diff --git a/packages/mosaic/framework/tools/git/test-wrapper-guard.sh b/packages/mosaic/framework/tools/git/test-wrapper-guard.sh
index 52dd6d21..150a5f9f 100755
--- a/packages/mosaic/framework/tools/git/test-wrapper-guard.sh
+++ b/packages/mosaic/framework/tools/git/test-wrapper-guard.sh
@@ -59,58 +59,84 @@ FIXTURES="$TMP/fixtures.tsv"
   printf '2\t{"tool_input":{"command":"a=/api/v1/repos/a/b/iss; b=ues/1/comments; curl -d@body https://git.example.invalid${a}${b}"}}\tan endpoint token split across variables is unreadable, not absent\n'
   printf '2\t{"tool_input":{"command":"a=/api/v1/repos/a/b/pu; b=lls/1/reviews; curl -d@body https://git.example.invalid${a}${b}"}}\tsame split, review endpoint\n'
   printf '0\t{"tool_input":{"command":"curl -X POST -d @payload https://hooks.example.invalid/services/${WEBHOOK_ID}"}}\tan opaque URL that is not forge-shaped stays allowed\n'
-  # And the other direction, which is the failure mode that gets a hook deleted:
-  # discussing a call is not making one. In each of these the client sits behind
-  # a quote, never at command position.
-  printf '0\t{"tool_input":{"command":"grep -R \\"curl -d https://git.example.invalid/api/v1/repos/a/b/issues\\" docs/"}}\tgrepping for an example is not calling it\n'
-  printf '0\t{"tool_input":{"command":"echo \\"curl -d https://git.example.invalid/api/v1/repos/a/b/pulls\\" > note.txt"}}\twriting an example into a file is not calling it\n'
-  printf '0\t{"tool_input":{"command":"python3 -c '"'"'print(\\"curl -d https://git.example.invalid/api/v1/repos/a/b/issues\\")'"'"'"}}\tprinting an example is not calling it\n'
+  # --- round six changed the contract in this direction, and these fixtures are
+  # where it shows. They used to assert that discussing a call is not making one.
+  # Five rounds proved there is no textual way to tell a quoted example from a
+  # quoted command, so the guard stopped trying: it judges the payload, and a
+  # payload inside quotes is still a payload. Quoting one of these on a Bash
+  # command line is now refused, and the way to write the example is a
+  # file-writing tool. This is the deliberate cost of the mechanism change.
+  printf '2\t{"tool_input":{"command":"grep -R \\"curl -d https://git.example.invalid/api/v1/repos/a/b/issues\\" docs/"}}\tquoting a wrapped write is refused even in a grep\n'
+  printf '2\t{"tool_input":{"command":"echo \\"curl -d https://git.example.invalid/api/v1/repos/a/b/pulls\\" > note.txt"}}\t...and when written into a file\n'
+  printf '2\t{"tool_input":{"command":"python3 -c '"'"'print(\\"curl -d https://git.example.invalid/api/v1/repos/a/b/issues\\")'"'"'"}}\t...and when printed from another language\n'
+  # The boundary that keeps this from being "block everything": what is refused
+  # is a WRITE to a WRAPPED endpoint. Mentioning either alone still passes, and
+  # these are asserted as hard as the blocks above.
+  printf '0\t{"tool_input":{"command":"grep -R \\"curl -s https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\" docs/"}}\tquoting a READ example is untouched\n'
+  printf '0\t{"tool_input":{"command":"echo \\"the wrapped endpoint is https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\" >> notes.md"}}\tnaming the endpoint without a body flag is untouched\n'
+  printf '0\t{"tool_input":{"command":"grep -R \\"curl -d@b https://git.example.invalid/api/v1/repos/a/b/releases\\" docs/"}}\tquoting a write to an UNWRAPPED endpoint is untouched\n'
+  printf '0\t{"tool_input":{"command":"issue-comment.sh --repo a/b --issue 1 --body @msg.md"}}\tthe wrapper itself carries a body flag and must never trip its own guard\n'
   # Command position must still catch the real thing behind operators and env.
   printf '2\t{"tool_input":{"command":"cd /tmp && GITEA_TOKEN=$T curl -d@b https://git.example.invalid/api/v1/repos/a/b/pulls/1/merge"}}\ta real call behind && and an assignment is still a call\n'
-  # --- and the case the AUTHOR hit, one level in from the reported one: an
-  # operator INSIDE a quoted string is not an operator. This blocked a message
-  # that merely quoted the fixture above. Position is judged on the skeleton.
