scrub: stop export UID= aborting the allow-list scrub mid-loop

CB-633's generated scrub.zsh blanks every non-allow-listed exported name
in one loop wrapped in `{ ... } 2>/dev/null`. In zsh, `export UID=` is
not a failed command: it is a fatal parameter error ("failed to change
user ID: operation not permitted") that aborts the whole sourced file.
The loop stops at UID, every later name is left unscrubbed, and the
report-writing block never runs -- silently, because of the 2>/dev/null.

The inversion is the severity. `env` lists inherited names first and the
names a startup file exports last, so the loop blanked the harmless
inherited half and died immediately before the operator's own exports --
exactly the credentials this policy exists to remove.

Measured on a fleet01 member pane: UID is name 42 of 57, and a decoy
exported from ~/.zshrc sat at 58, non-empty, on 8 of 8 spawns. xtrace
ends at `+scrub.zsh:28> export 'UID='` with rc=126. Reproduced
independently on macOS/zsh 5.9 (fleetd #394).

CONTAINMENT: `eval`, then VERIFY.

Neither `export "$n=" 2>/dev/null || true` nor a `${(t)n}` type guard
contains it -- both still abort, because it is an assignment error and
not a command failure. Only `eval` does. `eval` is safe at that point
because the loop above already rejected every name that is not
[A-Za-z_][A-Za-z0-9_]*, so nothing but a bare identifier reaches it.

Enumerating the specials (UID|EUID|GID|EGID|PPID|LINENO) also works, but
only for the names enumerated: one that turns up exported on another
host brings the abort straight back. `eval` covers all of them.

`eval` alone, though, contains the error WITHOUT blanking the value, so
the name would be reported as blanked having never been blanked --
measured: attempted=59 with UID still 1000. So each name is verified
after the attempt and only counted when it actually blanked. A name that
could not be blanked currently falls into the "allowed" count, which is
imprecise in the safe direction; the honest third count ("tried and could
not blank") needs a report-format change -- readReport treats every
non-first non-blank line as a blanked name -- and belongs with #394.

Why the suite stayed green: EnvAllowListScrubTest starts zsh from a
CLEARED parent (`pb.environment().clear()`), where UID is not an
exported name at all, so the abort cannot reproduce there. The new test
supplies the production shape -- UID present and exported -- and asserts
a report exists, which is written by the last statement in the file and
so proves the script ran to completion. Verified by mutation in both
shapes: reverting the fix fails exactly that test and no other.

Orthogonal to #388, which adds a fifth call site to a script that still
aborts at the same name.

CLAUDE.md

@@ -137,7 +137,7 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 | Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
 | Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
 | Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `fleet_send{coordId}` — or `{sessionId}` if they are on this host. **Not** `fleet_reply`: it has no peer route and the publish is refused |
+| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
 | Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
 | Tear down a member | `fleet_stop{paneId}` |
 
@@ -163,21 +163,15 @@ The traffic between leads is coordination and nothing else:
 3. **Verify a peer exactly as you verify yourself.** Peer status buys nothing: check the claim
    against the code, and re-run the build. A peer's correction gets the same treatment — right or
    wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
-   **N observations are N data points only if they differ in the axis you are trusting.** This cuts
-   both ways. N *failures* blamed on one cause are one data point when the cases share what you are
-   not varying. N *agreeing measurements* are also one data point when they share an instrument —
-   two hosts, two operators and the same formula is one formula, not two confirmations.
 4. **Ask a peer to read your project addendum.** Your addendum is instruction surface: every future
    session on your host obeys it, and a wrong one is obeyed just as faithfully as a right one. The
    author is the worst reader of their own qualifier placement — measured here, one addendum carried
    two defects and a non-author found both. If you have no peer, at least re-read it asking "which
    sentence goes false first, and would a reader reach the caveat before acting?"
 
-Being messaged by a peer does not make you its worker: answer the way you would open —
-`fleet_send{coordId}` for another daemon, `fleet_send{sessionId}` on this host — and push back on
-the substance if it is wrong. `fleet_reply` resolves a member's blocked `fleet_send`; a peer's
-coord-id message is durable and non-blocking, so there is nothing for it to resolve. A peer that
-simply complies has thrown away the reason there are two of you.
+Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
+the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
+you.
 
