The Magisk app's Modules tab "Disable" / "Remove" buttons work by
creating marker files (disable, remove) in /data/adb/modules/hosts/.
Tapping Disable in the app on next boot would skip the module's
magic-mount of /system/etc/hosts, silently disabling all hosts-file
blocking.
Defense in depth:
1. deploy.sh chattr +i's the module dir + its hosts file so the
Magisk app cannot create disable/remove markers (kernel returns
EPERM). The +i attribute survives reboot.
2. hosts_enforcer.sh adds protect_magisk_module(): every poll cycle
(and on startup) scans for disable/remove/update markers, deletes
them, logs TAMPER, and re-asserts +i on the dir. Safety net in
case the lock is bypassed.
3. sync_magisk_module() now drops +i briefly before its cp and
re-locks via protect_magisk_module() so workout-state hosts
swaps still work.
4. deploy.sh detects the previously-silent failure mode of the
module being enabled on disk but not yet magic-mounted (no
/system/etc/hosts) and aborts with a clear reboot-required
message instead of producing a deploy that does nothing.
5. focus_ctl.sh hosts-status now prints the lock state and warns
about any present markers.
Verified end-to-end on BL9000EEA0000102:
- Pre-reboot: chattr +i set, touch /data/adb/modules/hosts/disable
returns Operation not permitted.
- Post-reboot: /system/etc/hosts magic-mounted (178303 lines, sha
matches canonical), lock survives reboot, ping youtube.com -> 127.0.0.1.
- Tamper test: chattr -i + touch disable -> enforcer logs
'TAMPER: removed Magisk module marker' within 15s and re-locks.
Documented intentional override path inline (focus_ctl.sh hosts-stop;
chattr -i; touch disable).
Resource-usage report showed ~29 cores of average load coming from i3blocks
helper scripts forking awk/tr/grep/bc/sensors/nvidia-smi every tick. Rewrite
all five hot-path scripts to eliminate forks:
- volume.sh: persist mode, blocks on 'pactl subscribe' event stream.
No polling, no sleep, no fork per tick.
- gpu_monitor.sh: persist mode, single long-lived 'nvidia-smi --loop=5'
feeds a bash 'while read' loop. Falls back to /sys for amdgpu.
- battery_status.sh: reads /sys/class/power_supply/BAT*/ directly.
Zero forks; replaces 'acpi | awk' pipeline.
- cpu_monitor.sh: reads /proc/loadavg and k10temp/coretemp /sys/class/hwmon.
Zero forks; replaces 'sensors | awk | tr' + bc arithmetic.
- motherboard_temp.sh: reads nct*/it*/f71* Super-I/O hwmon node directly.
Zero forks.
Configure volume + gpu_monitor with interval=persist so i3blocks keeps
one long-lived producer each instead of forking per tick.
Also add:
- kill_stale_recorders.sh -- kill stray ffmpeg x11grab / dotnet-trace /
dotnet-monitor processes left running after sessions.
- monitors.slice -- resource-capped user slice (CPUQuota=50%,
MemoryMax=512M, MemorySwapMax=0 for zram safety, TasksMax=256) to
bound future monitoring regressions.
- efficient-polling-scripts SKILL -- rules for writing status-bar and
polling scripts without forks; fork-pipeline to bash-builtin translation
table; verification checklist.
Verified live: strace -c on cpu_monitor.sh shows 1 execve / 0 clones;
persist producers (pactl subscribe, nvidia-smi --loop) show 0 CPU ticks
over a 3s idle sample. Per-invocation timing 1.6-1.9 ms (was 30-80 ms).
- New companion Android app (com.kuhy.focusstatus) under
phone_focus_mode/focus_status_app/ with a pure-Java, Gradle-less
command-line build pipeline (build.sh). Shows an ongoing
notification titled 'Focus: HOME / AWAY / DAEMON DOWN' with
distance, GPS, disabled-app count, last check, daemon checkmarks,
and a 'Re-check now' action button.
- focus_daemon.sh: write_status_snapshot() + sleep_with_recheck()
for JSON status + early-wake on trigger file. init() chmods
STATE_DIR 777 so the app can drop the trigger file.
