unknown-env
A deny rule: it refuses a retired or misspelled MAGUS_* variable handed to a command, and names what to run instead.
What it catches
A retired or misspelled MAGUS_* variable handed to a command.
Why
A retired or misspelled name is ignored without a word, so the setting the caller meant never takes effect and nothing says so. Measured 2026-09-24: the day MAGUS_NO_WAIT was removed, agents prefixed 462 commands with it, copied from 33 briefs. It fires on the names a command's environment receives: a NAME=value prefix, env NAME=value, env -u NAME, and export. It asks config.EnvVarProblem, the check magus's own startup refuses on (MGS1046), so a name the guard denies is one the binary would refuse, and one it cannot prove wrong passes both.
Seeing it
A verdict names its rule in brackets, which is how you got here:
deny [unknown-env]: ...
magus describe rule unknown-env prints the same entry at a terminal, and
magus describe rules lists every rule this workspace enforces.