From 4e668e19371bc10669eb380f7433ee29e132240c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 5 Aug 2026 12:01:20 +0000
Subject: [PATCH 1/5] chore: capture four bugs verified by the bug-hunt loop
 (round 1)

iss-184 (critical, guard heredoc arithmetic-shift bypass), iss-185
(critical, scanner adjacent-secret boundary bypass), iss-186 (minor,
capture transition remove-failure strands an issue id), iss-187 (minor,
rules.Merge panics on a nil-Domains base). Each carries a reproducing
test verified independently before capture. This PR fixes iss-184; the
other three remain open for a future round.

Assisted-by: Claude:claude-opus-5
---
 .../iss-184-guard-heredoc-arithmetic-shift-bypass.md | 12 ++++++++++++
 ...ss-185-scanner-adjacent-secret-boundary-bypass.md | 12 ++++++++++++
 ...apture-transition-remove-failure-strands-issue.md | 12 ++++++++++++
 .../open/iss-187-rules-merge-nil-domains-panic.md    | 12 ++++++++++++
 4 files changed, 48 insertions(+)
 create mode 100644 .abcd/work/issues/open/iss-184-guard-heredoc-arithmetic-shift-bypass.md
 create mode 100644 .abcd/work/issues/open/iss-185-scanner-adjacent-secret-boundary-bypass.md
 create mode 100644 .abcd/work/issues/open/iss-186-capture-transition-remove-failure-strands-issue.md
 create mode 100644 .abcd/work/issues/open/iss-187-rules-merge-nil-domains-panic.md

diff --git a/.abcd/work/issues/open/iss-184-guard-heredoc-arithmetic-shift-bypass.md b/.abcd/work/issues/open/iss-184-guard-heredoc-arithmetic-shift-bypass.md
new file mode 100644
index 00000000..9100d666
--- /dev/null
+++ b/.abcd/work/issues/open/iss-184-guard-heredoc-arithmetic-shift-bypass.md
@@ -0,0 +1,12 @@
+---
+schema_version: 1
+id: "iss-184"
+slug: "guard-heredoc-arithmetic-shift-bypass"
+severity: "critical"
+category: "bug"
+source: "agent-finding"
+found_during: "bug-hunt loop round 1"
+found_at: "internal/core/guard/tokenize.go:152"
+---
+
+guard tokenizer heredoc misparse: an unquoted arithmetic left-shift with an identifier operand (e.g. `$((1<<shift))`) is misparsed as a here-document start by isDelimStart (tokenize.go:206, accepts any word starting with a letter/underscore) plus readHeredocDelim (tokenize.go:249, terminates the delimiter word on ')'). skipHeredocBodies (tokenize.go:264) then scans for a line equal to the bogus delimiter, finds none, and silently swallows every subsequent line of the command before it reaches command position. A dangerous command on a later line (git push --force, rm -rf, gh repo delete, etc.) is never seen by Registry.Check and the guard returns VerdictAllow with no error — a silent fail-open, not the loud could-not-answer path the shim reserves for unparsable input. Confirmed live via both CLI front doors (internal/surface/cli/guard.go: guard check and guard hook). The literal-digit form (1<<20) is unaffected; only identifier/variable operands trip it. Reproducing test: internal/core/guard/tokenize_test.go, TestArithmeticShiftByIdentifierIsNotAHeredoc.
\ No newline at end of file
diff --git a/.abcd/work/issues/open/iss-185-scanner-adjacent-secret-boundary-bypass.md b/.abcd/work/issues/open/iss-185-scanner-adjacent-secret-boundary-bypass.md
new file mode 100644
index 00000000..bb4b5cc3
--- /dev/null
+++ b/.abcd/work/issues/open/iss-185-scanner-adjacent-secret-boundary-bypass.md
@@ -0,0 +1,12 @@
+---
+schema_version: 1
+id: "iss-185"
+slug: "scanner-adjacent-secret-boundary-bypass"
+severity: "critical"
+category: "bug"
+source: "agent-finding"
+found_during: "bug-hunt loop round 1"
+found_at: "internal/adapter/scanner/scanner.go:274"
+---
+
+scanner leaves a second back-to-back secret token undetected and unredacted, and the fail-closed residual re-scan reports clean anyway. Fixed-length token patterns (e.g. github_pat_ at patterns.go:93) require a leading \b; when two same-family tokens are concatenated with no separator, the first regex match consumes bytes up through the second token's first byte, leaving word/word at the junction so the second token's \b can never match. ScanText (scanner.go:274) therefore returns only one finding. Redact's fingerprintSpan keeps 2 raw alnum bytes at the tail of the masked span (scanner.go:393), so the junction stays word/word after redaction too — the second token survives completely raw in the output. Because the boundary never recovers, history.Capture's stage-two residual check (history.go:159, blockingResidual) re-scans the redacted text, finds nothing, and writes the record to disk with a live secret still in it, directly violating history's documented fail-closed guarantee ('a stored record can never contain a live secret'). Distinct from iss-65 (Finding.MarshalJSON snippet cross-leak in serialized findings, already fixed) — this is a ScanText/Redact detection gap in the scan pass itself. Reproducing test: internal/adapter/scanner/, TestConcatenatedSecretsBothDetected.
\ No newline at end of file
diff --git a/.abcd/work/issues/open/iss-186-capture-transition-remove-failure-strands-issue.md b/.abcd/work/issues/open/iss-186-capture-transition-remove-failure-strands-issue.md
new file mode 100644
index 00000000..5a7f6d89
--- /dev/null
+++ b/.abcd/work/issues/open/iss-186-capture-transition-remove-failure-strands-issue.md
@@ -0,0 +1,12 @@
+---
+schema_version: 1
+id: "iss-186"
+slug: "capture-transition-remove-failure-strands-issue"
+severity: "minor"
+category: "bug"
+source: "agent-finding"
+found_during: "bug-hunt loop round 1"
+found_at: "internal/core/capture/workflow.go:266"
+---
+
+capture.commitTransition writes the destination file before removing the source (workflow.go:255-273); a non-ENOENT os.Remove(src) failure (EPERM/EROFS/EIO — e.g. a read-only remount or restrictive ACL on the source status dir) returns an error after dst already landed, with no rollback of dst. The same issue id is now present in two status directories (e.g. both open/ and resolved/). findIssue (alloc.go:383) then rejects any further transition on that id as ErrDuplicateIssueID, so it can never again be resolved or wontfixed on a healthy filesystem — no repair verb exists; recovery requires manually deleting one copy. scanLedger-based reads (List/Status) do not dedupe either, so the id also double-counts. Confirmed with a real non-ENOENT unlink failure (ext4 immutable attribute on the source dir, which blocks unlink even as root, unlike chmod). Reproducing test: internal/core/capture/, TestTransitionRemoveFailureStrandsIssueInTwoDirs.
\ No newline at end of file
diff --git a/.abcd/work/issues/open/iss-187-rules-merge-nil-domains-panic.md b/.abcd/work/issues/open/iss-187-rules-merge-nil-domains-panic.md
new file mode 100644
index 00000000..1851ca3a
--- /dev/null
+++ b/.abcd/work/issues/open/iss-187-rules-merge-nil-domains-panic.md
@@ -0,0 +1,12 @@
+---
+schema_version: 1
+id: "iss-187"
+slug: "rules-merge-nil-domains-panic"
+severity: "minor"
+category: "bug"
+source: "agent-finding"
+found_during: "bug-hunt loop round 1"
+found_at: "internal/core/rules/rules.go:193"
+---
+
+rules.Merge panics with 'assignment to entry in nil map' (rules.go:193) when the base RuleSet's Domains field is nil and the overlay has at least one domain key. cloneRuleSet (rules.go:524) only allocates out.Domains when the source map is already non-nil, so a base like RuleSet{SchemaVersion: 1} (a Validate-accepted, valid zero-ish value) crashes on merge, contradicting Merge's own doc comment ('New domain keys are added') which promises no such precondition. The sibling loader guard.Merge (internal/core/guard/config.go:77-79) gets this right, explicitly allocating out.Entries when nil before the same kind of loop — Merge is simply missing that guard. Not reachable today: RuleSet.Load's only call site passes Merge(Defaults(), over), and Defaults() always has non-nil Domains, so this is a latent exported-API contract defect rather than a live crash — it becomes live the moment any caller merges onto a non-Defaults() base (e.g. a future multi-tier overlay starting from an empty RuleSet). Reproducing test (recover-guarded): internal/core/rules/, TestMergeNilBaseDomainsAddsNewKeys.
\ No newline at end of file

