#388: scrub a pane shell that is neither login nor interactive

EnvAllowListScrub generated four zsh startup files but only .zshrc and
.zlogin sourced the scrub — .zshenv (the one file zsh always reads) did
not. A pane shell that is neither login nor interactive reads only
.zshenv and stops, so it was never scrubbed at all (measured on fleet01,
issue #388).

Adding an unguarded scrub to .zshenv (the ticket's own suggested fix) is
wrong: .zshenv is read by every zsh, including a short-lived `zsh -c`
a member's own tooling forks for a single command. Those children are
also neither login nor interactive, so they would scrub the environment
their parent deliberately set for them (GIT_DIR, VIRTUAL_ENV, ...), and
the rewritten scrub-report.txt would describe the last child to exit
instead of the pane.

Fix (per comment 15387, measured): keep .zshrc/.zlogin unconditional,
and add to .zshenv a pass guarded on the exact condition that defines
the gap (neither login nor interactive), plus a per-pane sentinel
(_CB633_SCRUBBED) so it runs once per pane, not once per process. The
sentinel is exported only after the scrub runs, and is folded into the
scrub's own allow-list so a later pass in the same pane cannot blank it
back to empty.

Also corrects the class javadoc's wrong premise (a bare argv[0] proves
NOT login, not "therefore interactive") and its now-stale two-file
walkthrough.

Tests: two new real-zsh tests in EnvAllowListScrubTest run actual
non-login/non-interactive zsh processes (never string-match the
generated files) to prove: a neither-shell pane is scrubbed; a child
that pane forks keeps variables the pane deliberately set for it; the
child does not re-scrub; and scrub-report.txt still describes the pane
after the child exits. Both fail without the production fix (verified
by reverting it and re-running: AssertionFailedError on the sentinel
and on the decoy secret surviving).

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -584,8 +584,12 @@ public final class Fleetd {
         if (cfg.health() != null && cfg.health().isEnabled()) {
             // CB-580: a member found GONE/NEVER_READY must fail whatever ticket is waiting on it,
             // through the same idempotent target-wide operation CB-516 already uses on release.
+            // fleetd #386: System::nanoTime freezes across a macOS sleep, so the stall check also
+            // gets a wall-clock source to detect and correct for that freeze. Every other decision
+            // in FleetHealthMonitor stays on the monotonic clock, unchanged.
             healthMonitor = new FleetHealthMonitor(agents, sessions::roster, messages, healthScheduler,
-                    System::nanoTime, cfg.health().intervalOrDefault(),
+                    System::nanoTime, () -> TimeUnit.MILLISECONDS.toNanos(System.currentTimeMillis()),
+                    cfg.health().intervalOrDefault(),
                     cfg.health().workingSuspectAfterOrDefault(), messages::abandon);
             String coverage = FleetHealthMonitor.coverage(true,
                     cfg.health().notifications() != null && cfg.health().notifications().configured());

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -38,15 +38,46 @@ public final class FleetHealthMonitor {
      */
     static final long ASK_LAPSE_RECHECK_DELAY_SECONDS = 120;
 
