{
  "title": "Archive the legacy hosts-guard subsystem and repoint check_and_enable_services.sh at guard-lib",
  "objective": "setup_hosts_guard.sh was NEXT_SESSION_PROMPT.md's next split target, but live-machine inspection showed the whole legacy hosts-guard subsystem it belongs to (17 files) has been fully superseded by guard-lib (migrate_hosts_guard_to_guard_lib.sh, run 2026-07-04). The user confirmed archiving the whole subsystem instead of splitting it, and confirmed fixing the one live script (check_and_enable_services.sh) that still checked and self-repaired against the retired system.",
  "acceptance_criteria": [
    "All 17 legacy hosts-guard files (setup_hosts_guard.sh, enforce-hosts.sh, enforce-nsswitch.sh, enforce-resolved.sh, hosts-bind-mount.service, hosts-guard.path, hosts-guard.service, nsswitch-guard.path, nsswitch-guard.service, resolved-guard.path, resolved-guard.service, install_pacman_hooks.sh, pacman-hooks/hosts-guard-common.sh, pacman-hooks/pacman-post-relock-hosts.sh, pacman-hooks/pacman-pre-unlock-hosts.sh, psychological/unlock-hosts.sh, README.md, README_FOR_LLM.md) exist in kuhyx/testsAndMisc-archive with git history intact, including both pre-reorg path prefixes (hosts/guard/* and linux_configuration/hosts/guard/*).",
    "The archive push completed and was verified live on GitHub via the API before any deletion happened in the main repo.",
    "The same 17 files are removed from testsAndMisc via git rm; plugins/nsswitch-plugin.sh and plugins/resolved-plugin.sh (guard-lib's live plugins) are untouched.",
    "check_and_enable_services.sh's check_hosts() no longer references any deleted file or legacy systemd unit name; it checks guard-lib instance health via guardctl file-guard status instead, and running it --status against the live (already-migrated) machine reports the hosts service as ok, not error.",
    "linux_configuration/.github/copilot-instructions.md (always-loaded) contains no remaining references to the archived files or the legacy mechanism.",
    "bash meta/scripts/check_file_length.sh --all reports fewer or equal over-cap files than before this session (12 -> 11), and check_and_enable_services.sh (already over cap, on the out-of-scope list) did not grow.",
    "pre-commit run --files passes on the full staged set for both the deletion+edit commit and the evidence/contract commit."
  ],
  "out_of_scope": [
    "Splitting check_and_enable_services.sh itself -- it is on NEXT_SESSION_PROMPT.md §4's out-of-scope list; edited in place only.",
    "Fixing the pre-existing defect where /etc/guard-lib/targets/{nsswitch,resolved}.conf point PLUGIN= at the repo checkout instead of /usr/local/share/guard-lib-plugins/ -- flagged in evidence risks[], not fixed (requires sudo mutation of live security enforcement + guardctl re-registration, not something the user was asked to approve this session).",
    "Updating linux_configuration/docs/security-hardening/{01-current-state,03-implementation,04-agent-personas,05-llm-readmes}.md -- these predate the 2026-07-04 guard-lib migration itself and were already stale before this session; fixing them is a larger doc-accuracy pass outside what was scoped.",
    "§4's other listed files (setup_midnight_shutdown.sh, generate_study_materials.sh, pacman_wrapper.sh, setup_night_lockdown.sh, install_leechblock.sh, block_compulsive_opening.sh, the Kotlin/Dart files) -- untouched, per standing scope.",
    "Any test suite for the archived subsystem -- it never had one, and the standing 100%-coverage decision applies to code that is split, not code that is deleted/archived (same precedent as archive-plagiarism-tools and archive-libre-translate, neither of which added tests)."
  ],
  "verifier": "gh api repos/kuhyx/testsAndMisc-archive/contents/linux_configuration/scripts/periodic_background/hosts/guard confirming all 17 files present before the git rm commit; sudo bash check_and_enable_services.sh --status showing the Hosts File and Guards section all-OK against live guard-lib state; bash -n + shellcheck on check_and_enable_services.sh and hosts/install.sh; bash meta/scripts/check_file_length.sh --all; pre-commit run --files on the full staged set."
}