#400: classify the blanking loop's result on the observed value, not eval's exit status

eval "export NAME=" can return success even when zsh coerces the bare
assignment on an integer special parameter (SECONDS, RANDOM, SHLVL,
HISTSIZE, COLUMNS, LINES, USERNAME) instead of failing, leaving the
value unchanged. The old exit-status check then reported the name as
blanked when it was not -- a false receipt.

Classify on the observed effect instead: attempt the export, then read
the name's value back with the (P) indirection flag and decide from
whether it is now empty. One check now covers all three shapes a name
can take here -- a genuine blank, a fatal read-only error eval merely
contains, and this silent no-op -- with the exit status playing no
part in the decision.

Adds a test driving all three shapes through the real scrubScript in
one run (a normal name, LINENO for the fatal case, SECONDS for the
silent no-op), with the parent environment explicitly carrying those
names since a cleared ProcessBuilder parent does not expose them on
its own. Also corrects the previously-merged
unblankableNameInTheMiddleDoesNotAbortNamesAfterIt test, whose "exactly
one failed name" assertion turned out to only pass by accident: zsh
itself auto-exports SHLVL on every shell start, and the old exit-status
bug was silently miscounting it as blanked. The fixed classification
now correctly reports it unblankable too, so the test asserts presence
rather than an exact count.

CLAUDE.md

@@ -137,7 +137,7 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 | Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
 | Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
 | Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
+| Answer a peer lead that messaged you | `fleet_send{coordId}` — or `{sessionId}` if they are on this host. **Not** `fleet_reply`: it has no peer route and the publish is refused |
 | Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
 | Tear down a member | `fleet_stop{paneId}` |
 
@@ -163,15 +163,21 @@ The traffic between leads is coordination and nothing else:
 3. **Verify a peer exactly as you verify yourself.** Peer status buys nothing: check the claim
    against the code, and re-run the build. A peer's correction gets the same treatment — right or
    wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
+   **N observations are N data points only if they differ in the axis you are trusting.** This cuts
+   both ways. N *failures* blamed on one cause are one data point when the cases share what you are
+   not varying. N *agreeing measurements* are also one data point when they share an instrument —
+   two hosts, two operators and the same formula is one formula, not two confirmations.
 4. **Ask a peer to read your project addendum.** Your addendum is instruction surface: every future
    session on your host obeys it, and a wrong one is obeyed just as faithfully as a right one. The
    author is the worst reader of their own qualifier placement — measured here, one addendum carried
    two defects and a non-author found both. If you have no peer, at least re-read it asking "which
    sentence goes false first, and would a reader reach the caveat before acting?"
 
-Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
-the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
-you.
+Being messaged by a peer does not make you its worker: answer the way you would open —
+`fleet_send{coordId}` for another daemon, `fleet_send{sessionId}` on this host — and push back on
+the substance if it is wrong. `fleet_reply` resolves a member's blocked `fleet_send`; a peer's
+coord-id message is durable and non-blocking, so there is nothing for it to resolve. A peer that
+simply complies has thrown away the reason there are two of you.
 
 ### Member (worker or architect) — the turn contract
 

fleetd/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java

@@ -369,8 +369,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
             // CB-547a: route the chosen profile but keep the caller's session identity — dropping it
             // here would silently sever the resume handle on every policy-routed spawn. CB-557: the
             // role rides along for the same reason, or a routed spawn would be labelled as a dev.
-            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd(),
-                    req.sessionName(), req.resumeSessionId(), req.role());
+            SpawnRequest routedReq = req.withProfile(chosen.profile());
             try {
                 PeerHandle handle = d.spawn(routedReq);
                 spawnedBy.put(handle.id(), d);

