From 9538c0ee84908afefa4f1709748bdec49b7ce912 Mon Sep 17 00:00:00 2001
From: Aco Piper <acopiper26@gmail.com>
Date: Mon, 28 Sep 2026 10:20:16 +0900
Subject: [PATCH 1/5] Add profile-applying descent commands to the daemon

bootler's session helper is a root process that spawns, bounds and
kills its own children, and must run them as a service account or as
the operator its session authenticated, under a pinned environment and
working directory. InDaemonExecutor could do neither: its resolution
was private, it applied no profile, and it refuses Identity::Operator.

descent_command builds, without spawning, a Command that descends
through sudo from the same site run uses, then applies the profile as
the target identity: cd into the directory, announce the start, and
exec env -i with the K=V words. Every value stays a discrete argv
word. The operator goes through sudo -u #uid -g #gid rather than
CommandExt::uid, which would drop supplementary groups and need new
unsafe to restore them.

settle_descent classifies the child's stderr. Its sentinel search and
64 KiB transport limit are factored out of the channel's judge, so
both starts are settled by one rule.

Also switch one test Duration to from_mins, which clippy on the
current stable toolchain requires.

Closes #133
---
 src/executor.rs         | 1139 ++++++++++++++++++++++++++++++++++++++-
 src/executor/channel.rs |   45 +-
 2 files changed, 1168 insertions(+), 16 deletions(-)

diff --git a/src/executor.rs b/src/executor.rs
index f938cd7..7856ab7 100644
--- a/src/executor.rs
+++ b/src/executor.rs
@@ -516,6 +516,13 @@ const RC_MARKER: &str = "__BOOTLER_RC__:";
 /// command that merely exited non-zero — even one whose own stderr mentions a
 /// password — rather than classifying by scanning combined stderr afterwards.
 const SUDO_OK_SENTINEL: &str = "__BOOTLER_SUDO_OK__";
+/// Marker the descent script prints on stderr, in place of
+/// [`SUDO_OK_SENTINEL`], when the target identity cannot enter the profile's
+/// working directory: `sudo` descended, but the command was never started.
+const NO_WORKING_DIRECTORY_MARKER: &str = "__BOOTLER_NO_WORKING_DIRECTORY__";
+/// The `$0` the descent script runs under, so a shell diagnostic — `cd`'s,
+/// above all — names what printed it.
+const DESCENT_ARG0: &str = "bootler-descent";
 
 /// Errors raised by an executor primitive.
 #[derive(Debug, thiserror::Error)]
@@ -2285,6 +2292,23 @@ fn sudo_sentinel_script() -> String {
     format!("printf '%s' '{SUDO_OK_SENTINEL}' >&2; exec \"$0\" \"$@\"")
 }
 
+/// The `sh -c` script [`InDaemonExecutor::descent_command`] descends through,
+/// run as the target identity.
+///
+/// Invoked as `sh -c SCRIPT <arg0> <cwd> <K=V>… <command> <args…>`: it enters
+/// `<cwd>` or prints [`NO_WORKING_DIRECTORY_MARKER`] and exits `1`, then
+/// announces the start with [`SUDO_OK_SENTINEL`] and replaces itself with
+/// `env -i`, which takes the `K=V` words as the whole environment and the first
+/// word without `=` as the utility. Every value is a positional word, never
+/// spliced into the script text.
+fn descent_script() -> String {
+    format!(
+        "cd -- \"$1\" || {{ printf '%s' '{NO_WORKING_DIRECTORY_MARKER}' >&2; exit 1; }}; \
+         shift; printf '%s' '{SUDO_OK_SENTINEL}' >&2; exec {env} -i \"$@\"",
+        env = bounded::ENV,
+    )
+}
+
 /// Removes the first [`SUDO_OK_SENTINEL`] from `stderr`, reporting whether it was
 /// present (i.e. whether `sudo` elevated and started the wrapped command).
 fn take_sudo_sentinel(stderr: &mut Vec<u8>) -> bool {
@@ -3077,6 +3101,12 @@ impl Executor for SshExecutor {
 ///
 /// It does not implement [`Executor::open_channel`]: that call returns the
 /// trait default's [`ChannelError::Unsupported`] here.
+///
+/// A root caller that spawns, bounds and kills its own children — and knows
+/// an operator's ids from a session it authenticated itself — builds its
+/// descents with [`InDaemonExecutor::descent_command`] instead, which applies
+/// an execution profile after `sudo` has selected the identity. That is not an
+/// [`Identity`], and does not change what [`Identity::Operator`] does here.
 #[derive(Debug, Clone)]
 pub struct InDaemonExecutor {
     host: String,
@@ -3138,19 +3168,37 @@ impl InDaemonExecutor {
                 Ok((cmd, false))
             }
             Identity::Service(account) => {
-                let mut cmd = Command::new(&self.sudo_bin);
-                cmd.arg("-u")
-                    .arg(account.as_str())
-                    .arg(shell)
-                    .arg("-c")
-                    .arg(script)
-                    .arg(command)
-                    .args(args);
+                let mut cmd = self.sudo_descent(Descent::Service(account));
+                cmd.arg(shell).arg("-c").arg(script).arg(command).args(args);
                 Ok((cmd, true))
             }
         }
     }
 
+    /// Returns `sudo` with the words that select `who` and nothing after them:
+    /// the one site building a descent from root, for [`Executor::run`] and its
+    /// siblings on [`Identity::Service`] and for
+    /// [`InDaemonExecutor::descent_command`] alike.
+    ///
+    /// A service account is `-u <account>`, one word whatever it contains. An
+    /// operator is `-u #<uid> -g #<gid>`, the numeric forms `sudo` reads as ids
+    /// rather than names.
+    fn sudo_descent(&self, who: Descent) -> Command {
+        let mut cmd = Command::new(&self.sudo_bin);
+        match who {
+            Descent::Service(account) => {
+                cmd.arg("-u").arg(account.as_str());
+            }
+            Descent::Operator(ids) => {
+                cmd.arg("-u")
+                    .arg(format!("#{}", ids.uid))
+                    .arg("-g")
+                    .arg(format!("#{}", ids.gid));
+            }
+        }
+        cmd
+    }
+
     /// Spawns a resolved invocation, feeding `payload` verbatim — there is no
     /// password line to prepend — and settling the sudo sentinel on descent.
     fn spawn_resolved(
@@ -3213,6 +3261,321 @@ impl InDaemonExecutor {
     }
 }
 
+/// Who a root process descends to through
+/// [`InDaemonExecutor::descent_command`].