 ### Member (worker or architect) — the turn contract
 

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -346,7 +346,7 @@ public final class FleetMcp {
                     String self = callerTerminal(exchange);
                     McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_reply", req.arguments()), self);
                     if (denied != null) return denied;
-                    return reply(messages, self, principal(exchange).role(), str(req.arguments(), "content"));
+                    return reply(messages, self, str(req.arguments(), "content"));
                 };
         // fleet_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> askHandler =
@@ -868,26 +868,19 @@ public final class FleetMcp {
     /**
      * {@code fleet_reply}: the worker returns its structured answer, resolving the awaiting send
      * or — when no send is open — queueing the reply in the inbox for later drain (CB-307).
-     * {@code callerTerminal} and {@code callerRole} are resolved from the connection (never an
-     * argument). A {@code null} terminal means the caller is not a known worker. A PRIMARY with a
-     * terminal is a lead and must use {@code fleet_send}, because reply has no peer-lead route.
+     * {@code callerTerminal} is resolved from the connection (never an argument); a {@code null}
+     * means the caller is not a known worker (e.g. the primary called it by mistake).
      *
      * <p>fleetd #365: the result text names which of those actually happened
      * ({@link MessageService.ReplyOutcome#description()}) instead of the single word "delivered"
      * for both — a queued reply is a real success, but it is not the same fact as one that resolved
      * a live waiter, and the caller could not previously tell them apart.
      */
-    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, Role callerRole, String content) {
+    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, String content) {
         if (callerTerminal == null) {
             return error("fleet_reply is for workers only — could not identify the calling worker "
                     + "from the connection");
         }
-        if (callerRole == Role.PRIMARY) {
-            return error("fleet_reply has no route to a peer lead. Use fleet_send{coordId: ...} for a peer on another "
-                    + "daemon or fleet_send{sessionId: ...} for a peer on this host. fleet_reply resolves a member's "
-                    + "blocked fleet_send, and a peer's coord-id message is durable and non-blocking, so there is "
-                    + "nothing for it to resolve.");
-        }
         // fleetd #302: isBlank, not == null, to match fleet_send's own guard above. MessageService
         // .reply now REJECTS blank content, and this handler is a bare BiFunction with no try/catch
         // around it — so a whitespace-only fleet_reply would leave here as an uncaught

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -75,28 +75,9 @@ import java.util.stream.Stream;
  * never to the control.
  *
  * <p>The scrub also writes {@code scrub-report.txt} into its own directory: one {@code allowed N of
- * M failed F} line (N = exports left untouched, M = exports present when the scrub ran, F = names
- * the scrub attempted to blank but could not), then the NAMES — blanked ones bare, unblankable ones
- * {@code !}-prefixed — never values. The launcher reads this back at teardown and logs it, because a
- * blocked count next to an unknown denominator is not a finding.
- *
- * <p><b>fleetd #394:</b> plain {@code export "$n="} is a FATAL error for a zsh read-only or special
- * parameter (for example {@code UID}) — it aborts the whole sourced file, so every name still to
- * come is never blanked and the report above is never written at all. The blanking loop instead
- * routes each attempt through {@code eval}, which contains that error to the single iteration: the
- * loop always finishes, and a name that could not be blanked is counted as {@code failed} and
- * listed {@code !}-prefixed rather than silently disappearing. This is deliberately not a skip-list
- * of known-bad names — every enumerated name is still attempted, so a name nobody has thought of
- * yet still gets tried and, if it fails, still gets counted.
- *
- * <p>The blanking loop also re-asserts, on its own, the same {@code [A-Za-z_][A-Za-z0-9_]*} shape
- * check the enumeration loop already applied. Before {@code eval} was introduced a non-conforming
- * name reaching {@code export "$n="} was harmless either way — the quoting made it inert. With
- * {@code eval}, the name is spliced into a string and interpreted as shell syntax, so the enumeration
- * loop's check is no longer sufficient on its own to keep that call site safe — it is a guard on a
- * different loop, and the two must not silently drift apart. Re-checking right before the
- * {@code eval} keeps that call site safe by its own reading, independent of whatever the enumeration
- * loop does or stops doing in a later change.
+ * M} line (N = exports left untouched, M = exports present when the scrub ran), then the blanked
+ * NAMES — never values. The launcher reads this back at teardown and logs it, because a blocked
+ * count next to an unknown denominator is not a finding.
  */
 public final class EnvAllowListScrub {
 