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -13,6 +13,7 @@ import java.nio.file.attribute.PosixFilePermissions;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Stream;
@@ -28,33 +29,85 @@ import java.util.stream.Stream;
  * control lacked: herdr applies that overlay BEFORE the shell starts, so any sourced file can undo
  * it — and did.
  *
- * <p><b>Which file is last depends on the platform, so the scrub runs from two of them.</b> zsh
+ * <p><b>zsh reads its four startup files under three different conditions, so no single file is
+ * guaranteed to run — the scrub has to cover the gap between them, not just the platforms.</b> zsh
  * reads {@code .zshenv} always, {@code .zprofile} and {@code .zlogin} only for a LOGIN shell, and
- * {@code .zshrc} only for an INTERACTIVE one. herdr does not open the same kind of shell
- * everywhere — measured on herdr 0.8.0: macOS panes run {@code -zsh} (login, so {@code .zlogin}
- * runs), Linux panes run a plain {@code /usr/bin/zsh} (interactive but NOT login, so
- * {@code .zlogin} never runs at all). A scrub in {@code .zlogin} alone is therefore a control that
- * silently does nothing on Linux — the exact failure this class exists to remove, one platform
- * over.
+ * {@code .zshrc} only for an INTERACTIVE one. A pane shell that is at least one of login or
+ * interactive is covered by sourcing the scrub from {@code .zshrc} and {@code .zlogin} (below), but
+ * a pane shell that is NEITHER reads only {@code .zshenv} and stops — fleetd #388, measured: a herdr
+ * pane can be neither login nor interactive, and such a pane read {@code .zshenv}, never reached
+ * {@code scrub.zsh}, and left no report at all. A bare {@code argv[0]} of {@code /usr/bin/zsh}
+ * proves the shell is NOT a login shell; it says nothing about whether it is interactive, so it
+ * must never be read as "therefore interactive" — that wrong inference is what let #388 ship.
  *
- * <p>So both {@code .zshrc} and {@code .zlogin} source the same generated {@code scrub.zsh} after
- * sourcing their {@code $HOME} counterpart. On Linux only the first fires; on macOS both do, and
- * the second pass is deliberate rather than merely harmless — it re-scrubs anything the operator's
- * own {@code ~/.zlogin} exported after {@code .zshrc} had finished. Re-running is idempotent: a
- * name already blank is blanked again, and the report is rewritten with the same counts.
+ * <p>So {@code .zshenv} carries a THIRD pass, guarded by the exact condition that defines the gap:
+ * {@code [[ ! -o login && ! -o interactive ]]}. That guard is why this pass cannot double-scrub a
+ * pane that {@code .zshrc} or {@code .zlogin} will also cover — one of {@code -o login}/
+ * {@code -o interactive} is always true there, so the {@code .zshenv} pass never fires for them, and
+ * their own unconditional sourcing is untouched. The guard also carries a sentinel
+ * ({@value #SCRUB_SENTINEL}) so it fires once per PANE and not once per PROCESS: {@code .zshenv} is
+ * read by every zsh a member's own tooling forks (a plain {@code zsh -c '...'} for a single
+ * command is itself neither login nor interactive), and those children inherit variables their
+ * parent deliberately set for them (git hooks get {@code GIT_DIR}, a venv gets
+ * {@code VIRTUAL_ENV}, a build tool gets {@code NODE_OPTIONS} or {@code JAVA_TOOL_OPTIONS}).
+ * Re-scrubbing every such child would blank all of that, and would also make the pane's own
+ * {@code scrub-report.txt} — rewritten on every pass — describe whichever child exited last
+ * instead of the pane. The sentinel is exported only AFTER {@code scrub.zsh} runs, so the pass
+ * that sets it never sees it and cannot blank it; it must also be on the scrub's own allow-list
+ * (see {@link #generate(Path, Set)}) so a later pass, in the same pane, cannot blank it back to
+ * empty — an exported-but-empty sentinel reads as unset to the {@code -z} guard and would silently
+ * re-enable scrubbing for every subsequent child of that pane.
+ *
+ * <p>So all three of {@code .zshenv} (gap only, guarded), {@code .zshrc}, and {@code .zlogin}
+ * source the same generated {@code scrub.zsh} after sourcing their {@code $HOME} counterpart. A
+ * login-and-interactive pane runs the {@code .zshrc} and {@code .zlogin} passes, and the second is
+ * deliberate rather than merely harmless — it re-scrubs anything the operator's own
+ * {@code ~/.zlogin} exported after {@code .zshrc} had finished. A pane that is neither runs only the
+ * {@code .zshenv} pass. Re-running is idempotent: a name already blank is blanked again, and the
+ * report is rewritten with the same counts.
  *
  * <p>Each generated file sources its {@code $HOME} counterpart FIRST, so {@code PATH} and every
- * toolchain binary still resolve exactly as the operator configured them; only afterwards does
- * {@code .zlogin} run the scrub: every EXPORTED variable not on the derived allow-list is re-exported
+ * toolchain binary still resolve exactly as the operator configured them; only afterwards does the
+ * scrub run: every EXPORTED variable not on the derived allow-list is re-exported
  * blank. Blank, not credential-shaped-pattern-filtered: a pattern list ({@code *TOKEN*}, …) is an
  * enumeration and misses what it did not think of — a username is the other half of a credential and
  * is shaped like none. Credential-SHAPED names among the blanked set go to the WARN log only,
  * never to the control.
  *
  * <p>The scrub also writes {@code scrub-report.txt} into its own directory: one {@code allowed N of
- * M} line (N = exports left untouched, M = exports present when the scrub ran), then the blanked
- * NAMES — never values. The launcher reads this back at teardown and logs it, because a blocked
- * count next to an unknown denominator is not a finding.
+ * M failed F} line (N = exports left untouched, M = exports present when the scrub ran, F = names
+ * the scrub attempted to blank but could not), then the NAMES — blanked ones bare, unblankable ones
+ * {@code !}-prefixed — never values. The launcher reads this back at teardown and logs it, because a
+ * blocked count next to an unknown denominator is not a finding.
+ *
+ * <p><b>fleetd #394:</b> plain {@code export "$n="} is a FATAL error for a zsh read-only or special
+ * parameter (for example {@code UID}) — it aborts the whole sourced file, so every name still to
+ * come is never blanked and the report above is never written at all. The blanking loop instead
+ * routes each attempt through {@code eval}, which contains that error to the single iteration: the
+ * loop always finishes, and a name that could not be blanked is counted as {@code failed} and
+ * listed {@code !}-prefixed rather than silently disappearing. This is deliberately not a skip-list
+ * of known-bad names — every enumerated name is still attempted, so a name nobody has thought of
+ * yet still gets tried and, if it fails, still gets counted.
+ *
+ * <p>The blanking loop also re-asserts, on its own, the same {@code [A-Za-z_][A-Za-z0-9_]*} shape
+ * check the enumeration loop already applied. Before {@code eval} was introduced a non-conforming
+ * name reaching {@code export "$n="} was harmless either way — the quoting made it inert. With
+ * {@code eval}, the name is spliced into a string and interpreted as shell syntax, so the enumeration
+ * loop's check is no longer sufficient on its own to keep that call site safe — it is a guard on a
+ * different loop, and the two must not silently drift apart. Re-checking right before the
+ * {@code eval} keeps that call site safe by its own reading, independent of whatever the enumeration
+ * loop does or stops doing in a later change.
+ *
+ * <p><b>fleetd #400:</b> {@code eval}'s exit status is not proof that the blank actually happened.
+ * zsh coerces a bare {@code NAME=} assignment on an integer special parameter (measured on macOS zsh
+ * 5.9: {@code SECONDS}, {@code RANDOM}, {@code SHLVL}, {@code HISTSIZE}, {@code COLUMNS},
+ * {@code LINES}, {@code USERNAME}) to a number instead of failing — {@code eval} returns success,
+ * the value is untouched, and a status-based classification reports it as blanked when it was not.
+ * The fix classifies on the observed effect instead: after the attempt, the name's value is read
+ * back with the {@code (P)} indirection flag and the decision is made from whether that is now
+ * empty. This one check covers all three shapes a name can take at this point — a genuine blank, a
+ * fatal read-only error {@code eval} merely contained, and this silent no-op — and the exit status
+ * plays no part in the decision at all.
  */
 public final class EnvAllowListScrub {
 
@@ -63,7 +116,11 @@ public final class EnvAllowListScrub {
     /** Name of the report file written into the generated directory by the scrub itself. */
     static final String REPORT_FILE = "scrub-report.txt";
 
-    /** The scrub body, generated once and sourced from both {@code .zshrc} and {@code .zlogin}. */
+    /**
+     * The scrub body, generated once and sourced from {@code .zshrc} and {@code .zlogin}
+     * unconditionally, and from {@code .zshenv} when the pane shell is neither login nor
+     * interactive (fleetd #388) — see the class javadoc.
+     */
     static final String SCRUB_FILE = "scrub.zsh";
 
     /** Prefix of every generated directory — also what {@link #reapOrphans} matches on. */
@@ -79,14 +136,42 @@ public final class EnvAllowListScrub {
     private static final String SOURCE_SCRUB =
             "source \"$ZDOTDIR/" + SCRUB_FILE + "\"\n";
 
+    /**
+     * fleetd #388: marks a pane, not a process, as already scrubbed. Set only by the guarded
+     * {@code .zshenv} pass (see {@link #NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB}) after
+     * {@code scrub.zsh} has run, so it must also be folded into that pass's own allow-list — see
+     * the class javadoc's "must also be on the scrub's own allow-list" paragraph.
+     */
+    static final String SCRUB_SENTINEL = "_CB633_SCRUBBED";
+
+    /**
+     * Appended to {@code .zshenv}, after its {@code $HOME} source: the third pass, guarded on the
+     * exact condition that defines the gap {@code .zshrc}/{@code .zlogin} do not cover — a shell
+     * that is neither login nor interactive. The sentinel export happens only once the scrub has
+     * already run, and only for as long as the current pane's environment has not been rebuilt from
+     * scratch (a fresh {@code env -i} child would not inherit it — that is out of scope here, since
+     * such a child is no longer running under the pane's own environment at all).
+     */
+    private static final String NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB =
+            "if [[ ! -o login && ! -o interactive && -z \"${" + SCRUB_SENTINEL + ":-}\" ]]; then\n"
+            + "  " + SOURCE_SCRUB
+            + "  export " + SCRUB_SENTINEL + "=1\n"
+            + "fi\n";
+
     private EnvAllowListScrub() {
     }
 
