Development record

.abcd/development/brief/04-surfaces/17-guard.md:997-998 gives `rm -rf "$DIR"/*` with DIR unset as a target an allow does not see. `abcd guard check` blocks it, exit 1, under the bundled entry rm-unguarded-variable-path (internal/core/guard/defaults/guard.json:126; commands/guard.md:1082), and likewise the `$DIR/*`, `"${DIR}"/*` and `"$DIR"/x` spellings. The chapter never names the entry.