@@ -151,16 +132,10 @@ public final class EnvAllowListScrub {
     }
 
     /**
-     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran
-     * ({@code total}), how many were left untouched ({@code allowed}), how many the scrub attempted
-     * to blank but could not ({@code failed} — fleetd #394: a zsh read-only/special parameter such
-     * as {@code UID} fatally errors on plain {@code export NAME=}, so those attempts go through
-     * {@code eval} instead so the loop keeps going and the failure is counted rather than left
-     * invisible), and the NAMES in each of the latter two categories. {@code allowed +
-     * blanked.size() + unblankable.size() == total}, and {@code unblankable.size() == failed}.
-     * Values never appear.
+     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran,
+     * how many were left untouched (allowed), and the NAMES that were blanked. Values never appear.
      */
-    record ScrubReport(int allowed, int total, int failed, List<String> blanked, List<String> unblankable) {
+    record ScrubReport(int allowed, int total, List<String> blanked) {
     }
 
     /**
@@ -359,46 +334,38 @@ public final class EnvAllowListScrub {
                   _cb633_blank+=("$_cb633_n")
                 done
 
-                # fleetd #394: plain `export "$n="` is FATAL for a zsh read-only/special parameter
-                # (e.g. UID) and aborts this whole sourced file — every name still to come is never
-                # blanked, and the report below is never written, silently. `eval` contains that
-                # error to the single iteration instead: it still fails for that one name, but the
-                # loop continues and we can tell allowed / blanked / unblankable apart afterwards.
-                # This is not a skip-list of known-bad names (that would miss the next one nobody
-                # thought of) — every name in _cb633_blank is still attempted, unconditionally.
-                # Every name reaching this loop already passed the identical identifier check in the
-                # enumeration loop above — but that guard is 20 lines away in a different loop, and
-                # this line is about to splice the name into a string handed to `eval`. Before this
-                # fix the name only ever reached `export` quoted ("$n="), which is inert on a
-                # non-identifier string either way; `eval` makes THIS line the only thing standing
-                # between such a string and code execution in the member's pane, so it re-asserts the
-                # same check on its own rather than trusting a guard it does not own. Under normal
-                # operation this can never fire (the enumeration guard already filtered everything
-                # reaching _cb633_blank), so a name caught here is counted as unblankable rather than
-                # silently dropped — it is real evidence that the upstream guard was bypassed.
-                typeset -a _cb633_ok _cb633_unblankable
-                _cb633_ok=()
-                _cb633_unblankable=()
+                # `export UID=` is not a failed command: it is a FATAL zsh parameter error
+                # ("failed to change user ID") that aborts this whole sourced file mid-loop,
+                # leaving every later name unscrubbed and the report below unwritten — silently,
+                # because of the 2>/dev/null. Neither `|| true` nor a `${(t)n}` type guard
+                # contains it; only `eval` does. `eval` is safe here precisely because the loop
+                # above already rejected every name that is not [A-Za-z_][A-Za-z0-9_]*, so
+                # nothing but a bare identifier can reach it.
+                #
+                # Enumerating the special names instead (UID|EUID|GID|EGID|PPID|LINENO) also
+                # works, but only for the ones enumerated: a special that turns up exported on
+                # some other host brings the abort straight back. `eval` contains all of them.
+                #
+                # Then VERIFY. A contained failure is still a failure, so a name that did not
+                # actually blank must not be reported as blanked. It currently falls into the
+                # "allowed" count, which is imprecise in the safe direction; the honest third
+                # count ("tried and could not blank") needs a report-format change and belongs
+                # with fleetd #394, not here.
+                typeset -a _cb633_done
+                _cb633_done=()
                 for _cb633_n in "${_cb633_blank[@]}"; do
-                  if [[ ! "$_cb633_n" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
-                    _cb633_unblankable+=("$_cb633_n")
-                    continue
-                  fi
-                  if eval "export ${_cb633_n}=" 2>/dev/null; then
-                    _cb633_ok+=("$_cb633_n")
-                  else
-                    _cb633_unblankable+=("$_cb633_n")
-                  fi
+                  eval "export ${_cb633_n}=" 2>/dev/null
+                  [[ -z "${(P)_cb633_n}" ]] && _cb633_done+=("$_cb633_n")
                 done
+                _cb633_blank=("${_cb633_done[@]}")
 