+///
+/// Not an [`Identity`]: [`Identity::Root`] has no place here, because a root
+/// caller spawns its own root children, and [`Descent::Operator`] names an
+/// operator by the ids a session already authenticated, where
+/// [`Identity::Operator`] inside the daemon has none to name and refuses.
+///
+/// Like [`Identity`], it has no `FromStr`, `Deserialize` or `From` impl:
+/// a service account is still one of the closed [`ServiceAccount`] set, so a
+/// configured account name cannot become a descent (RFC 0003 §9.2).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Descent {
+    /// A bootler-managed service account, reached by `sudo -u <account>`
+    /// exactly as [`Identity::Service`] is inside the daemon.
+    Service(ServiceAccount),
+    /// An already-authenticated operator, reached by
+    /// `sudo -u #<uid> -g #<gid>` — never root.
+    Operator(OperatorIds),
+}
+
+/// An already-authenticated operator's numeric user and group ids.
+///
+/// Built only by [`OperatorIds::new`], which refuses the ids that would not
+/// descend: `0`, root's, and `u32::MAX`, `(uid_t)-1`, which the kernel reads
+/// as "leave unchanged". There is no `From<(u32, u32)>`, so every pair goes
+/// through that check.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct OperatorIds {
+    uid: u32,
+    gid: u32,
+}
+
+impl OperatorIds {
+    /// Creates the ids of an operator whose session authenticated `uid` and
+    /// `gid`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`DescentError::InvalidOperator`] when either id is `0` or
+    /// `u32::MAX`.
+    pub fn new(uid: u32, gid: u32) -> Result<Self, DescentError> {
+        let descendable = |id: u32| id != 0 && id != u32::MAX;
+        if descendable(uid) && descendable(gid) {
+            Ok(Self { uid, gid })
+        } else {
+            Err(DescentError::InvalidOperator { uid, gid })
+        }
+    }
+
+    /// Returns the operator's user id.
+    #[must_use]
+    pub fn uid(self) -> u32 {
+        self.uid
+    }
+
+    /// Returns the operator's primary group id.
+    #[must_use]
+    pub fn gid(self) -> u32 {
+        self.gid
+    }
+}
+
+/// The execution profile [`InDaemonExecutor::descent_command`] applies to the
+/// command after `sudo` has selected the identity.
+///
+/// **No secret belongs in `env`.** Each pair travels as a `K=V` argument word
+/// of `sudo` and of the shell it starts, so it is readable in the process
+/// table by any local user until the command replaces them.
+#[derive(Clone, Copy)]
+pub struct DescentProfile<'a> {
+    /// The command's whole environment, as `(name, value)` pairs. Each name
+    /// matches `[A-Za-z_][A-Za-z0-9_]*` and appears once; no value contains
+    /// a NUL byte.
+    pub env: &'a [(&'a str, &'a str)],
+    /// The command's working directory: absolute, with no NUL byte.
+    pub cwd: &'a Path,
+}
+
+/// Errors raised building a descent, before anything is built.
+///
+/// No variant carries an environment value, so none can reach a log through
+/// this error.
+#[derive(Debug, thiserror::Error)]
+pub enum DescentError {
+    /// `command` is not an absolute path, or contains `=`.
+    ///
+    /// The command runs with only the profile's environment, and is started
+    /// through `env -i`, which reads an operand containing `=` as an
+    /// assignment rather than the utility.
+    #[error("command `{command}` is not an absolute path free of `=`")]
+    InvalidCommand {
+        /// The command as the caller named it.
+        command: String,
+    },
+    /// An entry of [`DescentProfile::env`] was refused: its name is not
+    /// `[A-Za-z_][A-Za-z0-9_]*`, it is given twice, or its value contains a
+    /// NUL byte. The value is never carried.
+    #[error("environment variable `{name}` {reason}")]
+    InvalidEnvironment {
+        /// The variable's name.
+        name: String,
+        /// Why it was refused.
+        reason: &'static str,
+    },
+    /// [`DescentProfile::cwd`] is not absolute, or contains a NUL byte.
+    #[error("working directory `{}` is not an absolute path free of NUL", cwd.display())]
+    InvalidWorkingDirectory {
+        /// The directory as the caller named it.
+        cwd: PathBuf,
+    },
+    /// An operator's uid or gid is `0` or `u32::MAX`.
+    #[error("operator uid {uid} and gid {gid} cannot be descended to: neither may be 0 or {max}", max = u32::MAX)]
+    InvalidOperator {
+        /// The uid given.
+        uid: u32,
+        /// The gid given.
+        gid: u32,
+    },
+}
+
+/// What [`InDaemonExecutor::settle_descent`] reads in the standard error a
+/// descent has written so far.
+#[derive(Debug)]
+pub enum DescentSettle {
+    /// Undecided: read more, and ask again.
+    Pending,
+    /// `sudo` descended and the command has been started in the profile's
+    /// directory. Standard error from `command_stderr_from` on is the
+    /// command's; everything before it is not.
+    Started {
+        /// The offset just past the start announcement.
+        command_stderr_from: usize,
+    },
+    /// `sudo` descended, but the target identity could not enter the
+    /// profile's working directory, so the command was never started.
+    NoWorkingDirectory {
+        /// What the shell wrote on failing to enter it, trimmed.
+        reason: String,
+    },
+    /// `sudo` refused before the command could start — or wrote more than
+    /// 64 KiB before announcing a start, which is treated the same way — with
+    /// the error [`Executor::run`] reports for that refusal. The caller kills
+    /// the child.
+    Refused(ExecutorError),
+}
+
+/// Refuses a descent [`InDaemonExecutor::descent_command`] cannot build as
+/// asked.