     /**
-     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran,
-     * how many were left untouched (allowed), and the NAMES that were blanked. Values never appear.
+     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran
+     * ({@code total}), how many were left untouched ({@code allowed}), how many the scrub attempted
+     * to blank but could not ({@code failed} — fleetd #394: a zsh read-only/special parameter such
+     * as {@code UID} fatally errors on plain {@code export NAME=}, so those attempts go through
+     * {@code eval} instead so the loop keeps going and the failure is counted rather than left
+     * invisible), and the NAMES in each of the latter two categories. {@code allowed +
+     * blanked.size() + unblankable.size() == total}, and {@code unblankable.size() == failed}.
+     * Values never appear.
      */
-    record ScrubReport(int allowed, int total, List<String> blanked) {
+    record ScrubReport(int allowed, int total, int failed, List<String> blanked, List<String> unblankable) {
     }
 
     /**
@@ -105,11 +190,16 @@ public final class EnvAllowListScrub {
             reapOrphans(parentDir);
             Path dir = Files.createTempDirectory(parentDir, DIR_PREFIX);
             dir.toFile().deleteOnExit();
-            // The report is written by zsh, after these hooks are registered, so register its path
-            // too — otherwise the directory is non-empty at JVM exit and cannot be removed at all.
-            dir.resolve(REPORT_FILE).toFile().deleteOnExit();
-            write(dir, SCRUB_FILE, scrubScript(allowedNames));
-            write(dir, ".zshenv", homeSourcingFile(".zshenv"));
+            // zsh truncates this pre-created receipt after these hooks are registered. Register its
+            // path too — otherwise the directory is non-empty at JVM exit and cannot be removed.
+            Files.createFile(dir.resolve(REPORT_FILE)).toFile().deleteOnExit();
+            // fleetd #388: scrub.zsh's OWN allow-list must also keep SCRUB_SENTINEL, or a later
+            // pass in the same pane blanks it back to empty and the .zshenv guard below thinks it
+            // was never scrubbed — see the class javadoc.
+            Set<String> namesForScrubScript = new HashSet<>(allowedNames);
+            namesForScrubScript.add(SCRUB_SENTINEL);
+            write(dir, SCRUB_FILE, scrubScript(namesForScrubScript));
+            write(dir, ".zshenv", homeSourcingFile(".zshenv") + NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB);
             write(dir, ".zprofile", homeSourcingFile(".zprofile"));
             write(dir, ".zshrc", homeSourcingFile(".zshrc") + SOURCE_SCRUB);
             write(dir, ".zlogin", homeSourcingFile(".zlogin") + SOURCE_SCRUB);
@@ -147,12 +237,11 @@ public final class EnvAllowListScrub {
      * into it: owner keeps full access, {@code group} gets traverse+read on the directory ({@code
      * rwxr-x---}, so a member process — a login shell reading it via {@code ZDOTDIR}, or another
      * process simply opening a file under it — running under that group can find and read the
-     * files) and read-only on each file ({@code rw-r-----}) — deliberately no group WRITE anywhere,
-     * since a member never needs to add or change what fleetd generated. (For the ZDOTDIR scrub
-     * specifically, this also means the scrub script's own report write inside the pane fails
-     * closed rather than open — see {@code scrub.zsh}'s trailing {@code 2>/dev/null} — which {@link
-     * dev.ltms.fleet.member.HerdrPeerLauncher#releaseZdotdir} already treats as "cannot be
-     * confirmed to have run" rather than success.)
+     * files) and read-only on each file ({@code rw-r-----}), except the pre-created ZDOTDIR
+     * {@code scrub-report.txt}. That receipt gets group write ({@code rw-rw----}), so
+     * {@code scrub.zsh} can truncate and write it without granting group write on the directory.
+     * If its optional permission change fails, the member cannot write a receipt and the launcher
+     * keeps its existing WARN rather than failing the spawn.
      *
      * <p>Package-private and named generically on purpose: fleetd #213 built this for the ZDOTDIR
      * scrub directory, and fleetd #219 reuses it verbatim for {@link
@@ -167,7 +256,15 @@ public final class EnvAllowListScrub {
             setGroupAndPermissions(dir, principal, "rwxr-x---");
             try (Stream<Path> entries = Files.list(dir)) {
                 for (Path file : entries.toList()) {
-                    setGroupAndPermissions(file, principal, "rw-r-----");
+                    if (REPORT_FILE.equals(file.getFileName().toString())) {
+                        try {
+                            setGroupAndPermissions(file, principal, "rw-rw----");
+                        } catch (IOException | UnsupportedOperationException ignored) {
+                            // The receipt is optional. Its absence keeps the existing WARN path.
+                        }
+                    } else {
+                        setGroupAndPermissions(file, principal, "rw-r-----");
+                    }
                 }
             }
         } catch (IOException e) {
@@ -245,11 +342,13 @@ public final class EnvAllowListScrub {
         }
         return """
                 # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
-                # Sourced from .zshrc and again from .zlogin, each time AFTER that file has sourced
-                # its $HOME counterpart — so this runs after everything the operator sourced, on a
-                # login shell (macOS panes) and on a plain interactive one (Linux panes) alike.
-                # Running twice is idempotent and deliberate: the second pass catches anything
-                # ~/.zlogin exported after ~/.zshrc had finished.
+                # Sourced unconditionally from .zshrc and again from .zlogin, each time AFTER that
+                # file has sourced its $HOME counterpart — so this runs after everything the
+                # operator sourced, on any pane that is login and/or interactive. Running twice is
+                # idempotent and deliberate: the second pass catches anything ~/.zlogin exported
+                # after ~/.zshrc had finished. Also sourced, once, from a guarded pass in .zshenv
+                # (fleetd #388) when the pane shell is NEITHER login nor interactive — the one gap
+                # those two files do not cover.
 
                 typeset -A _cb633_allowed
                 for _cb633_n in %s; do _cb633_allowed[$_cb633_n]=1; done
@@ -271,15 +370,57 @@ public final class EnvAllowListScrub {
                   _cb633_blank+=("$_cb633_n")
                 done
 
-                { for _cb633_n in "${_cb633_blank[@]}"; do export "$_cb633_n="; done; } 2>/dev/null
+                # fleetd #394: plain `export "$n="` is FATAL for a zsh read-only/special parameter
+                # (e.g. UID) and aborts this whole sourced file — every name still to come is never
+                # blanked, and the report below is never written, silently. `eval` contains that
+                # error to the single iteration instead: it still fails for that one name, but the
+                # loop continues and we can tell allowed / blanked / unblankable apart afterwards.
+                # This is not a skip-list of known-bad names (that would miss the next one nobody
+                # thought of) — every name in _cb633_blank is still attempted, unconditionally.
+                # Every name reaching this loop already passed the identical identifier check in the
+                # enumeration loop above — but that guard is 20 lines away in a different loop, and
+                # this line is about to splice the name into a string handed to `eval`. Before this
+                # fix the name only ever reached `export` quoted ("$n="), which is inert on a
+                # non-identifier string either way; `eval` makes THIS line the only thing standing
+                # between such a string and code execution in the member's pane, so it re-asserts the
+                # same check on its own rather than trusting a guard it does not own. Under normal
+                # operation this can never fire (the enumeration guard already filtered everything
+                # reaching _cb633_blank), so a name caught here is counted as unblankable rather than
+                # silently dropped — it is real evidence that the upstream guard was bypassed.
+                #
+                # fleetd #400: the attempt's own exit status is NOT proof of its effect. zsh coerces
+                # a bare `NAME=` assignment on an integer special parameter (SECONDS, RANDOM, SHLVL,
+                # HISTSIZE, COLUMNS, LINES, USERNAME on this host) to a number instead of failing —
+                # `eval` returns 0, the value is untouched, and the old exit-status check reported it
+                # as blanked when it was not. Classify on the observed effect instead: attempt the
+                # export, then read the name's value back with the `(P)` indirection flag and decide
+                # from whether it is now empty. One check then covers all three shapes a name can
+                # take here — a genuine blank, a fatal read-only error `eval` merely contained, and
+                # this silent no-op — without the exit status entering the decision at all.
+                typeset -a _cb633_ok _cb633_unblankable
+                _cb633_ok=()
+                _cb633_unblankable=()
+                for _cb633_n in "${_cb633_blank[@]}"; do
+                  if [[ ! "$_cb633_n" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+                    _cb633_unblankable+=("$_cb633_n")
+                    continue
+                  fi
+                  eval "export ${_cb633_n}=" 2>/dev/null
+                  if [[ -z "${(P)_cb633_n}" ]]; then
+                    _cb633_ok+=("$_cb633_n")
+                  else
+                    _cb633_unblankable+=("$_cb633_n")
+                  fi
+                done
 
