\write18 shell-escape permission boundary across restricted and unrestricted engine modes
The \write18 primitive lets a LaTeX document request an external program, but the engine—not the LaTeX kernel—decides whether that request is ignored, rejected, or executed. In a project that relies on an external tool such as repstopdf or makeindex , the same source may compile on a developer workstation yet fail in continuous integration because the engine