From 662edce8d90b3c56f704b95af748eb6b4ed69c58 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 5 Aug 2026 12:07:54 +0000
Subject: [PATCH 2/5] fix: the guard fails loud, not silent, when a `<<` is not
 a heredoc (iss-184)

An unquoted arithmetic left shift with an identifier operand
($((1<<shift))) was misparsed as a here-document delimiter, and
skipHeredocBodies then silently swallowed every remaining line of the
command looking for a terminator that never appears -- dropping a
later git push --force or rm -rf from ever reaching command position
with no error and no signal. A genuinely unterminated heredoc had the
same gap.

skipHeredocBodies now reports whether it actually found each pending
heredoc's terminator; tokenize turns a miss into ErrUnparsableCommand,
the same class an unterminated quote already uses, so the guard fails
open LOUDLY per its own documented contract instead of silently.

Detectors: TestArithmeticShiftByIdentifierIsRejected and
TestTokenizeRejectsUnterminatedHeredoc, both watched failing on
pre-fix code for the claimed reason and passing after. An existing
test that pinned the old silent-swallow as intended behaviour is
updated to assert the corrected contract.

Assisted-by: Claude:claude-opus-5
---
 internal/core/guard/tokenize.go      | 25 ++++++++++++---
 internal/core/guard/tokenize_test.go | 46 +++++++++++++++++++++++++---
 2 files changed, 61 insertions(+), 10 deletions(-)

diff --git a/internal/core/guard/tokenize.go b/internal/core/guard/tokenize.go
index 69ff9d3b..46e21f7f 100644
--- a/internal/core/guard/tokenize.go
+++ b/internal/core/guard/tokenize.go
@@ -127,7 +127,11 @@ func tokenize(line string) ([]segment, error) {
 			// is not complete, so the body waits — what follows it is still
 			// command text.
 			if len(pending) > 0 && !lastList {
-				i = skipHeredocBodies(line, i, pending)
+				next, ok := skipHeredocBodies(line, i, pending)
+				if !ok {
+					return nil, fmt.Errorf("%w: unterminated here-document body", ErrUnparsableCommand)
+				}
+				i = next
 				pending = nil
 			}
 			// lastList is NOT cleared here: a blank or comment-only line after a
@@ -259,10 +263,17 @@ func readHeredocDelim(line string, pos int) (heredoc, int, error) {
 
 // skipHeredocBodies consumes the body of every pending here-document, starting
 // at pos (the first byte after the newline that ended the command line), and
-// returns the position just past the last body. An unterminated body swallows
-// the rest of the input — exactly as a shell would treat it.
-func skipHeredocBodies(line string, pos int, pending []heredoc) int {
+// returns the position just past the last body. The second return is false if
+// any body never finds its terminating delimiter line before the input ends —
+// which is either a genuinely truncated heredoc, or a `<<` that isDelimStart
+// mistook for one (an identifier-operand arithmetic shift, `$((1<<shift))`,
+// reads as a delimiter word). Either way, silently consuming the remainder of
+// the line as unchecked "body" text would swallow real commands with no
+// signal; the caller turns a false result into ErrUnparsableCommand so the
+// guard fails open LOUDLY on it instead of silently.
+func skipHeredocBodies(line string, pos int, pending []heredoc) (int, bool) {
 	for _, hd := range pending {
+		found := false
 		for pos < len(line) {
 			end := pos
 			for end < len(line) && line[end] != '\n' {
@@ -278,9 +289,13 @@ func skipHeredocBodies(line string, pos int, pending []heredoc) int {
 				pos = end
 			}
 			if text == hd.delim {
+				found = true
 				break
 			}
 		}
+		if !found {
+			return pos, false
+		}
 	}
-	return pos
+	return pos, true
 }
diff --git a/internal/core/guard/tokenize_test.go b/internal/core/guard/tokenize_test.go
index 79b02cf1..87b9e6f1 100644
--- a/internal/core/guard/tokenize_test.go
+++ b/internal/core/guard/tokenize_test.go
@@ -129,11 +129,6 @@ func TestTokenizeSegments(t *testing.T) {
 			line: "cat <<EOF |\ngrep x\nrm -rf *\nEOF",
 			want: []string{"0:cat", "0:grep|x"},
 		},
-		{
-			name: "an unterminated heredoc swallows the rest of the input",
-			line: "cat <<EOF\nrm -rf *",
-			want: []string{"0:cat"},
-		},
 		{
 			name: "a blank line does not break a list continuation",
 			line: "cd scratch &&\n\nrm -rf *",
@@ -201,3 +196,44 @@ func TestTokenizeRejectsUnterminatedQuote(t *testing.T) {
 		}
 	}
 }
+
+// TestTokenizeRejectsUnterminatedHeredoc: a here-document whose delimiter line
+// never appears is unparsable, not a silent swallow of the remaining input —
+// the guard must fail open LOUDLY on it rather than allow whatever commands
+// happened to follow with no signal at all.
+func TestTokenizeRejectsUnterminatedHeredoc(t *testing.T) {
+	const line = "cat <<EOF\nrm -rf *"
+	if _, err := tokenize(line); !errors.Is(err, ErrUnparsableCommand) {
+		t.Fatalf("tokenize(%q) error = %v, want ErrUnparsableCommand", line, err)
+	}
+}
+
+// TestArithmeticShiftByIdentifierIsRejected pins the identifier-operand form of
+// the same boundary the literal-digit case above already covers: an unquoted
+// `<<` whose "delimiter" word is never terminated by a matching line — because
+// it was never a real heredoc delimiter to begin with, e.g. `$((1<<shift))` —
+// must not silently swallow the rest of the command as unchecked body text. It
+// is unparsable, exactly like an unterminated quote, so tokenize errors rather
+// than dropping the remaining lines from command position.
+func TestArithmeticShiftByIdentifierIsRejected(t *testing.T) {
+	const line = "shift=8\necho $((1<<shift))\ngit push --force origin main"
+	if _, err := tokenize(line); !errors.Is(err, ErrUnparsableCommand) {
+		t.Fatalf("tokenize(%q) error = %v, want ErrUnparsableCommand", line, err)
+	}
+
+	// The guard must not silently allow the command either: Check surfaces the
+	// same error rather than returning VerdictAllow.
+	if _, err := Defaults().Check(line); !errors.Is(err, ErrUnparsableCommand) {
+		t.Fatalf("Check(%q) error = %v, want ErrUnparsableCommand", line, err)
+	}
+
+	// Control: the literal-operand form must still parse and block normally.
+	const lit = "echo $((1<<20))\ngit push --force origin main"
+	d, err := Defaults().Check(lit)
+	if err != nil {
+		t.Fatalf("Check(%q): unexpected error: %v", lit, err)
+	}
+	if d.Verdict != VerdictBlock {
+		t.Fatalf("control: Check(%q).Verdict = %q, want %q", lit, d.Verdict, VerdictBlock)
+	}
+}