+fn check_descent(command: &str, profile: &DescentProfile<'_>) -> Result<(), DescentError> {
+    if !is_absolute_and_plain(command) {
+        return Err(DescentError::InvalidCommand {
+            command: command.to_string(),
+        });
+    }
+    let mut seen = std::collections::HashSet::new();
+    for &(name, value) in profile.env {
+        let refuse = |reason| DescentError::InvalidEnvironment {
+            name: name.to_string(),
+            reason,
+        };
+        if !is_env_name(name) {
+            return Err(refuse("is not a name of the form [A-Za-z_][A-Za-z0-9_]*"));
+        }
+        if !seen.insert(name) {
+            return Err(refuse("is given more than once"));
+        }
+        if value.contains('\0') {
+            return Err(refuse("has a value containing a NUL byte"));
+        }
+    }
+    let cwd = profile.cwd;
+    if !cwd.is_absolute() || cwd.as_os_str().as_encoded_bytes().contains(&0) {
+        return Err(DescentError::InvalidWorkingDirectory {
+            cwd: cwd.to_path_buf(),
+        });
+    }
+    Ok(())
+}
+
+/// Reports whether `name` matches `[A-Za-z_][A-Za-z0-9_]*`, the portable form
+/// of an environment variable name.
+fn is_env_name(name: &str) -> bool {
+    let mut bytes = name.bytes();
+    bytes
+        .next()
+        .is_some_and(|first| first.is_ascii_alphabetic() || first == b'_')
+        && bytes.all(|byte| byte.is_ascii_alphanumeric() || byte == b'_')
+}
+
+impl InDaemonExecutor {
+    /// Builds, without spawning, the command that descends from this root
+    /// process to `who` and runs `command` with `args` under `profile`.
+    ///
+    /// The command is
+    /// `sudo <selection> /bin/sh -c <script> <arg0> <cwd> <K=V>… <command> <args…>`,
+    /// where `<selection>` is `-u <account>` for [`Descent::Service`] — the
+    /// same words [`Executor::run`] descends with for that account — and
+    /// `-u #<uid> -g #<gid>` for [`Descent::Operator`]. There is no `-n`, no
+    /// `-S` and no password line: descent from root never prompts. `sudo`
+    /// sets the target's uid, primary gid and group-database groups, as a
+    /// login would. The fixed script, run as the target identity, enters
+    /// `profile.cwd`, announces the start on standard error, and `exec`s
+    /// `env -i` with the `K=V` words and the command. So the command sees
+    /// exactly `profile.env`, runs in `profile.cwd`, and receives every
+    /// argument as one word; no value is ever spliced into the script.
+    ///
+    /// The returned [`Command`] has its program, its arguments and the working
+    /// directory `/` set — so `sudo` never depends on the caller's — and
+    /// nothing else: no stdio, process group, session, uid, gid, `pre_exec`
+    /// or environment change. The caller sets stdio and its process group,
+    /// spawns it, and reads its standard error through
+    /// [`InDaemonExecutor::settle_descent`] until that settles.
+    ///
+    /// **What the command gets besides the profile.** Umask and resource
+    /// limits are not set here: they are what the caller passes on and what
+    /// `sudo` and its PAM session leave (a sudoers `umask` is unioned with the
+    /// caller's). `sudo` closes descriptors above 2, so only stdio reaches the
+    /// command. With no controlling terminal, as in a systemd service, `sudo`
+    /// allocates no pty and runs the command without a new session; that is
+    /// the condition under which `sudo` and the command stay in the process
+    /// group the caller spawned it into. Under a terminal, `sudo` may move the
+    /// command into a session of its own.
+    ///
+    /// **No secret belongs in `profile.env`.** The `K=V` words are visible in
+    /// the process table, as arguments of `sudo` and of the shell, until the
+    /// script `exec`s the command.
+    ///
+    /// A host whose sudoers does not let root run as the account, or as the
+    /// operator's uid and gid, refuses; that settles as
+    /// [`DescentSettle::Refused`], and nothing falls back.
+    ///
+    /// # Errors
+    ///
+    /// Refuses before anything is built with
+    /// [`DescentError::InvalidCommand`] when `command` is not an absolute path
+    /// free of `=`, [`DescentError::InvalidEnvironment`] for a profile entry
+    /// whose name is malformed or repeated or whose value holds a NUL byte, and
+    /// [`DescentError::InvalidWorkingDirectory`] when `profile.cwd` is relative
+    /// or holds a NUL byte.
+    pub fn descent_command(
+        &self,
+        who: Descent,
+        command: &str,
+        args: &[&str],
+        profile: &DescentProfile<'_>,
+    ) -> Result<Command, DescentError> {
+        check_descent(command, profile)?;
+        let mut cmd = self.sudo_descent(who);
+        cmd.arg(bounded::SUPERVISOR_SHELL)
+            .arg("-c")
+            .arg(descent_script())
+            .arg(DESCENT_ARG0)
+            .arg(profile.cwd)
+            .args(
+                profile
+                    .env
+                    .iter()
+                    .map(|(name, value)| format!("{name}={value}")),
+            )
+            .arg(command)
+            .args(args)
+            .current_dir("/");
+        Ok(cmd)
+    }
+
+    /// Classifies what a child spawned from
+    /// [`InDaemonExecutor::descent_command`] has written on standard error so
+    /// far. `ended` is whether that stream reached end of file, or the child
+    /// exited.
+    ///
+    /// - The start announced within the first 64 KiB is
+    ///   [`DescentSettle::Started`]; the bytes after it are the command's.
+    /// - The working directory the target could not enter is
+    ///   [`DescentSettle::NoWorkingDirectory`].
+    /// - A stream that ended with neither is [`DescentSettle::Refused`],
+    ///   carrying the [`ExecutorError::SudoRefused`] that [`Executor::run`]
+    ///   reports for the same standard error.
+    /// - More than 64 KiB ahead of any announcement — not counting a trailing
+    ///   fragment that may still grow into one — is
+    ///   [`DescentSettle::Refused`] too, ended or not, with the first 64 KiB
+    ///   as its reason; the caller then kills the child. An announcement that
+    ///   arrives only past the limit does not excuse what precedes it.
+    /// - Anything else is [`DescentSettle::Pending`]. A fragment of the
+    ///   announcement is never taken for it.
+    ///
+    /// The announcement and the limit are judged exactly as
+    /// [`Executor::open_channel`] judges a channel's start.