+    /**
+     * fleetd #386: {@code System.nanoTime()} (or whatever {@link #clock} is) does not advance while
+     * macOS sleeps, so a raw {@code nowNanos - lastActivityAtNanos} comparison freezes with the
+     * host and can never cross {@link #workingSuspectAfterNanos}. This is a second, wall-clock
+     * source used ONLY inside the stall check ({@link #stallElapsedNanos}) to detect and correct
+     * for that freeze. Nothing else in this class reads it — every other decision (readiness grace,
+     * the fault classification itself) stays exactly on {@link #clock}, as the ticket requires.
+     */
+    private static final LongSupplier DEFAULT_REALTIME_CLOCK =
+            () -> TimeUnit.MILLISECONDS.toNanos(System.currentTimeMillis());
+
     private final AgentControl agents;
     private final Supplier<List<MemberSession>> roster;
     private final MessageService messages;
     private final ScheduledExecutorService scheduler;
     private final LongSupplier clock;
+    private final LongSupplier realtimeClock;
     private final long intervalSeconds;
+    private final long tickIntervalNanos;
     private final long workingSuspectAfterNanos;
     private final BiConsumer<String, String> failTarget;
     private final Map<String, HealthPrior> priors = new HashMap<>();
+    /**
+     * fleetd #386 clock-drift bookkeeping. {@code haveClockBaseline}/{@code lastTickMonoNanos}/
+     * {@code lastTickRealNanos} track the previous tick's pair of readings so each new tick can
+     * measure how far the two clocks moved apart since then. {@code accumulatedDriftNanos} is the
+     * running total of every such divergence observed since this monitor started (never decreases —
+     * the monotonic clock can only lag real time, never lead it). {@code busyDriftBaselineNanos}/
+     * {@code busyBaselineActivityNanos} record, per target, the value of {@code accumulatedDriftNanos}
+     * at the moment this monitor first saw that target's CURRENT {@code lastActivityAtNanos} while
+     * BUSY — so {@link #stallElapsedNanos} adds back only the drift observed DURING this BUSY span,
+     * never drift from a sleep that happened before the member went busy. All five fields are touched
+     * only from {@code tick()}, like {@link #priors}.
+     */
+    private boolean haveClockBaseline = false;
+    private long lastTickMonoNanos;
+    private long lastTickRealNanos;
+    private long accumulatedDriftNanos = 0;
+    private final Map<String, Long> busyDriftBaselineNanos = new HashMap<>();
+    private final Map<String, Long> busyBaselineActivityNanos = new HashMap<>();
     /**
      * The live classification per member, and the only one of this class's three maps that more
      * than one scheduler task touches. {@code tick} writes it (and prunes it to the roster);
@@ -88,12 +119,29 @@ public final class FleetHealthMonitor {
     public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
                               ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
                               long workingSuspectAfterSeconds, BiConsumer<String, String> failTarget) {
+        this(agents, roster, messages, scheduler, clock, DEFAULT_REALTIME_CLOCK, intervalSeconds,
+                workingSuspectAfterSeconds, failTarget);
+    }
+
+    /**
+     * @param realtimeClock fleetd #386: a wall-clock nanosecond source (e.g.
+     *                       {@code System.currentTimeMillis()} converted to nanos) that keeps
+     *                       advancing while {@code clock} is frozen by a host sleep. Used only to
+     *                       correct the stall check — see the class-level javadoc on the
+     *                       clock-drift fields.
+     */
+    public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
+                              ScheduledExecutorService scheduler, LongSupplier clock, LongSupplier realtimeClock,
+                              long intervalSeconds, long workingSuspectAfterSeconds,
+                              BiConsumer<String, String> failTarget) {
         this.agents = agents;
         this.roster = roster;
         this.messages = messages;
         this.scheduler = scheduler;
         this.clock = clock;
+        this.realtimeClock = Objects.requireNonNull(realtimeClock, "realtimeClock");
         this.intervalSeconds = intervalSeconds;
+        this.tickIntervalNanos = TimeUnit.SECONDS.toNanos(intervalSeconds);
         this.workingSuspectAfterNanos = TimeUnit.SECONDS.toNanos(workingSuspectAfterSeconds);
         this.failTarget = Objects.requireNonNull(failTarget, "failTarget");
     }
@@ -123,6 +171,7 @@ public final class FleetHealthMonitor {
             for (Agent agent : agentsNow) live.put(agent.terminalId(), agent);
             HashSet<String> current = new HashSet<>();
             long nowNanos = clock.getAsLong();
+            long driftBeforeThisTick = observeClockDrift(nowNanos);
             for (MemberSession session : rosterNow) {
                 current.add(session.terminalId());
                 Agent agent = live.get(session.terminalId());