-  printf '0\t{"tool_input":{"command":"send.sh -m \\"repro was: cd /tmp && curl -d@b https://git.example.invalid/api/v1/repos/a/b/pulls/1/merge\\""}}\tan operator inside a quoted string is not an operator\n'
-  printf '0\t{"tool_input":{"command":"cat >> notes.md <<EOF\\nwe ran: curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues\\nEOF"}}\ta heredoc body is data, not code\n'
+  # --- the case the AUTHOR hit twice while chasing the above: sending a message
+  # that QUOTED one of these fixtures. Under the old contract that was a defect
+  # to be parsed away; under this one it is the documented cost, and the message
+  # gets composed with a file-writing tool instead.
+  printf '2\t{"tool_input":{"command":"send.sh -m \\"repro was: cd /tmp && curl -d@b https://git.example.invalid/api/v1/repos/a/b/pulls/1/merge\\""}}\tquoting the repro in a message is refused too\n'
+  printf '2\t{"tool_input":{"command":"cat >> notes.md <<EOF\\nwe ran: curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues\\nEOF"}}\ta heredoc body carrying the payload is refused with it\n'
   # ...but quotes stop being data the moment something executes them.
   printf '2\t{"tool_input":{"command":"bash -c \\"curl -d@b https://git.example.invalid/api/v1/repos/a/b/pulls/1/merge\\""}}\tbash -c makes the quoted text code again\n'
-  # --- round three. The skeleton was right about position and wrong about which
-  # words hold it. A word in front of a command does not displace the command:
-  # each of these four is a real write that the bare-name match could not see.
+  # --- round three. Each of these four is a real write that a bare-name match
+  # for the client could not see, because an ordinary word sat in front of it.
+  # They are kept as fixtures after the mechanism change even though the guard no
+  # longer looks for a client at all: they are the evidence for WHY it stopped,
+  # and a future re-narrowing that reintroduced position would fail here first.
   printf '2\t{"tool_input":{"command":"env GITEA_TOKEN=$T curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\tenv VAR=... in front of the client is still the client\n'
   printf '2\t{"tool_input":{"command":"command curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\tcommand in front of the client is still the client\n'
   printf '2\t{"tool_input":{"command":"timeout 10 curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\ttimeout N in front of the client is still the client\n'
   printf '2\t{"tool_input":{"command":"/usr/bin/curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\tan absolute path to the client is still the client\n'
-  # ...and the prefix list must stay a list of prefixes. `echo` is not one.
-  printf '0\t{"tool_input":{"command":"echo timeout 10 curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments >> notes.md"}}\tnaming a command after echo is not running it\n'
+  printf '2\t{"tool_input":{"command":"echo timeout 10 curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments >> notes.md"}}\tnaming the call after echo carries the payload, so it is refused\n'
   # A shell standing between quoted data and execution makes that data code,
   # and the pipe is the form agents actually use. Filing it as data allowed the
   # call to vanish from the skeleton while still running.
   printf '2\t{"tool_input":{"command":"printf '"'"'%%s\\\\n'"'"' '"'"'curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments'"'"' | sh"}}\tquoted code piped to a shell is code\n'
   printf '2\t{"tool_input":{"command":"cat <<EOF | sh\\ncurl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\nEOF"}}\ta heredoc piped to a shell is code\n'
   printf '2\t{"tool_input":{"command":"sh -s <<EOF\\ncurl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\nEOF"}}\tsh -s reads its script from the heredoc\n'
-  # ...but a pipe to anything that is not a shell leaves the data as data.
-  printf '0\t{"tool_input":{"command":"grep -R \\"curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\" docs/ | wc -l"}}\tpiping an example to wc is not executing it\n'
-  # ...and a shell on ONE line does not execute a string on another. Switching
-  # the whole command into code because it contains an unrelated `sh -c` is how
-  # this blocked its author a second time.