From 54fb692271f4abc58c8769faa99c63c1ba82b7b3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 5 Aug 2026 12:08:03 +0000
Subject: [PATCH 3/5] docs: resolve iss-184 in the ledger and record the round
 (bug-hunt loop)

Moves iss-184 open -> resolved via abcd capture resolve (impact: fix).
DECISIONS.md gets one dated round-summary line for the bug-hunt loop's
first round, naming the fix and the three bugs captured but not fixed
this round (iss-185, iss-186, iss-187). CHANGELOG gains the
user-facing Fixed entry.

Assisted-by: Claude:claude-opus-5
---
 .abcd/work/DECISIONS.md                                |  1 +
 .../iss-184-guard-heredoc-arithmetic-shift-bypass.md   |  2 ++
 CHANGELOG.md                                           | 10 ++++++++++
 3 files changed, 13 insertions(+)
 rename .abcd/work/issues/{open => resolved}/iss-184-guard-heredoc-arithmetic-shift-bypass.md (65%)

diff --git a/.abcd/work/DECISIONS.md b/.abcd/work/DECISIONS.md
index d9c5b87e..b94d6719 100644
--- a/.abcd/work/DECISIONS.md
+++ b/.abcd/work/DECISIONS.md
@@ -920,3 +920,4 @@ parallel-agent merge contention bites.
 - 2026-08-05 — iss-80 (v0.5.0): resolved as already-fixed, with the residual verification gap closed rather than the defect re-fixed. The branch-local id-collision class this item tracked — `itd-N`/`spc-N`/`iss-N` allocators scanning only the working tree, so two agents on branches cut from one base each mint the same id and collide at merge — was already closed by iss-115 and iss-120, which introduced `recordid.MaxAcrossRefs` (scan every git ref for the family's highest committed id) and folded it into all three minting paths: `internal/core/spec/store.go`, `internal/core/intent/create.go`, and `internal/core/capture/workflow.go`. What survived was uneven evidence, not an uneven fix: only the `spc-N` family had an end-to-end regression test standing up a real two-branch history (`internal/core/spec/refunion_test.go`), while none of capture's or intent's existing tests stood up a real two-branch history through `Capture`/`CreateFromText` and so never drove the ref scan through their public entry points at all — `MaxAcrossRefs` was exercised only as a primitive in its own package test, never as wiring. That is the shape in which a fix silently un-wires: a refactor that dropped the `MaxAcrossRefs` call from `Capture` or `CreateFromText` would have left every existing test in both packages green. So this round adds `internal/core/capture/refunion_test.go` (`TestCaptureMintsPastACommittedBranch`) and `internal/core/intent/refunion_test.go` (`TestCreateFromTextMintsPastACommittedBranch`), each mirroring the spec test's exact fixture via `internal/gittest.NewRepo` — branch A mints and commits record 1, branch B is cut from before that commit so its working tree carries no record, and B must mint record 2. Both were mutation-checked before being trusted: with `MaxAcrossRefs` stubbed to return an empty `RefScan`, each fails with precisely the collision it names (`iss-1`/`itd-1` re-minted on branch B), and all three families fail together — so the tests are pinned to the ref-union behaviour rather than passing incidentally. No production code was touched, which is the point: the minting paths were verified correct by reading before the coverage was written, and the change is test-and-record only. Impact recorded as `internal` and no CHANGELOG entry, matching the iss-34 precedent for a test-only closure with no user-facing behaviour change.
 - 2026-08-05 — CORRECTION to the entry immediately above, from a merge-gate record-accuracy review on PR #195. That entry, and iss-80's own `resolution:` field, said the branch-local id-collision class "was closed" by iss-115/iss-120. It was not: `internal/core/recordid/recordid.go`'s own package doc documents an ACCEPTED, undocumented-in-that-entry residual window — two branches that BOTH mint before either commits still collide — left to the already-armed record-lint uniqueness detectors (`issue_id_unique`, `intent_lifecycle`, `spec_id_unique`) as backstop, the same trade-off iss-120's own resolution names verbatim ("the armed record-lint detectors as the residual-window backstop"). iss-80's body asked for a fully collision-free minting scheme (forge-minted / random-suffix / timestamp / reserve-registry); that was never built, that trade-off was made when iss-115/iss-120 landed rather than here, and no open item currently tracks the residual window separately. Both iss-80's `resolution:` field and this log now say "already addressed, not closed to zero" and name the trade-off explicitly, rather than implying the class was eliminated. The test-coverage work in the entry above (the two new refunion tests) is unaffected and stands as described.
 - 2026-08-05 — iss-43 (v0.5.0 item D): the three-claim corpus is closed as OVERTAKEN rather than fixed — the Status section and the surface list were removed by `73428b6` (2026-07-17, "manual: Revise README with new badges and project details"), a manual revision predating the v0.5.0 plan, so the Phase 0 claim and the native review oracle / spec-task engine / autonomous run claims no longer exist to correct, and re-deriving a corpus against a rewritten document would be inventing findings to justify a ticket. That attribution is itself a correction worth recording: the round first credited the iss-143 tagline commit `48a3524`, which touches ONE README line (the strapline), because it read a SHALLOW clone whose truncation window opened well after 2026-07-17 and therefore could not see the real commit — a truncated history answers a `git log` question confidently and wrongly, and the cheap guard is `git log -S` over the file for the exact removed string, unshallowed first. Two corollaries earned the same way: the corpus's third claim was never `73428b6`'s at all (`git log -S "never shipped"` puts that line in the scaffold commit and in this branch alone), so "all three overtaken" was a second wrong attribution riding on the first; and a whole-phrase probe can miss a claim that was line-wrapped in the original, which is why `"spec/task"` reproduces