flowviant 0.116.0 → 0.124.0

package/bin/lib/deployCheckout.mjs

@@ -22,9 +22,12 @@ import {
   symlinkSync,
   unlinkSync,
 } from 'node:fs';
-import { homedir } from 'node:os';
-import { basename, isAbsolute, join, relative, sep } from 'node:path';
+import { isAbsolute, join, relative, sep } from 'node:path';
 import { git, gitNetAsync } from './git.mjs';
+import { worktreeHomeDir } from './statePaths.mjs';
+// WHICH FILES ARE ENV FILES has one home, beside the report's own narrower
+// rule; that block says why the two differ (2026-10-10, the audit's F085).
+import { isCheckoutEnvFile } from './env.mjs';
 
 /**
  * A DEPLOY BUILDS THE BASE COMMIT, NEVER THE OPERATOR'S WORKING TREE
@@ -60,7 +63,6 @@ import { git, gitNetAsync } from './git.mjs';
  * a workspace package's own CLI still runs from the checkout. Submodules are
  * not initialised. The code and the commands no longer come from the checkout.
  */
-const ENV_FILE_RE = /^(?:\.env(?:\..+)?|\.dev\.vars)$/;
 const lexists = (p) => {
   try {
     lstatSync(p);
@@ -71,11 +73,15 @@ const lexists = (p) => {
 };
 
 /** Bring the checkout's untracked environment into a deploy worktree. Returns
- *  every path it created, so the cleanup can unlink them BEFORE the worktree
- *  is removed (a recursive delete must never be handed a symlink into the
- *  operator's own node_modules). */
+ *  `{ made, envFiles }`: `made` is every path it created, so the cleanup can
+ *  unlink them BEFORE the worktree is removed (a recursive delete must never
+ *  be handed a symlink into the operator's own node_modules); `envFiles` is
+ *  every env file it COPIED (2026-10-10, the audit's F085), so the deploy lane
+ *  can teach the scrubber the values its own build is about to be able to
+ *  print — nested files the root-only env scan never reads. */
 export function linkCheckoutEnvironment(repoRoot, dir) {
   const made = [];
+  const envFiles = [];
   let realRoot = repoRoot;
   try {
     realRoot = realpathSync(repoRoot);
@@ -149,11 +155,12 @@ export function linkCheckoutEnvironment(repoRoot, dir) {
         if (e.isDirectory() && !lexists(dst)) linkNodeModules(src, dst, 0);
         continue;
       }
-      if (e.isFile() && ENV_FILE_RE.test(e.name)) {
+      if (e.isFile() && isCheckoutEnvFile(e.name)) {
         if (!lexists(dst)) {
           try {
             copyFileSync(src, dst);
             made.push(dst);
+            envFiles.push(dst);
           } catch {
             /* unreadable — the build says so if it needed it */
           }
@@ -168,15 +175,18 @@ export function linkCheckoutEnvironment(repoRoot, dir) {
     }
   };
   walk('', 0);
-  return made;
+  return { made, envFiles };
 }
 
 /**
- * Cut the deploy worktree at the base tip. Returns `{ dir, sha, cleanup }`, or
+ * Cut the deploy worktree at the base tip. Returns `{ dir, sha, cleanup,
+ * envFiles }` (`envFiles`: the env files copied in — see
+ * `linkCheckoutEnvironment`), or
  * throws with a sentence when base does not resolve. `worktreeDir` defaults to
- * the daemon's own worktree home for this repo (fleetStartup.mjs keys it the same
- * way); the job id is hashed into the path, never joined raw — it is a
- * server-named string.
+ * the daemon's own worktree home for this repo — statePaths.mjs's one
+ * derivation, the same one fleetStartup.worktreeHome makes and reaps — and the
+ * deploy lane relies on that default rather than passing it; the job id is
+ * hashed into the path, never joined raw — it is a server-named string.
  */
 export async function openDeployCheckout({ repoRoot, baseRef, jobId, worktreeDir }) {
   if (!baseRef) throw new Error('no base branch resolved, so there is nothing to deploy from');
@@ -195,14 +205,7 @@ export async function openDeployCheckout({ repoRoot, baseRef, jobId, worktreeDir
   } catch {
     throw new Error(`the base branch ${baseRef} does not resolve on this machine`);
   }
-  const home =
-    worktreeDir ??
-    join(
-      homedir(),
-      '.flowviant',
-      'worktrees',
-      `${basename(repoRoot)}-${createHash('sha256').update(repoRoot).digest('hex').slice(0, 8)}`
-    );
+  const home = worktreeDir ?? worktreeHomeDir(repoRoot);
   const dir = join(home, 'deploy', createHash('sha256').update(String(jobId)).digest('hex').slice(0, 16));
   mkdirSync(join(home, 'deploy'), { recursive: true });
   const drop = (made = [], target = dir) => {
@@ -256,10 +259,11 @@ export async function openDeployCheckout({ repoRoot, baseRef, jobId, worktreeDir
   }
   git(['worktree', 'add', '--detach', dir, sha], repoRoot);
   let made = [];
+  let envFiles = [];
   try {
-    made = linkCheckoutEnvironment(repoRoot, dir);
+    ({ made, envFiles } = linkCheckoutEnvironment(repoRoot, dir));
   } catch {
     /* the build says so if it needed any of it */
   }
-  return { dir, sha, cleanup: () => drop(made) };
+  return { dir, sha, envFiles, cleanup: () => drop(made) };
 }

