[#3112] Settled one environment variable guard form across the Drupal settings includes.

.vortex/docs/content/development/modules/contributed-modules.mdx

@@ -15,13 +15,13 @@ sidebar_position: 2
 
 ### Configuration
 
-[`settings.clamav.php`](https://github.com/drevops/vortex/blob/main/web/sites/default/includes/modules/settings.clamav.php) selects daemon or executable mode and points the daemon at the ClamAV service, but only when `DRUPAL_CLAMAV_ENABLED` is set.
+[`settings.clamav.php`](https://github.com/drevops/vortex/blob/main/web/sites/default/includes/modules/settings.clamav.php) selects daemon or executable mode and points the daemon at the ClamAV service, but only when `DRUPAL_CLAMAV_ENABLED` is set to `1`.
 
-| Variable                     | Purpose                            |
-|------------------------------|------------------------------------|
-| `DRUPAL_CLAMAV_ENABLED`      | Applies the override only when set |
-| `DRUPAL_CLAMAV_MODE`         | Selects daemon or executable mode  |
-| `CLAMAV_HOST`, `CLAMAV_PORT` | Daemon host and port               |
+| Variable                     | Purpose                                   |
+|------------------------------|-------------------------------------------|
+| `DRUPAL_CLAMAV_ENABLED`      | Applies the override only when set to `1` |
+| `DRUPAL_CLAMAV_MODE`         | Selects daemon or executable mode         |
+| `CLAMAV_HOST`, `CLAMAV_PORT` | Daemon host and port                      |
 
 ## Coffee
 
@@ -163,10 +163,10 @@ No settings override.
 
 [`settings.redis.php`](https://github.com/drevops/vortex/blob/main/web/sites/default/includes/modules/settings.redis.php) makes Redis the default cache backend, registers the module container YAML files and swaps the bootstrap container over - all gated on `DRUPAL_REDIS_ENABLED` and on the `redis` PHP extension being loaded, so a two-stage deployment can provision the service before switching the cache.
 
-| Variable                           | Purpose                            |
-|------------------------------------|------------------------------------|
-| `DRUPAL_REDIS_ENABLED`             | Applies the override only when set |
-| `REDIS_HOST`, `REDIS_SERVICE_PORT` | Connection host and port           |
+| Variable                           | Purpose                                   |
+|------------------------------------|-------------------------------------------|
+| `DRUPAL_REDIS_ENABLED`             | Applies the override only when set to `1` |
+| `REDIS_HOST`, `REDIS_SERVICE_PORT` | Connection host and port                  |
 
 ## Reroute Email
 
@@ -212,9 +212,9 @@ A site that deselects this module during [installation](../../installation.mdx)
 
 **Overriding default behavior:**
 
-Set `DRUPAL_REROUTE_EMAIL_DISABLED` to any non-empty value to completely disable
-email rerouting in an environment where it would otherwise be enabled. This is
-the supported way for a `stage` environment to send real mail during UAT.
+Set `DRUPAL_REROUTE_EMAIL_DISABLED` to `1` to completely disable email rerouting
+in an environment where it would otherwise be enabled. This is the supported way
+for a `stage` environment to send real mail during UAT.
 
 <details>
 <summary>Example of the `Reroute Email` module `settings.reroute_email.php` file</summary>
@@ -292,14 +292,13 @@ No settings override.
 | `DRUPAL_SHIELD_USER`                 |         | HTTP authentication username                        |
 | `DRUPAL_SHIELD_PASS`                 |         | HTTP authentication password                        |
 | `DRUPAL_SHIELD_PRINT`                |         | Message shown in the authentication popup (module default when unset) |
-| `DRUPAL_SHIELD_ALLOW_ACME_CHALLENGE` |         | Set to any non-empty value to keep the `/.well-known/acme-challenge/*` path open for Let's Encrypt certificate generation |
+| `DRUPAL_SHIELD_ALLOW_ACME_CHALLENGE` |         | Set to `1` to keep the `/.well-known/acme-challenge/*` path open for Let's Encrypt certificate generation |
 
 **Overriding default behavior:**
 
-Set `DRUPAL_SHIELD_DISABLED` to any non-empty value to completely disable Shield
-in an environment where it would otherwise be enabled. This is useful for
-temporary access during debugging or when an environment does not require
-protection.
+Set `DRUPAL_SHIELD_DISABLED` to `1` to completely disable Shield in an
+environment where it would otherwise be enabled. This is useful for temporary
+access during debugging or when an environment does not require protection.
 
 <details>
 <summary>Example of the `Shield` module `settings.shield.php` file</summary>

.vortex/docs/content/development/settings.mdx

@@ -349,6 +349,32 @@ Prefix all such variables with `DRUPAL_` (e.g. `DRUPAL_MY_SETTING`) to
 distinguish them from other environment variables.<br/>
 Always define a default hardcoded value for each environment variable.
 
+- **Guard a variable by what it holds.**<br/>
+A _boolean flag_ - a variable whose only job is to switch behavior on - is read
+with `getenv('DRUPAL_MY_FLAG') === '1'`. Every other value, including an unset
+variable, an empty string, `0`, `true` and `yes`, leaves the behavior off.<br/>
+A _value carrier_ - a variable whose value is used - is read with
+`!empty(getenv('DRUPAL_MY_VALUE'))`. Assign it to a variable first when the
+value is needed after the guard.<br/>
+Compare with `===` and `!==`, never with `==`.
+
+:::warning Flags accept only `1`
+
+An environment that sets a shipped flag to `true`, `yes`, `on` or any other
+non-empty value gets the behavior turned **off**. Set every flag below to `1`
+in your hosting provider's environment variables: `DRUPAL_CLAMAV_ENABLED`,
+`DRUPAL_REDIS_ENABLED`, `DRUPAL_REROUTE_EMAIL_DISABLED`,
+`DRUPAL_SHIELD_DISABLED`, `DRUPAL_SHIELD_ALLOW_ACME_CHALLENGE`,
+`DRUPAL_TMP_PATH_IS_SHARED` and `DRUPAL_SETTINGS_LOCAL_SKIP`.
+
+:::
+
+- **Gate on the presence of a contributed module only when the file needs it.**<br/>
+`file_exists($contrib_path . '/my_module')` belongs in an override file that
+loads a file from the module directory or registers its paths. An override file
+that only writes `$config` or `$settings` needs no such guard, because Drupal
+ignores overrides for a module that is not installed.
+
 - **Use conditions based on _environment type_ within per-module override files.**<br/>
 This allows for environment-specific configuration without cluttering the main
 `settings.php` file.<br/>

.vortex/docs/content/hosting/acquia.mdx

@@ -62,7 +62,7 @@ by setting the `DRUPAL_ACQUIA_SETTINGS_FILE` environment variable.
 three-tier priority:
 
 1. **Default**: `/tmp`
-2. **Shared GFS mount**: If `DRUPAL_TMP_PATH_IS_SHARED` is set, uses
+2. **Shared GFS mount**: If `DRUPAL_TMP_PATH_IS_SHARED` is set to `1`, uses
    `/mnt/gfs/{group}.{env}/tmp` - a per-head mounted directory on Acquia's
    shared filesystem. This is useful for operations like bulk uploads that
    require a shared temporary directory across web heads. See