                 integer _cb633_kept=$(( _cb633_total - ${#_cb633_blank} ))
                 {
-                  print -r -- "allowed $_cb633_kept of $_cb633_total failed ${#_cb633_unblankable}"
-                  for _cb633_n in "${_cb633_ok[@]}"; do print -r -- "$_cb633_n"; done
-                  for _cb633_n in "${_cb633_unblankable[@]}"; do print -r -- "!$_cb633_n"; done
+                  print -r -- "allowed $_cb633_kept of $_cb633_total"
+                  for _cb633_n in "${_cb633_blank[@]}"; do print -r -- "$_cb633_n"; done
                 } > "$ZDOTDIR/%s" 2>/dev/null
 
-                unset _cb633_allowed _cb633_names _cb633_blank _cb633_ok _cb633_unblankable _cb633_n _cb633_total _cb633_kept
+                unset _cb633_done _cb633_allowed _cb633_names _cb633_blank _cb633_n _cb633_total _cb633_kept
                 """.formatted(names, MemberEnvAllowList.zshCasePattern(), REPORT_FILE);
     }
 
@@ -412,11 +379,6 @@ public final class EnvAllowListScrub {
      * Read and parse {@link #REPORT_FILE} out of a generated ZDOTDIR directory. Returns {@code null}
      * when absent or unreadable (the pane may have been torn down before its login shell ever got to
      * the scrub) — callers treat that as "no measurement available", never as success.
-     *
-     * <p>First line is {@code "allowed <N> of <M> failed <F>"} (fleetd #394 added the trailing
-     * {@code failed <F>} — a count of names the scrub attempted to blank but could not, e.g. a zsh
-     * read-only/special parameter). Every following non-blank line is a name: a bare name was
-     * blanked, a {@code !}-prefixed name was attempted and failed. Values never appear on either.
      */
     static ScrubReport readReport(Path zdotdir) {
         Path report = zdotdir.resolve(REPORT_FILE);
@@ -429,24 +391,17 @@ public final class EnvAllowListScrub {
                 return null;
             }
             String[] parts = lines.getFirst().substring("allowed ".length()).trim().split("\\s+");
-            if (parts.length != 5 || !"of".equals(parts[1]) || !"failed".equals(parts[3])) {
+            if (parts.length != 3 || !"of".equals(parts[1])) {
                 return null;
             }
             List<String> blanked = new ArrayList<>();
-            List<String> unblankable = new ArrayList<>();
             for (int i = 1; i < lines.size(); i++) {
-                String line = lines.get(i);
-                if (line.isBlank()) {
-                    continue;
-                }
-                if (line.startsWith("!")) {
-                    unblankable.add(line.substring(1));
-                } else {
-                    blanked.add(line);
+                if (!lines.get(i).isBlank()) {
+                    blanked.add(lines.get(i));
                 }
             }
             return new ScrubReport(Integer.parseInt(parts[0]), Integer.parseInt(parts[2]),
-                    Integer.parseInt(parts[4]), List.copyOf(blanked), List.copyOf(unblankable));
+                    List.copyOf(blanked));
         } catch (IOException | NumberFormatException e) {
             return null;
         }

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -1643,19 +1643,11 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             log.warn("memberCredentials allow-list: pane {} left no scrub report in {} — the "
                     + "environment scrub cannot be confirmed to have run. Either the pane ended "
                     + "before its shell finished starting, or its shell never read our generated "
-                    + "startup files. Either way, we cannot tell from here whether the scrub ran, "
-                    + "so we do not know what that member's environment contained.",
+                    + "startup files, in which case that member saw the full host environment.",
                     paneId, dir);
         } else {
             log.info("memberCredentials allow-list: pane {} allowed {} of {} environment variables",
                     paneId, report.allowed(), report.total());
-            if (report.failed() > 0) {
-                log.warn("memberCredentials allow-list: pane {} could not blank {} environment "
-                        + "variable(s) — {} (likely a zsh read-only/special parameter) — those "
-                        + "names were left in the member's environment. Confirm none of them is a "
-                        + "credential.",
-                        paneId, report.failed(), report.unblankable());
-            }
             List<String> shaped = report.blanked().stream()
                     .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
                     .toList();