package/bin/lib/deployRunner.mjs

@@ -61,19 +61,35 @@
  * files, and this box's shell is not one). Deriving the redaction list from the
  * admission list is what stops the two drifting the next time a name is added.
  *
- * The honest residue, stated: a credential that is neither in `DEPLOY_KEEP` nor
- * in a checkout `.env*` — one a `build` script fetches for itself, say — is not
+ * AND THE NESTED ENV FILES THIS DAEMON COPIES IN ITSELF (2026-10-10, the
+ * audit's F085). The root scan reads only the checkout root's `.env*`
+ * (env.mjs states that limit), while `openDeployCheckout` copies every
+ * `.env*` and `.dev.vars` from tracked directories three levels deep into the
+ * worktree the build runs in — `apps/api/.dev.vars` among them — so a build
+ * that printed its config relayed values the scrubber had never been told.
+ * The checkout now reports which files it copied, and `runDeploy` teaches the
+ * scrubber their values for that job's life only (`learnExtraSecrets`), then
+ * forgets them with the worktree. The root-only report scan is unchanged.
+ * Well-known vendor token SHAPES are redacted too (uplinkScrub.mjs).
+ *
+ * The honest residue, stated: a credential that is in none of those — one a
+ * `build` script fetches for itself, say, in a shape nobody listed — is not
  * redacted, because this daemon has never seen it.
  */
 
 import { spawn } from 'node:child_process';
-import { scrub } from './uplinkScrub.mjs';
+import { forgetExtraSecrets, learnExtraSecrets, scrubTail } from './uplinkScrub.mjs';
 import { childEnv } from './childEnv.mjs';
 import { readDeployConfig } from './deployConfig.mjs';
 import { openDeployCheckout } from './deployCheckout.mjs';
+import { readEnvFileValues } from './env.mjs';
+import { killGroup } from './processGroup.mjs';
 
 /** How long one deploy command may run before it is stopped. */
 const DEPLOY_COMMAND_TIMEOUT_MS = 30 * 60_000;
+/** How much of a command's output is kept — a memory bound; only the tail is
+ *  ever read (`tailLines`, the version id). */
+const DEPLOY_OUTPUT_KEEP = 512 * 1024;
 