-  printf '0\t{"tool_input":{"command":"docker run --rm alpine sh -c '"'"'echo hi'"'"'\\necho \\"example: curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\" >> notes.md"}}\tan unrelated shell on another line does not promote quoted prose to code\n'
+  # ...and the questions that used to follow — is the pipe target a shell, does a
+  # shell on one line execute a string on another — no longer have to be answered
+  # at all. Both of these carry the payload, both are refused, and neither
+  # outcome depends on parsing what the pipe or the other line does.
+  printf '2\t{"tool_input":{"command":"grep -R \\"curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\" docs/ | wc -l"}}\tpiping the payload to wc is refused without asking what wc is\n'
+  printf '2\t{"tool_input":{"command":"docker run --rm alpine sh -c '"'"'echo hi'"'"'\\necho \\"example: curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\" >> notes.md"}}\tan unrelated shell on another line no longer changes the answer either way\n'
   # --- round four. The guard was still reading the command as typed rather than
   # as the shell will run it: a backslash before a newline is removed before
   # anything else happens, so the endpoint token can be split across the join.
   printf '2\t{"tool_input":{"command":"curl -d@b https://git.example.invalid/api/v1/repos/a/b/iss\\\\\\nues/1/comments"}}\ta line continuation inside the endpoint token is still that endpoint\n'
   printf '2\t{"tool_input":{"command":"curl -d@b https://git.example.invalid/api/v1/repos/a/b/pu\\\\\\nlls/1/reviews"}}\tsame join, review endpoint\n'
-  printf '0\t{"tool_input":{"command":"cat >> notes.md <<EOF\\nwe ran: curl -d@b https://git.example.invalid/api/v1/repos/a/b/iss\\\\\\nues/1/comments\\nEOF"}}\tjoining lines does not turn a document into a command\n'
+  printf '2\t{"tool_input":{"command":"cat >> notes.md <<EOF\\nwe ran: curl -d@b https://git.example.invalid/api/v1/repos/a/b/iss\\\\\\nues/1/comments\\nEOF"}}\tthe join still runs first, and the joined payload is refused in a document too\n'
   # Transparent prefixes take option VALUES, and the value was a word the list
   # did not know — so the client went missing again behind an ordinary `sudo -u`.
   printf '2\t{"tool_input":{"command":"sudo -u root curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\tan option value after a prefix does not hide the client\n'
   printf '2\t{"tool_input":{"command":"timeout --signal TERM 10 curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\tan option pair plus a duration does not hide the client\n'
-  # ...but only an OPTION and its value are skipped, never any word: in
-  # `xargs echo curl ...` the command is echo and the client is its argument.
-  printf '0\t{"tool_input":{"command":"xargs echo curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\ta client passed as an argument to echo is not a call\n'
+  printf '2\t{"tool_input":{"command":"xargs echo curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\tthe payload behind xargs echo is refused rather than adjudicated\n'
   printf '0\t{"tool_input":{"command":"sudo apt-get install curl"}}\tinstalling the client is not calling it\n'
-  # Execution through another command still opens command position.
+  # Execution through another command needed its own case under the old design.
   printf '2\t{"tool_input":{"command":"find . -maxdepth 0 -exec curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments ;"}}\tfind -exec runs the client\n'
+  # --- round five, and the finding that ended the parser. Command substitution
+  # inside a double-quoted span EXECUTES, while the skeleton was discarding that
+  # span as inert prose. The unquoted and process-substitution forms already
+  # blocked, which is what made it a classification defect rather than a spelling
+  # one: the same call was refused or allowed depending on a quote character.
+  printf '2\t{"tool_input":{"command":"echo \\"$(curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments)\\""}}\tcommand substitution inside double quotes executes\n'
+  printf '2\t{"tool_input":{"command":"echo \\"`curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments`\\""}}\tso does the backtick form\n'
+  printf '2\t{"tool_input":{"command":"msg=\\"$(curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments)\\""}}\tand an assignment RHS is not data either\n'
+  printf '2\t{"tool_input":{"command":"echo $(curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments)"}}\tthe unquoted form, which blocked before and must keep blocking\n'
+  printf '2\t{"tool_input":{"command":"cat <(curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments)"}}\tprocess substitution, same\n'
+  printf '2\t{"tool_input":{"command":"bash --command \\"curl -d@b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\""}}\tthe long-option spelling of bash -c needs no entry in any list now\n'
+  # A client the guard was never taught is the point of dropping client
+  # detection: neither of these names curl at all.
