# GTR020.1 — Single-quote command vars (partition fix)

**Contract:** behaviour-preserving (value-domain proof).
## Claim
Single-quoting a bare Cheetah `$var` in `<command>` preserves behaviour when
every possible runtime value of that parameter is a single shell word.

## Proof — the value-domain argument
Quote only references whose parameter type bounds the value domain to
single-token strings ({safe, attr_safe, builtin_path} classes; tier-1
`command_vars`); `select`/`drill_down` admitted only when **every static option
value is a single token** (the §32 narrowing — a multi-flag
`<option value="-b -h">` quoting fuses argv words).

**Output files (`command_var_info`, codemod §51).** A bare `$output` for an
`<outputs>` `<data name=>` renders to the dataset file path Galaxy assigns —
the *same* single-token, Galaxy-controlled value domain as a `type="data"`
input path, and an output has no word-splitting splat idiom — so it joins the
`safe` class under the identical argument. `<collection>` outputs are excluded
(not a single file path); an input wins on a name collision. The IUC rule's
scope is verbatim "text parameters, input **and output files**".

## Negative knowledge (load-bearing)
The bashlex no-split widening was **reverted as unsound**: Galaxy renders
Cheetah values as literal text, so `VAR=$x` splits — quoting changes behaviour.
Full record: `../upgrade_research/cheetah_bashlex_boundary_oracle.md`.

## Scope boundary
Dynamic/no-static-options selects, `#set`/loop variables, text/multi/label
params — value domain statically unknowable → the GTR020.2 advisory.

**Applied scope (codemod §52, the IUC rule).** The auto-fixer quotes only the
input/output **file** subset of the provably-safe set — a single `type="data"`
input or a `<data>` output (`is_io_file_ref`). The other provably-safe kinds
(selects, numbers, booleans, metadata attrs, built-ins) are *sound* to quote but
deliberately left alone: outside the IUC rule's "input and output files" scope,
and the source of the "too aggressive" inconsistency reviewers flagged. This is a
narrowing of *what we choose to quote*, not of the soundness claim — every quote
GTR020.1 makes is still proven behaviour-preserving by the value-domain argument
above.