 /** Run a shell command ASYNC (never blocks the daemon's event loop — the
  *  reconcile poll + the deploy heartbeat must keep firing during a long
@@ -88,7 +104,8 @@ const DEPLOY_COMMAND_TIMEOUT_MS = 30 * 60_000;
  *  `deploysInFlight` holding off every self-update). Measured: `sleep 30 &
  *  wait` held the job past its timeout. So the command runs as its own process
  *  group (the shape `gitNetAsync` in git.mjs and the project check in
- *  workAgentCheck.mjs already use), the timer kills the group, and the timer
+ *  workAgentCheck.mjs already use), the timer kills the group (`killGroup`,
+ *  processGroup.mjs — one home since 2026-10-10), and the timer
  *  itself resolves rather than waiting on a pipe a survivor could still hold.
  *  The output gains one line saying so, which reaches the server in the
  *  report's `message` — a relayed fact, not a new wire field.
@@ -131,27 +148,40 @@ export function run(command, { cwd, env, timeoutMs = DEPLOY_COMMAND_TIMEOUT_MS }
       clearTimeout(timer);
       resolve(v);
     };
+    /**
+     * SCRUBBED BEFORE IT IS CUT (2026-10-10, the audit's F143) — workAgentCheck's
+     * order. This used to keep the last 512 KB per chunk and scrub only at
+     * settle, so a secret straddling the window's edge was cut first and its
+     * surviving half matched nothing. Now the window is cut only from text
+     * that has been scrubbed whole (`scrubTail`); a secret still arriving at
+     * the END of the buffer is not cut, and the next scrub sees it whole.
+     *
+     * Amortised rather than per chunk, unlike the check's 4000-character tail:
+     * re-scrubbing a 512 KB buffer on every small write of a chatty build is
+     * quadratic, so the buffer may grow to twice the window before it is
+     * scrubbed and cut. The settle-time scrub stays as the second pass over
+     * what ships.
+     *
+     * A DECODER PER STREAM: `setEncoding` hands whole characters, where
+     * `d.toString()` split a multi-byte character across two chunks into
+     * replacement characters — and a secret holding one could then never
+     * match.
+     */
     const cap = (d) => {
-      buf += d.toString();
-      if (buf.length > 512 * 1024) buf = buf.slice(-512 * 1024); // bound memory
+      buf += d;
+      if (buf.length > 2 * DEPLOY_OUTPUT_KEEP) buf = scrubTail(buf, DEPLOY_OUTPUT_KEEP);
     };
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
     child.stdout.on('data', cap);
     child.stderr.on('data', cap);
     const timer = setTimeout(() => {
-      try {
-        process.kill(-child.pid, 'SIGKILL'); // the whole group
-      } catch {
-        try {
-          child.kill('SIGKILL');
-        } catch {
-          /* already gone */
-        }
-      }
+      killGroup(child, 'SIGKILL'); // the whole group
       const limit = timeoutMs >= 60_000 ? `${Math.round(timeoutMs / 60_000)} minutes` : `${timeoutMs}ms`;
       settle({
         ok: false,
         code: -1,
-        out: scrub(`${buf}\n[flowviant] the command ran past ${limit} and was stopped`),
+        out: scrubTail(`${buf}\n[flowviant] the command ran past ${limit} and was stopped`, DEPLOY_OUTPUT_KEEP),
       });
     }, timeoutMs);
     // A broken pipe (a child that exits before its stdin is closed) surfaces as
@@ -166,10 +196,10 @@ export function run(command, { cwd, env, timeoutMs = DEPLOY_COMMAND_TIMEOUT_MS }
     child.stdin.on('error', () => {});
     child.stdin.end();
     child.on('close', (code) => {
-      settle({ ok: code === 0, code: code ?? -1, out: scrub(buf) });
+      settle({ ok: code === 0, code: code ?? -1, out: scrubTail(buf, DEPLOY_OUTPUT_KEEP) });
     });
     child.on('error', (e) => {
-      settle({ ok: false, code: -1, out: scrub(`${buf}\n${e.message}`) });
+      settle({ ok: false, code: -1, out: scrubTail(`${buf}\n${e.message}`, DEPLOY_OUTPUT_KEEP) });
     });
   });
 }
@@ -203,7 +233,12 @@ export async function runDeploy(job, ctx) {
   } catch (e) {
     return { ok: false, message: `deploy not run — ${e.message}`, logs: [] };
   }
+  // THE FILES THIS JOB COPIED IN, TAUGHT TO THE SCRUBBER FOR ITS LIFE ONLY
+  // (2026-10-10, the audit's F085) — see the header. Keyed per job, so two
+  // deploys never forget each other's.
+  const secretsKey = `deploy:${job.id}`;
   try {
+    learnExtraSecrets(secretsKey, (checkout.envFiles ?? []).flatMap((f) => readEnvFileValues(f)));
     const targets = readDeployConfig(ctx.repoRoot, checkout.sha);
     const target = targets.find((t) => t.id === job.targetId);
     if (!target) {
@@ -213,6 +248,7 @@ export async function runDeploy(job, ctx) {
     const short = checkout.sha.slice(0, 12);
     return { ...outcome, sha: checkout.sha, message: `${outcome.message} (${short})` };
   } finally {
+    forgetExtraSecrets(secretsKey); // first: it cannot throw, and the cleanup can
     checkout.cleanup();
   }
 }

package/bin/lib/deployWire.mjs

@@ -1,41 +1,50 @@
 /**
- * THE DEPLOY LANE'S ONE POST — `/fleet/deploy-*`, with the machine credential.
+ * THE DEPLOY LANE'S WIRE — `/fleet/deploy-*`, with the machine credential.
  *
  * Split out of deploy.mjs (SOLID F060) because two halves of the lane speak
  * it: the config report (deployConfig.mjs) and the job lease (deploy.mjs —
  * claim, heartbeat, outcome). A leaf, so neither has to import the other to
- * reach the wire, and a change to how the lane authenticates or times out is
- * one edit.
+ * reach the wire.
+ *
+ * The request itself is fleetPost.mjs's (audit 2026-10-10, F082): this was a
+ * byte-identical copy of `postToFleet`'s skeleton that differed only in what it
+ * returned. What stays here is the lane's own CONTRACT over that request — a
+ * throw on anything but an accepted answer, carrying whether it was the API's
+ * own refusal of the credential — and the lane's 30-second ceiling.
  */
 
