact growth instead of recommending a future prune	2026-08-23 19:33:53 +02:00
ci-mirror-serialise-under-pressure-2026-08-23.json	Serialise the heavy ci-mirror gates when memory is tight	2026-08-23 20:02:59 +02:00
delete-hippo-2026-08-23.json	Delete the dead .hippo memory store	2026-08-23 20:42:03 +02:00
extract-digital-wellbeing-2026-08-23.json	Record the vendor-closure and broad-scan findings in the evidence	2026-08-23 21:10:14 +02:00
extract-hosts-blocker-2026-08-23.json	Extract the hosts blocker into its own repo	2026-08-23 20:30:18 +02:00
fix-bats-diag-path-2026-08-23.json	Point the diagnostics bats suite at the flattened path	2026-08-23 20:08:40 +02:00
fix-music-parallelism-drift-guard-2026-08-23.json	Derive the lib prefix in the music_parallelism drift guard	2026-08-23 19:53:17 +02:00
flatten-linux-configuration-2026-08-23.json	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
hosts-guard-rollback-fresh-install-2026-08-24.json	Let --rollback work on a freshly installed machine	2026-08-24 12:57:24 +02:00
hosts-guard-tests-2026-08-23.json	Clear both hosts-guard libs; teach the instrument done <redirect> (88 -> 86)	2026-08-23 11:50:13 +02:00
installer-cross-repo-fix-2026-08-24.json	Make install_core_system.sh work on a fresh machine	2026-08-24 12:45:21 +02:00
live-state-installed-scripts-2026-08-23.json	report_live_state: also scan installed scripts under /usr/local	2026-08-23 17:44:10 +02:00
nvidia-config-allowlist-2026-08-23.json	Take nvidia_config.sh off the allowlist for real (85 -> 84)	2026-08-23 14:13:24 +02:00
nvidia-config-seams-restore-2026-08-23.json	Restore nvidia_config.sh's four test seams	2026-08-23 13:33:35 +02:00
nvidia-config-tests-2026-08-23.json	Test nvidia_config.sh to 100%; the 8-lib campaign is done (85 -> 84)	2026-08-23 13:14:37 +02:00
precommit-workflow-dispatch-2026-08-23.json	Allow Pre-commit checks to be run manually	2026-08-23 16:38:15 +02:00
prettier-endurain-readme-2026-08-23.json	Apply prettier to endurain/README.md	2026-08-23 13:43:22 +02:00
prune-superpowers-artifacts-2026-08-23.json	Prune 655 superpowers evidence and contract artifacts	2026-08-23 19:28:49 +02:00
python-tests-minimal-deps-2026-08-23.json	Install only the test deps in Python tests CI: 79 packages -> 17	2026-08-23 16:29:24 +02:00
python-tests-path-filter-symlink-2026-08-23.json	Trigger Python tests when meta/requirements.txt changes	2026-08-23 16:20:10 +02:00
quarantine-arch-sysctl-cases-2026-08-22.json	Quarantine the arch_sysctl cases: they broke bt_audio's measurement	2026-08-23 10:15:11 +02:00
repair-stale-live-references-2026-08-23.json	Repair live self-repair broken by the flatten and extractions	2026-08-23 20:39:59 +02:00
restructure-step0-safety-net-2026-08-23.json	Restructure step 0: live-state inventory + depth gate dry run	2026-08-23 16:59:54 +02:00
shell-coverage-bar-back-to-presence-2026-08-23.json	Drop the 100% shell coverage bar; back to a presence ratchet	2026-08-23 15:47:04 +02:00
skip-duplicated-pytest-in-precommit-ci-2026-08-23.json	Stop running the Python suite twice per push in CI	2026-08-23 16:30:27 +02:00
split-boot-repair-2026-08-23.json	Cap extensionless scripts, and split the one that was hiding	2026-08-23 19:13:40 +02:00
suite-speedup-2026-08-23.json	Take the fixes/lib suite from 110s to 37s, same 645 assertions	2026-08-23 14:00:13 +02:00
template.json	style(prettier): apply markdown/json formatting updates	2026-05-07 22:08:00 +02:00
thorium-repairs-tests-2026-08-23.json	Test thorium_repairs.sh to 100%, lift the gate timeout (89 -> 88)	2026-08-23 11:05:56 +02:00
ubuntu-perf-fixes-tests-2026-08-23.json	Test ubuntu_perf_fixes.sh to 100%, take it off the allowlist (86 -> 85)	2026-08-23 12:38:40 +02:00
wire-shell-coverage-ratchet-2026-08-23.json	Wire the shell ratchet into pre-commit, and test the coverage tooling	2026-08-23 15:51:29 +02:00
wire-structure-gates-2026-08-23.json	Wire the depth and size gates, exempting structural depth	2026-08-23 19:26:16 +02:00