@@ -133,7 +182,7 @@ public final class FleetHealthMonitor {
                         && session.state() != MemberSession.State.SPAWNING;
                 boolean readinessGraceElapsed = nowNanos - session.spawnedAtNanos() >= READINESS_GRACE_NANOS;
                 boolean stalled = session.state() == MemberSession.State.BUSY
-                        && nowNanos - session.lastActivityAtNanos() >= workingSuspectAfterNanos;
+                        && stallElapsedNanos(session, nowNanos, driftBeforeThisTick) >= workingSuspectAfterNanos;
                 // CB-643: the three message-layer facts CB-640 published. Read them here rather than
                 // leaving them false — that constant is what made 8 of the 9 fault states dead.
                 boolean queuedDelivery = messages.hasQueuedDelivery(session.terminalId());
@@ -151,6 +200,8 @@ public final class FleetHealthMonitor {
             priors.keySet().retainAll(current);
             states.keySet().retainAll(current);
             orphanStreaks.keySet().retainAll(current);
+            busyDriftBaselineNanos.keySet().retainAll(current);
+            busyBaselineActivityNanos.keySet().retainAll(current);
         } catch (Throwable error) {
             // Any unclassified collection failure must never kill the monitor's only scheduler task.
             log.warn("fleet health collection failed; will retry next tick", error);
@@ -175,6 +226,65 @@ public final class FleetHealthMonitor {
         return streak >= ORPHAN_CONFIRM_TICKS;
     }
 
+    /**
+     * fleetd #386: compare this tick's monotonic and real-time readings against the previous
+     * tick's, and fold any positive divergence into {@link #accumulatedDriftNanos} (a ratchet — it
+     * never decreases, since the monotonic clock can only fall behind real time, never ahead of
+     * it). Logs once, at WARN, when that single tick's divergence exceeds one full tick interval —
+     * the signature of a host that slept between the two ticks (a tick literally cannot run while
+     * the process itself is suspended, so the whole sleep duration lands inside one tick's gap).
+     *
+     * @return {@link #accumulatedDriftNanos} as it stood BEFORE this tick's divergence was folded
+     *         in — the baseline {@link #stallElapsedNanos} needs when a target is observed BUSY
+     *         for the first time this tick, so a sleep that happened before this member went busy
+     *         is not attributed to it.
+     */
+    private long observeClockDrift(long nowNanos) {
+        long nowRealNanos = realtimeClock.getAsLong();
+        long driftBeforeThisTick = accumulatedDriftNanos;
+        if (haveClockBaseline) {
+            long monoDelta = nowNanos - lastTickMonoNanos;
+            long realDelta = nowRealNanos - lastTickRealNanos;
+            long tickDrift = realDelta - monoDelta;
+            if (tickDrift > tickIntervalNanos) {
+                log.warn("fleet health: the monotonic clock did not advance for about {}s that the "
+                        + "real clock did since the last tick (host likely slept); the stall "
+                        + "detector could not see that time", TimeUnit.NANOSECONDS.toSeconds(tickDrift));
+            }
+            if (tickDrift > 0) {
+                accumulatedDriftNanos = driftBeforeThisTick + tickDrift;
+            }
+        }
+        lastTickMonoNanos = nowNanos;
+        lastTickRealNanos = nowRealNanos;
+        haveClockBaseline = true;
+        return driftBeforeThisTick;
+    }
+
+    /**
+     * fleetd #386: {@code nowNanos - lastActivityAtNanos} alone freezes across a host sleep, since
+     * both come from the monotonic {@link #clock}. This adds back the real-time drift observed
+     * since this BUSY span started — not the monitor's whole lifetime, so a sleep that happened
+     * before this member went busy never leaks into its stall reading (see the class-level javadoc
+     * on the drift fields). The baseline resets whenever {@code lastActivityAtNanos} changes (a new
+     * turn) or the member is not currently BUSY.
+     */
+    private long stallElapsedNanos(MemberSession session, long nowNanos, long driftBeforeThisTick) {
+        String target = session.terminalId();
+        if (session.state() != MemberSession.State.BUSY) {
+            busyDriftBaselineNanos.remove(target);
+            busyBaselineActivityNanos.remove(target);
+            return nowNanos - session.lastActivityAtNanos();
+        }
+        Long baselineActivity = busyBaselineActivityNanos.get(target);
+        if (baselineActivity == null || baselineActivity != session.lastActivityAtNanos()) {
+            busyBaselineActivityNanos.put(target, session.lastActivityAtNanos());
+            busyDriftBaselineNanos.put(target, driftBeforeThisTick);
+        }
+        long driftSinceBusyStart = accumulatedDriftNanos - busyDriftBaselineNanos.get(target);
+        return (nowNanos - session.lastActivityAtNanos()) + driftSinceBusyStart;
+    }
+
     void reportTransition(String target, HealthState next) {
         HealthState previous = states.put(target, next);
         if (previous == next) return;