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { FLEET_URL } from './config.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
-import { isCredentialRejection } from './authReject.mjs';
+import { claimFleetLease, fleetRequest } from './fleetPost.mjs';
 
 const deployUrl = (tail) => fleetEndpoint(tail, FLEET_URL);
+const DEPLOY_TIMEOUT_MS = 30_000;
 
+/** POST to `/fleet/<tail>` and return the reply's `data`. A network error or
+ *  timeout is rethrown as `fetch` threw it; a refusal (a non-2xx, or a 2xx
+ *  saying `success: false`) throws an Error carrying `status` and
+ *  `credentialRejected`. */
 export async function post(tail, body) {
-  const res = await fetch(deployUrl(tail), {
-    method: 'POST',
-    headers: {
-      Authorization: `Bearer ${FLEET_TOKEN}`,
-      'User-Agent': USER_AGENT,
-      'Content-Type': 'application/json',
-    },
-    signal: AbortSignal.timeout(30_000),
-    body: JSON.stringify(body),
-  });
-  const json = await res.json().catch(() => ({}));
-  if (!res.ok || json?.success === false) {
+  const r = await fleetRequest(deployUrl(tail), { body, timeoutMs: DEPLOY_TIMEOUT_MS });
+  if (r.error) throw r.error;
+  const json = r.json;
+  if (!r.ok || json?.success === false) {
     // The sentence is unchanged. What rides beside it is whether this was the
     // API's OWN refusal of the credential (a Disconnect rotates it, even
-    // mid-deploy) — authReject.mjs's one rule, never the bare status: an edge
-    // 401/403 (Cloudflare's bot checks, which this client class trips) is a
-    // blip and is retried like any other failed post.
-    const e = new Error(`${tail} failed (${res.status}${json?.error ? `: ${json.error}` : ''})`);
-    e.status = res.status;
-    e.credentialRejected = isCredentialRejection(res.status, res.headers.get('content-type'), json);
+    // mid-deploy) — authReject.mjs's one rule, asked by fleetRequest, never
+    // the bare status: an edge 401/403 (Cloudflare's bot checks, which this
+    // client class trips) is a blip and is retried like any other failed post.
+    const e = new Error(`${tail} failed (${r.status}${json?.error ? `: ${json.error}` : ''})`);
+    e.status = r.status;
+    e.credentialRejected = r.credentialRejected;
     throw e;
   }
   return json?.data;
 }
+
+/** Claim a deploy job — the shared lease rule (fleetPost.mjs's
+ *  `claimFleetLease`: this process's `instance` stamped, the winner read from
+ *  `data.claimed`, any failure "not claimed"), on this lane's ceiling. */
+export function claim(tail, fields) {
+  return claimFleetLease(deployUrl(tail), fields, { timeoutMs: DEPLOY_TIMEOUT_MS });
+}

package/bin/lib/desktopContract.mjs

@@ -8,12 +8,11 @@ import { FLEET_URL, MACHINE_HOST, USER_AGENT, VERSION } from './config.mjs';
 import { listStoredProjects } from './credentials.mjs';
 import { readStoredPubB64 } from './boxIdentity.mjs';
 import { daemonRunningFor, drainingFor } from './instance.mjs';
-import { runningViaNpx } from './launchCommand.mjs';
+import { installChannel } from './launchCommand.mjs';
 import { boxesUrlFrom, classifyMachineResponse, fetchBoxesFor } from './machines.mjs';
 import { daemonLockPid, daemonLogPath, readDaemonState } from './daemonState.mjs';
 import { detectRuntimes } from './runtimeDetection.mjs';
 import { readClaudeAuthStatus } from './runtimeAuth.mjs';
-import { runningCompiledBinary } from './update.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
 
 /**
@@ -40,9 +39,8 @@ export function busyOf(liveState, now = Date.now()) {
   return liveState.busy;
 }
 