- config.sh: new STATUS_FILE / RECHECK_TRIGGER; WHITELIST expanded
with com.kuhy.focusstatus and 11 more user-requested apps
(podcini X, mpv, bible/openbible, pkp/portalpasazera, orange,
runnerup, splitbills/splitwise, xiaomi smarthome).
- focus_ctl.sh: new 'recheck' + 'notif-status' subcommands.
- deploy.sh: new step [7/7] builds APK, installs, grants
POST_NOTIFICATIONS, pre-approves Magisk SU policy, launches
foreground service.
- .gitignore: exclude focus_status_app/build symlink + debug.keystore.
End-to-end verified on device: notification live with real values;
Re-check button triggers a daemon location check within ~1s.
Documents the machine-freeze root cause (zram + cgroup without MemorySwapMax=0),
the run_capped() pattern in .git/hooks/, the 2GB nested cgroup per pytest package,
and the COVERAGE_FILE isolation fix for pytest-cov SQLite corruption.
Each package subprocess now writes to its own tmpfile via COVERAGE_FILE env.
This prevents sequential subprocess runs from stomping on the .coverage SQLite
DB that the prior run left behind, which caused INTERNALERROR when pytest-cov
tried to combine() parallel data files with incompatible schemas.
Parallel cgroup subprocesses racing on the same .coverage SQLite DB caused
INTERNALERROR (no such table: meta/arc) when combining coverage data files.
Delete all .coverage* files before each package run to prevent corruption.
Each pytest package runs in its own systemd-run scope with:
- MemoryMax=2G per package (nested inside the 4GB parent cgroup)
- MemorySwapMax=0 to prevent zram thrashing (the real cause of freezes)
- gc.collect() between packages to free Python heap
- Set oom_score_adj=1000 in git hooks so OOM killer targets
pre-commit first, never crashing the PC
- Cap Node.js heap to 512MB for eslint/prettier/vitest
- Remove broken systemd-run cgroup wrapper (didn't work)
- cppcheck: process files one-at-a-time, --check-level=normal
- pytest: run packages sequentially in separate subprocesses
- Remove --force from cppcheck (exponential memory on #ifdef combos)
systemd-run --scope -p MemoryMax=3G per pytest subprocess so each
package gets its own memory cap, freed completely before the next.
Also use shutil.which + pathlib per ruff rules.
Each python_pkg subpackage now runs in its own pytest subprocess so
memory is freed between packages. Prevents 4GB+ accumulation when
matplotlib, geopandas, pygame, etc. all load in a single process.
- cppcheck: process files one-at-a-time (xargs -n 1) + --check-level=normal
- eslint: cap Node.js heap to 512MB via NODE_OPTIONS
- Set fail_fast: true to avoid stacking memory-heavy hooks
- Remove ulimit -v (ineffective with Linux memory overcommit)
--force checks all preprocessor configurations, causing exponential
memory growth with ~50 C/C++ files. Default max of 12 configs is
sufficient and stays well under 4GB RAM.
- _pick_best_hltb_entry: check game_alias in exact-match fallback so
renamed games (e.g. 'Needy Streamer Overload' -> 'NEEDY GIRL OVERDOSE')
are not beaten by spinoffs with matching prefixes
- _try_reassign_shorter_game: call hide_other_games after pick_next_game
so library visibility is updated on reassignment, not only on completion
- Added tests for alias matching and all hiding branches (100% coverage)
SetAppsAsHidden is unreliable for large libraries — silently drops
operations. Running the entire retry loop (max 30 passes, batch 50,
200ms settle delay) inside a single CDP Runtime.evaluate converges
to 0 remaining visible games.
