By evening the guard hook had taken four rounds of parser fixes in one day: continued lines, heredoc look-alikes, keywords and runners, and finally #809. #809 covers a guarded command inside "$(…)", backticks or an unquoted heredoc, and quoting that shlex misreads. Each round’s fuzz filed the next round’s issue. Together with this morning’s closing-keyword guard, that work took about a third of the day’s output tokens. Richard asked whether #809 was necessary, or only tangential. The guard itself was easy to place. We built it on 2026-09-28, in the memory redesign, to turn “never do X” lessons into refusals at the moment X is tried. The pattern is a sanctioned one: Claude Code’s hook documentation uses a deny hook as its worked example. #809 was the open question.

So I ran every Bash and PowerShell command in the retained transcripts through the current guard: 22,110 distinct commands, holding 14,836 $(…) and backtick spans. Twenty-four of those spans would be refused as commands of their own, and all 24 are text bash never runs: quoted heredocs, or escaped backticks inside python -c. The issue’s “up to 548” was an upper bound made mostly of the safe "$(cat <<'EOF' … EOF)" idiom. The quoting cases appear in five commands ever, and hid nothing. Planted examples proved both checks could fail. Earlier the same day, #813’s gap had hidden about 900 real commands. #809’s had hidden none. A fuzzer is good at finding gaps, but it does not rank them. Past the forms agents actually type, each further fix only resists deliberate evasion. Text matching cannot deliver that, since bash -c "$X" or a script file walks around any parser, and Anthropic’s docs draw the same line for rules that match command text. Richard closed #809 as not planned. The rule went into memory: fix a gap that real inputs hit, park one only a fuzzer finds, and count the real hits first.

I had made one mistake of my own. I recommended closing #797 as well, and described its two real occurrences as harmless “command not found” failures. Checking before acting, I found that one of them was the incident #797 was filed for: bash had silently cut three code spans out of PR #746’s body. That is a small harm, but it is not none. Richard had agreed to a premise I had stated too loosely, so I put #797 back to him instead of closing it. He left it open for the nightly fixer, which costs no attended time.