+  printf '2\t{"tool_input":{"command":"python3 -c '"'"'import requests; requests.post(\\"https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\", json={})'"'"'"}}\ta library call is a write with no flag and no curl\n'
+  printf '2\t{"tool_input":{"command":"wget --post-data=x https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\twget spells its body differently and is still a write\n'
 } > "$FIXTURES"
 
 fail=0 n=0
diff --git a/packages/mosaic/framework/tools/git/wrapper-guard.sh b/packages/mosaic/framework/tools/git/wrapper-guard.sh
index cd539736..6e2370cd 100755
--- a/packages/mosaic/framework/tools/git/wrapper-guard.sh
+++ b/packages/mosaic/framework/tools/git/wrapper-guard.sh
@@ -22,6 +22,10 @@
 # curl for reads, for registry/manifest calls, and for endpoints with no
 # wrapper (there are many) all pass untouched.
 #
+# One consequence is worth knowing before it surprises you: it judges the
+# payload, not the caller, so a command that merely QUOTES such a write is
+# refused as well. See the long note at section 2 for why that trade was made.
+#
 # Break-glass, for a genuine gap where no wrapper can express the call:
 #   MOSAIC_WRAPPER_OVERRIDE=1 <command>
 # Using it means "no wrapper covers this" — if that is wrong, the fix is to
@@ -83,103 +87,73 @@ EOF
 fi
 
 # ---- 2/3. provider API writes ---------------------------------------------
-# A raw provider write is four things at once: an HTTP client, a URL, a mutating
-# verb or a request body, and a path fragment naming an endpoint a wrapper
-# already owns. All four are required, which is what keeps reads and unwrapped
-# endpoints flowing.
+# A raw provider write this guard cares about is two things: a WRITE, and a URL
+# naming an endpoint a Mosaic wrapper already owns. Reads are untouched — they
+# are how you gather evidence — and the many endpoints with no wrapper flow
+# through.
 #
-# Deliberately NOT gated on the literal "/api/v1/repos/". An independent reviewer
-# broke that version in one line: build the path in shell variables
-#   p=/api/v1/repo; q=s/a/b/pulls/1/reviews; curl -d@body "https://host${p}${q}"
-# and the host-anchored literal never appears, so the check read clean while the
-# write went through. The endpoint fragments below survive it, because the
-# fragment has to appear somewhere for the URL to be constructible at all.
-# The client must be at COMMAND POSITION, and that has to be judged against the
-# CODE in the command, not against its text. Review caught the text version
-# blocking ordinary work:
-#   grep -R "curl -d https://host/api/v1/repos/a/b/issues" docs/
-#   echo "curl -d https://host/api/v1/repos/a/b/pulls" > note.txt
-# Talking about a call is not making one, and over-blocking is not the safe
-# direction: a guard that blocks ordinary work gets switched off, and a guard
-# that is off permits everything.
+# It deliberately does NOT ask which program makes the call, or whether that
+# program sits at shell command position. It used to, and that is the whole
+# history of this file. Answering "is this code or is this data" from the text
+# of a shell command required a skeleton with quoted spans and heredoc bodies
+# removed, an invoker list for the forms where a shell executes quoted text, a
+# prefix list for `env`/`sudo`/`timeout`, option-value skipping, and
+# backslash-newline joining. Five rounds of adversarial review put nineteen
+# writes straight through it, and every one had the same shape: the client was
+# ABSENT from the skeleton, so the guard allowed. Variables, line continuations,
+# command prefixes, option values, pipes into a shell, and finally command
+# substitution inside the very quotes the skeleton was discarding:
+#   echo "$(curl -d@b .../issues/1/comments)"
+#   msg="$(curl -d@b .../issues/1/comments)"
+# Classifying code against data in shell text with sed and awk is not a hard
+# problem, it is the wrong problem. It was not even portable: under CI's busybox
+# awk the quote-stripping silently failed, the skeleton kept every quoted span,
+# and the guard started refusing ordinary prose instead — which is the other way
+# a control like this dies.