-export function installChannel() {
-  return runningCompiledBinary() ? 'binary' : runningViaNpx() ? 'npx' : 'npm-g';
-}
+// One home for the channel (launchCommand.mjs); re-exported for views.mjs.
+export { installChannel };
 
 export function desktopStatus({ entries = listStoredProjects(), runtimes = detectRuntimes(), runningFor = daemonRunningFor, stateFor = readDaemonState, pidFor = daemonLockPid, drainFor = drainingFor, nowMs = Date.now(), authFor = readClaudeAuthStatus, refreshAuth = false } = {}) {
   const runtimeRows = runtimes.map((rt) => ({
@@ -66,6 +64,9 @@ export function desktopStatus({ entries = listStoredProjects(), runtimes = detec
         holder: liveState?.holder ?? null,
         // Measured by the daemon; null = unknown, never idle (see `busyOf`).
         busy: busyOf(liveState, nowMs),
+        maintenance: busyOf(liveState, nowMs) !== null && typeof liveState?.maintenance === 'string' ? liveState.maintenance : null,
+        maintenanceEpoch: busyOf(liveState, nowMs) !== null && typeof liveState?.maintenanceEpoch === 'string' ? liveState.maintenanceEpoch : null,
+        liveAgents: busyOf(liveState, nowMs) !== null && Number.isInteger(liveState?.liveAgents) && liveState.liveAgents >= 0 ? liveState.liveAgents : null,
         // What a standing-down daemon is finishing (`web → prod`), from its
         // lock's draining mark; null when it is not draining or unknown. A
         // daemon→desktop report field: an older tray ignores it.

package/bin/lib/discoveryContract.mjs

@@ -0,0 +1,19 @@
+/** A discovery contract for the person's CLI, never a server-side diagnosis. */
+export const REGRESSION_INVESTIGATION = `REGRESSION INVESTIGATION — for "this existed before and now is gone", restoration requests, and bugs that persist after Done:
+1. Keep the REQUESTED OUTCOME separate from a proposed cause. The runtime baseline names cwd, HEAD, execution base and dirty state; it does not prove you inspected relevant code. Reconcile differing or dirty baselines before relying on them.
+2. Before naming a cause, formula or restoration location, trace current rendering and data flow: locate the UI label/symbol, its render conditions and formatting, the calculation, its data provider, missing/loading inputs, and relevant tests. Reading tests is not running them; never claim tests passed merely because you read them. Do not run write-producing tests or builds under this read-only profile.
+3. Inspect available local Git history with supported plain readers: git log --oneline -- <relative-path>, git log -p --follow -- <relative-path>, git log -S delta -- <relative-path>, git show <commit>:<relative-path>, and relevant diffs. Compare the previous implementation with current code. Missing/shallow history or an unavailable deployed version limits the comparison; say exactly which comparison remains unverified.
+4. Explain only supported evidence. A surviving hidden display needs its render condition investigated, not an invented replacement formula. A missing input needs its provider/comparison data traced, not a claim that the display was deleted. A removed implementation needs a verified historical file/commit and a compatibility check against current code before proposing restoration.
+5. A board card marked Done is history, not proof that an implementation shipped or that the reported behavior works in the deployed version. In capture, dedupe with list_cards and list_staged; use find_cards/read_card for held or completed matches. Refine a pending/staged match in place. A recurrence after Done is new work with followUpOf, never proof of its cause. Scratch planning instead compares the supplied cards and live-agent context; it has no staging MCP.
+6. A failed read requires supported recovery before claiming repository discovery is unavailable. Preserve the actual failure and each attempted alternative; distinguish syntax refusal, permission denial, missing path/history and absent tool. Runtime outcomes are observations; model-authored path/line/commit citations and causal explanations remain separate claims. A request alone proves no successful read.
+7. In capture, still STAGE FIRST: if discovery remains unresolved, stage an investigation-first fix for the requested outcome, requiring reproduction and cause establishment before implementation. State unverified causes in assumed, explicit discovery limits and failures/attempts in the brief, and do not invent a formula or restoration path. Use optional grounding when the served staging tool advertises it; otherwise put requested outcome, observed code/history, discovery limits and recovery attempts in clearly separate description sections. Stage before asking the one remaining person-only question, and edit_staged after its answer rather than creating a twin. In scratch planning, retain that investigation-first ordering in the proposal; do not turn an unverified explanation into implementation instructions.`;
+
+export function discoveryGuide(runtime, lane) {
+  const readers = runtime === 'claude'
+    ? `Claude: scoped Read and Glob, in-workspace Grep, and approved plain shell readers (cat/head/ls/wc and git log/show/diff/rev-parse). The read guard rejects shell composition, expansions/globs and unsafe paths; quoted pipes and bracket Git paths can still be refused. Quotes/escaping do not bypass the guard. Prefer native Read/Grep/Glob after such a refusal. Replace git log -G 'delta|change' with separate plain git log -S delta and git log -S change calls. For a bracket working-tree path use native Read with the literal path; for history use a supported parent-relative Git path or a scoped commit diff and inspect the relevant entry. Never disable the guard or request unrestricted Bash.`
+    : runtime === 'codex'
+      ? `Codex: this profile uses a read-only sandbox with shell discovery such as cat, head, rg and plain Git readers; Claude's dedicated Read/Grep/Glob and read guard are not guaranteed here. Use only tools advertised this turn. No native web, subagents, browser/apps or unrestricted shell are granted. Read only the repository and explicitly supplied project knowledge.`
+      : `This runtime: use the native file/list/search readers actually advertised this turn. Shell availability is unverified and may be denied; do not claim all reading is blocked after one shell refusal. Keep the read-only profile.`;
+  return `DISCOVERY CAPABILITIES (${runtime}, ${lane}):\n${readers}\n` +
+    `Recovery order: use a cwd-relative path; use one plain reader rather than a composed command; use native Read/Grep/Glob where supported, or shell cat/head/rg where permitted; use git show <commit>:<relative-path> when a working-tree file is missing and history is available. If a utility is absent, switch to an advertised reader. Do not try to evade a secret/path denial. Re-read the actual result after each attempt. Preserve the first failure and subsequent recovery attempts, including an unresolved result; then state the remaining limit rather than asking the person to disable protections. ${lane === 'capture' ? 'Only the scoped Flowviant staging tools write records; never change repository files.' : 'Scratch planning has no Flowviant MCP; return a proposal only.'}`;
+}

