@@ -16,6 +16,7 @@ priorities.
 - [x] Give no twins for an incomplete occurrence, a verb word that is not static, a word without a complete finite value set, an unquoted value that can split or glob, a redirect that depends on a value, and combinations over the limit. Kill a hand mutant of each gate with a test.
 - [x] Review round 1: guard a backslash-newline, a carriage return, `=~` and `:~`, an unproved home directory, and `extglob` patterns. Count every twin parse against one budget of parses and source characters. Compare twins with GNU Bash argv on Linux.
 - [x] Review round 2: check `=~` and `:~` in the full source. Parse each twin as one command in its exact directory, and check the budget before a twin is built.
+- [x] Verification round: give no twins under the Unknown initial state, and for a directory that comes from an unproved `HOME`.
 - [ ] Merge the PR after Linux and Windows CI and after the 0.4.0-beta.22 lexer fix. Tag `0.4.0-beta.23` and verify NuGet publication.
 
 ## Completed (0.4.0-beta.21 restore the beta.19 verb-slot rule)
 
@@ -15,7 +15,9 @@ This prerelease adds literal twins of Bash commands whose argument words have a
 - An unquoted word uses its authored values only under `FreshNonInteractiveNoStartup`, and only when each value is nonempty and has no space, tab, newline, `*`, `?`, `[`, parenthesis, or backslash. The parenthesis rule covers a Bash build with `extglob` on by default.
 - A source with a backslash-newline, a carriage return, `=~`, or `:~` anywhere gets no twins. The lexer does not model this text as Bash does. The `=~` and `:~` rule covers a loop list item such as `for f in if=~/x`, and it also stops `[[ $x =~ re ]]`.
 - When the source has `~` or `HOME`, a command gets twins only with a live launch `HOME`. Without it, the home directory is the caller assumption `HomeDirectory`.
-- Budget: one call parses at most 128 twins and at most 2,048 + 8 x (source length) characters of twin text. The projection checks the budget before it builds a twin, so its cost stays a small constant factor of one `Parse`. On an 80 KB source with 8,000 commands, the projection takes about as long as `Parse`.
+- A command whose exact directory comes from `HOME` (after `cd`, `cd --`, `builtin cd`, or `if cd; then`) gets twins only with a live launch `HOME`. The projection finds such a command with one more parse that uses another `HomeDirectory`.
+- The projection gives no twins under `BashInitialStateMode.Unknown`. In that mode the parser can report `-o"$n"` as the exact value `-o$n`.
+- Budget: one call parses at most 128 twins and at most 2,048 + 8 x (source length) characters of twin text, plus at most one more parse of the source for the `HOME` check. The projection checks the budget before it builds a twin, so its cost stays a small constant factor of one `Parse`. On an 80 KB source with 8,000 commands, the projection takes about as long as `Parse`.
 - Values of different words combine independently. The twin set can hold combinations that never run, so a check of every twin is stricter, not weaker.
 - A Linux test runs each source and each twin in GNU Bash and compares the argv.
 - A twin grants no authority. Existing facts do not change: `Parse` gives the same output as 0.4.0-beta.22.
 
@@ -1547,11 +1547,14 @@ command, so read the structure from `SourceOccurrence`.
 The projection uses this schematic flow:
 
 ```text
+give nothing when the initial state mode is Unknown
 give nothing when the source has a backslash-newline, a carriage return,
     `=~`, or `:~`
 for each occurrence of the full parse:
     give nothing unless the occurrence is complete
     give nothing unless its directory is exact
+    without a live launch HOME, give nothing when its directory changes
+        in one more parse with another HomeDirectory
     give nothing when it has an assignment prefix (`X=1 cmd`)
     give nothing when the source has `~` or `HOME` and no live launch HOME
     give nothing unless each word has a span in the submitted source
@@ -1609,6 +1612,15 @@ a loop list, so these guards read the full source:
 - Without a live launch `HOME`, the home directory is the caller assumption
   `HomeDirectory`. When the source has `~` or `HOME`, an occurrence gets twins
   only with a live launch `HOME`.
+- A `cd` without an operand (also `cd --`, `builtin cd`, `if cd; then`) goes
+  to `$HOME`. Without a live launch `HOME`, the parser takes that directory
+  from `HomeDirectory`. The projection does not read the `cd` forms. It parses
+  the source once more with another `HomeDirectory`, and an occurrence whose
+  exact directory changes gets no twins. When the launch facts export `HOME`
+  but `HOME` is not live at the occurrence, the occurrence gets no twins.