where `"spec/task engine"` returns nothing. One instance survives, and it is half true rather than false, which is why it needed splitting instead of deleting: the Layout line called `.abcd/` "never shipped", which holds for the released binaries alone (release.yml uploads the four of them and `checksums.txt`, nothing else) and fails everywhere else — `.claude-plugin/marketplace.json` declares `source: "./"`, so a marketplace install takes the whole repository, and GitHub attaches auto-generated source archives to each release, which carry the directory too because `.gitattributes` declares no `export-ignore`. The line now divides on the boundary that is real: every repository checkout against the released binaries, rather than a per-channel split that would have been wrong about the release page. Doc-side deliberately: the marketplace manifest schema has no per-path exclusion, so making "never shipped" true everywhere means building a curated publish path — feature work with its own design questions, not doc repair, and writing the doc to describe a packaging mechanism that does not exist is the phantom-claim failure this item belongs to. The proposed detector (README capability and status claims resolve to wired verbs and to the roadmap) is DROPPED here and re-pointed at iss-181 as a candidate extension of the gate cross-check detector's scope, recorded as a candidate rather than a commitment because it shares that detector's two unsettled scoping questions and a second half-specified scanner would answer neither. The same claim survives across the record — CONTEXT.md's sharp-edges list, AGENTS.md, both `.abcd/` READMEs, `02-constraints/01-platform.md`, `05-internals/03-configuration.md` and `phase-1-ahoy.md`, with adr-0028, the dated plans and the planned/shipped intent bodies exempt as decision and historical records — and it is recorded as iss-183 rather than fixed here, since the disposition scoped this item to one README line. That issue also corrects a claim this round made twice: the exclusion is NOT unimplemented. `internal/core/launch/bundle.go` denies the `.abcd` namespace structurally, with tests, reachable from the wired `abcd launch ship`; it is unwired, because `Ship` stops at `WouldPublish` with no network call and `release.yml` uploads the binaries without ever invoking the verb. "No mechanism exists" and "the mechanism never runs" ask for different fixes, and only the second is true.
+- 2026-08-05 — bug-hunt loop round 1: iss-184 (critical, guard tokenizer heredoc misparse) fixed at root cause. `internal/core/guard/tokenize.go`'s `<<` handling already special-cased the literal-digit arithmetic-shift form (`$((1<<20))` is not a heredoc), but `isDelimStart` accepts any identifier-shaped word, so `$((1<<shift))` — an identifier operand — still read as a heredoc delimiter, and `skipHeredocBodies` then silently consumed every remaining line of the command looking for a "shift" terminator line that never comes, dropping later commands (a force-push, an `rm -rf`, anything) from ever reaching command position — a silent allow, not the loud fail-open the hook's own doc comment promises for anything the tokenizer cannot answer confidently. Rather than widen the delimiter-shape heuristic (which just moves the boundary to the next unanticipated shape), the fix makes `skipHeredocBodies` report whether it actually found each pending heredoc's terminator; `tokenize` turns a miss into `ErrUnparsableCommand`, the same error class quoting failures already use. This closes the identifier-operand shift AND a second latent gap the same swallow covered: a genuinely unterminated heredoc (`cat <<EOF` with no closing `EOF` line) previously also silently swallowed the rest of the input with no signal — an existing test pinned that exact silent-swallow as intended behaviour and is updated to assert the new, correct `ErrUnparsableCommand` contract instead. Detectors: `TestArithmeticShiftByIdentifierIsRejected` and `TestTokenizeRejectsUnterminatedHeredoc`, both watched failing on pre-fix code for the claimed reason and passing after. Three more bugs surfaced by the same round's multi-angle sweep and independently verified with failing tests are captured but not fixed here — iss-185 (critical, scanner leaves a second back-to-back secret token undetected and unredacted, defeating history's fail-closed residual re-scan), iss-186 (minor, a failed source-unlink in a capture ledger transition can permanently strand an issue id across two status directories), iss-187 (minor, `rules.Merge` panics on a nil-Domains base — currently unreachable through any live caller, so a latent exported-API contract defect) — left open for a future round, highest severity first.
diff --git a/.abcd/work/issues/open/iss-184-guard-heredoc-arithmetic-shift-bypass.md b/.abcd/work/issues/resolved/iss-184-guard-heredoc-arithmetic-shift-bypass.md
similarity index 65%
rename from .abcd/work/issues/open/iss-184-guard-heredoc-arithmetic-shift-bypass.md
rename to .abcd/work/issues/resolved/iss-184-guard-heredoc-arithmetic-shift-bypass.md
index 9100d666..91fa0793 100644
--- a/.abcd/work/issues/open/iss-184-guard-heredoc-arithmetic-shift-bypass.md
+++ b/.abcd/work/issues/resolved/iss-184-guard-heredoc-arithmetic-shift-bypass.md
@@ -7,6 +7,8 @@ category: "bug"
 source: "agent-finding"
 found_during: "bug-hunt loop round 1"
 found_at: "internal/core/guard/tokenize.go:152"
+resolution: "Fixed at root cause: skipHeredocBodies now signals when a pending here-document never finds its terminating delimiter line, and tokenize turns that into ErrUnparsableCommand instead of silently consuming the rest of the input. Covers both the identifier-operand arithmetic-shift misparse and genuinely unterminated heredocs (same underlying gap). Guard fails open LOUDLY (per the documented itd-103 contract) on the unparsable command instead of silently allowing it. Detector: internal/core/guard/tokenize_test.go TestArithmeticShiftByIdentifierIsRejected + TestTokenizeRejectsUnterminatedHeredoc, both watched failing before the fix and passing after."
+impact: fix
 ---
 
