{
  "intent": "Split tether_enforcer.sh (267) below the cap, as the first phone_focus_mode split, and prove the deployment copy lists were updated so the daemon still finds its sibling on the phone.",
  "scope": [
    "phone_focus_mode/tether_enforcer.sh 267 -> 182",
    "New: phone_focus_mode/tether_iptables.sh 103",
    "phone_focus_mode/deploy.sh: added the sibling to both hardcoded lists",
    "phone_focus_mode/lib/tests/test_tether_enforcer.sh: copy the sibling into the scratch dir",
    "Non-goal: any behaviour change"
  ],
  "changes": [
    "Moved the nine iptables and tethering-offload functions into a sibling file, not a lib/ member: deploy.sh copies a hardcoded per-file list into REMOTE_DIR and never deploys lib/, so anything sourced on the phone must sit beside the entry script.",
    "deploy.sh has TWO hardcoded lists - an adb push into the staging dir and an adb_root cp into REMOTE_DIR. Both were updated. Missing the push would have left the copy pointing at a file that was never staged.",
    "The test harness copies only the entry script into a scratch dir, so it was taught to copy the sibling too - the same coupling as the phone deployment, in a form that can actually be run.",
    "This script is #!/system/bin/sh with `shell=ash` and has no `set -e`, so extract_shell_functions.py exited rather than guessing an anchor. The source line was placed by hand after the existing `. \"$SCRIPT_DIR/config.sh\"`, and the functions were lifted with the same brace-matching helper the tool uses."
  ],
  "verification": [
    {
      "command": "bash phone_focus_mode/lib/tests/test_tether_enforcer.sh, before and after",
      "result": "pass",
      "evidence": "17 passed, 0 failed both times. This is a real run of the daemon against fakes for iptables, settings and the state dir - it exercises the sibling source the same way the phone will, which is the strongest evidence available without the device."
    },
    {
      "command": "bash meta/scripts/verify_shell_split.sh HEAD tether_enforcer.sh tether_iptables.sh tether_enforcer.sh",
      "result": "pass",
      "evidence": "IDENTICAL: all 20 top-level functions moved verbatim."
    },
    {
      "command": "grep -n tether_iptables phone_focus_mode/deploy.sh",
      "result": "pass",
      "evidence": "Two hits: line 382 pushes it to the staging dir, line 499 copies it into REMOTE_DIR - mirroring exactly how tether_enforcer.sh itself is handled."
    },
    {
      "command": "shellcheck on the new sibling standalone",
      "result": "pass",
      "evidence": "Clean, with no suppression. The file is marked `shell=ash` to match the entry script's Android shell."
    },
    {
      "command": "pre-commit run --files <all four changed files>",
      "result": "pass",
      "evidence": "shellcheck and shfmt pass."
    },
    {
      "command": "bash ~/utils/scripts/check_file_length.sh --all",
      "result": "pass",
      "evidence": "24 files over cap, down from 25."
    }
  ],
  "risks": [
    "Not verified on the phone. The deploy path was not run, because deploying requires the device and a focus-mode window; the copy-list edits are verified by inspection plus the test harness, which reproduces the same source-a-sibling arrangement. The next deploy is where this gets confirmed - if tether enforcement stops working after it, this commit is the first place to look.",
    "The test harness now mirrors the deployment's file list in a third place. If a future split adds another sibling, all three lists must grow together."
  ],
  "rollback": [
    "git revert the commit; the entry script returns to 267 lines, the sibling disappears, and both deploy.sh lists shrink back.",
    "After rollback, re-run test_tether_enforcer.sh and expect 17 passed."
  ]
}