The Guard's Wait-Loop Rule Misses a Loop Inside a Double-Quoted Command Substitution #2206

Problem

The guard's wait-loop rule never reads a command substitution inside double quotes. The tokenizer keeps "$(...)" as one word, so the loop inside it is never seen, although bash runs it. The unquoted form of the same substitution is denied.

Reproduce (constructed)

Allowed on develop, and bash runs the loop until something kills it:

echo "$(until false; do sleep 1; done)"

echo $(until false; do sleep 1; done) is denied. The same holds with bash -c '<loop>' or eval '<loop>' inside the quoted substitution.

Done looks like

A $(...) body inside double quotes is scanned as commands the way an unquoted one is. The command above is denied, and a self-test row pins it.

Found by the local strict review of the #2080 fix (handoff #2137). It predates that fix, and differs from #1843, which needs a line whose quoting does not parse.