 guard tokenizer heredoc misparse: an unquoted arithmetic left-shift with an identifier operand (e.g. `$((1<<shift))`) is misparsed as a here-document start by isDelimStart (tokenize.go:206, accepts any word starting with a letter/underscore) plus readHeredocDelim (tokenize.go:249, terminates the delimiter word on ')'). skipHeredocBodies (tokenize.go:264) then scans for a line equal to the bogus delimiter, finds none, and silently swallows every subsequent line of the command before it reaches command position. A dangerous command on a later line (git push --force, rm -rf, gh repo delete, etc.) is never seen by Registry.Check and the guard returns VerdictAllow with no error — a silent fail-open, not the loud could-not-answer path the shim reserves for unparsable input. Confirmed live via both CLI front doors (internal/surface/cli/guard.go: guard check and guard hook). The literal-digit form (1<<20) is unaffected; only identifier/variable operands trip it. Reproducing test: internal/core/guard/tokenize_test.go, TestArithmeticShiftByIdentifierIsNotAHeredoc.
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac06e402..16da56e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -820,6 +820,16 @@ called out in a **Breaking** section.
   false block, and a backtick command substitution, which stays a disclosed v1
   gap: the fourth part of iss-148 was attempted on this branch and reverted, and
   the issue stays open on it alone.
+- **The guard no longer silently drops the rest of a command when a `<<`
+  is mistaken for a here-document** (iss-184). An unquoted arithmetic left
+  shift with an identifier operand (`$((1<<shift))`) parsed as a heredoc
+  delimiter; the tokenizer then scanned for a closing line that never
+  appears and consumed every line after it — including a later `git push
+  --force` or `rm -rf` — as unchecked body text, so the guard returned an
+  allow verdict with no error and no signal at all. A genuinely
+  unterminated heredoc had the same silent-swallow gap. Both now surface
+  as an unparsable command, the same error class an unterminated quote
+  already uses, so the guard fails open loudly instead of silently.
 
 ## [0.4.1] - 2026-07-28
 

From c120e527b62460cfd225ad689d68884ec7ba43ef Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 5 Aug 2026 12:19:38 +0000
Subject: [PATCH 4/5] fix: a heredoc delimiter can't be adjacent to a bare
 paren (iss-184)

The pre-PR security review found that the first pass only closed the
unterminated half of the heredoc-vs-arithmetic-shift confusion: an
attacker who supplies a later line matching the misread "delimiter"
(e.g. appending a bare `shift`) still finds a coincidental terminator,
so the guarded command is still silently swallowed with no error.

Root cause: a real heredoc delimiter word is never immediately
followed by a bare `(` or `)` with no separator -- its body and
terminator line have to come first. `$((expr<<ident))` always produces
that shape (readHeredocDelim stops at the arithmetic expression's own
closing paren), so `<<` there is now classified correctly at tokenize
time -- same as the existing literal-digit case -- and the rest of the
command is checked normally regardless of what any later line
contains. This is the actual fix; the previous commit's
unterminated-body-to-error path is kept as defense in depth for
genuinely malformed heredocs, a distinct, narrower gap.

Detectors: TestArithmeticShiftByIdentifierIsNotAHeredoc and
TestArithmeticShiftCoincidentalDelimiterStillBlocks (the exact
adversarial payload from the security review), both watched failing
against the previous commit's code and passing after this one.

Assisted-by: Claude:claude-opus-5
---
 internal/core/guard/tokenize.go      | 14 +++++-
 internal/core/guard/tokenize_test.go | 75 +++++++++++++++++++++-------
 2 files changed, 71 insertions(+), 18 deletions(-)

diff --git a/internal/core/guard/tokenize.go b/internal/core/guard/tokenize.go
index 46e21f7f..1786e80b 100644
--- a/internal/core/guard/tokenize.go
+++ b/internal/core/guard/tokenize.go
@@ -162,7 +162,19 @@ func tokenize(line string) ([]segment, error) {
 			if err != nil {
 				return nil, err
 			}
-			if !hd.quoted && !isDelimStart(hd.delim) {
+			// A real heredoc delimiter is never immediately followed by a bare
+			// paren: its body and terminator line have to come first, so nothing
+			// legitimate places `(` or `)` directly against the delimiter word
+			// with no separator. `$((expr<<ident))` produces exactly this shape
+			// -- readHeredocDelim reads the shift's right-hand identifier as if
+			// it were a delimiter and stops at the arithmetic expression's own
+			// closing paren. Catching this at classification time (rather than
+			// only an unterminated body, below) matters: without it, an
+			// attacker can supply a later line that happens to equal the
+			// misread "delimiter" and have it swallow real commands with no
+			// error at all.
+			followedByParen := next < len(line) && (line[next] == '(' || line[next] == ')')
+			if !hd.quoted && (!isDelimStart(hd.delim) || followedByParen) {
 				cur = append(cur, '<', '<')
 				hasCur = true
 				lastList = false
diff --git a/internal/core/guard/tokenize_test.go b/internal/core/guard/tokenize_test.go
index 87b9e6f1..2a247244 100644
--- a/internal/core/guard/tokenize_test.go
+++ b/internal/core/guard/tokenize_test.go
@@ -208,32 +208,73 @@ func TestTokenizeRejectsUnterminatedHeredoc(t *testing.T) {
 	}
 }
 
-// TestArithmeticShiftByIdentifierIsRejected pins the identifier-operand form of
-// the same boundary the literal-digit case above already covers: an unquoted
-// `<<` whose "delimiter" word is never terminated by a matching line — because
-// it was never a real heredoc delimiter to begin with, e.g. `$((1<<shift))` —
-// must not silently swallow the rest of the command as unchecked body text. It
-// is unparsable, exactly like an unterminated quote, so tokenize errors rather
-// than dropping the remaining lines from command position.
-func TestArithmeticShiftByIdentifierIsRejected(t *testing.T) {
+// TestArithmeticShiftByIdentifierIsNotAHeredoc pins the identifier-operand
+// form of the same boundary the literal-digit case above already covers: an
+// unquoted `<<` whose "delimiter" word is immediately followed by a bare paren
+// — e.g. `$((1<<shift))`, where readHeredocDelim reads "shift" and stops at
+// the arithmetic expression's own closing paren — is never a real heredoc. A
+// genuine delimiter word is always followed by its body and terminator line,
+// never by `(` or `)` with no separator. Classifying this correctly at parse
+// time (rather than merely erroring when no terminator line happens to exist)
+// matters: an unquoted `<<` misread this way must still let every later line
+// reach command position and be matched normally, not merely fail loud.
+func TestArithmeticShiftByIdentifierIsNotAHeredoc(t *testing.T) {
 	const line = "shift=8\necho $((1<<shift))\ngit push --force origin main"
-	if _, err := tokenize(line); !errors.Is(err, ErrUnparsableCommand) {
-		t.Fatalf("tokenize(%q) error = %v, want ErrUnparsableCommand", line, err)
+	segs, err := tokenize(line)
+	if err != nil {
+		t.Fatalf("tokenize(%q): unexpected error: %v", line, err)
+	}
+	got := render(segs)
+	swallowed := true
+	for _, s := range got {
+		if strings.Contains(s, "push") {
+			swallowed = false
+		}
+	}
+	if swallowed {
+		t.Errorf("tokenize(%q) = %q: the `git push --force` line never reached command position", line, got)
 	}
 