fleetd/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java

@@ -369,8 +369,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
             // CB-547a: route the chosen profile but keep the caller's session identity — dropping it
             // here would silently sever the resume handle on every policy-routed spawn. CB-557: the
             // role rides along for the same reason, or a routed spawn would be labelled as a dev.
-            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd(),
-                    req.sessionName(), req.resumeSessionId(), req.role());
+            SpawnRequest routedReq = req.withProfile(chosen.profile());
             try {
                 PeerHandle handle = d.spawn(routedReq);
                 spawnedBy.put(handle.id(), d);

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -13,6 +13,7 @@ import java.nio.file.attribute.PosixFilePermissions;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Stream;
@@ -28,24 +29,46 @@ import java.util.stream.Stream;
  * control lacked: herdr applies that overlay BEFORE the shell starts, so any sourced file can undo
  * it — and did.
  *
- * <p><b>Which file is last depends on the platform, so the scrub runs from two of them.</b> zsh
+ * <p><b>zsh reads its four startup files under three different conditions, so no single file is
+ * guaranteed to run — the scrub has to cover the gap between them, not just the platforms.</b> zsh
  * reads {@code .zshenv} always, {@code .zprofile} and {@code .zlogin} only for a LOGIN shell, and
- * {@code .zshrc} only for an INTERACTIVE one. herdr does not open the same kind of shell
- * everywhere — measured on herdr 0.8.0: macOS panes run {@code -zsh} (login, so {@code .zlogin}
- * runs), Linux panes run a plain {@code /usr/bin/zsh} (interactive but NOT login, so
- * {@code .zlogin} never runs at all). A scrub in {@code .zlogin} alone is therefore a control that
- * silently does nothing on Linux — the exact failure this class exists to remove, one platform
- * over.
+ * {@code .zshrc} only for an INTERACTIVE one. A pane shell that is at least one of login or
+ * interactive is covered by sourcing the scrub from {@code .zshrc} and {@code .zlogin} (below), but
+ * a pane shell that is NEITHER reads only {@code .zshenv} and stops — fleetd #388, measured: a herdr
+ * pane can be neither login nor interactive, and such a pane read {@code .zshenv}, never reached
+ * {@code scrub.zsh}, and left no report at all. A bare {@code argv[0]} of {@code /usr/bin/zsh}
+ * proves the shell is NOT a login shell; it says nothing about whether it is interactive, so it
+ * must never be read as "therefore interactive" — that wrong inference is what let #388 ship.
  *
- * <p>So both {@code .zshrc} and {@code .zlogin} source the same generated {@code scrub.zsh} after
- * sourcing their {@code $HOME} counterpart. On Linux only the first fires; on macOS both do, and
- * the second pass is deliberate rather than merely harmless — it re-scrubs anything the operator's
- * own {@code ~/.zlogin} exported after {@code .zshrc} had finished. Re-running is idempotent: a
- * name already blank is blanked again, and the report is rewritten with the same counts.
+ * <p>So {@code .zshenv} carries a THIRD pass, guarded by the exact condition that defines the gap:
+ * {@code [[ ! -o login && ! -o interactive ]]}. That guard is why this pass cannot double-scrub a
+ * pane that {@code .zshrc} or {@code .zlogin} will also cover — one of {@code -o login}/
+ * {@code -o interactive} is always true there, so the {@code .zshenv} pass never fires for them, and
+ * their own unconditional sourcing is untouched. The guard also carries a sentinel
+ * ({@value #SCRUB_SENTINEL}) so it fires once per PANE and not once per PROCESS: {@code .zshenv} is
+ * read by every zsh a member's own tooling forks (a plain {@code zsh -c '...'} for a single
+ * command is itself neither login nor interactive), and those children inherit variables their
+ * parent deliberately set for them (git hooks get {@code GIT_DIR}, a venv gets
+ * {@code VIRTUAL_ENV}, a build tool gets {@code NODE_OPTIONS} or {@code JAVA_TOOL_OPTIONS}).
+ * Re-scrubbing every such child would blank all of that, and would also make the pane's own
+ * {@code scrub-report.txt} — rewritten on every pass — describe whichever child exited last
+ * instead of the pane. The sentinel is exported only AFTER {@code scrub.zsh} runs, so the pass
+ * that sets it never sees it and cannot blank it; it must also be on the scrub's own allow-list
+ * (see {@link #generate(Path, Set)}) so a later pass, in the same pane, cannot blank it back to
+ * empty — an exported-but-empty sentinel reads as unset to the {@code -z} guard and would silently
+ * re-enable scrubbing for every subsequent child of that pane.
+ *
+ * <p>So all three of {@code .zshenv} (gap only, guarded), {@code .zshrc}, and {@code .zlogin}
+ * source the same generated {@code scrub.zsh} after sourcing their {@code $HOME} counterpart. A
+ * login-and-interactive pane runs the {@code .zshrc} and {@code .zlogin} passes, and the second is
+ * deliberate rather than merely harmless — it re-scrubs anything the operator's own
+ * {@code ~/.zlogin} exported after {@code .zshrc} had finished. A pane that is neither runs only the
+ * {@code .zshenv} pass. Re-running is idempotent: a name already blank is blanked again, and the
+ * report is rewritten with the same counts.
  *
  * <p>Each generated file sources its {@code $HOME} counterpart FIRST, so {@code PATH} and every
- * toolchain binary still resolve exactly as the operator configured them; only afterwards does
- * {@code .zlogin} run the scrub: every EXPORTED variable not on the derived allow-list is re-exported
+ * toolchain binary still resolve exactly as the operator configured them; only afterwards does the
+ * scrub run: every EXPORTED variable not on the derived allow-list is re-exported
  * blank. Blank, not credential-shaped-pattern-filtered: a pattern list ({@code *TOKEN*}, …) is an
  * enumeration and misses what it did not think of — a username is the other half of a credential and
  * is shaped like none. Credential-SHAPED names among the blanked set go to the WARN log only,
@@ -63,7 +86,11 @@ public final class EnvAllowListScrub {
     /** Name of the report file written into the generated directory by the scrub itself. */
     static final String REPORT_FILE = "scrub-report.txt";
 