+    #[must_use]
+    pub fn settle_descent(&self, stderr: &[u8], ended: bool) -> DescentSettle {
+        let limit = bounded::TRANSPORT_STDERR_LIMIT;
+        let capped = |end: usize| stderr.get(..end.min(limit)).unwrap_or_default();
+        match channel::announcement(stderr) {
+            channel::Announcement::Started(from) => DescentSettle::Started {
+                command_stderr_from: from,
+            },
+            channel::Announcement::Overran(transport) => {
+                DescentSettle::Refused(elevation_refusal(capped(transport), None, &self.host))
+            }
+            channel::Announcement::Undecided => {
+                let marker = NO_WORKING_DIRECTORY_MARKER.as_bytes();
+                if let Some(at) = bounded::find(stderr, marker) {
+                    DescentSettle::NoWorkingDirectory {
+                        reason: String::from_utf8_lossy(capped(at)).trim().to_string(),
+                    }
+                } else if ended {
+                    DescentSettle::Refused(elevation_refusal(stderr, None, &self.host))
+                } else {
+                    DescentSettle::Pending
+                }
+            }
+        }
+    }
+}
+
 impl Executor for InDaemonExecutor {
     fn run(
         &self,
@@ -7661,7 +8024,7 @@ exec "$@"
                 // and which must still end the command.
                 let dir = tempfile::tempdir().expect("tempdir");
                 let pids = dir.path().join("pids");
-                let supervisor = Supervisor::new(Duration::from_secs(300)).expect("a supervisor");
+                let supervisor = Supervisor::new(Duration::from_mins(5)).expect("a supervisor");
                 let mut child = spawn_supervised(&supervisor, &pids);
                 let deadline = Instant::now() + REAP_WAIT;
                 while !pids.exists() {
@@ -8691,5 +9054,763 @@ exec "$@"
                 }
             }
         }
+
+        /// [`InDaemonExecutor::descent_command`] and
+        /// [`InDaemonExecutor::settle_descent`], against stub `sudo` programs:
+        /// the returned `Command` is spawned exactly as a root caller spawns
+        /// it, and the stub stands in for `sudo` alone, so the descent script,
+        /// `env -i` and the command all really run.
+        mod descents {
+            use std::path::{Path, PathBuf};
+            use std::process::{Command, Output, Stdio};
+
+            use tempfile::TempDir;
+
+            use super::super::super::bounded::TRANSPORT_STDERR_LIMIT;
+            use super::super::super::{
+                CommandOutput, Descent, DescentError, DescentProfile, DescentSettle, Executor,
+                ExecutorError, Identity, InDaemonExecutor, NO_WORKING_DIRECTORY_MARKER,
+                OperatorIds, SUDO_OK_SENTINEL, ServiceAccount, classify_elevation,
+                spawn_retrying_text_busy,
+            };
+            use super::write_script;
+
+            /// The pinned execution profile's variables.
+            const PROFILE_ENV: &[(&str, &str)] = &[
+                ("PATH", "/usr/local/bin:/usr/bin:/bin"),
+                ("HOME", "/home/operator"),
+                ("USER", "operator"),
+                ("LOGNAME", "operator"),
+                ("LANG", "C.UTF-8"),
+                ("LC_ALL", "C.UTF-8"),
+            ];
+            /// Arguments a shell would split, expand or read as options.
+            const AWKWARD_ARGS: &[&str] = &[
+                "two words",
+                "\"double\" and 'single' quotes",
+                "$(echo expanded)",
+                "`echo expanded`",
+                "line\nbreak",
+                "-n",
+                "-leading-dash",
+                "K=V",
+                "",
+                "*",
+            ];
+            /// Parses the flags a `sudo` stub drops — `-u` and `-g` with their
+            /// values, any other flag alone — leaving the wrapped command in
+            /// `$@`.
+            const SKIP_SUDO_FLAGS: &str = r#"while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -u|-g) shift 2 ;;
+    -*) shift ;;
+    *) break ;;
+  esac
+done
+"#;
+
+            /// A `sudo` stub that prints its arguments, each ended by a NUL.
+            fn recording_sudo(dir: &Path) -> PathBuf {
+                write_script(
+                    dir,
+                    "recording-sudo",
+                    &format!(
+                        "#!/bin/sh\nfor arg in \"$@\"; do printf '%s\\0' \"$arg\"; done\n\
+                         printf '%s' '{SUDO_OK_SENTINEL}' >&2\n"
+                    ),
+                )
+            }
+
+            /// A `sudo` stub that drops its flags and replaces itself with the
+            /// wrapped command.
+            fn descending_sudo(dir: &Path) -> PathBuf {
+                write_script(
+                    dir,
+                    "descending-sudo",
+                    &format!("#!/bin/sh\n{SKIP_SUDO_FLAGS}exec \"$@\"\n"),
+                )
+            }
+
+            /// A `sudo` stub that drops its flags and runs the wrapped command
+            /// as its child, staying alive beside it as `sudo` does.
+            #[cfg(target_os = "linux")]
+            fn staying_sudo(dir: &Path) -> PathBuf {
+                write_script(
+                    dir,
+                    "staying-sudo",
+                    &format!("#!/bin/sh\n{SKIP_SUDO_FLAGS}\"$@\"\nexit \"$?\"\n"),
+                )
+            }
+
+            /// A `sudo` stub that refuses an unknown account.
+            fn refusing_sudo(dir: &Path) -> PathBuf {
+                write_script(
+                    dir,
+                    "refusing-sudo",
+                    "#!/bin/sh\necho 'sudo: unknown user clumit-insight' >&2\nexit 1\n",
+                )
+            }
+
+            fn daemon(sudo: PathBuf) -> InDaemonExecutor {
+                InDaemonExecutor::new("mgmt").with_sudo_bin(sudo)
+            }
+
+            /// Returns `dir` with every symlink resolved, as `/bin/pwd` prints
+            /// it.
+            fn real(dir: &TempDir) -> PathBuf {
+                std::fs::canonicalize(dir.path()).expect("canonicalize the tempdir")
+            }
+
+            /// Spawns `cmd` with standard input closed and both output streams
+            /// captured, and waits for it.
+            fn output(mut cmd: Command) -> Output {
+                cmd.stdin(Stdio::null())
+                    .stdout(Stdio::piped())
+                    .stderr(Stdio::piped());
+                spawn_retrying_text_busy(&mut cmd)
+                    .expect("spawn the descent")
+                    .wait_with_output()
+                    .expect("wait for the descent")
+            }
+
+            /// Runs `command` through a descent to `who` and returns its
+            /// standard output, once standard error has settled as started.