+- Under `BashInitialStateMode.Unknown`, the parser can report an exact value
+  for a word that Bash expands (`-o"$n"` gives `-o$n`). The projection gives
+  no twins in that mode.
 
 The budget is checked before a twin text is built. A twin text is one simple
 command with no loop, so its parse costs about as much as its length. The
 
@@ -1025,7 +1025,9 @@ Rules for a consumer:
 - An unquoted word gets twins only under `FreshNonInteractiveNoStartup`
   with `PublishAuthoredSourceFacts`, and only when no value can split or glob.
 - A source with `~` or `HOME` gets twins only with a live launch `HOME` in
-  `LaunchEnvironment`.
+  `LaunchEnvironment`. A command whose directory comes from `HOME` (after a
+  `cd` without an operand) also needs a live launch `HOME`.
+- The projection gives no twins under `BashInitialStateMode.Unknown`.
 
 Warnings:
 
 
@@ -209,7 +209,11 @@ internal static bool TryProject(
         projection = null;
         cost = default;
         var source = parsed.Source;
-        if (HasUnmodeledText(source))
+        // SECURITY: with an unknown initial state, the parser can report an
+        // exact value for a word that Bash expands (`-o"$n"` gives `-o$n`).
+        // A twin would turn that value into a literal word.
+        if (options.InitialStateMode == BashInitialStateMode.Unknown ||
+            HasUnmodeledText(source))
         {
             return false;
         }
@@ -218,10 +222,15 @@ internal static bool TryProject(
         var mentionsHome = source.IndexOf('~') >= 0 ||
                            source.IndexOf("HOME", StringComparison.Ordinal) >= 0;
         var candidates = new List<Candidate>();
+        ParsedCommand? otherHomeParse = null;
         for (var index = 0; index < parsed.Commands.Count; index++)
         {
-            if (TryCreateCandidate(source, index, parsed.Commands[index], options,
-                    mentionsHome, out var candidate))
+            var occurrence = parsed.Commands[index];
+            if (TryCreateCandidate(source, index, occurrence, options,
+                    mentionsHome, out var candidate) &&
+                (HasLiveHome(occurrence) ||
+                 HasHomeIndependentDirectory(parsed, options, index, candidate.Directory,
+                     ref otherHomeParse)))
             {
                 candidates.Add(candidate);
             }
@@ -272,6 +281,61 @@ internal static bool TryProject(
         return true;
     }
 
+    /// <summary>
+    /// Returns true when the exact directory of the occurrence does not come
+    /// from the home directory that the caller assumes.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// SECURITY: a <c>cd</c> without an operand (also <c>cd --</c>,
+    /// <c>builtin cd</c>, and <c>if cd; then</c>) changes to <c>$HOME</c>.
+    /// Without a live launch <c>HOME</c>, the parser takes that directory from
+    /// <see cref="ShellParserOptions.HomeDirectory"/>, but Bash uses its real
+    /// <c>HOME</c>. A twin would then claim a wrong directory.
+    /// </para>
+    /// <para>
+    /// The check does not read the <c>cd</c> forms. It parses the source once
+    /// more with another home directory. When the exact directory of the
+    /// occurrence changes, the directory depends on the home directory, and
+    /// the occurrence gets no twins. The check costs at most one more parse
+    /// for each call. When the launch facts export <c>HOME</c>, the parser
+    /// needs that value as the home directory, so an occurrence without a live
+    /// <c>HOME</c> gets no twins.
+    /// </para>
+    /// </remarks>
+    private static bool HasHomeIndependentDirectory(
+        ParsedCommand parsed,
+        BashParserOptions options,
+        int index,
+        string directory,
+        ref ParsedCommand? otherHomeParse)
+    {
+        if (options.LaunchEnvironment?.ExportedVariables.ContainsKey("HOME") == true)
+        {
+            return false;
+        }
+
+        if (otherHomeParse is null)
+        {
+            var otherHome = string.Equals(options.HomeDirectory, FirstOtherHome,
+                StringComparison.Ordinal)
+                ? SecondOtherHome
+                : FirstOtherHome;
+            otherHomeParse = new BashParser(options with { HomeDirectory = otherHome })
+                .Parse(parsed.Source);
+        }
+
+        return !otherHomeParse.IsUnparseable &&
+               otherHomeParse.Commands.Count == parsed.Commands.Count &&
+               otherHomeParse.Commands[index].WorkingDirectory is ShellValueDomain.Exact
+                   { Value: var otherDirectory } &&
+               string.Equals(otherDirectory, directory, StringComparison.Ordinal);
+    }
+
+    private const string FirstOtherHome = "/nonexistent/shellsyntaxtree-twin-home-1";
+
+    private const string SecondOtherHome = "/nonexistent/shellsyntaxtree-twin-home-2";
+
     /// <summary>
     /// Returns true when the source has text that the Bash lexer does not
     /// model as Bash does.
