Development record

The package runners' shell-string flags are not read: npx -c '<cmd>', npm exec --call '<cmd>' and pnpm dlx -c '<cmd>' run their value as a shell command, and the guard passes it unread, so npx -c 'kill-port 3000' is allowed while npx kill-port 3000 blocks. commands/guard.md and the runner change name this as a limit.