+            fn descended_stdout(
+                exec: &InDaemonExecutor,
+                who: Descent,
+                command: &str,
+                args: &[&str],
+                profile: &DescentProfile<'_>,
+            ) -> Vec<u8> {
+                let cmd = exec
+                    .descent_command(who, command, args, profile)
+                    .expect("a valid descent");
+                let out = output(cmd);
+                match exec.settle_descent(&out.stderr, true) {
+                    DescentSettle::Started {
+                        command_stderr_from,
+                    } => assert_eq!(
+                        out.stderr.get(command_stderr_from..),
+                        Some(&b""[..]),
+                        "the command wrote nothing on stderr"
+                    ),
+                    other => panic!("{who:?}: expected a start, got {other:?}"),
+                }
+                assert!(out.status.success(), "{who:?}: {out:?}");
+                out.stdout
+            }
+
+            fn operator() -> OperatorIds {
+                OperatorIds::new(1000, 1000).expect("1000 is an operator id")
+            }
+
+            fn both_descents() -> [Descent; 2] {
+                [
+                    Descent::Service(ServiceAccount::Insight),
+                    Descent::Operator(operator()),
+                ]
+            }
+
+            /// Splits NUL-ended words.
+            fn words(bytes: &[u8]) -> Vec<String> {
+                bytes
+                    .split(|&byte| byte == 0)
+                    .map(|word| String::from_utf8_lossy(word).into_owned())
+                    .collect::<Vec<_>>()
+                    .split_last()
+                    .map(|(_, words)| words.to_vec())
+                    .unwrap_or_default()
+            }
+
+            /// Returns the words before `shell`.
+            fn prefix<'w>(words: &'w [String], shell: &str) -> &'w [String] {
+                let at = words
+                    .iter()
+                    .position(|word| word == shell)
+                    .unwrap_or_else(|| panic!("`{shell}` should be present: {words:?}"));
+                words.get(..at).expect("the position is within the words")
+            }
+
+            #[test]
+            fn a_service_descends_as_run_does_and_an_operator_by_id() {
+                let dir = tempfile::tempdir().expect("tempdir");
+                let exec = daemon(recording_sudo(dir.path()));
+                let cwd = real(&dir);
+                let profile = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: &cwd,
+                };
+
+                let run = exec
+                    .run(Identity::Service(ServiceAccount::Insight), "printf", &[])
+                    .expect("the recording stub runs");
+                let run_words = words(&run.stdout);
+                let run_prefix = prefix(&run_words, super::super::super::SH);
+                assert_eq!(run_prefix, ["-u", "clumit-insight"]);
+
+                for (who, expected) in [
+                    (
+                        Descent::Service(ServiceAccount::Insight),
+                        run_prefix.to_vec(),
+                    ),
+                    (
+                        Descent::Operator(operator()),
+                        ["-u", "#1000", "-g", "#1000"].map(String::from).to_vec(),
+                    ),
+                ] {
+                    let cmd = exec
+                        .descent_command(who, "/usr/bin/printf", &["%s", "a b"], &profile)
+                        .expect("a valid descent");
+                    let out = output(cmd);
+                    let argv = words(&out.stdout);
+                    assert_eq!(prefix(&argv, "/bin/sh"), expected, "{who:?}");
+                    for flag in ["-n", "-S", "-p"] {
+                        assert!(
+                            !argv.iter().any(|word| word == flag),
+                            "{who:?}: descent from root must not carry `{flag}`: {argv:?}"
+                        );
+                    }
+                    let mut tail = vec![
+                        "/bin/sh".to_string(),
+                        "-c".to_string(),
+                        super::super::super::descent_script(),
+                        "bootler-descent".to_string(),
+                        cwd.to_string_lossy().into_owned(),
+                    ];
+                    tail.extend(
+                        PROFILE_ENV
+                            .iter()
+                            .map(|(name, value)| format!("{name}={value}")),
+                    );
+                    tail.extend(["/usr/bin/printf", "%s", "a b"].map(String::from));
+                    assert_eq!(
+                        argv.get(expected.len()..),
+                        Some(tail.as_slice()),
+                        "{who:?}: every value is a word of its own"
+                    );
+                }
+            }
+
+            #[test]
+            fn the_command_is_built_and_not_spawned() {
+                let dir = tempfile::tempdir().expect("tempdir");
+                let marker = dir.path().join("spawned");
+                let sudo = write_script(
+                    dir.path(),
+                    "touching-sudo",
+                    &format!("#!/bin/sh\n: > '{}'\n", marker.display()),
+                );
+                let exec = daemon(sudo.clone());
+                let profile = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: Path::new("/"),
+                };
+                for who in both_descents() {
+                    let cmd = exec
+                        .descent_command(who, "/bin/cat", &[], &profile)
+                        .expect("a valid descent");
+                    assert_eq!(cmd.get_program(), sudo.as_os_str(), "{who:?}");
+                    assert_eq!(cmd.get_current_dir(), Some(Path::new("/")), "{who:?}");
+                    assert_eq!(cmd.get_envs().count(), 0, "{who:?}: no environment change");
+                }
+                assert!(!marker.exists(), "building a descent must spawn nothing");
+            }
+
+            #[test]
+            fn the_command_sees_exactly_the_profile_in_its_directory() {
+                let dir = tempfile::tempdir().expect("tempdir");
+                let exec = daemon(descending_sudo(dir.path()));
+                let cwd = real(&dir);
+                let profile = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: &cwd,
+                };
+                let mut expected: Vec<String> = PROFILE_ENV
+                    .iter()
+                    .map(|(name, value)| format!("{name}={value}"))
+                    .collect();
+                expected.sort_unstable();
+
+                for who in both_descents() {
+                    let mut cmd = exec
+                        .descent_command(who, "/usr/bin/env", &[], &profile)
+                        .expect("a valid descent");
+                    // Reaches the stub standing in for `sudo`, and must stop
+                    // there.
