Development record

abcd guard check --help (mirrored in the generated docs/reference/cli/commands.md) says an allow still does not see a parameter expansion with no substitution ($VAR, ${VAR:-git}) wherever it stands, because the guard sees the variable, not its expansion; since the carried-value reading the guard does read a value the same line assigns and uses: P=pkill; $P make and X=rm-payload; sh -c "$X" both block. The help under-states the guard (it fails safe).