                 integer _cb633_kept=$(( _cb633_total - ${#_cb633_blank} ))
                 {
-                  print -r -- "allowed $_cb633_kept of $_cb633_total"
-                  for _cb633_n in "${_cb633_blank[@]}"; do print -r -- "$_cb633_n"; done
+                  print -r -- "allowed $_cb633_kept of $_cb633_total failed ${#_cb633_unblankable}"
+                  for _cb633_n in "${_cb633_ok[@]}"; do print -r -- "$_cb633_n"; done
+                  for _cb633_n in "${_cb633_unblankable[@]}"; do print -r -- "!$_cb633_n"; done
                 } > "$ZDOTDIR/%s" 2>/dev/null
 
-                unset _cb633_allowed _cb633_names _cb633_blank _cb633_n _cb633_total _cb633_kept
+                unset _cb633_allowed _cb633_names _cb633_blank _cb633_ok _cb633_unblankable _cb633_n _cb633_total _cb633_kept
                 """.formatted(names, MemberEnvAllowList.zshCasePattern(), REPORT_FILE);
     }
 
@@ -293,6 +434,11 @@ public final class EnvAllowListScrub {
      * Read and parse {@link #REPORT_FILE} out of a generated ZDOTDIR directory. Returns {@code null}
      * when absent or unreadable (the pane may have been torn down before its login shell ever got to
      * the scrub) — callers treat that as "no measurement available", never as success.
+     *
+     * <p>First line is {@code "allowed <N> of <M> failed <F>"} (fleetd #394 added the trailing
+     * {@code failed <F>} — a count of names the scrub attempted to blank but could not, e.g. a zsh
+     * read-only/special parameter). Every following non-blank line is a name: a bare name was
+     * blanked, a {@code !}-prefixed name was attempted and failed. Values never appear on either.
      */
     static ScrubReport readReport(Path zdotdir) {
         Path report = zdotdir.resolve(REPORT_FILE);
@@ -305,17 +451,24 @@ public final class EnvAllowListScrub {
                 return null;
             }
             String[] parts = lines.getFirst().substring("allowed ".length()).trim().split("\\s+");
-            if (parts.length != 3 || !"of".equals(parts[1])) {
+            if (parts.length != 5 || !"of".equals(parts[1]) || !"failed".equals(parts[3])) {
                 return null;
             }
             List<String> blanked = new ArrayList<>();
+            List<String> unblankable = new ArrayList<>();
             for (int i = 1; i < lines.size(); i++) {
-                if (!lines.get(i).isBlank()) {
-                    blanked.add(lines.get(i));
+                String line = lines.get(i);
+                if (line.isBlank()) {
+                    continue;
+                }
+                if (line.startsWith("!")) {
+                    unblankable.add(line.substring(1));
+                } else {
+                    blanked.add(line);
                 }
             }
             return new ScrubReport(Integer.parseInt(parts[0]), Integer.parseInt(parts[2]),
-                    List.copyOf(blanked));
+                    Integer.parseInt(parts[4]), List.copyOf(blanked), List.copyOf(unblankable));
         } catch (IOException | NumberFormatException e) {
             return null;
         }

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -1643,11 +1643,19 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             log.warn("memberCredentials allow-list: pane {} left no scrub report in {} — the "
                     + "environment scrub cannot be confirmed to have run. Either the pane ended "
                     + "before its shell finished starting, or its shell never read our generated "
-                    + "startup files, in which case that member saw the full host environment.",
+                    + "startup files. Either way, we cannot tell from here whether the scrub ran, "
+                    + "so we do not know what that member's environment contained.",
                     paneId, dir);
         } else {
             log.info("memberCredentials allow-list: pane {} allowed {} of {} environment variables",
                     paneId, report.allowed(), report.total());
+            if (report.failed() > 0) {
+                log.warn("memberCredentials allow-list: pane {} could not blank {} environment "
+                        + "variable(s) — {} (likely a zsh read-only/special parameter) — those "
+                        + "names were left in the member's environment. Confirm none of them is a "
+                        + "credential.",
+                        paneId, report.failed(), report.unblankable());
+            }
             List<String> shaped = report.blanked().stream()
                     .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
                     .toList();

fleetd/src/main/java/dev/ltms/fleet/peer/SpawnRequest.java

@@ -29,4 +29,9 @@ public record SpawnRequest(String profileName, String requestedCwd, String calle
                         String sessionName, String resumeSessionId) {
         this(profileName, requestedCwd, callerCwd, sessionName, resumeSessionId, null);
     }
+
+    /** Return a copy of this request with {@code profileName} replaced by {@code profile}. */
+    public SpawnRequest withProfile(String profile) {
+        return new SpawnRequest(profile, requestedCwd, callerCwd, sessionName, resumeSessionId, role);
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/health/FleetHealthMonitorTest.java

@@ -30,6 +30,7 @@ import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.ScheduledThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.BiConsumer;
 import java.util.function.LongSupplier;
 
