{
  "intent": "Bring block_compulsive_opening.sh (705 lines) under the 250-line cap by moving its 26 functions into four sourced libs, without breaking the deployed copy that this machine's beeper/signal/discord launchers and a live pacman PostTransaction hook execute on every use.",
  "scope": [
    "block_compulsive_opening.sh: 705 -> 182 lines",
    "New: lib/cco_state.sh (147), lib/cco_wrapper.sh (119), lib/cco_install.sh (238), lib/cco_report.sh (101)",
    "New: lib/tests/cco_harness.sh + lib/tests/test_cco_state.sh (21 assertions)",
    "Non-goal: executing install/uninstall/kill paths under test — they move system binaries and pkill running apps"
  ],
  "changes": [
    "Moved all 26 functions into four libs by responsibility: state/timing (cco_state), the launch path (cco_wrapper), install/uninstall + pacman hook (cco_install), status/reset/usage (cco_report). Extracted with meta/scripts/extract_shell_functions.py, which walks brace-by-brace rather than slicing line ranges.",
    "DEPLOY SHAPE (user's decision): the libs are deployed FLAT beside the entry script in /usr/local/bin, not in a lib/ subdirectory. This matches the existing precedent — /usr/local/bin/pacman_lock_lib.sh and heavy_job_lock.sh are already deployed and sourced exactly that way. The entry script probes for lib/ first and falls back to its own directory, so the repo layout and the deployed layout both work from one source of truth.",
    "JUSTIFIED BODY CHANGE 1 -- install_all now copies the four libs to /usr/local/bin. Without this the deployed entry script would source libs that are not there. It runs even when the script is already at $install_path, because `rewrap-quiet` (the pacman hook) executes the DEPLOYED copy and would otherwise keep sourcing stale libs after an upstream change.",
    "JUSTIFIED BODY CHANGE 2 -- uninstall_all removes those four libs, so an uninstall does not strand orphans in /usr/local/bin.",
    "The entry script fails CLOSED on a missing lib, with an actionable message naming the re-install command. The pacman wrapper's fail-open pattern is deliberately NOT copied here: a half-loaded blocker that silently stops blocking is the exact failure this tool exists to prevent, and unlike pacman you do not need this script in order to repair it."
  ],
  "verification": [
    {
      "command": "bash meta/scripts/check_file_length.sh --all",
      "result": "pass",
      "evidence": "Over-cap list went from 4 files to 3. block_compulsive_opening.sh is 182 lines; the largest new lib is cco_install.sh at 238."
    },
    {
      "command": "diff of `help`, `status` and an unknown command against pre-split baselines",
      "result": "pass",
      "evidence": "All three byte-identical, exit codes 0/0/1 unchanged. Re-verified after shfmt. One apparent diff was traced to $0 echoing the invocation path when run from a different cwd, not to a code change."
    },
    {
      "command": "bash meta/scripts/verify_shell_split.sh HEAD <old> <old> <4 libs>",
      "result": "pass",
      "evidence": "Exactly two -/+ pairs, install_all and uninstall_all — the two functions deliberately changed above. The other 24 functions moved byte-identically."
    },
    {
      "command": "python3 line-multiset check, original vs entry+libs (comments excluded)",
      "result": "pass",
      "evidence": "0 code lines from the 705-line original missing from the split."
    },
    {
      "command": "flat-layout simulation in a scratch dir (entry + 4 libs, no lib/ subdir)",
      "result": "pass",
      "evidence": "This is the shape install_all writes to /usr/local/bin. `help` and `status` both exit 0 from the flat layout. Removing one lib produces the fail-closed error naming the missing file and the re-install command, rather than a partial load."
    },
    {
      "command": "wrapper path against an unknown app, with HOME/XDG_STATE_HOME pointed at a tmpdir",
      "result": "pass",
      "evidence": "Rejects cleanly. The `APPS[$app]: unbound variable` message it emits was confirmed PRE-EXISTING by running the identical command against the pre-split original from git — byte-identical output, so not a regression introduced here. The real ~/.local/state/compulsive-block was confirmed untouched afterwards."
    },
    {
      "command": "lib/tests/run_all.sh",
      "result": "pass",
      "evidence": "21 assertions for cco_state, 0 failures (50 across the whole directory including the leechblock suites). Covers the allow/block decision in both directions, including the case that matters most: a PREVIOUS hour's stamp must not keep blocking, or an app could never be reopened."
    },
    {
      "command": "bash meta/scripts/shell_coverage.sh <run_all.sh> cco_state.sh 0",
      "result": "measured, below 100%",
      "evidence": "MEASURED: cco_state.sh 62/66 lines = 93.94%. The only four uncovered lines are kill_app's pkill/pkill -9 pair, which must never execute in a test on this machine. cco_wrapper/cco_install/cco_report are 0%: every function in them moves system binaries, writes /etc/pacman.d/hooks or kills processes."
    },
    {
      "command": "shellcheck (no -x) + shfmt -w idempotence on all 8 files",
      "result": "pass",
      "evidence": "shellcheck rc=0, no suppressions added. shfmt is a no-op on every file. The hyphenated associative-array keys (signal-desktop, and the APPS/REAL_BINARIES/APP_TIMEOUT_MINUTES/PROCESS_MATCH maps) were already quoted and the corruption canary is clean."
    }
  ],
  "risks": [
    "The deployed /usr/local/bin copy is NOT updated by this commit. Until `sudo block_compulsive_opening.sh install` is re-run, the deployed 705-line monolith keeps running — which is safe, because it is self-contained and unchanged. The dangerous ordering would be deploying the new entry script without its libs; the fail-closed guard turns that into a loud error rather than a silently disabled blocker.",
    "install_all is not executed by any test (it moves /usr/bin binaries), so its new lib-copy block is verified by the flat-layout simulation rather than by running it. The simulation reproduces exactly what it writes.",
    "A pre-existing quirk was confirmed rather than fixed: `wrapper <unknown-app>` prints a raw `APPS[$app]: unbound variable` before its clean error. Identical pre-split; out of scope for a behaviour-preserving split."
  ],
  "rollback": [
    "git revert the commit; block_compulsive_opening.sh returns to a single 705-line file and lib/cco_*.sh disappear.",
    "The deployed copy needs no rollback — this commit never touched it.",
    "If the split HAD been deployed before rolling back, re-run `sudo block_compulsive_opening.sh install` from the reverted tree and then confirm `ls /usr/local/bin/cco_*.sh` returns nothing and a wrapped app still launches."
  ]
}