package/bin/lib/env.mjs

@@ -92,7 +92,18 @@ import { learnSecrets } from './uplinkScrub.mjs';
  * monorepo's shared types. The daemon holds its own line for the same reason
  * every other boundary in this file does — a report that the server will
  * reject is a report nobody sees, and clamping here is what makes the
- * difference visible as a smaller list rather than a 400.
+ * difference visible as a smaller list.
+ *
+ * ── THE RELEASE GATE HOLDS THEM (2026-10-10, audit F093) ──
+ *
+ * `ENV_REPORT_BOUNDS` and `ENV_NAME_RE` are exported for
+ * `scripts/check-app-parity.mjs`, which compares them with the shared
+ * `MACHINE_ENV_MAX_FILES` / `_MAX_VARS` / `_MAX_NAME` / `_FP_LENGTH` and
+ * `machineEnvVarSchema`'s name pattern. Drift would be silent: POST
+ * /fleet/env-report answers a body its schema refuses with 200 `stored:false`
+ * (and its reader drops a bad file alone), so this lane would see `ok`, dedup,
+ * and the comparison sheet would simply stop hearing from this box. `vars` is
+ * a TOTAL on both ends (the server's reader spends one budget across files).
  *
  * ── THE REPORT'S CAPS ARE NOT THE SCRUBBER'S, AND THAT ASYMMETRY IS
  *    DELIBERATE (2026-09-21, the review) ──
@@ -112,23 +123,41 @@ import { learnSecrets } from './uplinkScrub.mjs';
  * actually read, so the totals are honest about a directory somebody has let
  * grow without this scan walking an unbounded list of files on the poll's beat.
  */
-const MAX_ENV_FILES = 8;
-const MAX_ENV_VARS = 200; // TOTAL across every file, not per file — REPORT only
-const MAX_ENV_NAME_CHARS = 64;
+export const ENV_REPORT_BOUNDS = Object.freeze({ files: 8, vars: 200, name: 64, fp: 8 });
+const MAX_ENV_FILES = ENV_REPORT_BOUNDS.files;
+const MAX_ENV_VARS = ENV_REPORT_BOUNDS.vars; // TOTAL across every file, not per file — REPORT only
+const MAX_ENV_NAME_CHARS = ENV_REPORT_BOUNDS.name;
 const MAX_ENV_FILE_BYTES = 256 * 1024;
 const MAX_SCAN_FILES = 64;
 const MAX_SCRUB_VALUES = 2000;
-const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 /** `.env`, `.env.local`, `.env.production` … and never a template. A file whose
  *  name ends `.example` / `.sample` / `.template` is somebody's DOCUMENTATION
  *  of the shape, committed on purpose, and its "values" are placeholders — so
  *  it would fingerprint `your-key-here` on every box and report them as
  *  agreeing, which is the exact opposite of what a comparison is for. */
-const isEnvFileName = (name) =>
+export const isEnvFileName = (name) =>
   (name === '.env' || name.startsWith('.env.')) &&
   !/\.(example|sample|template)$/i.test(name);
 