@@ -277,6 +278,58 @@ class FleetHealthMonitorTest {
         }
     }
 
+    /**
+     * fleetd #386 follow-up, added on merge. The fix carries a PER-MEMBER drift baseline, so drift
+     * from a sleep that happened BEFORE a member went busy is never charged to that member. The
+     * two tests shipped with the fix both start with the member already BUSY, so a single global
+     * baseline passes them — this one fails without the per-member map.
+     *
+     * <p>Order matters: the host sleeps while nothing is busy, and only then does a member take a
+     * turn. Its stall clock must start at zero.
+     */
+    @Test void driftFromASleepBeforeAMemberWentBusyIsNotChargedToThatMember() {
+        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            AtomicLong mono = new AtomicLong(0);
+            AtomicLong real = new AtomicLong(0);
+            AtomicReference<List<MemberSession>> roster = new AtomicReference<>(List.of());
+            FakeHerdr herdr = new FakeHerdr().withAgent("busy", "term_busy", "pane_busy", "tab_busy");
+            var scheduler = Executors.newSingleThreadScheduledExecutor();
+            AgentControl agents = new AgentControl(herdr);
+            FleetHealthMonitor monitor = new FleetHealthMonitor(agents, roster::get,
+                    new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
+                    scheduler, mono::get, real::get, 60, 600, (_, _) -> { });
+
+            monitor.tick();                                   // baseline, no members yet
+
+            // The host sleeps for 700s with nobody busy: the monotonic clock stands still.
+            real.set(TimeUnit.SECONDS.toNanos(700));
+            monitor.tick();
+
+            // Awake again. Only NOW does a member start a turn, with a fresh activity stamp taken
+            // from the monotonic clock. Both clocks advance together from here.
+            mono.set(TimeUnit.SECONDS.toNanos(10));
+            real.set(TimeUnit.SECONDS.toNanos(710));
+            roster.set(List.of(member("term_busy", MemberSession.State.BUSY,
+                    0, TimeUnit.SECONDS.toNanos(10))));
+            monitor.tick();
+
+            mono.set(TimeUnit.SECONDS.toNanos(20));
+            real.set(TimeUnit.SECONDS.toNanos(720));
+            monitor.tick();
+            monitor.stop();
+
+            assertEquals(0, appender.list.stream().filter(event -> event.getFormattedMessage()
+                            .contains("member=term_busy state=STALL_SUSPECTED")).count(),
+                    "the member has been busy for 10s, not 710s — the earlier sleep is not its stall");
+        } finally {
+            logger.detachAppender(appender);
+        }
+    }
+
     private static FleetHealthMonitor monitorWithClocks(FakeHerdr herdr, List<MemberSession> roster,
             java.util.concurrent.ScheduledExecutorService scheduler, LongSupplier clock,
             LongSupplier realtimeClock, long intervalSeconds, long workingSuspectAfterSeconds,

fleetd/src/test/java/dev/ltms/fleet/member/EnvAllowListScrubTest.java

@@ -8,6 +8,7 @@ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -17,6 +18,7 @@ import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -45,6 +47,15 @@ class EnvAllowListScrubTest {
     /** Env var names appearing in command output; anything else (prompts, wrapped lines) is noise. */
     private static final Pattern ENV_NAME = Pattern.compile("^([A-Za-z_][A-Za-z0-9_]*)$");
 
+    /**
+     * fleetd #388: the sentinel name the generated {@code .zshenv} guard uses, kept here as a
+     * literal rather than referencing {@link EnvAllowListScrub#SCRUB_SENTINEL} — the two tests that
+     * use it must still compile and run against the pre-fix production class (which has no such
+     * constant), so the revert-and-prove-it-fails step exercises a real assertion instead of a
+     * compilation error.
+     */
+    private static final String SCRUB_SENTINEL_NAME = "_CB633_SCRUBBED";
+
     /**
      * The equality test. Expected survivors = baseline exports ∩ allowed — i.e. every survivor is
      * allowed AND every allowed name that existed survives. The operator's own secret-store exports
@@ -108,6 +119,230 @@ class EnvAllowListScrubTest {
                 "allowed N of M with N <= M — the denominator is always reported");
     }
 
