{
  "intent": "Split three more linux_configuration scripts, and harden the verifier after a split silently corrupted a file.",
  "scope": [
    "misc/testsAndMisc-bash/transcribe.sh (473 -> 39) + transcribe_pkgmgr, transcribe_deps, transcribe_venv",
    "single_use/features/setup_activitywatch.sh (457 -> 102) + aw_install, aw_service, aw_autostart",
    "single_use/features/setup_wireguard_ssh.sh (464 -> 136) + wg_keys, wg_firewall, wg_sshd",
    "meta/scripts/verify_shell_split.sh (lib parse check moved ahead of the entry lint)",
    "Deferred and fully restored: virtualbox/enforce_vbox_hosts.sh (443)",
    "Non-goal: no script executed"
  ],
  "changes": [
    "Nine libs across three scripts, each needing a second carve after the first pass.",
    "enforce_vbox_hosts.sh was reverted because the split landed INSIDE a heredoc: the resulting lib had an unterminated here-document and bash -n rejected it outright. This is the first split in the whole effort to produce a file that does not parse, and it is the most dangerous failure mode yet - shellcheck reported it only as SC1094 'parsing of sourced file failed' on the caller, which reads like a linting nicety rather than a broken file.",
    "The verifier now runs bash -n over every lib BEFORE linting the entry, and names the offending lib with a hint about heredocs. Proven in both directions on a deliberately corrupted copy.",
    "Fixed another unguarded cd, this one before `git clone ... .` - a failed cd would have cloned an AUR repo into the caller's working directory.",
    "ALLOW_WEB and ALLOW_DNS are declared in the entry, set by the arg parser in one lib and read by the ruleset builder in another; exported, which is what SC2034 asks for and makes the three-way contract explicit."
  ],
  "verification": [
    {
      "command": "meta/scripts/verify_shell_split.sh per script",
      "result": "fail then pass",
      "evidence": "All three now report 'libs sourced, functions defined'. Four real failures on the way: chained libs in all three, the unguarded cd, the exported flags, and the vbox heredoc corruption."
    },
    {
      "command": "append an unterminated heredoc to a lib, re-run the verifier, restore",
      "result": "pass",
      "evidence": "Reports the here-document parse failure and exits non-zero; passes again once restored. Tested in both directions, because a check that never fires is worse than none."
    },
    {
      "command": "git checkout HEAD -- enforce_vbox_hosts.sh, rm its lib dir, bash -n and shellcheck -x",
      "result": "pass",
      "evidence": "Restored to 443 lines, parses and lints clean."
    },
    {
      "command": "pre-commit run --files <13 changed files>",
      "result": "pass",
      "evidence": "Clean, including shellcheck over each lib in isolation."
    }
  ],
  "risks": [
    "None of the three was run: they install CUDA runtimes and AUR packages, start user services, and rewrite sshd and nftables configuration.",
    "The heredoc failure means the function-boundary heuristic the splitter uses is not safe on files with heredocs at top level. bash -n now catches it, but only after the fact - the splitter itself still has no awareness of heredocs.",
    "enforce_vbox_hosts.sh stays at 443 lines and needs a seam chosen by hand, outside any heredoc."
  ],
  "rollback": [
    "git revert the commit; the three scripts return to their previous sizes, the nine libs disappear, and the verifier loses its parse check.",
    "After rollback, re-run bash -n and shellcheck on the restored scripts."
  ]
}