-    /** The scrub body, generated once and sourced from both {@code .zshrc} and {@code .zlogin}. */
+    /**
+     * The scrub body, generated once and sourced from {@code .zshrc} and {@code .zlogin}
+     * unconditionally, and from {@code .zshenv} when the pane shell is neither login nor
+     * interactive (fleetd #388) — see the class javadoc.
+     */
     static final String SCRUB_FILE = "scrub.zsh";
 
     /** Prefix of every generated directory — also what {@link #reapOrphans} matches on. */
@@ -79,6 +106,28 @@ public final class EnvAllowListScrub {
     private static final String SOURCE_SCRUB =
             "source \"$ZDOTDIR/" + SCRUB_FILE + "\"\n";
 
+    /**
+     * fleetd #388: marks a pane, not a process, as already scrubbed. Set only by the guarded
+     * {@code .zshenv} pass (see {@link #NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB}) after
+     * {@code scrub.zsh} has run, so it must also be folded into that pass's own allow-list — see
+     * the class javadoc's "must also be on the scrub's own allow-list" paragraph.
+     */
+    static final String SCRUB_SENTINEL = "_CB633_SCRUBBED";
+
+    /**
+     * Appended to {@code .zshenv}, after its {@code $HOME} source: the third pass, guarded on the
+     * exact condition that defines the gap {@code .zshrc}/{@code .zlogin} do not cover — a shell
+     * that is neither login nor interactive. The sentinel export happens only once the scrub has
+     * already run, and only for as long as the current pane's environment has not been rebuilt from
+     * scratch (a fresh {@code env -i} child would not inherit it — that is out of scope here, since
+     * such a child is no longer running under the pane's own environment at all).
+     */
+    private static final String NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB =
+            "if [[ ! -o login && ! -o interactive && -z \"${" + SCRUB_SENTINEL + ":-}\" ]]; then\n"
+            + "  " + SOURCE_SCRUB
+            + "  export " + SCRUB_SENTINEL + "=1\n"
+            + "fi\n";
+
     private EnvAllowListScrub() {
     }
 
@@ -108,8 +157,13 @@ public final class EnvAllowListScrub {
             // zsh truncates this pre-created receipt after these hooks are registered. Register its
             // path too — otherwise the directory is non-empty at JVM exit and cannot be removed.
             Files.createFile(dir.resolve(REPORT_FILE)).toFile().deleteOnExit();
-            write(dir, SCRUB_FILE, scrubScript(allowedNames));
-            write(dir, ".zshenv", homeSourcingFile(".zshenv"));
+            // fleetd #388: scrub.zsh's OWN allow-list must also keep SCRUB_SENTINEL, or a later
+            // pass in the same pane blanks it back to empty and the .zshenv guard below thinks it
+            // was never scrubbed — see the class javadoc.
+            Set<String> namesForScrubScript = new HashSet<>(allowedNames);
+            namesForScrubScript.add(SCRUB_SENTINEL);
+            write(dir, SCRUB_FILE, scrubScript(namesForScrubScript));
+            write(dir, ".zshenv", homeSourcingFile(".zshenv") + NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB);
             write(dir, ".zprofile", homeSourcingFile(".zprofile"));
             write(dir, ".zshrc", homeSourcingFile(".zshrc") + SOURCE_SCRUB);
             write(dir, ".zlogin", homeSourcingFile(".zlogin") + SOURCE_SCRUB);
@@ -147,11 +201,11 @@ public final class EnvAllowListScrub {
      * into it: owner keeps full access, {@code group} gets traverse+read on the directory ({@code
      * rwxr-x---}, so a member process — a login shell reading it via {@code ZDOTDIR}, or another
      * process simply opening a file under it — running under that group can find and read the
-      * files) and read-only on each file ({@code rw-r-----}), except the pre-created ZDOTDIR
-      * {@code scrub-report.txt}. That receipt gets group write ({@code rw-rw----}), so
-      * {@code scrub.zsh} can truncate and write it without granting group write on the directory.
-      * If its optional permission change fails, the member cannot write a receipt and the launcher
-      * keeps its existing WARN rather than failing the spawn.
+     * files) and read-only on each file ({@code rw-r-----}), except the pre-created ZDOTDIR
+     * {@code scrub-report.txt}. That receipt gets group write ({@code rw-rw----}), so
+     * {@code scrub.zsh} can truncate and write it without granting group write on the directory.
+     * If its optional permission change fails, the member cannot write a receipt and the launcher
+     * keeps its existing WARN rather than failing the spawn.
      *
      * <p>Package-private and named generically on purpose: fleetd #213 built this for the ZDOTDIR
      * scrub directory, and fleetd #219 reuses it verbatim for {@link
@@ -252,11 +306,13 @@ public final class EnvAllowListScrub {
         }
         return """
                 # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
-                # Sourced from .zshrc and again from .zlogin, each time AFTER that file has sourced
-                # its $HOME counterpart — so this runs after everything the operator sourced, on a
-                # login shell (macOS panes) and on a plain interactive one (Linux panes) alike.
-                # Running twice is idempotent and deliberate: the second pass catches anything
-                # ~/.zlogin exported after ~/.zshrc had finished.
+                # Sourced unconditionally from .zshrc and again from .zlogin, each time AFTER that
+                # file has sourced its $HOME counterpart — so this runs after everything the
+                # operator sourced, on any pane that is login and/or interactive. Running twice is
+                # idempotent and deliberate: the second pass catches anything ~/.zlogin exported
+                # after ~/.zshrc had finished. Also sourced, once, from a guarded pass in .zshenv
+                # (fleetd #388) when the pane shell is NEITHER login nor interactive — the one gap
+                # those two files do not cover.
 