 #
-# A first fix required the client to follow a shell operator. That lasted until
-# the author sent a message quoting one of these fixtures — the quoted text
-# contained `... && GITEA_TOKEN=$T curl -d@b .../merge`, so an operator appeared
-# INSIDE the quotes and the guard blocked the message. Same defect, one level
-# in: an operator inside a string is not an operator.
+# So the client detection is gone, and with it that entire failure class: what
+# is left cannot fail open by hiding the caller, because it never looks for one.
+# It looks for the payload. Something that names a wrapped endpoint and carries
+# a body is refused however it is spelled — curl, wget, `python -c`, or a form
+# nobody has thought of yet.
 #
-# So the position test runs against a SKELETON — the command with its data spans
-# (quoted strings, heredoc bodies) removed. Endpoint, URL and body detection all
-# still run against the FULL text, because real calls quote their URLs and a
-# skeleton would be blind to them.
+# The cost is real and belongs in the open, because over-blocking is how a hook
+# gets switched off: QUOTING one of these calls on a Bash command line now
+# blocks too. `grep -R "curl -d .../issues" docs/` is refused, and so is echoing
+# an example into a file. There is no textual way to tell a quoted example from
+# a quoted command — that is exactly the finding above — so the rule is the one
+# an agent can hold in mind without a parser:
 #
-# The exception is the reason quotes are data at all: if something is about to
-# EXECUTE the quoted text, then the quotes hold code and the skeleton is the
-# full text again. The first version of this list named only `bash -c`, `sh <<`
-# and `eval`, and review immediately produced the spellings it did not know:
-#   printf '%s\n' 'curl -d@b .../comments' | sh
-#   cat <<EOF | sh
-#   sh -s <<EOF
-# Each one executes; each one had its client filed away as data. So the test is
-# not "which invocation form did I think of" but "does a shell stand between
-# this data and execution" — including the pipe, which is the common form.
-SHELL_EXECUTES_DATA='(^|[[:space:]|;&(])((ba|z)?sh|dash)([[:space:]]+-[a-z]*[cs]([[:space:]]|$)|[[:space:]]*<<)'
-SHELL_EXECUTES_DATA="$SHELL_EXECUTES_DATA"'|(^|[[:space:]|;&(])eval([[:space:]]|$)'
-SHELL_EXECUTES_DATA="$SHELL_EXECUTES_DATA"'|\|[[:space:]]*((ba|z)?sh|dash)([[:space:]]|$)'
+#   do not put a raw write to a wrapped forge endpoint on a Bash command line,
+#   not even inside quotes.
+#
+# Write the example with a file-writing tool, or leave the body flag out of it.
+# That is a deliberate narrowing of scope, not an oversight. This hook stops
+# mistakes; it is not a sandbox, and pretending otherwise is how you get a
+# control nobody can trust the boundaries of.
+#
+# Scoped to commands carrying a URL, so nothing without one is even considered.
+if printf '%s' "$CMD" | grep -Eq 'https?://'; then
 
-# That decision is made PER LINE, not for the whole command. The first version
-# switched globally, and it blocked its author again within the hour: a script
-# whose only shell invocation was an unrelated `docker run ... sh -c 'echo hi'`
-# had every OTHER quoted span on every other line promoted to code with it.
-# A shell on one line does not execute a string on another, and a guard that
-# says otherwise is back to blocking ordinary work.
-SKEL="$(printf '%s' "$CMD" | awk -v inv="$SHELL_EXECUTES_DATA" '
-  function ascode(s) { gsub(/["\047]/, ";", s); return s }   # quotes separate
-  function asdata(s) { gsub(/\047[^\047]*\047/, "", s); gsub(/"[^"]*"/, "", s); return s }
-  {
-    # Inside a heredoc: the body is code only if the line that OPENED it fed a
-    # shell (`cat <<EOF | sh`, `sh -s <<EOF`). Otherwise it is a document.
