The broad sweep (agent-session-recursion + daemon-mode, 341 tests) found 35 failures, all from this session's changes. Three fixes, one honest revert: 1. R9's daemon change is REVERTED. Forwarding the whole worker environment to a session it creates leaks unrelated provider keys into a session that was never granted them, and it broke seven daemon tests that pin the deliberate narrow launch env. The worker's PATH already comes from the supervisor's seeded client environment, so the audited `cargo: command not found` case is covered by the runtime half (R9's `_child_env` inheritance and PATH floor) plus the launch env the client sends. A daemon started by launchd with no client environment has no developer environment to inherit, and that is now stated rather than papered over. 2. R10's backpressure wait treated a session that cannot report a queue depth (a stub, or a passive child) as saturated and waited the full 30s, which timed out three daemon messaging tests. An unknown depth is now "not saturated". 3. R11's obligation sentence is REMOVED from the task envelope: it leaked into every echo of the task (child answer previews included) and the doctrine in the child's system prompt already carries the same rule. The harvest itself stays, and the two tests that pinned the old plain no-reply notice now pin the harvested shape. Sweep after the fixes: agent-session-recursion + daemon-mode = 340 passed, 1 failed, and that one is the known environment case (`RLM_MAX_DEPTH=2` exported, so `source: env` instead of `default`; it passes with the variable unset).