{
  "title": "Split install_pacman_wrapper.sh under the 250-line cap",
  "objective": "Bring linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh (316 lines) under the repo-wide 250-line file cap by moving its middle steps into a sibling lib/, with byte-identical runtime behaviour proven by an executed before/after trace, and without relocating any statement the trace harness cannot reach.",
  "acceptance_criteria": [
    "install_pacman_wrapper.sh and all four new lib/*.sh files are each at most 250 lines.",
    "meta/scripts/trace_shell_split.sh with the four required --bind-abs flags produces an identical trace before and after: same exit status (1, at the unbindable /usr/bin symlink), same stubbed call, and all 16 generated-file content hashes unchanged -- notably pacman_wrapper at sha=548fc2b53ee4cea6, which proves the sed -i still runs after the copy, and source.sha256 at sha=4c928a499d437070.",
    "Nothing that was moved into a lib sits at or after the ln -sf /usr/bin/pacman line, nor inside the `if [ ! -L /usr/bin/pacman ]` backup branch, since neither executes under the harness.",
    "linux_configuration/tests/test_pacman_wrapper_security.sh produces output byte-identical to its pre-split run, with all of its installer source-text assertions intact and none weakened.",
    "shellcheck clean at the real gate (pre-commit run shellcheck) and shfmt clean on every touched file, with zero suppressions -- no # shellcheck disable, no per-file ignores, and no `export` used to silence SC2034.",
    "The verification runs write nothing outside the trace prefix: /usr/bin/pacman still symlinks to /usr/local/bin/pacman_wrapper and `pacman --version` still works."
  ],
  "out_of_scope": [
    "Any behaviour change, including reordering the sed -i relative to the wrapper copy.",
    "Weakening any assertion in test_pacman_wrapper_security.sh or its libs; only the search PATH of installer source-text greps may widen to include lib/.",
    "The pre-existing single failure in test_security_hardening.sh ('Compulsive block wrappers installed'), which fails identically at HEAD and belongs to block_compulsive_opening.sh -- explicitly out of scope.",
    "Fixing the pre-existing repo-wide jscpd overage caused by vendored .venv site-packages.",
    "Wiring the file-length pre-commit hook -- it must land last."
  ],
  "verifier": "meta/scripts/trace_shell_split.sh install_pacman_wrapper.sh --prefix <fresh-empty-dir> --bind-abs /usr/local/bin --bind-abs /usr/local/share/digital_wellbeing --bind-abs /usr/local/share/digital_wellbeing/virtualbox --bind-abs /var/lib/pacman-wrapper, captured at HEAD and again after the split, then diff of the two traces (must be empty); diff of test_pacman_wrapper_security.sh output before and after (must be empty); diff of test_security_hardening.sh output before and after (must be empty, both exit 1); pre-commit run shellcheck --files <all touched>; shfmt -d; jscpd as the git hook runs it, measured in a clean worktree with the changes applied; bash ~/utils/scripts/check_file_length.sh --all; ls -la /usr/bin/pacman plus pacman --version."
}