+    /**
+     * fleetd #394: the actual defect. Plain {@code export "$n="} is FATAL for a zsh read-only or
+     * special parameter (e.g. {@code UID}) and aborts the whole sourced file — every name still to
+     * come is never blanked, and the {@code scrub-report.txt} below is never written at all,
+     * silently ({@code 2>/dev/null} swallows the error). This plants an unblankable, exported,
+     * read-only variable in the MIDDLE of the names the scrub attempts to blank, with two more
+     * names after it, and asserts that both of those later names are STILL blanked and the report
+     * is STILL written with the failure counted — a test that only checked names BEFORE the failure
+     * point would pass today and prove nothing.
+     *
+     * <p>The planted name is a made-up one ({@code FLEETD_TEST_UNBLANKABLE}), not {@code UID} or
+     * any other name a skip-list might already know about — invariant 1 is that the loop survives
+     * ANY unblankable name, not a known one, so the test must not lean on one either.
+     *
+     * <p>Exercises the real artefact: {@link EnvAllowListScrub#scrubScript} is run verbatim under a
+     * real {@code /bin/zsh}, not just asserted on as a Java string. The four planted names are
+     * exported one at a time via {@code typeset -x}/{@code typeset -rx} immediately before the
+     * script runs, in a fixed order — zsh's {@code export}/{@code typeset -x} appends to the
+     * process's environment table in call order (verified empirically: a freshly-exported name
+     * always sorts after every inherited one and after every earlier freshly-exported name in
+     * {@code command env}'s own output), which is what makes the "middle" position deterministic
+     * here, unlike relying on the OS's own inherited-environment order.
+     */
+    @Test
+    void unblankableNameInTheMiddleDoesNotAbortNamesAfterIt(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+
+        // Only ZDOTDIR is allowed — it must survive the scrub itself, since the report is written
+        // to "$ZDOTDIR/..." AFTER the blanking loop runs; if ZDOTDIR were blanked as a side effect,
+        // the report write would silently go to the wrong place instead of testing anything.
+        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
+        String setup = """
+                typeset -x FLEETD_TEST_BEFORE=1
+                typeset -rx FLEETD_TEST_UNBLANKABLE=1
+                typeset -x FLEETD_TEST_AFTER_A=1
+                typeset -x FLEETD_TEST_AFTER_B=1
+                """;
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
+        pb.environment().clear();
+        pb.environment().put("PATH", "/usr/bin:/bin");
+        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write((setup + script).getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the scrub script did not exit within 60s");
+        assertEquals(0, zsh.exitValue(),
+                "the scrub script itself must never abort — an unblankable name must not kill the "
+                        + "sourced file");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
+        assertNotNull(report, "the report must still be written even though one name could not be "
+                + "blanked — a report that silently never appears is the #394 bug");
+        assertTrue(report.blanked().contains("FLEETD_TEST_BEFORE"),
+                "sanity: the name before the unblankable one must be blanked");
+        assertTrue(report.blanked().contains("FLEETD_TEST_AFTER_A"),
+                "the FIRST name AFTER the unblankable one must still be blanked — before the fix, "
+                        + "the whole loop aborted at the unblankable name and every later name was "
+                        + "silently left untouched");
+        assertTrue(report.blanked().contains("FLEETD_TEST_AFTER_B"),
+                "the SECOND name after the unblankable one must also still be blanked");
+        assertTrue(report.unblankable().contains("FLEETD_TEST_UNBLANKABLE"),
+                "the unblankable name is reported by name, not silently dropped");
+        // fleetd #400 note: zsh itself auto-exports SHLVL on every shell start (measured: it appears
+        // in `command env` even from a fully cleared parent), and a bare assignment to it is coerced
+        // rather than failing — exactly the shape #400 fixes. Before that fix, eval's exit status
+        // alone silently misclassified SHLVL as blanked, so this test's old "exactly one" assertion
+        // passed by accident: it never actually proved SHLVL was absent from the candidates, only
+        // that the old bug hid it. Now that classification reads the value back, SHLVL and
+        // FLEETD_TEST_UNBLANKABLE both correctly land in unblankable() — real, unplanted evidence
+        // the #400 fix works, not just the synthetic case in the dedicated #400 test above.
+        assertTrue(report.unblankable().contains("SHLVL"),
+                "fleetd #400: zsh's own auto-exported SHLVL must also be reported unblankable, not "
+                        + "silently miscounted as blanked");
+        assertEquals(report.unblankable().size(), report.failed(),
+                "the failed count must equal the number of names actually reported unblankable");
+    }
+
+    /**
+     * fleetd #400: {@code eval}'s exit status is not proof that a name was actually blanked. zsh
+     * coerces a bare {@code NAME=} assignment on an integer special parameter to a number instead of
+     * failing, so {@code eval} reports success while the value stays non-empty — a status-based
+     * classification calls that "blanked" when it was not. This drives all three shapes a name can
+     * take through the real {@code scrubScript} in ONE run: a normal, genuinely blankable name; a
+     * fatal one ({@code LINENO} — deliberately not {@code UID}, so this test does not depend on the
+     * harness's uid); and the silent-no-op one the ticket is about ({@code SECONDS}, rc 0 but
+     * unchanged). Under the pre-#400 exit-status check, {@code SECONDS} would land in
+     * {@code blanked()} — that is the exact false receipt this fix removes.
+     *
+     * <p>Criterion 3: a cleared {@code ProcessBuilder} parent does not, by itself, give the child
+     * zsh any of these names — {@code SECONDS}/{@code LINENO} are zsh's own built-in parameters and
+     * only become CANDIDATES the enumeration loop can see (i.e. show up in {@code command env}) when
+     * they arrive via the process's own environment table, not merely by existing as zsh parameters
+     * inside the shell. So each is put into {@code pb.environment()} explicitly, after
+     * {@code clear()} — confirmed empirically first (a throwaway probe piping
+     * {@code env -i PATH=... SECONDS=999 LINENO=999 FLEETD_TEST_NORMAL=1 zsh -c 'command env | cut
+     * -d= -f1'}) that all three names really appear in {@code command env}'s output under exactly
+     * this construction, not relying on whatever the test-runner's own ambient environment happens
+     * to contain.
+     */
+    @Test
+    void classifiesByObservedValueNotExitStatusAcrossAllThreeShapes(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+
+        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
+        pb.environment().clear();
+        pb.environment().put("PATH", "/usr/bin:/bin");
+        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
+        // Explicitly placed in the child's environment table — see the javadoc above on why a
+        // cleared parent alone does not put these on the enumeration loop's candidate list.
+        pb.environment().put("SECONDS", "999");   // rc 0, value coerced/unchanged — the #400 bug
+        pb.environment().put("LINENO", "999");    // fatal on assignment, eval rc != 0, contained
+        pb.environment().put("FLEETD_TEST_NORMAL", "1"); // genuinely blankable, the control case
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write(script.getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the scrub script did not exit within 60s");
+        assertEquals(0, zsh.exitValue(),
+                "the scrub script must still reach its end with both a fatal name and a silent "
+                        + "no-op name among the candidates");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
+        assertNotNull(report, "the report must still be written");
+        assertTrue(report.blanked().contains("FLEETD_TEST_NORMAL"),
+                "the control case: an ordinary name is genuinely blankable and must be reported so");
+        assertTrue(report.unblankable().contains("LINENO"),
+                "a name fatal to assign to must be reported unblankable — sanity check that "
+                        + "containment still works under the new classification");
+        assertTrue(report.unblankable().contains("SECONDS"),
+                "the #400 defect: eval returns rc 0 for SECONDS (zsh coerces the assignment instead "
+                        + "of failing) but the value is left non-empty — classifying on the observed "
+                        + "value catches this; classifying on eval's exit status would have called "
+                        + "this \"blanked\" and produced a false receipt");
+        assertFalse(report.blanked().contains("SECONDS"),
+                "SECONDS must never appear as blanked — it was never actually emptied");
+    }
+
+    /**
+     * fleetd #394 follow-up: the blanking loop's {@code eval "export ${n}="} splices {@code n} into
+     * a string that zsh then interprets as shell syntax. That is only safe because every name
+     * reaching {@code _cb633_blank} already passed an identifier check in the ENUMERATION loop
+     * (20 lines away, in a different loop) — so the fix re-asserts the identical check immediately
+     * before the {@code eval} call, rather than trusting that distant guard to keep holding.
+     *
+     * <p>This test plants a value with an embedded newline, exploiting the exact "junk from
+     * multi-line values" gap the enumeration loop's own comment already documents: {@code command
+     * env}'s text output is read line-by-line, so a value's second line becomes a spurious extra
+     * "name" that was never a real exported variable. The fragment used here ({@code
+     * junk.fragment}) is merely non-conforming (it contains a dot) — never command-shaped; this
+     * test must never demonstrate command execution and plants no command-shaped payload.
+     *
+     * <p>Exercises the real artefact end-to-end: {@link EnvAllowListScrub#scrubScript} runs
+     * verbatim under a real {@code /bin/zsh}, exactly as {@code generate()} would produce it — this
+     * is not a synthetic call into just the blanking loop.
+     */
+    @Test
+    void nonIdentifierJunkFromAMultilineValueIsSkippedNotBlankedOrUnblankable(@TempDir Path tmp)
+            throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+
+        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
+        pb.environment().clear();
+        pb.environment().put("PATH", "/usr/bin:/bin");
+        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
+        // Embedded newline: `command env`'s own text output splits this into two lines, and the
+        // second ("junk.fragment") has no "=" at all, so `cut -d= -f1` returns it unchanged as a
+        // spurious candidate "name" — it was never an actual exported variable by that name.
+        pb.environment().put("FLEETD_TEST_MULTILINE", "keep\njunk.fragment");
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write(script.getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the scrub script did not exit within 60s");
+        assertEquals(0, zsh.exitValue(), "the scrub script must reach its end");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
+        assertNotNull(report, "the report must still be written");
+        assertTrue(report.blanked().contains("FLEETD_TEST_MULTILINE"),
+                "sanity: the real, identifier-shaped variable must still be blanked normally");
+        assertFalse(report.blanked().contains("junk.fragment"),
+                "a non-identifier fragment is not a real variable and must never be blanked");
+        assertFalse(report.unblankable().contains("junk.fragment"),
+                "a non-identifier fragment must never even become a candidate the blanking loop "
+                        + "attempts — it must be filtered before either guard has to catch it, so "
+                        + "it is neither blanked nor counted as a failed attempt");
+    }
+
+    /** A group-shared ZDOTDIR still lets the member truncate and write its pre-created receipt. */
+    @Test
+    void groupSharedScrubWritesAndReadsItsReport(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed, currentUserGroup());
+
+        Map<String, String> cleanParent = Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh");
+        exportedNamesFromCleanParent(cleanParent, zdotdir);
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(zdotdir);
+        assertNotNull(report, "a group-shared completed login shell must leave a report behind");
+        assertTrue(report.allowed() >= 0 && report.total() >= report.allowed(),
+                "allowed N of M with N <= M — the denominator is always reported");
+        assertEquals("rw-rw----", java.nio.file.attribute.PosixFilePermissions.toString(
+                        Files.getPosixFilePermissions(zdotdir.resolve(EnvAllowListScrub.REPORT_FILE))),
+                "the pre-created receipt must be group-writable");
+        assertEquals("rwxr-x---", java.nio.file.attribute.PosixFilePermissions.toString(
+                        Files.getPosixFilePermissions(zdotdir)),
+                "group sharing must not make the ZDOTDIR directory group-writable");
+    }
+
     /** Report parsing is lenient: absent file → null (no measurement), not an exception. */
     @Test
     void readReportReturnsNullForADirectoryWithoutOne(@TempDir Path dir) {
@@ -224,6 +459,140 @@ class EnvAllowListScrubTest {
                         + "shell. A difference here means the scrub is dead on Linux.");
     }
 