+/**
+ * THE OTHER RULE FOR "AN ENV FILE", AND WHY THE TWO DIFFER (2026-10-10, the
+ * audit's F085; it moved here from deployCheckout.mjs so both live in one
+ * place). `isEnvFileName` decides what the COMPARISON REPORT reads at the
+ * checkout root: `.env*` minus templates, because a template's placeholders
+ * would fingerprint as agreement. This one decides what a DEPLOY COPIES into
+ * its throwaway worktree, at every tracked directory three levels deep: every
+ * `.env*` and `.dev.vars` a build might load, templates included, because a
+ * build that reads one must find it. Copying is about making the build work;
+ * reporting is about a screen a person reads. The deploy lane teaches the
+ * scrubber the files it actually copied (deployRunner.mjs), so the wider rule
+ * never widens what goes unredacted. (vaultArtefacts.mjs keeps a third, wider
+ * net on purpose: it looks only for files the deleted vault wrote, which it
+ * recognises by their header, never by their name alone.)
+ */
+export const isCheckoutEnvFile = (name) => /^(?:\.env(?:\..+)?|\.dev\.vars)$/.test(name);
+
 /**
  * ONE LINE OF DOTENV. Blank lines and `#` comments are skipped, an optional
  * `export ` prefix is allowed, the line is split on the FIRST `=` (a value may
@@ -230,6 +259,55 @@ function closingQuoteLine(lines, start, quote) {
   return lines.length;
 }
 
+/**
+ * ONE DOTENV FILE'S TEXT → `[{ name, value }]`, the variables in force — pure
+ * (2026-10-10, extracted from `scanEnvFiles` so the deploy lane parses the
+ * nested files it copies with the SAME rules the report uses).
+ *
+ * A MAP, because LAST WRITE WINS inside one file — which is how a dotenv
+ * loader resolves a repeated key, so the fingerprint reported is the one
+ * actually in force. It also makes the totals honest: a file that sets the
+ * same key forty times counts once, not forty times.
+ */
+export function parseEnvText(text) {
+  const byName = new Map();
+  const lines = String(text ?? '').split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const parsed = parseEnvLine(lines[i]);
+    if (!parsed) continue;
+    // A VALUE WE CANNOT READ IS REPORTED AS NOTHING. The variable is
+    // dropped from BOTH halves and the scan steps over its continuation
+    // lines, so a PEM body can never be read as variables of its own.
+    if (parsed.unterminated) {
+      i = closingQuoteLine(lines, i, parsed.unterminated);
+      continue;
+    }
+    // A NAME THAT FAILS EITHER TEST IS DROPPED, NEVER TRUNCATED: a cut name
+    // is a DIFFERENT VARIABLE, and a comparison screen rendering two boxes'
+    // truncated names as the same row is worse than rendering neither.
+    if (parsed.name.length > MAX_ENV_NAME_CHARS) continue;
+    if (!ENV_NAME_RE.test(parsed.name)) continue;
+    if (!byName.has(parsed.name) && byName.size >= MAX_SCRUB_VALUES) continue;
+    byName.set(parsed.name, parsed.value);
+  }
+  return [...byName].map(([name, value]) => ({ name, value }));
+}
+
+/**
+ * The values in ONE env file, for the scrubber — `[]` for anything that is not
+ * a regular file under the scan's size cap (the same `lstat` refusal of a
+ * symlink, for the same reason; see `scanEnvFiles`). Never throws.
+ */
+export function readEnvFileValues(path) {
+  try {
+    const st = lstatSync(path);
+    if (!st.isFile() || st.size > MAX_ENV_FILE_BYTES) return [];
+    return parseEnvText(readFileSync(path, 'utf8'));
+  } catch {
+    return [];
+  }
+}
+
 /**
  * A VALUE FINGERPRINT — sha256 over `<projectId>\n<value>`, first 8 hex
  * characters.
@@ -249,8 +327,22 @@ function closingQuoteLine(lines, start, quote) {
  * `development`, `production`, `postgres`, `localhost`, `info` — so anybody who
  * could read a stored report could recover those values with one precomputed
  * table, and the eight characters that were chosen to be uninformative became
- * a lookup key instead. Salting with the project id makes the table worthless
- * without knowing which project it is for, and makes it per-project even then.
+ * a lookup key instead. Salting with the project id stops ONE table serving
+ * every project, and that is all it stops.
+ *
+ * ── WHAT THE SALT DOES NOT STOP (2026-10-10, audit F094) ──
+ *
+ * The project id is no secret: every member of the project has it in the URL,
+ * and it is stored beside the report. To anyone who knows it, this digest
+ * still CONFIRMS A GUESS — hash `postgres`, `changeme` or every six-digit PIN
+ * with the id and compare eight hex — so for a weak value it is a per-project
+ * dictionary oracle, not "useless for recovering it". The server therefore
+ * never serves it back: the app's comparison receives an opaque equality group
+ * per (file, name) instead (`envComparisonView` in the app's
+ * `machineEnvReports.ts`). Keying this digest with a secret no member holds —
+ * an HMAC under the machine credential, with a scheme marker so mixed daemons
+ * read as "not comparable" rather than `differs` — is the at-rest half, and it
+ * is still an open item, not done here.
  *
  * IT COSTS THE FEATURE NOTHING, and that is what makes the trade obvious: the
  * screen compares the BOXES OF ONE PROJECT. Two projects agreeing on a value is
@@ -263,7 +355,7 @@ function closingQuoteLine(lines, start, quote) {
  * deliberately SHORT so nobody mistakes it for a commitment to the value.
  */
 const fingerprint = (salt, value) =>
-  createHash('sha256').update(`${salt}\n${value}`, 'utf8').digest('hex').slice(0, 8);
+  createHash('sha256').update(`${salt}\n${value}`, 'utf8').digest('hex').slice(0, ENV_REPORT_BOUNDS.fp);
 