                 typeset -A _cb633_allowed
                 for _cb633_n in %s; do _cb633_allowed[$_cb633_n]=1; done

fleetd/src/main/java/dev/ltms/fleet/peer/SpawnRequest.java

@@ -29,4 +29,9 @@ public record SpawnRequest(String profileName, String requestedCwd, String calle
                         String sessionName, String resumeSessionId) {
         this(profileName, requestedCwd, callerCwd, sessionName, resumeSessionId, null);
     }
+
+    /** Return a copy of this request with {@code profileName} replaced by {@code profile}. */
+    public SpawnRequest withProfile(String profile) {
+        return new SpawnRequest(profile, requestedCwd, callerCwd, sessionName, resumeSessionId, role);
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/health/FleetHealthMonitorTest.java

@@ -30,6 +30,7 @@ import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.ScheduledThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.BiConsumer;
 import java.util.function.LongSupplier;
 
@@ -206,6 +207,139 @@ class FleetHealthMonitorTest {
                 .workingSuspectAfterOrDefault());
     }
 
+    // --- fleetd #386: a stall detector whose only clock freezes with a sleeping host is worse
+    // than a silent one — it reports "quiet" for a member that was genuinely busy for hours.
+
+    @Test void monotonicClockFrozenPastThresholdOnRealClockStillReportsStallSuspected() {
+        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            AtomicLong mono = new AtomicLong(0);
+            AtomicLong real = new AtomicLong(0);
+            FakeHerdr herdr = new FakeHerdr().withAgent("busy", "term_busy", "pane_busy", "tab_busy");
+            var scheduler = Executors.newSingleThreadScheduledExecutor();
+            FleetHealthMonitor monitor = monitorWithClocks(herdr,
+                    List.of(member("term_busy", MemberSession.State.BUSY, 0, 0)), scheduler,
+                    mono::get, real::get, 60, 600, (_, _) -> { });
+
+            monitor.tick(); // establishes the clock baseline; nothing has diverged yet
+            assertEquals(0, appender.list.stream().filter(event -> event.getFormattedMessage()
+                    .contains("state=STALL_SUSPECTED")).count());
+
+            // The host "sleeps": the monotonic clock stands completely still while the real clock
+            // keeps moving, past the 600s stall threshold.
+            real.set(TimeUnit.SECONDS.toNanos(700));
+            monitor.tick();
+            monitor.stop();
+
+            assertTrue(appender.list.stream().anyMatch(event -> event.getFormattedMessage()
+                            .contains("member=term_busy state=STALL_SUSPECTED")),
+                    "the real clock crossed the stall threshold even though the monotonic clock never moved");
+        } finally {
+            logger.detachAppender(appender);
+        }
+    }
+
+    @Test void clockDivergenceIsLoggedOnceNotOncePerTick() {
+        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            AtomicLong mono = new AtomicLong(0);
+            AtomicLong real = new AtomicLong(0);
+            var scheduler = Executors.newSingleThreadScheduledExecutor();
+            FleetHealthMonitor monitor = monitorWithClocks(new FakeHerdr(), List.of(), scheduler,
+                    mono::get, real::get, 60, 600, (_, _) -> { });
+
+            monitor.tick(); // baseline: no divergence possible yet
+
+            // One sleep gap: the monotonic clock is frozen while the real clock jumps far past one
+            // tick interval (60s).
+            real.set(TimeUnit.SECONDS.toNanos(700));
+            monitor.tick();
+
+            // The host is awake again: both clocks advance together from here, so no more divergence.
+            mono.set(TimeUnit.SECONDS.toNanos(10));
+            real.set(TimeUnit.SECONDS.toNanos(710));
+            monitor.tick();
+            mono.set(TimeUnit.SECONDS.toNanos(20));
+            real.set(TimeUnit.SECONDS.toNanos(720));
+            monitor.tick();
+            monitor.stop();
+
+            assertEquals(1, appender.list.stream().filter(event -> event.getFormattedMessage()
+                            .contains("the monotonic clock did not advance"))
+                    .count(), "one sleep gap must produce exactly one divergence line, not one per tick");
+        } finally {
+            logger.detachAppender(appender);
+        }
+    }
+
+    /**
+     * fleetd #386 follow-up, added on merge. The fix carries a PER-MEMBER drift baseline, so drift
+     * from a sleep that happened BEFORE a member went busy is never charged to that member. The
+     * two tests shipped with the fix both start with the member already BUSY, so a single global
+     * baseline passes them — this one fails without the per-member map.
+     *
+     * <p>Order matters: the host sleeps while nothing is busy, and only then does a member take a
+     * turn. Its stall clock must start at zero.
+     */
+    @Test void driftFromASleepBeforeAMemberWentBusyIsNotChargedToThatMember() {
+        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            AtomicLong mono = new AtomicLong(0);
+            AtomicLong real = new AtomicLong(0);
+            AtomicReference<List<MemberSession>> roster = new AtomicReference<>(List.of());
+            FakeHerdr herdr = new FakeHerdr().withAgent("busy", "term_busy", "pane_busy", "tab_busy");
+            var scheduler = Executors.newSingleThreadScheduledExecutor();
+            AgentControl agents = new AgentControl(herdr);
+            FleetHealthMonitor monitor = new FleetHealthMonitor(agents, roster::get,
+                    new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
+                    scheduler, mono::get, real::get, 60, 600, (_, _) -> { });
+
+            monitor.tick();                                   // baseline, no members yet
+
+            // The host sleeps for 700s with nobody busy: the monotonic clock stands still.
+            real.set(TimeUnit.SECONDS.toNanos(700));
+            monitor.tick();
+
+            // Awake again. Only NOW does a member start a turn, with a fresh activity stamp taken
+            // from the monotonic clock. Both clocks advance together from here.
+            mono.set(TimeUnit.SECONDS.toNanos(10));
+            real.set(TimeUnit.SECONDS.toNanos(710));
+            roster.set(List.of(member("term_busy", MemberSession.State.BUSY,
+                    0, TimeUnit.SECONDS.toNanos(10))));
+            monitor.tick();
+
+            mono.set(TimeUnit.SECONDS.toNanos(20));
+            real.set(TimeUnit.SECONDS.toNanos(720));
+            monitor.tick();
+            monitor.stop();
+
+            assertEquals(0, appender.list.stream().filter(event -> event.getFormattedMessage()
+                            .contains("member=term_busy state=STALL_SUSPECTED")).count(),
+                    "the member has been busy for 10s, not 710s — the earlier sleep is not its stall");
+        } finally {
+            logger.detachAppender(appender);
+        }
+    }
+
+    private static FleetHealthMonitor monitorWithClocks(FakeHerdr herdr, List<MemberSession> roster,
+            java.util.concurrent.ScheduledExecutorService scheduler, LongSupplier clock,
+            LongSupplier realtimeClock, long intervalSeconds, long workingSuspectAfterSeconds,
+            BiConsumer<String, String> failTarget) {
+        AgentControl agents = new AgentControl(herdr);
+        return new FleetHealthMonitor(agents, () -> roster,
+                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
+                scheduler, clock, realtimeClock, intervalSeconds, workingSuspectAfterSeconds, failTarget);
+    }
+
     @Test void goneMemberRecoveryLogsOnceWithoutRefiringTargetFailure() {
         Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
         Level previousLevel = logger.getLevel();