-	// The guard must not silently allow the command either: Check surfaces the
-	// same error rather than returning VerdictAllow.
-	if _, err := Defaults().Check(line); !errors.Is(err, ErrUnparsableCommand) {
-		t.Fatalf("Check(%q) error = %v, want ErrUnparsableCommand", line, err)
+	d, err := Defaults().Check(line)
+	if err != nil {
+		t.Fatalf("Check(%q): unexpected error: %v", line, err)
+	}
+	if d.Verdict != VerdictBlock {
+		t.Fatalf("Check(%q).Verdict = %q (entry %q), want %q via git-push-force", line, d.Verdict, d.EntryID, VerdictBlock)
 	}
 
 	// Control: the literal-operand form must still parse and block normally.
 	const lit = "echo $((1<<20))\ngit push --force origin main"
-	d, err := Defaults().Check(lit)
+	dl, err := Defaults().Check(lit)
 	if err != nil {
 		t.Fatalf("Check(%q): unexpected error: %v", lit, err)
 	}
-	if d.Verdict != VerdictBlock {
-		t.Fatalf("control: Check(%q).Verdict = %q, want %q", lit, d.Verdict, VerdictBlock)
+	if dl.Verdict != VerdictBlock {
+		t.Fatalf("control: Check(%q).Verdict = %q, want %q", lit, dl.Verdict, VerdictBlock)
+	}
+}
+
+// TestArithmeticShiftCoincidentalDelimiterStillBlocks is the adversarial case
+// that TestArithmeticShiftByIdentifierIsNotAHeredoc alone would miss: an
+// attacker who knows the tokenizer once looked for a line matching the
+// misread "delimiter" could supply exactly that line (here, a bare `shift`
+// with no arguments — a harmless no-op POSIX builtin), so the earlier,
+// narrower fix (erroring only when no such line exists) would still let this
+// swallow the guarded command with no error and no signal. Classifying the
+// `<<` correctly up front — never treating it as a heredoc in the first place
+// — closes this regardless of what later lines happen to contain.
+func TestArithmeticShiftCoincidentalDelimiterStillBlocks(t *testing.T) {
+	for _, line := range []string{
+		"echo $((1<<shift))\ngit push --force origin main\nshift",
+		"echo $((1<<k))\ngit push --force origin main\nk",
+		"echo $(( $((1<<a)) ))\ngit push --force origin main\na",
+	} {
+		d, err := Defaults().Check(line)
+		if err != nil {
+			t.Fatalf("Check(%q): unexpected error: %v", line, err)
+		}
+		if d.Verdict != VerdictBlock {
+			t.Fatalf("Check(%q).Verdict = %q, want %q — the guarded line must not be silently swallowed", line, d.Verdict, VerdictBlock)
+		}
 	}
 }

From 09ab7d757f3e6009c573161d96994b9222d3dd1c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 5 Aug 2026 12:19:45 +0000
Subject: [PATCH 5/5] docs: correct the iss-184 record to describe the real fix

The ledger resolution, DECISIONS.md round line, and CHANGELOG entry
described the first pass's error-on-unterminated-body mitigation as a
root-cause fix. It wasn't -- the pre-PR security review demonstrated a
live bypass surviving it. All three now describe the two-pass fix
accurately: the classification fix that actually closes the hole, and
the unterminated-body fix kept as defense in depth for a distinct,
narrower gap.

