POSIX recognizes an IO number only when the digit run is unquoted, but
tokenize()'s redirection branch tested `cur` — the token's characters — and
never `curMask`, their quoting. `"2"` and `2` were indistinguishable to it,
so a correct `gsd_run query commit ... --files "2">out` had its value
consumed as an IO number and scored as an unscoped invocation: the #2269
guard reddening on documentation that was right.
The mask was already maintained in the same loop and thrown away on this
branch. One conjunct reads it: '0' marks a bare character, so /^0+$/ asks
precisely whether every character of the digit run was unquoted.
The regression arms come in both directions. The quoted rows (glued,
detached, single-quoted, and the partially-quoted 2"3" that a
some-character-unquoted test would get wrong) must be scoped; the existing
unquoted `--files 2>&1` row is the negative control and must stay unscoped,
so an implementation that simply stopped consuming IO numbers altogether
fails instead of passing.
No live instance exists in any of the six scan roots, so this is latent
rather than urgent — a false positive, never a silent miss.
Co-authored-by: Tom Boucher <trekkie@nomorestars.com>
93abf3a7b6