+                    cmd.env("BOOTLER_OUTER_ONLY", "leaked");
+                    let out = output(cmd);
+                    assert!(
+                        matches!(
+                            exec.settle_descent(&out.stderr, true),
+                            DescentSettle::Started { .. }
+                        ),
+                        "{who:?}: {out:?}"
+                    );
+                    let stdout = String::from_utf8(out.stdout).expect("utf-8");
+                    let mut seen: Vec<String> = stdout.lines().map(String::from).collect();
+                    seen.sort_unstable();
+                    assert_eq!(seen, expected, "{who:?}: exactly the profile");
+
+                    let pwd = descended_stdout(&exec, who, "/bin/pwd", &[], &profile);
+                    assert_eq!(
+                        pwd,
+                        format!("{}\n", cwd.display()).into_bytes(),
+                        "{who:?}: the profile's directory"
+                    );
+                }
+            }
+
+            #[test]
+            fn every_argument_and_value_arrives_intact() {
+                let dir = tempfile::tempdir().expect("tempdir");
+                let exec = daemon(descending_sudo(dir.path()));
+                let cwd = real(&dir);
+                let mut args = vec!["%s\n"];
+                args.extend_from_slice(AWKWARD_ARGS);
+                let expected: String = AWKWARD_ARGS.iter().flat_map(|arg| [*arg, "\n"]).collect();
+                let awkward_value = "a value with \"double\", 'single', $(x) and\nnewline";
+                let env = [("PATH", "/usr/bin:/bin"), ("AWKWARD", awkward_value)];
+                let profile = DescentProfile {
+                    env: &env,
+                    cwd: &cwd,
+                };
+
+                for who in both_descents() {
+                    let printed = descended_stdout(&exec, who, "/usr/bin/printf", &args, &profile);
+                    assert_eq!(
+                        String::from_utf8_lossy(&printed),
+                        expected,
+                        "{who:?}: every argument is one word, unchanged"
+                    );
+
+                    let printed = descended_stdout(
+                        &exec,
+                        who,
+                        "/usr/bin/printf",
+                        &["%s", "$AWKWARD"],
+                        &profile,
+                    );
+                    assert_eq!(printed, b"$AWKWARD", "{who:?}: no argument is expanded");
+
+                    let printed = descended_stdout(&exec, who, "/usr/bin/env", &[], &profile);
+                    assert!(
+                        String::from_utf8_lossy(&printed)
+                            .contains(&format!("AWKWARD={awkward_value}\n")),
+                        "{who:?}: the value arrives unchanged: {printed:?}"
+                    );
+                }
+            }
+
+            #[test]
+            fn a_missing_directory_starts_nothing_and_settles_as_such() {
+                let dir = tempfile::tempdir().expect("tempdir");
+                let exec = daemon(descending_sudo(dir.path()));
+                let missing = real(&dir).join("missing");
+                let marker = real(&dir).join("ran");
+                let profile = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: &missing,
+                };
+                for who in both_descents() {
+                    let cmd = exec
+                        .descent_command(
+                            who,
+                            "/usr/bin/touch",
+                            &[&marker.to_string_lossy()],
+                            &profile,
+                        )
+                        .expect("a valid descent");
+                    let out = output(cmd);
+                    assert!(!out.status.success(), "{who:?}");
+                    assert!(!marker.exists(), "{who:?}: the command must not run");
+                    match exec.settle_descent(&out.stderr, true) {
+                        DescentSettle::NoWorkingDirectory { reason } => {
+                            assert!(reason.contains("missing"), "{who:?}: reason: {reason}");
+                            assert!(!reason.contains(NO_WORKING_DIRECTORY_MARKER));
+                        }
+                        other => panic!("{who:?}: expected no directory, got {other:?}"),
+                    }
+                }
+            }
+
+            #[test]
+            fn a_refusal_settles_as_run_classifies_it() {
+                let dir = tempfile::tempdir().expect("tempdir");
+                let exec = daemon(refusing_sudo(dir.path()));
+                let profile = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: Path::new("/"),
+                };
+                for who in both_descents() {
+                    let cmd = exec
+                        .descent_command(who, "/bin/cat", &[], &profile)
+                        .expect("a valid descent");
+                    let out = output(cmd);
+                    let run = classify_elevation(
+                        CommandOutput {
+                            code: out.status.code(),
+                            stdout: Vec::new(),
+                            stderr: out.stderr.clone(),
+                        },
+                        None,
+                        "mgmt",
+                    )
+                    .expect_err("run refuses too");
+                    let ExecutorError::SudoRefused {
+                        host: run_host,
+                        reason: run_reason,
+                    } = run
+                    else {
+                        panic!("run classifies a refusal as SudoRefused, got {run:?}");
+                    };
+                    assert!(
+                        matches!(
+                            exec.settle_descent(&out.stderr, false),
+                            DescentSettle::Pending
+                        ),
+                        "{who:?}: a stream still open may yet announce a start"
+                    );
+                    match exec.settle_descent(&out.stderr, true) {
+                        DescentSettle::Refused(ExecutorError::SudoRefused { host, reason }) => {
+                            assert_eq!(host, run_host);
+                            assert_eq!(reason, run_reason);
+                            assert_eq!(reason, "sudo: unknown user clumit-insight");
+                        }
+                        other => panic!("{who:?}: expected a refusal, got {other:?}"),
+                    }
+                }
+            }
+
+            #[test]
+            fn settling_follows_the_sentinel_and_the_transport_limit() {
+                let exec = InDaemonExecutor::new("mgmt");
+                let sentinel = SUDO_OK_SENTINEL.as_bytes();
+                let (head, rest) = sentinel.split_at(sentinel.len() / 2);
+
+                // A sentinel split across two reads.
+                let mut read = b"sudo: note\n".to_vec();
+                read.extend_from_slice(head);
+                assert!(matches!(
+                    exec.settle_descent(&read, false),
+                    DescentSettle::Pending
+                ));
+                read.extend_from_slice(rest);
+                read.extend_from_slice(b"own");
+                assert!(matches!(
+                    exec.settle_descent(&read, false),
+                    DescentSettle::Started { command_stderr_from } if command_stderr_from == 11 + sentinel.len()
+                ));
+
+                // Once started, a marker in the command's own stderr is its own.
+                let mut read = sentinel.to_vec();
+                read.extend_from_slice(NO_WORKING_DIRECTORY_MARKER.as_bytes());
+                assert!(matches!(
+                    exec.settle_descent(&read, true),
+                    DescentSettle::Started { command_stderr_from } if command_stderr_from == sentinel.len()
+                ));
+
+                // The limit itself is not passed.
+                let mut read = vec![b'x'; TRANSPORT_STDERR_LIMIT];
+                read.extend_from_slice(sentinel);
+                assert!(matches!(
+                    exec.settle_descent(&read, false),
+                    DescentSettle::Started { command_stderr_from }
+                        if command_stderr_from == TRANSPORT_STDERR_LIMIT + sentinel.len()
+                ));
+
+                // Past the limit with no sentinel, while the stream is open.