fleetd/src/test/java/dev/ltms/fleet/member/EnvAllowListScrubTest.java

@@ -8,6 +8,7 @@ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -45,6 +46,15 @@ class EnvAllowListScrubTest {
     /** Env var names appearing in command output; anything else (prompts, wrapped lines) is noise. */
     private static final Pattern ENV_NAME = Pattern.compile("^([A-Za-z_][A-Za-z0-9_]*)$");
 
+    /**
+     * fleetd #388: the sentinel name the generated {@code .zshenv} guard uses, kept here as a
+     * literal rather than referencing {@link EnvAllowListScrub#SCRUB_SENTINEL} — the two tests that
+     * use it must still compile and run against the pre-fix production class (which has no such
+     * constant), so the revert-and-prove-it-fails step exercises a real assertion instead of a
+     * compilation error.
+     */
+    private static final String SCRUB_SENTINEL_NAME = "_CB633_SCRUBBED";
+
     /**
      * The equality test. Expected survivors = baseline exports ∩ allowed — i.e. every survivor is
      * allowed AND every allowed name that existed survives. The operator's own secret-store exports
@@ -249,6 +259,140 @@ class EnvAllowListScrubTest {
                         + "shell. A difference here means the scrub is dead on Linux.");
     }
 
+    /**
+     * fleetd #388: the actual gap. zsh reads {@code .zshenv} always, {@code .zprofile}/
+     * {@code .zlogin} only for a LOGIN shell, and {@code .zshrc} only for an INTERACTIVE one — so a
+     * shell that is NEITHER (a bare {@code /bin/zsh} reading a script off a non-tty stdin, no
+     * {@code -l}, no {@code -i}) reads only {@code .zshenv} and stops. Before this fix, that shell
+     * never reached {@code scrub.zsh} at all: the decoy secret below would survive untouched. This
+     * test injects that decoy directly into the process environment (not via a sourced dotfile,
+     * since the whole point of the gap is that {@code .zshenv} is normally close to empty) so the
+     * test does not depend on any real {@code ~/.zshrc} content existing on the host.
+     */
+    @Test
+    void scrubRunsInAShellThatIsNeitherLoginNorInteractive(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed);
+
+        Map<String, String> cleanParent = new HashMap<>(Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh",
+                "USER", System.getProperty("user.name", "nobody"),
+                "TMPDIR", tmp.toString()));
+        cleanParent.put("FLEETD_TEST_DECOY_SECRET", "x"); // not on any allow-list; must be blanked
+
+        List<String> neither = List.of(); // no -l, no -i; stdin is a pipe (never a tty) either way
+        Set<String> baseline = exportedNamesFromCleanParent(cleanParent, null, neither);
+        Set<String> scrubbed = exportedNamesFromCleanParent(cleanParent, zdotdir, neither);
+
+        Set<String> expected = new TreeSet<>();
+        for (String name : baseline) {
+            if (MemberEnvAllowList.keeps(allowed, name)) {
+                expected.add(name);
+            }
+        }
+        assertTrue(baseline.contains("FLEETD_TEST_DECOY_SECRET"),
+                "sanity: the decoy must actually reach the un-scrubbed baseline, or this test proves "
+                        + "nothing");
+        expected.add("ZDOTDIR"); // the harness set it and it is infrastructure, so it must survive
+        expected.add(SCRUB_SENTINEL_NAME); // set by the new .zshenv guard once scrubbed
+        assertEquals(expected, scrubbed,
+                "a pane shell that is NEITHER login nor interactive must still be scrubbed — its "
+                        + "surviving exported names must EQUAL baseline ∩ allow-list, plus the "
+                        + "sentinel the guard sets once it has run. FLEETD_TEST_DECOY_SECRET surviving "
+                        + "here means the gap is still open.");
+    }
+
+    /**
+     * fleetd #388 invariants 3 and 4, which a name-set equality cannot show: a member's own tooling
+     * forks plain, non-login, non-interactive zsh processes for a single command (the same shape as
+     * the pane shell itself), and such a child must (a) keep whatever its parent deliberately set
+     * for it, never (b) re-run the scrub and blank it, and never (c) overwrite the pane's own
+     * {@code scrub-report.txt} with a description of itself instead of the pane. All three can only
+     * be shown by actually running a child process from within the scrubbed pane shell.
+     *
+     * <p>The pane and the child both report presence via {@code ${NAME:+present}} — empty when a
+     * name is unset OR blanked (exported empty), {@code present} when it is set and non-empty. No
+     * value is ever printed, only these two shapes and the literal word {@code set}/{@code unset}
+     * for the sentinel.
+     */
+    @Test
+    void neitherShellChildKeepsParentVariablesAndReceiptStillDescribesThePane(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed);
+
+        Map<String, String> paneEnv = new HashMap<>(Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh",
+                "USER", System.getProperty("user.name", "nobody"),
+                "TMPDIR", tmp.toString()));
+        paneEnv.put("FLEETD_TEST_DECOY_SECRET", "x"); // not allow-listed; the pane must blank it
+        paneEnv.put("ZDOTDIR", zdotdir.toAbsolutePath().toString());
+
+        // The pane's own script reports what IT sees, then forks a plain non-login, non-interactive
+        // child — the shape a member's own tooling uses — carrying a variable the "parent" (this
+        // pane) deliberately set for it, the way git sets GIT_DIR for a hook.
+        String outerScript = """
+                print -r -- "PANE_SENTINEL=${%1$s:+set}"
+                print -r -- "PANE_DECOY=${FLEETD_TEST_DECOY_SECRET:+present}"
+                FLEETD_TEST_TOOL_VAR=keep /bin/zsh <<'CHILD'
+                print -r -- "CHILD_LOGIN=$([[ -o login ]] && echo yes || echo no)"
+                print -r -- "CHILD_INTERACTIVE=$([[ -o interactive ]] && echo yes || echo no)"
+                print -r -- "CHILD_TOOL_VAR=${FLEETD_TEST_TOOL_VAR:+present}"
+                print -r -- "CHILD_DECOY=${FLEETD_TEST_DECOY_SECRET:+present}"
+                print -r -- "CHILD_SENTINEL=${%1$s:+set}"
+                CHILD
+                exit
+                """.formatted(SCRUB_SENTINEL_NAME);
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh"); // no -l, no -i: the pane's own shape
+        pb.environment().clear();
+        pb.environment().putAll(paneEnv);
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write(outerScript.getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        String stdout = new String(zsh.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the pane+child probe did not exit within 60s");
+        assertTrue(zsh.exitValue() == 0, "probe zsh exited non-zero: " + stdout);
+
+        Map<String, String> reported = new HashMap<>();
+        for (String line : stdout.split("\n")) {
+            int eq = line.indexOf('=');
+            if (eq > 0) {
+                reported.put(line.substring(0, eq).trim(), line.substring(eq + 1).trim());
+            }
+        }
+
+        assertEquals("set", reported.get("PANE_SENTINEL"),
+                "the pane itself is neither login nor interactive, so the .zshenv guard must have "
+                        + "run the scrub and exported the sentinel");
+        assertEquals("", reported.get("PANE_DECOY"),
+                "the pane must blank a non-allow-listed name — invariant 1");
+        assertEquals("no", reported.get("CHILD_LOGIN"), "sanity: the child must also be non-login");
+        assertEquals("no", reported.get("CHILD_INTERACTIVE"), "sanity: the child must also be non-interactive");
+        assertEquals("present", reported.get("CHILD_TOOL_VAR"),
+                "invariant 3: a variable the pane deliberately set for its child must survive — a "
+                        + "child that re-ran the scrub would have blanked it");
+        assertEquals("", reported.get("CHILD_DECOY"),
+                "a name already blanked by the pane must stay blanked in the child, never resurrected");
+        assertEquals("set", reported.get("CHILD_SENTINEL"),
+                "the child must inherit the sentinel from the pane's environment, or it would re-scrub");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(zdotdir);
+        assertNotNull(report, "the pane's own scrub pass must leave a report behind");
+        assertTrue(report.blanked().stream().noneMatch(n -> n.startsWith("FLEETD_TEST_TOOL_VAR")),
+                "invariant 4: the receipt must still describe the PANE, not the child — a child that "
+                        + "re-ran the scrub would have rewritten this file to list its own "
+                        + "FLEETD_TEST_TOOL_VAR as blanked");
+    }
+
     /**
      * Run {@code /bin/zsh -l -i} from a clean parent and return the NAMES it has exported by prompt
      * time. With {@code zdotdir} non-null, {@code ZDOTDIR} points at a generated scrub directory, so

fleetd/src/test/java/dev/ltms/fleet/peer/SpawnRequestWithProfilePreservesEveryComponentTest.java

