{
  "title": "Cover nc_php.sh and teach the jail runner to measure foreign-platform subjects",
  "objective": "Extend the namespace-jail runner with the path seeding and bind-failure handling needed to measure a library written for another distribution, and use it to bring nc_php.sh -- the next-hardest library on the allowlist -- as close to the 100% bar as its code allows.",
  "acceptance_criteria": [
    "nc_php.sh measures at least 98% through its new suite, run inside the jail with the documented binds and seeds.",
    "dot_resolver_install.sh still measures 39/39 = 100.00% after every runner change, proving no regression.",
    "A bind-mount that cannot be established fails the run instead of warning, so a silent bind failure can never be reported as unreachable code.",
    "--seed-dir creates a directory that does not exist on the host, verified by a probe asserting /etc/php/8.2/apache2 exists inside the jail while /etc/php does not exist outside it.",
    "shellcheck is clean on every new and modified file, with no suppression added.",
    "The real /etc, /var and /root are unmodified after every run; the jail's escape assertion stays armed."
  ],
  "out_of_scope": [
    "Removing nc_php.sh from the allowlist: at 98.82% it is below the 100% bar and must stay exempt until line 111 is covered.",
    "Covering line 111 (the crontab first-run fallback). Two attempts hung the suite for the full timeout; it is left uncovered and documented rather than attempted a third time.",
    "Wiring the gate into the hook chain.",
    "Modifying nc_php.sh itself -- the jail is meant to reach production code unchanged."
  ],
  "verifier": "bash meta/scripts/shell_coverage_jail.sh --subject linux_configuration/scripts/single_use/features/lib/tests/run_all.sh --bind /etc --bind /usr/local/bin --bind /var --bind /root --seed-dir /var/www/nextcloud --seed-dir /var/lib --seed-dir /etc/php/8.2/apache2 --seed-dir /etc/php/8.2/mods-available --seed-file /etc/php/8.2/apache2/php.ini --measure nc_php.sh --min 0 -- \"\" (expects 84/85 = 98.82%), then the same command with --measure dot_resolver_install.sh --min 100 (expects 39/39)."
}