+    /**
+     * fleetd #388: the actual gap. zsh reads {@code .zshenv} always, {@code .zprofile}/
+     * {@code .zlogin} only for a LOGIN shell, and {@code .zshrc} only for an INTERACTIVE one — so a
+     * shell that is NEITHER (a bare {@code /bin/zsh} reading a script off a non-tty stdin, no
+     * {@code -l}, no {@code -i}) reads only {@code .zshenv} and stops. Before this fix, that shell
+     * never reached {@code scrub.zsh} at all: the decoy secret below would survive untouched. This
+     * test injects that decoy directly into the process environment (not via a sourced dotfile,
+     * since the whole point of the gap is that {@code .zshenv} is normally close to empty) so the
+     * test does not depend on any real {@code ~/.zshrc} content existing on the host.
+     */
+    @Test
+    void scrubRunsInAShellThatIsNeitherLoginNorInteractive(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed);
+
+        Map<String, String> cleanParent = new HashMap<>(Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh",
+                "USER", System.getProperty("user.name", "nobody"),
+                "TMPDIR", tmp.toString()));
+        cleanParent.put("FLEETD_TEST_DECOY_SECRET", "x"); // not on any allow-list; must be blanked
+
+        List<String> neither = List.of(); // no -l, no -i; stdin is a pipe (never a tty) either way
+        Set<String> baseline = exportedNamesFromCleanParent(cleanParent, null, neither);
+        Set<String> scrubbed = exportedNamesFromCleanParent(cleanParent, zdotdir, neither);
+
+        Set<String> expected = new TreeSet<>();
+        for (String name : baseline) {
+            if (MemberEnvAllowList.keeps(allowed, name)) {
+                expected.add(name);
+            }
+        }
+        assertTrue(baseline.contains("FLEETD_TEST_DECOY_SECRET"),
+                "sanity: the decoy must actually reach the un-scrubbed baseline, or this test proves "
+                        + "nothing");
+        expected.add("ZDOTDIR"); // the harness set it and it is infrastructure, so it must survive
+        expected.add(SCRUB_SENTINEL_NAME); // set by the new .zshenv guard once scrubbed
+        assertEquals(expected, scrubbed,
+                "a pane shell that is NEITHER login nor interactive must still be scrubbed — its "
+                        + "surviving exported names must EQUAL baseline ∩ allow-list, plus the "
+                        + "sentinel the guard sets once it has run. FLEETD_TEST_DECOY_SECRET surviving "
+                        + "here means the gap is still open.");
+    }
+
+    /**
+     * fleetd #388 invariants 3 and 4, which a name-set equality cannot show: a member's own tooling
+     * forks plain, non-login, non-interactive zsh processes for a single command (the same shape as
+     * the pane shell itself), and such a child must (a) keep whatever its parent deliberately set
+     * for it, never (b) re-run the scrub and blank it, and never (c) overwrite the pane's own
+     * {@code scrub-report.txt} with a description of itself instead of the pane. All three can only
+     * be shown by actually running a child process from within the scrubbed pane shell.
+     *
+     * <p>The pane and the child both report presence via {@code ${NAME:+present}} — empty when a
+     * name is unset OR blanked (exported empty), {@code present} when it is set and non-empty. No
+     * value is ever printed, only these two shapes and the literal word {@code set}/{@code unset}
+     * for the sentinel.
+     */
+    @Test
+    void neitherShellChildKeepsParentVariablesAndReceiptStillDescribesThePane(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed);
+
+        Map<String, String> paneEnv = new HashMap<>(Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh",
+                "USER", System.getProperty("user.name", "nobody"),
+                "TMPDIR", tmp.toString()));
+        paneEnv.put("FLEETD_TEST_DECOY_SECRET", "x"); // not allow-listed; the pane must blank it
+        paneEnv.put("ZDOTDIR", zdotdir.toAbsolutePath().toString());
+
+        // The pane's own script reports what IT sees, then forks a plain non-login, non-interactive
+        // child — the shape a member's own tooling uses — carrying a variable the "parent" (this
+        // pane) deliberately set for it, the way git sets GIT_DIR for a hook.
+        String outerScript = """
+                print -r -- "PANE_SENTINEL=${%1$s:+set}"
+                print -r -- "PANE_DECOY=${FLEETD_TEST_DECOY_SECRET:+present}"
+                FLEETD_TEST_TOOL_VAR=keep /bin/zsh <<'CHILD'
+                print -r -- "CHILD_LOGIN=$([[ -o login ]] && echo yes || echo no)"
+                print -r -- "CHILD_INTERACTIVE=$([[ -o interactive ]] && echo yes || echo no)"
+                print -r -- "CHILD_TOOL_VAR=${FLEETD_TEST_TOOL_VAR:+present}"
+                print -r -- "CHILD_DECOY=${FLEETD_TEST_DECOY_SECRET:+present}"
+                print -r -- "CHILD_SENTINEL=${%1$s:+set}"
+                CHILD
+                exit
+                """.formatted(SCRUB_SENTINEL_NAME);
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh"); // no -l, no -i: the pane's own shape
+        pb.environment().clear();
+        pb.environment().putAll(paneEnv);
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write(outerScript.getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        String stdout = new String(zsh.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the pane+child probe did not exit within 60s");
+        assertTrue(zsh.exitValue() == 0, "probe zsh exited non-zero: " + stdout);
+
+        Map<String, String> reported = new HashMap<>();
+        for (String line : stdout.split("\n")) {
+            int eq = line.indexOf('=');
+            if (eq > 0) {
+                reported.put(line.substring(0, eq).trim(), line.substring(eq + 1).trim());
+            }
+        }
+
+        assertEquals("set", reported.get("PANE_SENTINEL"),
+                "the pane itself is neither login nor interactive, so the .zshenv guard must have "
+                        + "run the scrub and exported the sentinel");
+        assertEquals("", reported.get("PANE_DECOY"),
+                "the pane must blank a non-allow-listed name — invariant 1");
+        assertEquals("no", reported.get("CHILD_LOGIN"), "sanity: the child must also be non-login");
+        assertEquals("no", reported.get("CHILD_INTERACTIVE"), "sanity: the child must also be non-interactive");
+        assertEquals("present", reported.get("CHILD_TOOL_VAR"),
+                "invariant 3: a variable the pane deliberately set for its child must survive — a "
+                        + "child that re-ran the scrub would have blanked it");
+        assertEquals("", reported.get("CHILD_DECOY"),
+                "a name already blanked by the pane must stay blanked in the child, never resurrected");
+        assertEquals("set", reported.get("CHILD_SENTINEL"),
+                "the child must inherit the sentinel from the pane's environment, or it would re-scrub");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(zdotdir);
+        assertNotNull(report, "the pane's own scrub pass must leave a report behind");
+        assertTrue(report.blanked().stream().noneMatch(n -> n.startsWith("FLEETD_TEST_TOOL_VAR")),
+                "invariant 4: the receipt must still describe the PANE, not the child — a child that "
+                        + "re-ran the scrub would have rewritten this file to list its own "
+                        + "FLEETD_TEST_TOOL_VAR as blanked");
+    }
+
     /**
      * Run {@code /bin/zsh -l -i} from a clean parent and return the NAMES it has exported by prompt
      * time. With {@code zdotdir} non-null, {@code ZDOTDIR} points at a generated scrub directory, so

fleetd/src/test/java/dev/ltms/fleet/peer/SpawnRequestWithProfilePreservesEveryComponentTest.java