 /**
  * READ THE CHECKOUT'S `.env*` FILES AND REPORT WHAT IS IN THEM BY NAME.
@@ -353,36 +445,13 @@ export function scanEnvFiles(repoRoot, salt) {
       // file and contributes nothing, and neither is a SYMLINK: see above.
       const st = lstatSync(abs);
       if (!st.isFile() || st.size > MAX_ENV_FILE_BYTES) continue;
-      // A MAP, because LAST WRITE WINS inside one file — which is how a dotenv
-      // loader resolves a repeated key, so the fingerprint reported is the one
-      // actually in force. It also makes the totals honest: a file that sets
-      // the same key forty times counts once, not forty times.
-      const byName = new Map();
-      const lines = readFileSync(abs, 'utf8').split('\n');
-      for (let i = 0; i < lines.length; i++) {
-        const parsed = parseEnvLine(lines[i]);
-        if (!parsed) continue;
-        // A VALUE WE CANNOT READ IS REPORTED AS NOTHING. The variable is
-        // dropped from BOTH halves and the scan steps over its continuation
-        // lines, so a PEM body can never be read as variables of its own.
-        if (parsed.unterminated) {
-          i = closingQuoteLine(lines, i, parsed.unterminated);
-          continue;
-        }
-        // A NAME THAT FAILS EITHER TEST IS DROPPED, NEVER TRUNCATED: a cut name
-        // is a DIFFERENT VARIABLE, and a comparison screen rendering two boxes'
-        // truncated names as the same row is worse than rendering neither.
-        if (parsed.name.length > MAX_ENV_NAME_CHARS) continue;
-        if (!ENV_NAME_RE.test(parsed.name)) continue;
-        if (!byName.has(parsed.name) && byName.size >= MAX_SCRUB_VALUES) continue;
-        byName.set(parsed.name, parsed.value);
-      }
-      out.varsTotal += byName.size;
+      const parsed = parseEnvText(readFileSync(abs, 'utf8'));
+      out.varsTotal += parsed.length;
       // Decided BEFORE this file spends any budget, so `budget` reaching zero
       // inside a file still lets that file's own entry carry what it got.
       const reporting = canReport && budget > 0 && out.files.length < MAX_ENV_FILES;
       const vars = [];
-      for (const [n, value] of byName) {
+      for (const { name: n, value } of parsed) {
         // THE SCRUB LIST IS NOT BOUNDED BY THE REPORT'S CAPS — see the bounds
         // block above. A secret dropped for being the 201st is a secret in the
         // server's database.