Development record

Found in a counterpart: internal/surface/cli/guard.go:31-34 says the hook treats a guard that cannot answer as 'fail-OPEN (loud, exit 0 ...)'. failOpen returns exit 1 (guard.go:332-335), as 17-guard.md:71-73 and docs/how-to/install.md:152-157 state, because the host discards stderr on exit 0.