{
  "title": "Gate shellcheck on every finding, and fix all 222 that the old gate hid",
  "objective": "The pre-commit shellcheck hook ran with --severity=warning, so info- and style-level findings never failed a commit. 222 of them had accumulated across 94 of 244 shell files, and several were real defects rather than style noise. Make the hook fail on ANY shellcheck finding and drive the repo to zero, fixing the underlying code rather than suppressing it.",
  "acceptance_criteria": [
    "shellcheck reports zero findings, at full strictness, across every tracked first-party .sh file",
    "The pre-commit hook runs shellcheck with no --severity filter",
    "The hook demonstrably FAILS on an info-level-only finding and passes on the clean tree",
    "Sourced files are genuinely followed (external-sources + source-path) rather than SC1091 being silenced",
    "Every remaining `# shellcheck disable=` carries a written reason at the call site",
    "Behaviour is preserved: scripts that were runnable before still run, and tests that covered them still pass"
  ],
  "out_of_scope": [
    "third_party/ — vendored upstream code we do not own; excluded from the hook, matching the existing prettier exclusion",
    "The pre-existing SC2034 disable in check_polling_antipatterns.sh, which hides a real bug (its `patterns` array is never used, so the checker checks nothing). Reported, not fixed — it is a behavioural change beyond a lint sweep.",
    "linux_configuration/scripts/single_use/fresh-install/main.sh — another session's uncommitted work, deliberately left unstaged"
  ],
  "verifier": "pre-commit run shellcheck --all-files (exit 0); the same hook against a deliberately planted info-level canary (exit 1); per-file `bash -n`/`sh -n`; and re-running the affected test suites"
}