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -3,7 +3,6 @@ package dev.ltms.fleet.mcp;
 import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.auth.Principal;
-import dev.ltms.fleet.auth.Role;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -29,7 +28,6 @@ import dev.ltms.fleet.placement.BackendQuarantine;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import io.modelcontextprotocol.spec.McpSchema;
 import dev.ltms.fleet.msg.InMemoryReplyInbox;
-import dev.ltms.fleet.msg.ReplyInbox;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -79,7 +77,7 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting(target), "send should be accepted for " + target);
-        FleetMcp.reply(messages, target, Role.WORKER, "received");
+        FleetMcp.reply(messages, target, "received");
         assertEquals("received", textOf(send.get(6, TimeUnit.SECONDS)));
     }
 
@@ -112,7 +110,7 @@ class FleetMcpTest {
 
         // fleetd #365: a resolved live send must read distinctly from a merely-queued reply —
         // see replyWithNoPendingSendIsQueuedNotError below for the other case.
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "LGTM");
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "LGTM");
         assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
 
         McpSchema.CallToolResult res = send.get(6, TimeUnit.SECONDS);
@@ -138,7 +136,7 @@ class FleetMcpTest {
         }
         assertTrue(rendezvous.isWaiting("term_a"), "send should have opened its waiter");
 
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "async LGTM");
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "async LGTM");
         assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
 
         // Poll until the async send completes and reports the reply.
@@ -185,7 +183,7 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting("term_a"));
-        FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
+        FleetMcp.reply(messages, "term_a", "done");
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
 
         McpSchema.CallToolResult done = FleetMcp.poll(messages, ticket, null);
@@ -217,7 +215,7 @@ class FleetMcpTest {
         // fleet_poll{ticket} stuck PENDING forever and later force-failed with a false "session
         // released before it replied" reason. This used to land in the inbox instead (see the old
         // assertion this replaced: messages.drainReplies("term_a").getFirst()...) — that was the bug.
-        FleetMcp.reply(messages, "term_a", Role.WORKER, "finished after timeout");
+        FleetMcp.reply(messages, "term_a", "finished after timeout");
         assertEquals("finished after timeout", textOf(FleetMcp.poll(messages, ticket, null)));
         assertTrue(messages.drainReplies("term_a").isEmpty(),
                 "the reply completed its own ticket directly and never touched the inbox");
@@ -271,7 +269,7 @@ class FleetMcpTest {
         }
         assertEquals(MessageService.Phase.FAILED, second.phase());
 
-        FleetMcp.reply(messages, "term_a", Role.WORKER, "late reply");
+        FleetMcp.reply(messages, "term_a", "late reply");
         assertEquals("late reply", messages.drainReplies("term_a").getFirst().content());
 
         CompletableFuture<McpSchema.CallToolResult> answer = CompletableFuture.supplyAsync(
@@ -280,7 +278,7 @@ class FleetMcpTest {
         while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
             Thread.sleep(5);
         }
-        FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
+        FleetMcp.reply(messages, "term_a", "done");
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
     }
 
@@ -333,7 +331,7 @@ class FleetMcpTest {
     void replyWithNoPendingSendIsQueuedNotError() {
         // CB-307: a reply with no open send is now queued in the inbox, not an error.
         // fleetd #365: it must also no longer claim "delivered" — nothing was waiting for it.
-        McpSchema.CallToolResult res = FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan");
+        McpSchema.CallToolResult res = FleetMcp.reply(messages, "term_a", "orphan");
         assertNotEquals(Boolean.TRUE, res.isError(), "a queued reply is not an error");
         assertEquals(MessageService.ReplyOutcome.QUEUED.description(), textOf(res));
 
@@ -343,40 +341,6 @@ class FleetMcpTest {
         assertEquals("orphan", drained.getFirst().content());
     }
 