 
@@ -61,10 +61,12 @@ public bool TryProjectFiniteScopes(
     /// <summary>
     /// Builds literal twins for each command whose changeable argument words
     /// (an expansion, a tilde) have a proved finite set of values. A twin
-    /// writes each such word as one literal value and parses the full source
-    /// again, so the twin occurrence has the facts of the literal command.
-    /// Returns false when no command has twins. A command without twins keeps
-    /// the facts of <see cref="Parse(string)"/> only.
+    /// writes each such word as one literal value. The parser then parses the
+    /// text of that one command in the exact directory of the command, so the
+    /// twin occurrence has the facts of the literal command. Returns false,
+    /// with a null projection, when no command has twins, and always under
+    /// <see cref="BashInitialStateMode.Unknown"/>. A command without twins
+    /// keeps the facts of <see cref="Parse(string)"/> only.
     /// </summary>
     public bool TryProjectLiteralTwins(
         string command,
 
@@ -22,7 +22,7 @@ public class BashLiteralTwinBashDifferentialTests
 {
     private const string Home = "/home/agent";
 
-    private static readonly string[] Programs = { "cat", "cmd", "cp", "echo", "gh", "git", "rm" };
+    private static readonly string[] Programs = { "cat", "cmd", "cp", "echo", "gh", "git", "rm", "tool" };
 
     private static readonly BashParser Parser = new(new BashParserOptions
     {
@@ -52,6 +52,11 @@ public class BashLiteralTwinBashDifferentialTests
     [InlineData("for n in a b; do cat ~/x \"$n\"; done")]
     [InlineData("for n in a b; do cat \"$HOME/x\" \"$n\"; done")]
     [InlineData("for r in 100001 100002; do echo -n \"$r: \"; gh run view $r --json headSha 2>/dev/null; echo; done")]
+    [InlineData("for n in a x; do tool '$n' -o\"$n\"; done")]
+    [InlineData("for n in a x; do git -C\"$n\" status; done")]
+    [InlineData("for n in a x; do tool -xo\"$n\"; done")]
+    [InlineData("for n in a x; do tool -o\"${n}\"; done")]
+    [InlineData("for n in a x; do tool -o\"$n\"x; done")]
     public void Each_twin_has_the_argv_that_bash_passes(string source)
     {
         Assert.True(Parser.TryProjectLiteralTwins(source, out var projection));
@@ -107,20 +112,103 @@ public void Bash_changes_a_list_item_that_gives_no_twins(
         Assert.Equal(bashValue, run.Split('\u001f')[^1]);
     }
 
+    // With an unknown initial state, the parser reports `-o$n` as an exact
+    // value, but Bash passes `-oa`. The projection gives no twins in that mode.
+    [BashTheory]
+    [InlineData("for n in a; do tool -o\"$n\"; done", "-o$n", "-oa")]
+    [InlineData("for n in a; do tool -o\"${n}\"; done", "-o${n}", "-oa")]
+    public void Bash_changes_a_word_that_the_unknown_state_reports_as_exact(
+        string source,
+        string parserValue,
+        string bashValue)
+    {
+        var unknown = new BashParser(new BashParserOptions
+        {
+            WorkingDirectory = "/work",
+            HomeDirectory = Home,
+            PublishAuthoredSourceFacts = true,
+        });
+
+        Assert.False(unknown.TryProjectLiteralTwins(source, out _));
+        var argument = Assert.Single(Assert.Single(unknown.Parse(source).Commands).Arguments);
+        Assert.Equal(parserValue, Assert.IsType<ShellValueDomain.Exact>(argument.Value).Value);
+        Assert.Equal("tool\u001f" + bashValue, Assert.Single(RunArgv(source, "tool")));
+    }
+
+    // A `cd` without an operand goes to $HOME. With a live launch HOME, the
+    // twin directory is the directory where Bash runs the command. Without
+    // it, the parser uses the HomeDirectory assumption, so the projection
+    // gives no twins.