+                let read = vec![b'x'; TRANSPORT_STDERR_LIMIT + 1];
+                assert_refused_with_the_limit(exec.settle_descent(&read, false));
+
+                // A fragment that may still become the sentinel is not counted,
+                // and is not the sentinel.
+                let mut read = vec![b'x'; TRANSPORT_STDERR_LIMIT];
+                read.extend_from_slice(
+                    sentinel
+                        .get(..sentinel.len() - 1)
+                        .expect("the sentinel is longer than one byte"),
+                );
+                assert!(matches!(
+                    exec.settle_descent(&read, false),
+                    DescentSettle::Pending
+                ));
+
+                // A sentinel arriving past the limit does not excuse what
+                // precedes it.
+                let mut read = vec![b'x'; TRANSPORT_STDERR_LIMIT + 1];
+                read.extend_from_slice(sentinel);
+                assert_refused_with_the_limit(exec.settle_descent(&read, false));
+            }
+
+            /// Asserts a refusal whose reason is the first
+            /// [`TRANSPORT_STDERR_LIMIT`] bytes of a run of `x`.
+            fn assert_refused_with_the_limit(settled: DescentSettle) {
+                match settled {
+                    DescentSettle::Refused(ExecutorError::SudoRefused { host, reason }) => {
+                        assert_eq!(host, "mgmt");
+                        assert_eq!(reason, "x".repeat(TRANSPORT_STDERR_LIMIT));
+                    }
+                    other => panic!("expected a refusal, got {other:?}"),
+                }
+            }
+
+            #[test]
+            fn an_invalid_descent_is_refused_before_building() {
+                const SECRET: &str = "s3cret-value";
+                let dir = tempfile::tempdir().expect("tempdir");
+                let exec = daemon(descending_sudo(dir.path()));
+                let valid = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: Path::new("/"),
+                };
+                let who = Descent::Operator(operator());
+
+                for command in ["cat", "bin/cat", "/usr/bin/env=x", ""] {
+                    let error = exec
+                        .descent_command(who, command, &[], &valid)
+                        .expect_err("the command is refused");
+                    assert!(
+                        matches!(&error, DescentError::InvalidCommand { command: named } if named == command),
+                        "{command:?}: got {error:?}"
+                    );
+                }
+
+                let nul_value = format!("{SECRET}\0{SECRET}");
+                let cases: [(&[(&str, &str)], &str); 7] = [
+                    (&[("1PATH", SECRET)], "1PATH"),
+                    (&[("A-B", SECRET)], "A-B"),
+                    (&[("", SECRET)], ""),
+                    (&[("A=B", SECRET)], "A=B"),
+                    (&[("PÄTH", SECRET)], "PÄTH"),
+                    (&[("DUP", SECRET), ("OTHER", "x"), ("DUP", SECRET)], "DUP"),
+                    (&[("NUL", nul_value.as_str())], "NUL"),
+                ];
+                for (env, name) in cases {
+                    let profile = DescentProfile {
+                        env,
+                        cwd: Path::new("/"),
+                    };
+                    let error = exec
+                        .descent_command(who, "/bin/cat", &[], &profile)
+                        .expect_err("the environment is refused");
+                    assert!(
+                        matches!(&error, DescentError::InvalidEnvironment { name: named, .. } if named == name),
+                        "{name:?}: got {error:?}"
+                    );
+                    for text in [error.to_string(), format!("{error:?}")] {
+                        assert!(!text.contains(SECRET), "{name:?}: a value leaked: {text}");
+                    }
+                }
+
+                for cwd in [Path::new("tmp"), Path::new(""), Path::new("/tmp/a\0b")] {
+                    let profile = DescentProfile {
+                        env: PROFILE_ENV,
+                        cwd,
+                    };
+                    let error = exec
+                        .descent_command(who, "/bin/cat", &[], &profile)
+                        .expect_err("the directory is refused");
+                    assert!(
+                        matches!(&error, DescentError::InvalidWorkingDirectory { cwd: named } if named == cwd),
+                        "{cwd:?}: got {error:?}"
+                    );
+                }
+
+                for (uid, gid) in [
+                    (0, 1000),
+                    (1000, 0),
+                    (u32::MAX, 1000),
+                    (1000, u32::MAX),
+                    (0, 0),
+                ] {
+                    let error = OperatorIds::new(uid, gid).expect_err("the ids are refused");
+                    assert!(
+                        matches!(error, DescentError::InvalidOperator { uid: u, gid: g } if u == uid && g == gid),
+                        "{uid}:{gid}: got {error:?}"
+                    );
+                }
+                let ids = OperatorIds::new(1000, 1001).expect("valid ids");
+                assert_eq!((ids.uid(), ids.gid()), (1000, 1001));
+            }
+
+            /// `/proc/<pid>/stat`'s command name, parent pid and process group.
+            #[cfg(target_os = "linux")]
+            fn stat(pid: u32) -> Option<(String, u32, u32)> {
+                let stat = std::fs::read_to_string(format!("/proc/{pid}/stat")).ok()?;
+                let open = stat.find('(')?;
+                let close = stat.rfind(')')?;
+                let comm = stat.get(open + 1..close)?.to_string();
+                let mut fields = stat.get(close + 1..)?.split_whitespace().skip(1);
+                let parent = fields.next()?.parse().ok()?;
+                let group = fields.next()?.parse().ok()?;
+                Some((comm, parent, group))
+            }
+
+            /// Waits for a process named `name` to be `root` or one of its
+            /// descendants, and returns its pid.
+            ///
+            /// Only called while that process blocks reading standard input
+            /// the test still holds open, so the state waited for is reached
+            /// and then stays.