@@ -0,0 +1,144 @@
+package dev.ltms.fleet.peer;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.RecordComponent;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Fleetd #382, the same "defect factory" #357 and #358 guarded on {@code FleetConfig.withDefaults()}
+ * and {@link dev.ltms.fleet.session.MemberSession}'s rebuild sites — reproduced here on
+ * {@link SpawnRequest#withProfile(String)}.
+ *
+ * <p>{@code SpawnRequest} has back-compat constructors at arity 3 and 5 alongside its canonical
+ * arity-6 constructor. Before this ticket, {@code CompositePeerLauncher} routed a profile by
+ * building a fresh {@code SpawnRequest} from a literal {@code new SpawnRequest(...)} call listing
+ * six of the original request's own accessors. That call is only correct because it happens to
+ * name exactly six arguments today — add a 7th component and the established back-compat pattern
+ * (a new constructor at the old, now-shorter arity) and a call one argument short of the new
+ * canonical arity would silently rebind to that back-compat constructor, dropping the new
+ * component on every profile-routed spawn without any compile error. {@link #withProfile} replaces
+ * that literal call, so this test guards the ONE rebuild site instead of a call site scattered
+ * through a launcher.
+ *
+ * <p>The check below builds a {@link SpawnRequest} through the TRUE canonical constructor —
+ * resolved by the record's own component types via {@code getDeclaredConstructor}, never by
+ * argument count, so it can never itself land on a back-compat overload — with a real, distinctive,
+ * non-null value in every component, calls {@link SpawnRequest#withProfile(String)}, and asserts
+ * every component the method is not documented to change survives unchanged, while {@code
+ * profileName} comes back as the new value it was given. A component that comes back anything else
+ * was silently dropped — the shape of the defect this test exists to catch.
+ *
+ * <p>{@link #EXCLUDED_FROM_SURVIVAL_CHECK} is kept deliberately empty and size-pinned by
+ * {@link #exclusionListSizeIsPinned()}, for the same reason the other two guards pin theirs at
+ * zero: a checker whose escape hatch can grow to silence a failure is not a checker. Every one of
+ * {@link SpawnRequest}'s 6 current components has a real, non-null value here and none is excluded.
+ */
+class SpawnRequestWithProfilePreservesEveryComponentTest {
+
+    private static final RecordComponent[] COMPONENTS = SpawnRequest.class.getRecordComponents();
+
+    /** Deliberately empty today; grow it only with a matching justification, and re-pin the size. */
+    private static final Set<String> EXCLUDED_FROM_SURVIVAL_CHECK = Set.of();
+
+    /** One real, distinctive, non-null value per component — none of the 6 is excluded. */
+    private static Map<String, Object> baseValues() {
+        Map<String, Object> v = new LinkedHashMap<>();
+        v.put("profileName", "profile-guard");
+        v.put("requestedCwd", "/wt/requested-guard");
+        v.put("callerCwd", "/wt/caller-guard");
+        v.put("sessionName", "session-guard");
+        v.put("resumeSessionId", "resume-guard");
+        v.put("role", MemberRole.REVIEWER);
+        assertNamesMatchComponents(v);
+        return v;
+    }
+
+    /**
+     * Guards {@link #baseValues()} itself against drifting from the record's real shape — forgetting
+     * to add a new component here fails this assertion by name, rather than silently checking one
+     * component fewer than the record has.
+     */
+    private static void assertNamesMatchComponents(Map<String, Object> values) {
+        Set<String> names = new TreeSet<>();
+        for (RecordComponent rc : COMPONENTS) {
+            names.add(rc.getName());
+        }
+        assertEquals(names, new TreeSet<>(values.keySet()),
+                "this test's value map has drifted from SpawnRequest's actual components — "
+                        + "update baseValues() alongside the record");
+    }
+
+    /**
+     * Builds a {@link SpawnRequest} through the TRUE canonical constructor — resolved by the
+     * record's own component types, not by argument count — so this never accidentally exercises a
+     * back-compat overload the way a literal {@code new SpawnRequest(...)} call risks doing.
+     */
+    private static SpawnRequest requestOf(Map<String, Object> values) throws ReflectiveOperationException {
+        Class<?>[] types = Arrays.stream(COMPONENTS).map(RecordComponent::getType).toArray(Class<?>[]::new);
+        Object[] args = Arrays.stream(COMPONENTS).map(rc -> values.get(rc.getName())).toArray();
+        Constructor<SpawnRequest> ctor = SpawnRequest.class.getDeclaredConstructor(types);
+        return ctor.newInstance(args);
+    }
+
+    @Test
+    void exclusionListSizeIsPinned() {
+        assertEquals(0, EXCLUDED_FROM_SURVIVAL_CHECK.size(),
+                "EXCLUDED_FROM_SURVIVAL_CHECK grew from 0 — every entry needs a justification in "
+                        + "this test class's javadoc AND this assertion re-pinned to the new size; a "
+                        + "growing exclusion list that silences failures on its own is not a guard");
+    }
+
+    @Test
+    void withProfilePreservesEveryOtherComponent() throws ReflectiveOperationException {
+        Map<String, Object> base = baseValues();
+        SpawnRequest request = requestOf(base);
+        SpawnRequest result = request.withProfile("profile-updated");
+
+        Map<String, Object> expectedOverrides = Map.of("profileName", "profile-updated");
+
+        List<String> dropped = new ArrayList<>();
+        int checked = 0;
+        for (RecordComponent rc : COMPONENTS) {
+            String name = rc.getName();
+            if (EXCLUDED_FROM_SURVIVAL_CHECK.contains(name)) {
+                continue;
+            }
+            checked++;
+            Object expected = expectedOverrides.containsKey(name) ? expectedOverrides.get(name) : base.get(name);
+            Object actual;
+            try {
+                actual = rc.getAccessor().invoke(result);
+            } catch (ReflectiveOperationException e) {
+                throw new RuntimeException("failed to read SpawnRequest." + name + "()", e);
+            }
+            if (!Objects.equals(expected, actual)) {
+                dropped.add(String.format(Locale.ROOT,
+                        "%s: withProfile() was expected to carry (%s) for '%s' but returned %s — a "
+                                + "component silently dropped by withProfile(), the shape of the defect "
+                                + "this test exists to catch (its final \"return new SpawnRequest(...)\" "
+                                + "call binding to a back-compat constructor instead of the true "
+                                + "canonical one)",
+                        name, expected, name, actual));
+            }
+        }
+
+        System.out.printf(Locale.ROOT,
+                "SpawnRequest.withProfile() component-survival coverage — %d components, %d checked, "
+                        + "%d excluded, %d survived%n",
+                COMPONENTS.length, checked, EXCLUDED_FROM_SURVIVAL_CHECK.size(), checked - dropped.size());
+        assertEquals(List.of(), dropped,
+                "withProfile() silently dropped these components: " + dropped);
+    }
+}