{
  "title": "Split pacman_wrapper.sh under the 250-line cap",
  "objective": "Bring pacman_wrapper.sh (929 lines) under the cap by moving its 31 functions into five flat-deployed libraries, without any failure mode that could leave this machine without a working package manager — /usr/bin/pacman is a symlink to the deployed copy.",
  "acceptance_criteria": [
    "The entry script and all five pw_*.sh libs are at most 250 lines.",
    "Real read-only pacman queries through the split wrapper (-Qi bash, -Q) are byte-identical to the pre-split baseline.",
    "A missing library FAILS OPEN: warning on stderr, exec of real pacman, correct output and exit status.",
    "The five libs are deployed by install_files.sh and covered by the integrity manifest; tampering with one is detected and denied.",
    "verify_shell_split.sh reports all functions moved verbatim.",
    "The deployed /usr/local/bin/pacman_wrapper is byte-identical to the pre-work backup, and live pacman still works.",
    "shellcheck passes without -x, shfmt is a no-op, no suppression added."
  ],
  "out_of_scope": [
    "Running a live `pacman -S` transaction: the Bash tool deadlocks on db.lck and a failure costs the package manager.",
    "Re-deploying to /usr/local/bin — a separate, user-run step.",
    "The pre-existing SC2329 suppression on load_policy_lists, which predates this split."
  ],
  "verifier": "Real -Qi/-Q diffs against the captured baseline; a scratch-dir fail-open simulation with a lib removed; an integrity round-trip proving tamper detection covers the new libs; verify_shell_split.sh; sha256 of the deployed copy vs the pre-work backup; shellcheck + shfmt + check_file_length --all."
}