testsAndMisc/docs
Krzysztof kuhy Rudnicki b7523d1691 Bound every coverage-jail case with a timeout and closed stdin
Investigated whether this session caused the 11:33 hard freeze. It did
not, and the evidence is recorded in the evidence artifact:

- No OOM kill, no oom_reaper, no hung-task or soft-lockup message, and
  no kernel message AT ALL after 11:20. The log stops mid-line at
  11:33:15 -- a hard hang, not a process the kernel was fighting.
- Last commit 11:30:32; last jail trace 11:11:57, 21 minutes earlier.
  The session was idle when the machine died.
- Steam wrote a crash minidump at 11:31:10 and at-spi2 disabled an
  unresponsive app at 11:32:06, on an RTX 3090. Correlation only -- a
  hard hang leaves no log to prove cause.
- Nothing survived the reboot: no stray unshare/kcov, no leftover
  tmpdirs, no leaked mounts, and the live /etc and /usr/local/bin
  files keep their original dates.

Hardened anyway, because the jail had one genuinely unbounded
behaviour: a case could run forever. Two hangs yesterday came from a
`crontab -` fallback inheriting the caller's stdin.

Each case now runs under `timeout --kill-after=10s` (default 120s,
--timeout to override) with stdin from /dev/null, and a timed-out case
WARNS by name instead of being swallowed -- a silent timeout looks
identical to an unreachable line in the report. Verified: a `sleep 600`
subject now ends in 5s with --timeout 5s.

dot_resolver_install.sh still measures 39/39 = 100.00%.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DbD4nco3EgL1UFoZKmKsLE
2026-08-22 11:40:16 +02:00
..
explanations session_autopsy: badge counts only significant candidates; zero-token aliases 2026-07-25 18:05:49 +02:00
superpowers Bound every coverage-jail case with a timeout and closed stdin 2026-08-22 11:40:16 +02:00
agent-harness-evaluation-2026-08-18.md docs/agent-harness-evaluation-2026-08-18.md: fix prettier formatting 2026-08-18 21:08:01 +02:00
app-split-recipes.md Add docs/app-split-recipes.md; update the handoff to 78 left 2026-08-16 20:51:38 +02:00
device-owner-wipe-checklist.md inFakt is SMS-only 2FA, so the wipe cannot strand the account 2026-08-10 20:04:06 +02:00
dns-filtering-parked.md Park phone DNS filtering: Private DNS fails closed, so the PC cannot host it 2026-08-05 10:05:16 +02:00
mcp-shortlist.html docs: add MCP server security-triage shortlist 2026-07-17 19:16:31 +02:00
python-split-recipes.md Apply prettier to the handoff and recipe docs 2026-08-16 18:27:18 +02:00
shared-checkout-safety.md Retarget the handoff on verifiability; split out the shared-checkout doc 2026-08-16 23:10:25 +02:00
shell-split-harness.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-recipes.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-verification.md shell: split clean_audio, enforce_vbox_hosts and migrate_hosts_guard 2026-08-17 14:27:57 +02:00
syncyomi-restore-runbook.md syncyomi_guard: refuse a collapsed payload as the new good copy 2026-08-10 15:33:18 +02:00