-    @Test
-    void replyFromLeadIsRefusedBeforeItCanPublishToTheWorkerInbox() {
-        ReplyInbox inboxThatRejectsPublishes = new ReplyInbox() {
-            @Override public void own(String target) { }
-            @Override public void release(String target) { }
-            @Override public void publish(String target, String msgId, String content) {
-                fail("a lead fleet_reply must not publish to the worker inbox");
-            }
-            @Override public List<InboxMessage> peek(String target) { return List.of(); }
-            @Override public void ack(String target, String msgId) { }
-        };
-        MessageService leadMessages = new MessageService(agents, new Injector(agents), new Rendezvous(),
-                inboxThatRejectsPublishes);
-
-        McpSchema.CallToolResult res = assertDoesNotThrow(
-                () -> FleetMcp.reply(leadMessages, "term_lead", Role.PRIMARY, "peer reply"));
-
-        assertTrue(res.isError());
-        assertEquals("fleet_reply has no route to a peer lead. Use fleet_send{coordId: ...} for a peer on another "
-                        + "daemon or fleet_send{sessionId: ...} for a peer on this host. fleet_reply resolves a member's "
-                        + "blocked fleet_send, and a peer's coord-id message is durable and non-blocking, so there is "
-                        + "nothing for it to resolve.",
-                textOf(res));
-    }
-
-    @Test
-    void replyFromUnidentifiedCallerKeepsItsOwnError() {
-        McpSchema.CallToolResult res = FleetMcp.reply(messages, null, Role.PRIMARY, "reply");
-
-        assertTrue(res.isError());
-        assertEquals("fleet_reply is for workers only — could not identify the calling worker from the connection",
-                textOf(res));
-    }
-
     @Test
     void replyWithBlankContentIsACleanToolErrorNotAnUncaughtException() {
         // fleetd #302: MessageService.reply now REJECTS blank content by throwing. fleet_reply's
@@ -387,7 +351,7 @@ class FleetMcpTest {
         // has always used isBlank for exactly this reason.
         for (String blank : new String[] {null, "", "   ", "\n\t"}) {
             McpSchema.CallToolResult res = assertDoesNotThrow(
-                    () -> FleetMcp.reply(messages, "term_a", Role.WORKER, blank),
+                    () -> FleetMcp.reply(messages, "term_a", blank),
                     "blank content must be refused as a tool error, never thrown out of the handler");
             assertEquals(Boolean.TRUE, res.isError(), "blank content is an error result");
             assertTrue(textOf(res).contains("content is required"),
@@ -400,7 +364,7 @@ class FleetMcpTest {
     @Test
     void bridgePollWithTargetDrainsReplies() {
         // A reply with no open send queues it in the inbox.
-        FleetMcp.reply(messages, "term_a", Role.WORKER, "queued-msg");
+        FleetMcp.reply(messages, "term_a", "queued-msg");
 
         // fleet_poll with target drains the inbox.
         McpSchema.CallToolResult res = FleetMcp.poll(messages, null, "term_a");
@@ -451,7 +415,7 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting("term_a"), "the answer should have reopened a waiter");
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "done");
         assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
     }
@@ -1290,13 +1254,13 @@ class FleetMcpTest {
     @Test
     void bridgeAckRemovesSpecificReply() {
         // Queue a reply and capture its msgId.
-        FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan");
+        FleetMcp.reply(messages, "term_a", "orphan");
         var before = messages.drainReplies("term_a");
         assertEquals(1, before.size(), "one reply in the inbox");
         String msgId = before.getFirst().msgId();
 