@@ -0,0 +1,144 @@
+package dev.ltms.fleet.peer;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.RecordComponent;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Fleetd #382, the same "defect factory" #357 and #358 guarded on {@code FleetConfig.withDefaults()}
+ * and {@link dev.ltms.fleet.session.MemberSession}'s rebuild sites — reproduced here on
+ * {@link SpawnRequest#withProfile(String)}.
+ *
+ * <p>{@code SpawnRequest} has back-compat constructors at arity 3 and 5 alongside its canonical
+ * arity-6 constructor. Before this ticket, {@code CompositePeerLauncher} routed a profile by
+ * building a fresh {@code SpawnRequest} from a literal {@code new SpawnRequest(...)} call listing
+ * six of the original request's own accessors. That call is only correct because it happens to
+ * name exactly six arguments today — add a 7th component and the established back-compat pattern
+ * (a new constructor at the old, now-shorter arity) and a call one argument short of the new
+ * canonical arity would silently rebind to that back-compat constructor, dropping the new
+ * component on every profile-routed spawn without any compile error. {@link #withProfile} replaces
+ * that literal call, so this test guards the ONE rebuild site instead of a call site scattered
+ * through a launcher.
+ *
+ * <p>The check below builds a {@link SpawnRequest} through the TRUE canonical constructor —
+ * resolved by the record's own component types via {@code getDeclaredConstructor}, never by
+ * argument count, so it can never itself land on a back-compat overload — with a real, distinctive,
+ * non-null value in every component, calls {@link SpawnRequest#withProfile(String)}, and asserts
+ * every component the method is not documented to change survives unchanged, while {@code
+ * profileName} comes back as the new value it was given. A component that comes back anything else
+ * was silently dropped — the shape of the defect this test exists to catch.
+ *
+ * <p>{@link #EXCLUDED_FROM_SURVIVAL_CHECK} is kept deliberately empty and size-pinned by
+ * {@link #exclusionListSizeIsPinned()}, for the same reason the other two guards pin theirs at
+ * zero: a checker whose escape hatch can grow to silence a failure is not a checker. Every one of
+ * {@link SpawnRequest}'s 6 current components has a real, non-null value here and none is excluded.
+ */
+class SpawnRequestWithProfilePreservesEveryComponentTest {
+
+    private static final RecordComponent[] COMPONENTS = SpawnRequest.class.getRecordComponents();
+
+    /** Deliberately empty today; grow it only with a matching justification, and re-pin the size. */
+    private static final Set<String> EXCLUDED_FROM_SURVIVAL_CHECK = Set.of();
+
+    /** One real, distinctive, non-null value per component — none of the 6 is excluded. */
+    private static Map<String, Object> baseValues() {
+        Map<String, Object> v = new LinkedHashMap<>();
+        v.put("profileName", "profile-guard");
+        v.put("requestedCwd", "/wt/requested-guard");
+        v.put("callerCwd", "/wt/caller-guard");
+        v.put("sessionName", "session-guard");
+        v.put("resumeSessionId", "resume-guard");
+        v.put("role", MemberRole.REVIEWER);
+        assertNamesMatchComponents(v);
+        return v;
+    }
+
+    /**
+     * Guards {@link #baseValues()} itself against drifting from the record's real shape — forgetting
+     * to add a new component here fails this assertion by name, rather than silently checking one
+     * component fewer than the record has.
+     */
+    private static void assertNamesMatchComponents(Map<String, Object> values) {
+        Set<String> names = new TreeSet<>();
+        for (RecordComponent rc : COMPONENTS) {
+            names.add(rc.getName());
+        }
+        assertEquals(names, new TreeSet<>(values.keySet()),
+                "this test's value map has drifted from SpawnRequest's actual components — "
+                        + "update baseValues() alongside the record");
+    }
+
+    /**
+     * Builds a {@link SpawnRequest} through the TRUE canonical constructor — resolved by the
+     * record's own component types, not by argument count — so this never accidentally exercises a
+     * back-compat overload the way a literal {@code new SpawnRequest(...)} call risks doing.
+     */
+    private static SpawnRequest requestOf(Map<String, Object> values) throws ReflectiveOperationException {
+        Class<?>[] types = Arrays.stream(COMPONENTS).map(RecordComponent::getType).toArray(Class<?>[]::new);
+        Object[] args = Arrays.stream(COMPONENTS).map(rc -> values.get(rc.getName())).toArray();
+        Constructor<SpawnRequest> ctor = SpawnRequest.class.getDeclaredConstructor(types);
+        return ctor.newInstance(args);
+    }
+
+    @Test
+    void exclusionListSizeIsPinned() {
+        assertEquals(0, EXCLUDED_FROM_SURVIVAL_CHECK.size(),
+                "EXCLUDED_FROM_SURVIVAL_CHECK grew from 0 — every entry needs a justification in "
+                        + "this test class's javadoc AND this assertion re-pinned to the new size; a "
+                        + "growing exclusion list that silences failures on its own is not a guard");
+    }
+
+    @Test
+    void withProfilePreservesEveryOtherComponent() throws ReflectiveOperationException {
+        Map<String, Object> base = baseValues();
+        SpawnRequest request = requestOf(base);
+        SpawnRequest result = request.withProfile("profile-updated");
+
+        Map<String, Object> expectedOverrides = Map.of("profileName", "profile-updated");
+
+        List<String> dropped = new ArrayList<>();
+        int checked = 0;
+        for (RecordComponent rc : COMPONENTS) {
+            String name = rc.getName();
+            if (EXCLUDED_FROM_SURVIVAL_CHECK.contains(name)) {
+                continue;
+            }
+            checked++;
+            Object expected = expectedOverrides.containsKey(name) ? expectedOverrides.get(name) : base.get(name);
+            Object actual;
+            try {
+                actual = rc.getAccessor().invoke(result);
+            } catch (ReflectiveOperationException e) {
+                throw new RuntimeException("failed to read SpawnRequest." + name + "()", e);
+            }
+            if (!Objects.equals(expected, actual)) {
+                dropped.add(String.format(Locale.ROOT,
+                        "%s: withProfile() was expected to carry (%s) for '%s' but returned %s — a "
+                                + "component silently dropped by withProfile(), the shape of the defect "
+                                + "this test exists to catch (its final \"return new SpawnRequest(...)\" "
+                                + "call binding to a back-compat constructor instead of the true "
+                                + "canonical one)",
+                        name, expected, name, actual));
+            }
+        }
+
+        System.out.printf(Locale.ROOT,
+                "SpawnRequest.withProfile() component-survival coverage — %d components, %d checked, "
+                        + "%d excluded, %d survived%n",
+                COMPONENTS.length, checked, EXCLUDED_FROM_SURVIVAL_CHECK.size(), checked - dropped.size());
+        assertEquals(List.of(), dropped,
+                "withProfile() silently dropped these components: " + dropped);
+    }
+}