@@ -326,13 +326,44 @@ expect block "echo \"\$(echo \"\$(printf '\"')\")\" ; sed -i s/a/b/ pkg/x.ts"
 # introducer behind it is found and the body stays prose.
 expect allow "$(printf 'echo "$(echo " #")" <<EOF\nsed -i s/a/b/ pkg/x.ts\nEOF\n')"
 
+echo "== a \${…} inside \"…\" is its own quoting context too (#24901) =="
+CWD="$MAIN"
+# The measured false block: the `"` that opens the default was read as CLOSING the outer string,
+# so `b}` became a write target. Pure reads — nothing is written. Each one exercises a different
+# pass: tokenisation (the first two), segmentation (the `;`), nesting both ways (the third).
+expect allow 'echo "${x:-"a > b"}"'
+expect allow 'echo "${x#"a > b"}"'
+expect allow 'echo "${x:-"$(printf "a > b")"}"'
+expect allow 'echo "${x:-"a; sed -i s/a/b/ pkg/x.ts"}"'
+expect allow "echo \"\${x:-'a > b'}\""          # control: no nested `"`, allowed before and after
+# The heredoc scan agrees: the ` #` inside the expansion is no comment, so the introducer
+# behind it is found and the body stays prose.
+expect allow "$(printf 'echo "${x:-" #"}" <<EOF\nsed -i s/a/b/ pkg/x.ts\nEOF\n')"
+# Recall is untouched: a write behind, beside or inside the script of a quoted expansion. A
+# '…' run holding no character the shells disagree on is skipped, so the write behind it stays.
+expect block 'sed -i "s/a/${x:-"b"}/" pkg/x.ts'
+expect block 'sed -i "s/a/${x}/" pkg/x.ts'
+expect block 'echo "${HOME}" > pkg/x.ts'
+expect block 'echo "${x:-"a"}" ; sed -i s/a/b/ pkg/x.ts'
+expect block "echo \"\${x:-'a'}\" ; sed -i s/a/b/ pkg/x.ts"
+# A `$(…)` inside the expansion is read by the same function, quotes and all: the `"` inside
+# its single quotes closes nothing, so the separator behind the word still splits.
+expect block "echo \"\${x:-\$(printf '\"')}\" ; sed -i s/a/b/ pkg/x.ts"
+
 echo "== shapes this guard deliberately does NOT claim (documented fail-open) =="
 CWD="$MAIN"
 expect allow "bash -c \"sed -i s/a/b/ $MAIN/pkg/x.ts\""
 expect allow 'echo pkg/x.ts | xargs sed -i s/a/b/'
 expect allow 'node -e "fs.writeFileSync(\"pkg/x.ts\", \"y\")"'
 expect allow 'python3 -c "open(\"pkg/x.ts\",\"w\").write(\"y\")"'
 expect allow 'echo "$(sed -i s/a/b/ pkg/x.ts)"'      # a QUOTED $(…) body is one inert word
+expect allow 'echo "${x:-"$(sed -i s/a/b/ pkg/x.ts)"}"'   # …and so is a QUOTED ${…} body
+expect allow 'echo hi > "${x:-"a > b"}"'              # a target holding an expansion
+# A '…' run inside a quoted ${…} that holds `}` (or `"` `\` `$` and a backtick): bash 5.2 reads
+# it as quoted and POSIX shells as literal, so they end the expansion in different places and
+# everything after it is inert. Under bash the first is a pure read, under dash a real write.
+expect allow "echo \"\${x:-'}\"; sed -i s/a/b/ pkg/x.ts'}\""
+expect allow "echo \"\${x:-'}'}\" ; sed -i s/a/b/ pkg/x.ts"
 expect allow 'sed -i s/a/b/ $SOMEDIR/x.ts'
 expect allow 'sed -i s/a/b/ pkg/*.ts'
 
 
@@ -176,6 +176,41 @@ echo "== an escaped \\\" INSIDE a double-quoted word does NOT close it (#10406 h
 expect allow 'grep -rn "he said \"pkill -f vitest\" once" .claude/'
 expect block 'echo "he said \"x\"" && pkill -f vitest'
 