         // Publish the same reply again and ack it via fleet_ack surface.
-        FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan-again");
+        FleetMcp.reply(messages, "term_a", "orphan-again");
         var peeked = messages.drainReplies("term_a");
         assertEquals(1, peeked.size(), "one fresh reply in the inbox");
 

fleetd/src/test/java/dev/ltms/fleet/member/EnvAllowListScrubTest.java

@@ -120,128 +120,40 @@ class EnvAllowListScrubTest {
     }
 
     /**
-     * fleetd #394: the actual defect. Plain {@code export "$n="} is FATAL for a zsh read-only or
-     * special parameter (e.g. {@code UID}) and aborts the whole sourced file — every name still to
-     * come is never blanked, and the {@code scrub-report.txt} below is never written at all,
-     * silently ({@code 2>/dev/null} swallows the error). This plants an unblankable, exported,
-     * read-only variable in the MIDDLE of the names the scrub attempts to blank, with two more
-     * names after it, and asserts that both of those later names are STILL blanked and the report
-     * is STILL written with the failure counted — a test that only checked names BEFORE the failure
-     * point would pass today and prove nothing.
+     * A pane inherits {@code UID}; a cleared test parent does not. The scrub must survive it.
      *
-     * <p>The planted name is a made-up one ({@code FLEETD_TEST_UNBLANKABLE}), not {@code UID} or
-     * any other name a skip-list might already know about — invariant 1 is that the loop survives
-     * ANY unblankable name, not a known one, so the test must not lean on one either.
+     * <p>Every other test here starts zsh from a CLEARED environment, so {@code UID} is never an
+     * exported name and never reaches the blanking loop. In a real member pane it is exported and
+     * it IS reached — and {@code export UID=} is a fatal zsh parameter error that aborts the whole
+     * sourced file, leaving every later name unscrubbed and writing no report at all. The abort is
+     * silent: the loop is wrapped in {@code 2>/dev/null}.
      *
-     * <p>Exercises the real artefact: {@link EnvAllowListScrub#scrubScript} is run verbatim under a
-     * real {@code /bin/zsh}, not just asserted on as a Java string. The four planted names are
-     * exported one at a time via {@code typeset -x}/{@code typeset -rx} immediately before the
-     * script runs, in a fixed order — zsh's {@code export}/{@code typeset -x} appends to the
-     * process's environment table in call order (verified empirically: a freshly-exported name
-     * always sorts after every inherited one and after every earlier freshly-exported name in
-     * {@code command env}'s own output), which is what makes the "middle" position deterministic
-     * here, unlike relying on the OS's own inherited-environment order.
+     * <p>The assertion is deliberately "a report exists" rather than "the canary is blanked". The
+     * report is written by the last statement in the file, so its presence proves the script ran
+     * to completion; the canary alone would depend on where it happens to sit in {@code env} order.
+     * Both are checked, but only the first one fails deterministically without the fix.
      */
     @Test
-    void unblankableNameInTheMiddleDoesNotAbortNamesAfterIt(@TempDir Path tmp) throws Exception {
+    void scrubSurvivesAnInheritedUidTheWayARealPaneHasIt(@TempDir Path tmp) throws Exception {
         assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed);
 
-        // Only ZDOTDIR is allowed — it must survive the scrub itself, since the report is written
-        // to "$ZDOTDIR/..." AFTER the blanking loop runs; if ZDOTDIR were blanked as a side effect,
-        // the report write would silently go to the wrong place instead of testing anything.
-        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
-        String setup = """
-                typeset -x FLEETD_TEST_BEFORE=1
-                typeset -rx FLEETD_TEST_UNBLANKABLE=1
-                typeset -x FLEETD_TEST_AFTER_A=1
-                typeset -x FLEETD_TEST_AFTER_B=1
-                """;
+        // The production shape: UID present and exported, as every pane shell inherits it.
+        Map<String, String> paneLikeParent = Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh",
+                "UID", "1000",
+                "CB633_CANARY", "must-not-survive-the-scrub");
+        Set<String> survivors = exportedNamesFromCleanParent(paneLikeParent, zdotdir);
 
