Pass every terminal host's env through safehouse, and only what exists - #730

env | grep TMUX returned nothing inside a safehouse-wrapped session. The frontdoor was not the cause — launchEnv forwards the whole parent environment and only swaps SPACEDOCK_BIN. The loss was at the sandbox boundary.

terminalTargetingEnvArgs gated its entire allowance on one sentinel:

if _, present := os.LookupEnv("ZELLIJ"); !present {
    return nil
}
return []string{"--env-pass=ZELLIJ,ZELLIJ_PANE_ID,ZELLIJ_SESSION_NAME"}

No ZELLIJ meant nothing was passed at all. So a tmux session reached the child with no TMUX and no TMUX_PANE, and five of six terminal hosts lost their identity crossing into the sandbox. When ZELLIJ was present, all three names were emitted whether set or not — and ZELLIJ is not one of the two variables the consumer actually probes.

The visible consequence: inside safehouse, the subspace:r skill resolves Zellij or falls through to none. A captain in tmux, Herdr, CMUX, Ghostty, or Apple Terminal gets the fallback instead of their real pane. That was reproduced live during this work — a review opened toward a detached Terminal tab rather than the caller's tmux split.

What changed

One list of the nine signals subspace:r probes across its six hosts, and one presence filter over it. A name is emitted only when the parent has that variable; an empty parent yields no allowance at all. The lookup is injected, so the composer is testable without touching the process environment.

Four recorded decisions: drop the bare ZELLIJ name, which no live consumer probes; keep TERM_PROGRAM value-agnostic rather than embedding the consumer's resolution semantics; treat presence as LookupEnv, including set-but-empty; duplicate the nine names rather than build a cross-repository mechanism, because drift degrades to today's behavior or to a diagnosable probe stop, never to a wrong pane.

Evidence

The measuring criterion could not be proven from inside the sandbox — no wrapped session can execute safehouse, and validation confirmed that independently rather than substituting unit evidence for it. It was closed by a captain-run comparison outside the sandbox, in a real tmux session: the consumer's own nine-signal probe, run bare and then wrapped.

All nine signals matched. TMUX and TMUX_PANE read present inside, where they read absent before. The other six read absent in both, so nothing is invented.

The composer was also exercised against real compiled production code under a real process environment, and validation judged the test cases against 11 mutations, finding them not padded with one exception it named.

Surface: 4 files, net +135, of which production is +26. That is 3.0x the ideation estimate, disclosed and judged case by case rather than absorbed.

89b