+echo "== a \$(…), backtick or \${…} inside \"…\" is its own quoting context (#24901) =="
+# Reading the `"` inside the body as CLOSING the outer string split the body at its `;`, so a
+# pure read became a name-matched kill. All four were BLOCKED before subst_end() existed here.
+expect allow 'echo "a $(echo "x; pkill -f node")"'
+expect allow 'echo "a `echo "x; pkill -f node"`"'
+expect allow 'echo "${x:-"a; pkill -f node"}"'
+expect allow 'echo "${x:-"; killall node"}"'
+# Recall: a kill behind a quoted expansion is still seen, and a pattern held in one is still a
+# pattern — the expansion is part of the word, not a way around the rule.
+expect block 'echo "${x:-"a"}" ; pkill -f node'
+expect block 'kill $(pgrep -f "${pat:-"node"}")'
+expect block 'pkill -f "${pat:-"vitest; x"}"'
+# The fail-OPEN mirror: the `"` inside the single quotes left the outer string hanging, so the
+# separator behind it went inert. ALLOWED before subst_end() existed here.
+expect block "echo \"\$(printf '\"')\" ; pkill -f vitest"
+# Deliberately not claimed, as before: a kill INSIDE a quoted substitution is one inert word.
+expect allow 'echo "$(pkill -f node)"'
+
+echo "== the shared quoting rules are copies, byte for byte (#24901) =="
+# split_segments() is guard-shared-stash.sh's and subst_end() is guard-main-checkout-bash.sh's.
+# A copy that drifts is a quoting rule the guards no longer share, and nothing else notices:
+# each hook's own cases keep passing on its own dialect.
+fn_text() { sed -n "/^$1() {\$/,/^}\$/p" "$2"; }
+same_fn() { # same_fn <function> <file holding the copy this hook must equal>
+  local mine theirs
+  mine="$(fn_text "$1" "$hook")"; theirs="$(fn_text "$1" "$2")"
+  if [ -n "$mine" ] && [ "${mine%%$'\n'*}" = "$1() {" ] && [ "$mine" = "$theirs" ]; then
+    pass=$((pass + 1)); printf '  ok   same   %s() as %s\n' "$1" "${2##*/}"
+  else
+    fail=$((fail + 1)); printf '  FAIL %s() is missing here or differs from %s\n' "$1" "${2##*/}"
+  fi
+}
+same_fn split_segments "$here/guard-shared-stash.sh"
+same_fn subst_end "$here/guard-main-checkout-bash.sh"
+
 echo "== escape hatch =="
 expect allow 'pkill -f vitest' OS_ALLOW_PROCESS_KILL=1
 expect allow 'ps aux | grep node | xargs kill' OS_ALLOW_PROCESS_KILL=1
 
@@ -158,6 +158,43 @@ expect block 'echo "a \\" ; git stash pop'
 # quotes it would swallow the closing `'` and let the stash behind it through.
 expect block "echo 'a \\' ; git stash pop"
 
+echo "== a \$(…), backtick or \${…} inside \"…\" is its own quoting context (#24901) =="
+# Reading the `"` inside the body as CLOSING the outer string split the body at its `;`, so a
+# pure read became a stash. The first three were BLOCKED before subst_end() existed here; the
+# fourth (both kinds nested) was allowed then only because two misread quotes cancelled out,
+# and the single-level `echo "x; git stash pop"` was allowed throughout.
+expect allow 'echo "a $(echo "x; git stash pop")"'
+expect allow 'echo "a `echo "x; git stash pop"`"'
+expect allow 'echo "${x:-"a; git stash pop"}"'
+expect allow 'echo "${x:-"$(echo "a; git stash pop")"}"'
+expect allow 'echo "x; git stash pop"'
+# Recall: a stash behind or beside a quoted expansion is still seen.
+expect block 'echo "${x:-"a"}" ; git stash pop'
+expect block 'X="${Y:-"z"}" && git stash push -m wip'
+expect block 'git stash push -m "${msg:-"wip; x"}"'
+# The fail-OPEN mirror: the `"` inside the single quotes left the outer string hanging, so the
+# separator behind it went inert and the real stash rode through as text. Both were ALLOWED
+# before subst_end() existed here.
+expect block "echo \"\$(printf '\"')\" ; git stash pop"
+expect block "echo \"\${x:-\$(printf '\"')}\" ; git stash pop"
+# Deliberately not claimed, as before: a stash INSIDE a quoted substitution is one inert word.
+expect allow 'echo "$(git stash pop)"'
+
+echo "== the shared quoting rule is guard-main-checkout-bash.sh's, byte for byte (#24901) =="
+# subst_end() lives in four hooks. A copy that drifts is a quoting rule the guards no longer
+# share, and nothing else notices: each hook's own cases keep passing on its own dialect.
+fn_text() { sed -n "/^$1() {\$/,/^}\$/p" "$2"; }
+same_fn() { # same_fn <function> <file holding the copy this hook must equal>
+  local mine theirs
+  mine="$(fn_text "$1" "$hook")"; theirs="$(fn_text "$1" "$2")"
+  if [ -n "$mine" ] && [ "${mine%%$'\n'*}" = "$1() {" ] && [ "$mine" = "$theirs" ]; then
+    pass=$((pass + 1)); printf '  ok   same   %s() as %s\n' "$1" "${2##*/}"
+  else
+    fail=$((fail + 1)); printf '  FAIL %s() is missing here or differs from %s\n' "$1" "${2##*/}"
+  fi
+}
+same_fn subst_end "$here/guard-main-checkout-bash.sh"
+
 echo "== escape hatch =="
 expect allow 'git stash pop' OS_ALLOW_STASH=1
 