-        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
-        pb.environment().clear();
-        pb.environment().put("PATH", "/usr/bin:/bin");
-        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
-        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
-        Process zsh = pb.start();
-        zsh.getOutputStream().write((setup + script).getBytes(StandardCharsets.UTF_8));
-        zsh.getOutputStream().flush();
-        zsh.getOutputStream().close();
-        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
-                "the scrub script did not exit within 60s");
-        assertEquals(0, zsh.exitValue(),
-                "the scrub script itself must never abort — an unblankable name must not kill the "
-                        + "sourced file");
-
-        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
-        assertNotNull(report, "the report must still be written even though one name could not be "
-                + "blanked — a report that silently never appears is the #394 bug");
-        assertTrue(report.blanked().contains("FLEETD_TEST_BEFORE"),
-                "sanity: the name before the unblankable one must be blanked");
-        assertTrue(report.blanked().contains("FLEETD_TEST_AFTER_A"),
-                "the FIRST name AFTER the unblankable one must still be blanked — before the fix, "
-                        + "the whole loop aborted at the unblankable name and every later name was "
-                        + "silently left untouched");
-        assertTrue(report.blanked().contains("FLEETD_TEST_AFTER_B"),
-                "the SECOND name after the unblankable one must also still be blanked");
-        assertEquals(1, report.failed(),
-                "exactly one attempted name could not be blanked, and that count must be visible "
-                        + "without reading the member's environment");
-        assertEquals(List.of("FLEETD_TEST_UNBLANKABLE"), report.unblankable(),
-                "the unblankable name is reported by name, not silently dropped");
-    }
-
-    /**
-     * fleetd #394 follow-up: the blanking loop's {@code eval "export ${n}="} splices {@code n} into
-     * a string that zsh then interprets as shell syntax. That is only safe because every name
-     * reaching {@code _cb633_blank} already passed an identifier check in the ENUMERATION loop
-     * (20 lines away, in a different loop) — so the fix re-asserts the identical check immediately
-     * before the {@code eval} call, rather than trusting that distant guard to keep holding.
-     *
-     * <p>This test plants a value with an embedded newline, exploiting the exact "junk from
-     * multi-line values" gap the enumeration loop's own comment already documents: {@code command
-     * env}'s text output is read line-by-line, so a value's second line becomes a spurious extra
-     * "name" that was never a real exported variable. The fragment used here ({@code
-     * junk.fragment}) is merely non-conforming (it contains a dot) — never command-shaped; this
-     * test must never demonstrate command execution and plants no command-shaped payload.
-     *
-     * <p>Exercises the real artefact end-to-end: {@link EnvAllowListScrub#scrubScript} runs
-     * verbatim under a real {@code /bin/zsh}, exactly as {@code generate()} would produce it — this
-     * is not a synthetic call into just the blanking loop.
-     */
-    @Test
-    void nonIdentifierJunkFromAMultilineValueIsSkippedNotBlankedOrUnblankable(@TempDir Path tmp)
-            throws Exception {
-        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
-
-        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
-
-        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
-        pb.environment().clear();
-        pb.environment().put("PATH", "/usr/bin:/bin");
-        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
-        // Embedded newline: `command env`'s own text output splits this into two lines, and the
-        // second ("junk.fragment") has no "=" at all, so `cut -d= -f1` returns it unchanged as a
-        // spurious candidate "name" — it was never an actual exported variable by that name.
-        pb.environment().put("FLEETD_TEST_MULTILINE", "keep\njunk.fragment");
-        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
-        Process zsh = pb.start();
-        zsh.getOutputStream().write(script.getBytes(StandardCharsets.UTF_8));
-        zsh.getOutputStream().flush();
-        zsh.getOutputStream().close();
-        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
-                "the scrub script did not exit within 60s");
-        assertEquals(0, zsh.exitValue(), "the scrub script must reach its end");
-
-        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
-        assertNotNull(report, "the report must still be written");
-        assertTrue(report.blanked().contains("FLEETD_TEST_MULTILINE"),
-                "sanity: the real, identifier-shaped variable must still be blanked normally");
-        assertFalse(report.blanked().contains("junk.fragment"),
-                "a non-identifier fragment is not a real variable and must never be blanked");
-        assertFalse(report.unblankable().contains("junk.fragment"),
-                "a non-identifier fragment must never even become a candidate the blanking loop "
-                        + "attempts — it must be filtered before either guard has to catch it, so "
-                        + "it is neither blanked nor counted as a failed attempt");
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(zdotdir);
+        assertNotNull(report,
+                "an inherited UID must not abort the scrub — no report means the file died mid-loop "
+                        + "and every name after UID in `env` order was left unscrubbed");
+        assertFalse(survivors.contains("CB633_CANARY"),
+                "a non-allow-listed name must still be blanked when UID is in the environment");
     }
 
     /** A group-shared ZDOTDIR still lets the member truncate and write its pre-created receipt. */