GTR020.1 — Single-quote command vars (partition fix)

Contract: behaviour-preserving (value-domain proof).

Claim

Single-quoting a bare Cheetah $var in <command> preserves behaviour when every possible runtime value of that parameter is a single shell word.

Proof — the value-domain argument

Quote only references whose parameter type bounds the value domain to single-token strings ({safe, attr_safe, builtin_path} classes; tier-1 command_vars); select/drill_down admitted only when every static option value is a single token (the §32 narrowing — a multi-flag <option value="-b -h"> quoting fuses argv words).

Output files (command_var_info, codemod §51). A bare $output for an <outputs> <data name=> renders to the dataset file path Galaxy assigns — the same single-token, Galaxy-controlled value domain as a type="data" input path, and an output has no word-splitting splat idiom — so it joins the safe class under the identical argument. <collection> outputs are excluded (not a single file path); an input wins on a name collision. The IUC rule’s scope is verbatim “text parameters, input and output files”.

Negative knowledge (load-bearing)

The bashlex no-split widening was reverted as unsound: Galaxy renders Cheetah values as literal text, so VAR=$x splits — quoting changes behaviour. Full record: ../upgrade_research/cheetah_bashlex_boundary_oracle.md.

Scope boundary

Dynamic/no-static-options selects, #set/loop variables, text/multi/label params — value domain statically unknowable → the GTR020.2 advisory.

Applied scope (codemod §52, the IUC rule). The auto-fixer quotes only the input/output file subset of the provably-safe set — a single type="data" input or a <data> output (is_io_file_ref). The other provably-safe kinds (selects, numbers, booleans, metadata attrs, built-ins) are sound to quote but deliberately left alone: outside the IUC rule’s “input and output files” scope, and the source of the “too aggressive” inconsistency reviewers flagged. This is a narrowing of what we choose to quote, not of the soundness claim — every quote GTR020.1 makes is still proven behaviour-preserving by the value-domain argument above.