 
@@ -119,6 +119,43 @@ expect allow 'echo "never feed a working-tree glob into git show origin/main:"'
 expect allow 'git grep -n "ls-tree --name-only origin/main"'
 expect allow 'cat .claude/hooks/guard-tree-enum.sh'
 
+echo "== a \"…\" string ends only where bash ends it (#24901) =="
+# Two shapes inside "…" whose `"` does NOT close the outer string, and this pass read both as
+# closing it, so a pure read split into an enumeration segment and an origin/main read. Every
+# allow-case below was BLOCKED before the fix; the single-level forms next door never were.
+# (1) an escaped `\"`, the #11804 repair its two siblings already carried:
+expect allow 'echo "say \"; ls *.yml; git show origin/main:x\" ok"'
+expect allow 'echo "say ; ls *.yml; git show origin/main:x ok"'
+# (2) a `"` inside a `$(…)`, a backtick or a `${…}`, which opens a context of its own:
+expect allow 'echo "a $(echo "x; ls *.yml")" && git show origin/main:README.md'
+expect allow 'echo "a `echo "; find ."`"; git grep foo origin/main'
+expect allow 'echo "${x:-"; ls *.yml"}" && git show origin/main:README.md'
+expect allow 'echo "x; ls *.yml" && git show origin/main:README.md'
+# Recall: the sweep this guard exists for is still caught when a quoted expansion sits in it.
+expect block 'for f in "${dir:-"docs"}"/*.md; do git show "origin/main:$f"; done'
+expect block 'for f in .github/workflows/*.yml; do git show "origin/main:${f}"; done'
+expect block 'echo "${x:-"a"}" ; for f in *.yml; do git show "origin/main:$f"; done'
+# The fail-OPEN mirror of (1): the escaped quotes paired up and left the region hanging, so
+# the real sweep behind them rode through as text. ALLOWED before the fix.
+expect block 'echo "he said \"x\"" ; for f in *.yml; do git show "origin/main:$f"; done'
+
+echo "== the shared quoting rules are copies, byte for byte (#24901) =="
+# split_segments() is guard-shared-stash.sh's and subst_end() is guard-main-checkout-bash.sh's.
+# This pass's header called it identical while it lacked the in-quote escape rule — exactly
+# the drift a prose claim cannot catch and this pin does.
+fn_text() { sed -n "/^$1() {\$/,/^}\$/p" "$2"; }
+same_fn() { # same_fn <function> <file holding the copy this hook must equal>
+  local mine theirs
+  mine="$(fn_text "$1" "$hook")"; theirs="$(fn_text "$1" "$2")"
+  if [ -n "$mine" ] && [ "${mine%%$'\n'*}" = "$1() {" ] && [ "$mine" = "$theirs" ]; then
+    pass=$((pass + 1)); printf '  ok   same   %s() as %s\n' "$1" "${2##*/}"
+  else
+    fail=$((fail + 1)); printf '  FAIL %s() is missing here or differs from %s\n' "$1" "${2##*/}"
+  fi
+}
+same_fn split_segments "$here/guard-shared-stash.sh"
+same_fn subst_end "$here/guard-main-checkout-bash.sh"
+
 echo "== unrelated commands are untouched =="
 expect allow 'pnpm --filter @objectstack/spec test'
 expect allow 'git status'