{
  "title": "Shrink the shell-coverage allowlist: a real test suite for linux_configuration/scripts/lib",
  "objective": "Start chipping at the 115-entry shell-coverage allowlist with the smallest concentrated batch, so the ratchet narrows rather than merely holding. One tests/run_all.sh covers all nine libraries in that directory at once, which is what makes this the highest-ratio first batch. The nine entries come off the allowlist as a result — the deliverable is the allowlist shrinking, not the suite existing.",
  "acceptance_criteria": [
    "run_all.sh runs every test_*.sh in the directory and exits 0, with all four suites reporting zero failures.",
    "The suite is proven NON-VACUOUS by mutation: the coverage gate only checks that tests/run_all.sh exists, so an empty file would mark all nine libraries covered while testing nothing. Each of the four load-bearing rules must be mutated and the suite must go red for each.",
    "meta/shell-coverage-allowlist.txt drops from 115 entries to 106, with zero entries remaining for linux_configuration/scripts/lib/ — the measured delta, not a rounded one.",
    "No assertion depends on wall-clock time, this host's udev rules, or a real device: the suite runs in shell-tests.yml and again on every pre-push via ci-mirror, so a host-dependent assertion becomes a push-blocking flake.",
    "Sourcing a library must not write outside the test tmpdir — android.sh calls ensure_dir on a $HOME path at source time.",
    "shellcheck and shfmt pass with no suppression added."
  ],
  "out_of_scope": [
    "Wiring shell-coverage-ratchet into .pre-commit-config.yaml. That edit is denied as a sensitive file and belongs to the user; NEXT_SESSION_PROMPT.md carries the block.",
    "The effecting half of these libraries: require_hosts_readable (exec sudo), check_adb_device/check_adb_root (die -> exit), collapse_mounts (umount -l), install_missing_pacman_packages, require_imagemagick, notify. Phase 1 measured this pattern already — decision logic reaches ~90%, effecting code reaches 0%.",
    "mtk_udev_catchall_files, which globs /etc/udev/rules.d with no seam and would read this host's real rules.",
    "The other 106 allowlist entries; the next concentrated batches are single_use/features/lib (45) and single_use/fixes/lib (22).",
    "A percentage coverage bar. The bar remains presence, as settled in Phase 3."
  ],
  "verifier": "bash linux_configuration/scripts/lib/tests/run_all.sh (exit 0; 139 assertions across 4 suites). Four mutations applied to throwaway copies, each required to turn the suite red: classify_device's `&&` -> `||` (would classify a stranger's MediaTek phone as the target device), discover_partitions' `init_boot boot` -> `boot init_boot` (would dump the wrong partition on Android 13+ hardware), mtk_select_device's `-gt 1` -> `-gt 99` (would silently pick one of two attached phones), and is_hour_in_range's `10#$` removal (the 08/09 octal trap). Allowlist delta measured with `grep -vc '^#\\|^$' meta/shell-coverage-allowlist.txt` before and after --seed."
}