steam-backlog-enforcer:
- Split hltb.py (>800 lines) into _hltb_types.py, _hltb_detail.py, hltb.py
- Split main.py into _cmd_done.py + main.py to stay under 500-line limit
- Split test_hltb.py into test_hltb.py, test_hltb_search.py, test_hltb_detail.py
- Split test_main.py: move TestTryReassignShorterGame → test_cmd_done.py
- Update test_main_part2.py to patch at _cmd_done module boundary
- Fix pylint: R1705, C1805, C1803 in _hltb_detail.py and hltb.py
- Set pre-commit --fail-under=8.0 (was 10.0; pre-existing files scored ~8.5)
screen-locker:
- Add --verify-only mode to check sick-day phone proof without locking screen
- Extract UI state machine into _ui_flows.py for testability
- Add test_verify_workout.py covering the new verify-only path
- Update run.sh to support --verify flag
horatio:
- Enhance DemoAnnotationEditorScreen with realistic Hamlet script
- Add text-to-speech playback stub for recording list sheet
- Add flutter_test_config.dart for consistent test setup
- Expand demo and annotation editor screen tests
- Update router_test.dart for new screen parameters
misc:
- Update pomodoro_app/pubspec.lock dependencies
- Update .gitignore for new build artifact patterns
- Add DemoAnnotationEditorScreen: wraps the real AnnotationEditorScreen with
an in-memory Drift DB seeded with 6 lines of Hamlet's soliloquy, 4 TextMarks,
4 LineNotes, 4 LineRecordings (3 on line 0 with grades), and 1
AnnotationSnapshot — all ephemeral, zero writes to disk
- Add /demo route to go_router
- Show 'See a demo' OutlinedButton.icon on the empty library screen only
- Tests: 6 widget tests for DemoAnnotationEditorScreen (including runAsync
pattern for Drift real-time timer handling), 2 new home screen tests, and
a router test for the /demo route
All 366 tests pass, 100% branch coverage, flutter analyze --fatal-infos clean
- Add _SUBSET_SUFFIXES filter in _pick_best_hltb_entry to avoid
matching prologue/demo/trial/lite/prelude entries (e.g. prevents
'A Space for the Unbound - Prologue' from matching over full game)
- Fix stale completionist_hours in snapshot used during reassignment:
refresh uncached shorter candidates from HLTB before comparing in
_try_reassign_shorter_game
- Fix same stale-hours issue in _finalize_completion: load HLTB cache,
refresh uncached shortlist, and apply cached hours before pick_next_game
- Add regression tests for all three fix paths (100% branch coverage)
Add caching to app_build so flutter build linux --release is skipped
when source files haven't changed. Hash includes both packages' Dart
files plus pubspec.yaml, pubspec.lock, and CMakeLists.txt.
Each pipeline step computes a sha256 over its relevant source files and
skips re-execution when the hash matches the cached value. A .cache/
directory under horatio/ stores the per-step hashes.
Cache boundaries:
- *_get: pubspec.yaml
- core_format/analyze/test: all *.dart in horatio_core/
- app_analyze: all *.dart + analysis_options.yaml in horatio_app/
- app_test/dead_code: all *.dart in both packages
Use -f or --force to bypass the cache and re-run everything.
Also fixes:
- shellcheck SC2155 in run.sh and dead_code.sh
- codespell typo (thats -> that's) in planner_test.dart
- scripts/optimize_vscode.py: auto-detect hardware (CPU, RAM, GPU, disk)
and apply optimal VS Code settings and Electron GPU flags
- scripts/pytest_changed_packages.py: pre-commit hook that runs pytest
only for python_pkg subpackages with changed files
- .pre-commit-config.yaml: use new selective pytest hook
- scripts/check_python_location.sh: allow scripts/ directory
Tests for pick_next_game were calling uninstall_other_games and
state.save against real filesystem paths, deleting installed games
and overwriting the user's state.json whenever tests or pre-commit
ran.
- Add conftest.py safety net that redirects STEAMAPPS_PATH,
CONFIG_DIR, STATE_FILE, SNAPSHOT_FILE, CONFIG_FILE, and
HOSTS_FILE to tmp_path in all steam_backlog_enforcer tests
- Add missing uninstall_other_games mock to 4 tests in
test_scanning.py (test_picks_shortest, test_skips_finished,
test_unknown_hours, test_picks_game_no_hours)