Assisted-by: Claude:claude-opus-5
---
 .abcd/work/DECISIONS.md                       |  2 +-
 ...4-guard-heredoc-arithmetic-shift-bypass.md |  2 +-
 CHANGELOG.md                                  | 26 ++++++++++++-------
 3 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/.abcd/work/DECISIONS.md b/.abcd/work/DECISIONS.md
index b94d6719..bc85b723 100644
--- a/.abcd/work/DECISIONS.md
+++ b/.abcd/work/DECISIONS.md
@@ -920,4 +920,4 @@ parallel-agent merge contention bites.
 - 2026-08-05 — iss-80 (v0.5.0): resolved as already-fixed, with the residual verification gap closed rather than the defect re-fixed. The branch-local id-collision class this item tracked — `itd-N`/`spc-N`/`iss-N` allocators scanning only the working tree, so two agents on branches cut from one base each mint the same id and collide at merge — was already closed by iss-115 and iss-120, which introduced `recordid.MaxAcrossRefs` (scan every git ref for the family's highest committed id) and folded it into all three minting paths: `internal/core/spec/store.go`, `internal/core/intent/create.go`, and `internal/core/capture/workflow.go`. What survived was uneven evidence, not an uneven fix: only the `spc-N` family had an end-to-end regression test standing up a real two-branch history (`internal/core/spec/refunion_test.go`), while none of capture's or intent's existing tests stood up a real two-branch history through `Capture`/`CreateFromText` and so never drove the ref scan through their public entry points at all — `MaxAcrossRefs` was exercised only as a primitive in its own package test, never as wiring. That is the shape in which a fix silently un-wires: a refactor that dropped the `MaxAcrossRefs` call from `Capture` or `CreateFromText` would have left every existing test in both packages green. So this round adds `internal/core/capture/refunion_test.go` (`TestCaptureMintsPastACommittedBranch`) and `internal/core/intent/refunion_test.go` (`TestCreateFromTextMintsPastACommittedBranch`), each mirroring the spec test's exact fixture via `internal/gittest.NewRepo` — branch A mints and commits record 1, branch B is cut from before that commit so its working tree carries no record, and B must mint record 2. Both were mutation-checked before being trusted: with `MaxAcrossRefs` stubbed to return an empty `RefScan`, each fails with precisely the collision it names (`iss-1`/`itd-1` re-minted on branch B), and all three families fail together — so the tests are pinned to the ref-union behaviour rather than passing incidentally. No production code was touched, which is the point: the minting paths were verified correct by reading before the coverage was written, and the change is test-and-record only. Impact recorded as `internal` and no CHANGELOG entry, matching the iss-34 precedent for a test-only closure with no user-facing behaviour change.
 - 2026-08-05 — CORRECTION to the entry immediately above, from a merge-gate record-accuracy review on PR #195. That entry, and iss-80's own `resolution:` field, said the branch-local id-collision class "was closed" by iss-115/iss-120. It was not: `internal/core/recordid/recordid.go`'s own package doc documents an ACCEPTED, undocumented-in-that-entry residual window — two branches that BOTH mint before either commits still collide — left to the already-armed record-lint uniqueness detectors (`issue_id_unique`, `intent_lifecycle`, `spec_id_unique`) as backstop, the same trade-off iss-120's own resolution names verbatim ("the armed record-lint detectors as the residual-window backstop"). iss-80's body asked for a fully collision-free minting scheme (forge-minted / random-suffix / timestamp / reserve-registry); that was never built, that trade-off was made when iss-115/iss-120 landed rather than here, and no open item currently tracks the residual window separately. Both iss-80's `resolution:` field and this log now say "already addressed, not closed to zero" and name the trade-off explicitly, rather than implying the class was eliminated. The test-coverage work in the entry above (the two new refunion tests) is unaffected and stands as described.
 - 2026-08-05 — iss-43 (v0.5.0 item D): the three-claim corpus is closed as OVERTAKEN rather than fixed — the Status section and the surface list were removed by `73428b6` (2026-07-17, "manual: Revise README with new badges and project details"), a manual revision predating the v0.5.0 plan, so the Phase 0 claim and the native review oracle / spec-task engine / autonomous run claims no longer exist to correct, and re-deriving a corpus against a rewritten document would be inventing findings to justify a ticket. That attribution is itself a correction worth recording: the round first credited the iss-143 tagline commit `48a3524`, which touches ONE README line (the strapline), because it read a SHALLOW clone whose truncation window opened well after 2026-07-17 and therefore could not see the real commit — a truncated history answers a `git log` question confidently and wrongly, and the cheap guard is `git log -S` over the file for the exact removed string, unshallowed first. Two corollaries earned the same way: the corpus's third claim was never `73428b6`'s at all (`git log -S "never shipped"` puts that line in the scaffold commit and in this branch alone), so "all three overtaken" was a second wrong attribution riding on the first; and a whole-phrase probe can miss a claim that was line-wrapped in the original, which is why `"spec/task"` reproduces where `"spec/task engine"` returns nothing. One instance survives, and it is half true rather than false, which is why it needed splitting instead of deleting: the Layout line called `.abcd/` "never shipped", which holds for the released binaries alone (release.yml uploads the four of them and `checksums.txt`, nothing else) and fails everywhere else — `.claude-plugin/marketplace.json` declares `source: "./"`, so a marketplace install takes the whole repository, and GitHub attaches auto-generated source archives to each release, which carry the directory too because `.gitattributes` declares no `export-ignore`. The line now divides on the boundary that is real: every repository checkout against the released binaries, rather than a per-channel split that would have been wrong about the release page. Doc-side deliberately: the marketplace manifest schema has no per-path exclusion, so making "never shipped" true everywhere means building a curated publish path — feature work with its own design questions, not doc repair, and writing the doc to describe a packaging mechanism that does not exist is the phantom-claim failure this item belongs to. The proposed detector (README capability and status claims resolve to wired verbs and to the roadmap) is DROPPED here and re-pointed at iss-181 as a candidate extension of the gate cross-check detector's scope, recorded as a candidate rather than a commitment because it shares that detector's two unsettled scoping questions and a second half-specified scanner would answer neither. The same claim survives across the record — CONTEXT.md's sharp-edges list, AGENTS.md, both `.abcd/` READMEs, `02-constraints/01-platform.md`, `05-internals/03-configuration.md` and `phase-1-ahoy.md`, with adr-0028, the dated plans and the planned/shipped intent bodies exempt as decision and historical records — and it is recorded as iss-183 rather than fixed here, since the disposition scoped this item to one README line. That issue also corrects a claim this round made twice: the exclusion is NOT unimplemented. `internal/core/launch/bundle.go` denies the `.abcd` namespace structurally, with tests, reachable from the wired `abcd launch ship`; it is unwired, because `Ship` stops at `WouldPublish` with no network call and `release.yml` uploads the binaries without ever invoking the verb. "No mechanism exists" and "the mechanism never runs" ask for different fixes, and only the second is true.
-- 2026-08-05 — bug-hunt loop round 1: iss-184 (critical, guard tokenizer heredoc misparse) fixed at root cause. `internal/core/guard/tokenize.go`'s `<<` handling already special-cased the literal-digit arithmetic-shift form (`$((1<<20))` is not a heredoc), but `isDelimStart` accepts any identifier-shaped word, so `$((1<<shift))` — an identifier operand — still read as a heredoc delimiter, and `skipHeredocBodies` then silently consumed every remaining line of the command looking for a "shift" terminator line that never comes, dropping later commands (a force-push, an `rm -rf`, anything) from ever reaching command position — a silent allow, not the loud fail-open the hook's own doc comment promises for anything the tokenizer cannot answer confidently. Rather than widen the delimiter-shape heuristic (which just moves the boundary to the next unanticipated shape), the fix makes `skipHeredocBodies` report whether it actually found each pending heredoc's terminator; `tokenize` turns a miss into `ErrUnparsableCommand`, the same error class quoting failures already use. This closes the identifier-operand shift AND a second latent gap the same swallow covered: a genuinely unterminated heredoc (`cat <<EOF` with no closing `EOF` line) previously also silently swallowed the rest of the input with no signal — an existing test pinned that exact silent-swallow as intended behaviour and is updated to assert the new, correct `ErrUnparsableCommand` contract instead. Detectors: `TestArithmeticShiftByIdentifierIsRejected` and `TestTokenizeRejectsUnterminatedHeredoc`, both watched failing on pre-fix code for the claimed reason and passing after. Three more bugs surfaced by the same round's multi-angle sweep and independently verified with failing tests are captured but not fixed here — iss-185 (critical, scanner leaves a second back-to-back secret token undetected and unredacted, defeating history's fail-closed residual re-scan), iss-186 (minor, a failed source-unlink in a capture ledger transition can permanently strand an issue id across two status directories), iss-187 (minor, `rules.Merge` panics on a nil-Domains base — currently unreachable through any live caller, so a latent exported-API contract defect) — left open for a future round, highest severity first.
