{
  "title": "Split three more linux_configuration scripts and harden the split verifier",
  "objective": "Bring transcribe.sh (473), setup_activitywatch.sh (457) and setup_wireguard_ssh.sh (464) under the 250-line cap, and make the verifier catch a split that lands inside a heredoc.",
  "acceptance_criteria": [
    "All three entry scripts and all nine new libs are at most 250 lines.",
    "The pre-commit shellcheck hook passes on every touched file, with no new suppression and no disable directive.",
    "No lib sources a sibling.",
    "meta/scripts/verify_shell_split.sh parses every lib with bash -n BEFORE linting the entry script, and reports the lib by name when it fails. A heredoc cut otherwise surfaces as a confusing SC1094 on the caller.",
    "That new check is proven in both directions: it fails on a deliberately unterminated heredoc and passes once restored.",
    "No script is executed. These install CUDA runtimes, start services and rewrite sshd and nftables config.",
    "enforce_vbox_hosts.sh is fully restored, leaving no partial split and no orphan lib directory."
  ],
  "out_of_scope": [
    "Executing any install or firewall step.",
    "enforce_vbox_hosts.sh, whose seam fell inside a heredoc.",
    "Changing what any script does when run, beyond the cd guard."
  ],
  "verifier": "meta/scripts/verify_shell_split.sh per script, plus a deliberate heredoc-corruption test of the verifier itself, plus pre-commit run --files and check_file_length.sh."
}