-    if (hd != "") { if ($0 == hd) { hd=""; next }
-                    if (hdcode) print ascode($0); next }
-    if (match($0, /<<-?[[:space:]]*\047?"?[A-Za-z_][A-Za-z0-9_]*/)) {
-      t = substr($0, RSTART, RLENGTH); sub(/^<<-?[[:space:]]*[\047"]?/, "", t)
-      hd = t; hdcode = ($0 ~ inv)
-    }
-    print ($0 ~ inv) ? ascode($0) : asdata($0)
-  }')"
-
-# Command position is not "the first word is literally `curl`". A word can sit
-# in front of a command without displacing it, and review found four ordinary
-# ones hiding a real write: `env GITEA_TOKEN=$T curl`, `command curl`,
-# `timeout 10 curl`, `/usr/bin/curl`. The `env` form matters most, because it is
-# precisely what an agent reaches for to keep a credential out of the global
-# environment — the careful spelling was the invisible one.
-CMD_PREFIX='([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*|env|command|builtin|exec|nohup|setsid|stdbuf|nice|ionice|sudo|doas|xargs|time|timeout|watch)[[:space:]]+'
-# Their options take values: `sudo -u root curl` hid a live write because `root`
-# was a word the list did not know. What is skipped is an OPTION and at most one
-# value for it — not any word — so `xargs echo curl ...` stays allowed, because
-# there `echo` is the command and curl is its argument. Plus a bare duration,
-# which is `timeout`'s operand.
-PREFIX_OPT='-[^[:space:]]+[[:space:]]+([^-][^[:space:]|;&(){}<>]*[[:space:]]+)?'
-PREFIX_ARG='('"$PREFIX_OPT"'|[0-9]+[smhd]?[[:space:]]+)'
-# A path in front of the client is still the client.
-CLIENT='([^[:space:]]*/)?(curl|wget|httpie|http)'
-# `find -exec` opens command position the same way an operator does.
-CLIENT_AT_CMD_POS='(^|[;&|(){}]|`|\$\(|-execdir|-exec)[[:space:]]*('"$CMD_PREFIX"'('"$CMD_PREFIX"'|'"$PREFIX_ARG"')*)?'"$CLIENT"'([[:space:]]|$)'
-
-if printf '%s' "$SKEL" | grep -Eq "$CLIENT_AT_CMD_POS" \
-   && printf '%s' "$CMD" | grep -Eq 'https?://'; then
-
-  # Write detection. Every spelling curl accepts, because the guard is defeated
-  # by the one spelling it does not know: `-d@body` (no space) and
-  # `--request=POST` (equals form) both slipped past the first version.
+  # Write detection, now client-agnostic. Every spelling curl accepts, because
+  # the guard is defeated by the one spelling it does not know: `-d@body` (no
+  # space) and `--request=POST` (equals form) both slipped past the first
+  # version. Plus wget's forms and a library call, which a client-shaped test
+  # could not have seen at all.
+  #
+  # A body flag is read as a body flag wherever it appears. `ls -d */ && curl -s
+  # .../issues/1/comments` is therefore refused, which is a read wearing a
+  # write's flag. That direction is the acceptable one: it costs an override on
+  # a rare command, where the reverse costs a silent raw write.
   is_write=0
   printf '%s' "$CMD" | grep -Eq -- \
-    '-X[[:space:]]*(POST|PATCH|PUT|DELETE)|--request[[:space:]=]*(POST|PATCH|PUT|DELETE)' && is_write=1
+    '-X[[:space:]]*(POST|PATCH|PUT|DELETE)|--(request|method)[[:space:]=]*(POST|PATCH|PUT|DELETE)' && is_write=1
   # curl sends POST implicitly when handed a body, in any of these forms.
   printf '%s' "$CMD" | grep -Eq -- \
-    '(^|[[:space:]])(-d|-F|-T)|--data([-a-z]*)?[[:space:]=]|--json[[:space:]=]|--form|--upload-file' && is_write=1
+    '(^|[[:space:]])(-d|-F|-T)|--data([-a-z]*)?[[:space:]=]|--json[[:space:]=]|--form|--upload-file|--post-(data|file)[[:space:]=]' && is_write=1
+  # ...and a library call is a write without any flag at all.
+  printf '%s' "$CMD" | grep -Eq -- \
+    '\.(post|put|patch|delete)\(' && is_write=1
 
   if [ "$is_write" -eq 1 ]; then
     endpoint=""; wrapper=""