+- 2026-08-05 — bug-hunt loop round 1: iss-184 (critical, guard tokenizer heredoc misparse) fixed at root cause, in two passes after a pre-PR adversarial security review caught the first pass narrowing the hole rather than closing it. `internal/core/guard/tokenize.go`'s `<<` handling already special-cased the literal-digit arithmetic-shift form (`$((1<<20))` is not a heredoc), but `isDelimStart` accepts any identifier-shaped word, so `$((1<<shift))` — an identifier operand — still read as a heredoc delimiter, and `skipHeredocBodies` then silently consumed every remaining line of the command looking for a "shift" terminator line that never comes, dropping later commands (a force-push, an `rm -rf`, anything) from ever reaching command position — a silent allow, not the loud fail-open the hook's own doc comment promises for anything the tokenizer cannot answer confidently. The first pass made `skipHeredocBodies` report whether it actually found each pending heredoc's terminator, turning a miss into `ErrUnparsableCommand`. The security review then constructed the exploit this missed: an attacker supplying a later line that happens to equal the misread "delimiter" (e.g. appending a bare `shift`) still finds a match, so the swallow still succeeds silently — the fix only closed the *unterminated* half of the class, not the *coincidentally-terminated* half, which is the one an attacker actually controls. The real fix is classification, not detection-of-failure: a heredoc delimiter word immediately followed by a bare `(` or `)` with no separator is never a real heredoc — its body and terminator line have to come first, so nothing legitimate places a paren directly against the delimiter word, and `$((expr<<ident))` produces exactly that shape. `<<` in that position is now read as the arithmetic operator at tokenize time, same as the literal-digit case, so the guarded line is reached and matched normally regardless of what any later line contains. The unterminated-body-to-error fix from the first pass is kept as defense in depth for genuinely malformed heredocs (`cat <<EOF` with no closing `EOF` line), a distinct, narrower gap the same swallow also covered — an existing test that pinned that silent-swallow as intended behaviour is updated to assert the corrected `ErrUnparsableCommand` contract. Detectors: `TestArithmeticShiftByIdentifierIsNotAHeredoc`, `TestArithmeticShiftCoincidentalDelimiterStillBlocks` (the adversarial payload the security review demonstrated), and `TestTokenizeRejectsUnterminatedHeredoc` — each watched failing on pre-fix code for the claimed reason and passing after. Three more bugs surfaced by the same round's multi-angle sweep and independently verified with failing tests are captured but not fixed here — iss-185 (critical, scanner leaves a second back-to-back secret token undetected and unredacted, defeating history's fail-closed residual re-scan), iss-186 (minor, a failed source-unlink in a capture ledger transition can permanently strand an issue id across two status directories), iss-187 (minor, `rules.Merge` panics on a nil-Domains base — currently unreachable through any live caller, so a latent exported-API contract defect) — left open for a future round, highest severity first.
diff --git a/.abcd/work/issues/resolved/iss-184-guard-heredoc-arithmetic-shift-bypass.md b/.abcd/work/issues/resolved/iss-184-guard-heredoc-arithmetic-shift-bypass.md
index 91fa0793..257b5215 100644
--- a/.abcd/work/issues/resolved/iss-184-guard-heredoc-arithmetic-shift-bypass.md
+++ b/.abcd/work/issues/resolved/iss-184-guard-heredoc-arithmetic-shift-bypass.md
@@ -7,7 +7,7 @@ category: "bug"
 source: "agent-finding"
 found_during: "bug-hunt loop round 1"
 found_at: "internal/core/guard/tokenize.go:152"
-resolution: "Fixed at root cause: skipHeredocBodies now signals when a pending here-document never finds its terminating delimiter line, and tokenize turns that into ErrUnparsableCommand instead of silently consuming the rest of the input. Covers both the identifier-operand arithmetic-shift misparse and genuinely unterminated heredocs (same underlying gap). Guard fails open LOUDLY (per the documented itd-103 contract) on the unparsable command instead of silently allowing it. Detector: internal/core/guard/tokenize_test.go TestArithmeticShiftByIdentifierIsRejected + TestTokenizeRejectsUnterminatedHeredoc, both watched failing before the fix and passing after."
+resolution: "Fixed at root cause, in two parts after a pre-PR security review caught the first pass narrowing rather than closing the hole. (1) Classification: a heredoc delimiter word immediately followed by a bare '(' or ')' with no separator is never a real heredoc -- the body and terminator line have to come first, so nothing legitimate places a paren directly against the delimiter word. `$((expr<<ident))` produces exactly that shape, so `<<` in that position is now correctly read as the arithmetic operator at tokenize time, same as the pre-existing literal-digit case, and the dangerous command on a later line reaches command position and blocks normally -- no error, no swallow, no reliance on whether a later line happens to coincidentally match the misread delimiter (the security review's exploit: appending a bare `shift` line let the earlier, error-only fix still swallow the guarded command silently). (2) Defense in depth: skipHeredocBodies still signals when a GENUINE pending heredoc never finds its terminator line, and tokenize turns that into ErrUnparsableCommand (guard fails open LOUDLY per the documented itd-103 contract) rather than silently consuming the rest of the input -- covers truly malformed/unterminated heredocs, a distinct residual gap the same swallow covered. Detectors: internal/core/guard/tokenize_test.go TestArithmeticShiftByIdentifierIsNotAHeredoc, TestArithmeticShiftCoincidentalDelimiterStillBlocks (the adversarial payload), and TestTokenizeRejectsUnterminatedHeredoc -- all watched failing before their respective fix and passing after."
 impact: fix
 ---
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 16da56e1..3afb6189 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -820,16 +820,22 @@ called out in a **Breaking** section.
   false block, and a backtick command substitution, which stays a disclosed v1
   gap: the fourth part of iss-148 was attempted on this branch and reverted, and
   the issue stays open on it alone.
-- **The guard no longer silently drops the rest of a command when a `<<`
-  is mistaken for a here-document** (iss-184). An unquoted arithmetic left
-  shift with an identifier operand (`$((1<<shift))`) parsed as a heredoc
-  delimiter; the tokenizer then scanned for a closing line that never
-  appears and consumed every line after it — including a later `git push
-  --force` or `rm -rf` — as unchecked body text, so the guard returned an
-  allow verdict with no error and no signal at all. A genuinely
-  unterminated heredoc had the same silent-swallow gap. Both now surface
-  as an unparsable command, the same error class an unterminated quote
-  already uses, so the guard fails open loudly instead of silently.
+- **The guard no longer treats an arithmetic shift as a here-document, so a
+  command after it is no longer silently unchecked** (iss-184). An unquoted
+  arithmetic left shift with an identifier operand (`$((1<<shift))`) parsed
+  as a heredoc delimiter; the tokenizer then scanned for a closing line and,
+  finding one — even one an attacker supplies on purpose — consumed every
+  line up to it as unchecked body text, so a later `git push --force` or
+  `rm -rf` never reached command position and the guard returned an allow
+  verdict with no error and no signal at all. The delimiter word is now
+  recognised as never real when a bare `(` or `)` immediately follows it
+  with no separator (the shape `$((expr<<ident))` always produces), so the
+  arithmetic expression is read correctly and the rest of the command is
+  checked normally regardless of what later lines contain. A genuinely
+  unterminated heredoc (a real delimiter whose closing line never appears)
+  still surfaces as an unparsable command rather than silently swallowing
+  the rest of the input, the same error class an unterminated quote already
+  uses.
 
 ## [0.4.1] - 2026-07-28