+    [BashTheory]
+    [InlineData("cd && for n in a; do cmd \"$n\"; done")]
+    [InlineData("cd -L && for n in a; do cmd \"$n\"; done")]
+    [InlineData("cd -- && for n in a; do cmd \"$n\"; done")]
+    [InlineData("builtin cd && for n in a; do cmd \"$n\"; done")]
+    [InlineData("command cd && for n in a; do cmd \"$n\"; done")]
+    [InlineData("cd >/dev/null && for n in a; do cmd \"$n\"; done")]
+    [InlineData("if cd; then for n in a; do cmd \"$n\"; done; fi")]
+    [InlineData("for d in x; do cd && cmd \"$d\"; done")]
+    public void A_cd_to_home_gives_the_directory_that_bash_uses(string source)
+    {
+        var home = Directory.CreateTempSubdirectory("sst-twin-home-").FullName;
+        try
+        {
+            var proved = new BashParser(new BashParserOptions
+            {
+                WorkingDirectory = "/work",
+                HomeDirectory = home,
+                InitialStateMode = BashInitialStateMode.FreshNonInteractiveNoStartup,
+                PublishAuthoredSourceFacts = true,
+                LaunchEnvironment = new ShellLaunchEnvironment(
+                    new[] { new KeyValuePair<string, string>("HOME", home) },
+                    Array.Empty<string>()),
+            });
+            Assert.True(proved.TryProjectLiteralTwins(source, out var projection));
+            var twin = Assert.Single(Assert.Single(projection!.Commands).Twins);
+            var run = Assert.Single(RunRecords(source, "cmd", home));
+            Assert.Equal(SstArgv(twin), run.Argv);
+            Assert.Equal(twin.WorkingDirectory, run.Directory);
+
+            var assumed = new BashParser(new BashParserOptions
+            {
+                WorkingDirectory = "/work",
+                HomeDirectory = "/home/assumed",
+                InitialStateMode = BashInitialStateMode.FreshNonInteractiveNoStartup,
+                PublishAuthoredSourceFacts = true,
+            });
+            Assert.False(assumed.TryProjectLiteralTwins(source, out _));
+            var occurrence = assumed.Parse(source).Commands.Single(command =>
+                command.Clause.Elements[0].Value == "cmd");
+            Assert.Equal("/home/assumed",
+                Assert.IsType<ShellValueDomain.Exact>(occurrence.WorkingDirectory).Value);
+            Assert.NotEqual("/home/assumed", run.Directory);
+        }
+        finally
+        {
+            Directory.Delete(home, recursive: true);
+        }
+    }
+
     private static string SstArgv(BashLiteralTwin twin) =>
         string.Join("\u001f", twin.Occurrence.Clause.Elements
             .Where(element => element.Role != ClauseElementRole.Redirect)
             .Select(element => element.Value));
 
-    private static IReadOnlyList<string> RunArgv(string source, string program)
+    private static IReadOnlyList<string> RunArgv(string source, string program) =>
+        RunRecords(source, program, Home).Select(record => record.Argv).ToArray();
+
+    private static IReadOnlyList<(string Argv, string Directory)> RunRecords(
+        string source,
+        string program,
+        string home)
     {
         var script = new StringBuilder("exec 3>&1\n");
         foreach (var name in Programs)
         {
             script.Append(name)
                 .Append("() { builtin printf '%s\\037' ")
                 .Append(name)
-                .Append(" \"$@\" >&3; builtin printf '\\036' >&3; }\n");
+                .Append(" \"$@\" >&3; builtin printf '\\035%s\\036' \"$PWD\" >&3; }\n");
         }
 
         script.Append(source).Append('\n');
@@ -139,7 +227,7 @@ private static IReadOnlyList<string> RunArgv(string source, string program)
             start.ArgumentList.Add("-c");
             start.ArgumentList.Add(script.ToString());
             start.Environment.Clear();
-            start.Environment["HOME"] = Home;
+            start.Environment["HOME"] = home;
             start.Environment["PATH"] = "/nonexistent-shellsyntaxtree";
 
             using var process = Process.Start(start)!;
@@ -149,8 +237,10 @@ private static IReadOnlyList<string> RunArgv(string source, string program)
             Assert.Equal(string.Empty, error.Result);
 
             return output.Split('\u001e', StringSplitOptions.RemoveEmptyEntries)
-                .Select(record => record.EndsWith('\u001f') ? record[..^1] : record)
-                .Where(record => record.Split('\u001f')[0] == program)
+                .Select(record => record.Split('\u001d'))
+                .Select(parts => (Argv: parts[0].EndsWith('\u001f') ? parts[0][..^1] : parts[0],
+                    Directory: parts[1]))
+                .Where(record => record.Argv.Split('\u001f')[0] == program)
                 .ToArray();
         }
         finally