+            #[cfg(target_os = "linux")]
+            fn await_descendant(root: u32, name: &str) -> u32 {
+                const POLLS: u32 = 1000;
+                const POLL_INTERVAL: std::time::Duration = std::time::Duration::from_millis(10);
+                let descends = |mut pid: u32| {
+                    while pid > 1 {
+                        if pid == root {
+                            return true;
+                        }
+                        match stat(pid) {
+                            Some((_, ppid, _)) => pid = ppid,
+                            None => return false,
+                        }
+                    }
+                    false
+                };
+                for _ in 0..POLLS {
+                    let found = std::fs::read_dir("/proc")
+                        .expect("read /proc")
+                        .flatten()
+                        .filter_map(|entry| entry.file_name().to_str()?.parse::<u32>().ok())
+                        .find(|&pid| {
+                            stat(pid).is_some_and(|(comm, _, _)| comm == name) && descends(pid)
+                        });
+                    if let Some(pid) = found {
+                        return pid;
+                    }
+                    std::thread::sleep(POLL_INTERVAL);
+                }
+                panic!("no `{name}` appeared under pid {root}");
+            }
+
+            /// Spawns `cmd` in a new process group of its own, as the root
+            /// caller spawns it into its anchored group, and asserts that the
+            /// spawned process — `sudo`, here its stub — and `/bin/cat` beneath
+            /// it both report that group, then ends `cat` by closing its
+            /// standard input.
+            #[cfg(target_os = "linux")]
+            fn assert_one_process_group(mut cmd: Command) {
+                use std::os::unix::process::CommandExt;
+
+                cmd.process_group(0)
+                    .stdin(Stdio::piped())
+                    .stdout(Stdio::null())
+                    .stderr(Stdio::null());
+                let mut child = spawn_retrying_text_busy(&mut cmd).expect("spawn the descent");
+                let group = child.id();
+                let cat = await_descendant(group, "cat");
+                for pid in [group, cat] {
+                    let (comm, _, pgrp) = stat(pid).expect("the process is alive");
+                    assert_eq!(pgrp, group, "`{comm}` ({pid}) is in the caller's group");
+                }
+                drop(child.stdin.take());
+                let status = child.wait().expect("wait for the descent");
+                assert!(status.success(), "{status:?}");
+            }
+
+            #[cfg(target_os = "linux")]
+            #[test]
+            fn the_descent_stays_in_the_group_it_is_spawned_into() {
+                let dir = tempfile::tempdir().expect("tempdir");
+                let profile = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: Path::new("/"),
+                };
+                for sudo in [staying_sudo(dir.path()), descending_sudo(dir.path())] {
+                    let exec = daemon(sudo);
+                    for who in both_descents() {
+                        assert_one_process_group(
+                            exec.descent_command(who, "/bin/cat", &[], &profile)
+                                .expect("a valid descent"),
+                        );
+                    }
+                }
+            }
+
+            /// Runs the real `sudo`, as root, down to the `nobody` account —
+            /// once named as a service account, once by its ids as an
+            /// operator — and checks the identity, the environment, the
+            /// directory and the process group the command gets.
+            ///
+            /// Needs root, `sudo`, and a `nobody` account that root may run
+            /// as, with its group; CI runs none of that. Run it as
+            /// `cargo test -- --ignored descent_through_the_real_sudo`.
+            #[cfg(target_os = "linux")]
+            #[test]
+            #[ignore = "runs the real sudo as root to a real account"]
+            fn descent_through_the_real_sudo() {
+                use std::os::unix::fs::PermissionsExt;
+
+                const ACCOUNT: &str = "nobody";
+                assert!(
+                    rustix::process::geteuid().is_root(),
+                    "this test runs `sudo` as root"
+                );
+                let id = |flag: &str| {
+                    let out = Command::new("/usr/bin/id")
+                        .args([flag, ACCOUNT])
+                        .output()
+                        .expect("run id");
+                    assert!(out.status.success(), "{out:?}");
+                    String::from_utf8(out.stdout).expect("utf-8")
+                };
+                let uid: u32 = id("-u").trim().parse().expect("a uid");
+                let gid: u32 = id("-g").trim().parse().expect("a gid");
+                let groups = id("-G");
+                let dir = tempfile::tempdir().expect("tempdir");
+                std::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o755))
+                    .expect("let the account enter the directory");
+                let cwd = real(&dir);
+                let profile = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: &cwd,
+                };
+                let mut expected_env: Vec<String> = PROFILE_ENV
+                    .iter()
+                    .map(|(name, value)| format!("{name}={value}"))
+                    .collect();
+                expected_env.sort_unstable();
+                let exec = InDaemonExecutor::new("real");
+
+                for who in [
+                    Descent::Service(ServiceAccount::Fixture(ACCOUNT)),
+                    Descent::Operator(OperatorIds::new(uid, gid).expect("nobody is not root")),
+                ] {
+                    let text = |args: &[&str]| {
+                        let (command, args) = args.split_first().expect("a command");
+                        String::from_utf8(descended_stdout(&exec, who, command, args, &profile))
+                            .expect("utf-8")
+                    };
+                    assert_eq!(
+                        text(&["/usr/bin/id", "-u"]).trim(),
+                        uid.to_string(),
+                        "{who:?}"
+                    );
+                    assert_eq!(
+                        text(&["/usr/bin/id", "-g"]).trim(),
+                        gid.to_string(),
+                        "{who:?}"
+                    );
+                    assert_eq!(text(&["/usr/bin/id", "-G"]), groups, "{who:?}");
+                    let mut env: Vec<String> =
+                        text(&["/usr/bin/env"]).lines().map(String::from).collect();
+                    env.sort_unstable();
+                    assert_eq!(env, expected_env, "{who:?}");
+                    assert_eq!(
+                        text(&["/bin/pwd"]),
+                        format!("{}\n", cwd.display()),
+                        "{who:?}"
+                    );
+                    let printed = text(&["/usr/bin/printf", "%s\n", "a b", "$(x)", "-n"]);
+                    assert_eq!(printed, "a b\n$(x)\n-n\n", "{who:?}");
+                    assert_one_process_group(
+                        exec.descent_command(who, "/bin/cat", &[], &profile)
+                            .expect("a valid descent"),
+                    );
+                    eprintln!("{who:?}: uid {uid}, gid {gid}, groups {}", groups.trim());
+                }
+            }
+        }
     }
 }
diff --git a/src/executor/channel.rs b/src/executor/channel.rs
index 9f2a47d..d411830 100644
--- a/src/executor/channel.rs
+++ b/src/executor/channel.rs
@@ -486,19 +486,50 @@ fn feed_and_settle(
 /// that passes the limit included. Before the sentinel has arrived, only a
 /// trailing fragment that may still grow into it is not yet counted.
 fn judge(read: &mut Vec<u8>, fed: bool) -> Option<Settled> {
-    let sentinel = SUDO_OK_SENTINEL.as_bytes();
-    match find(read, sentinel) {
-        Some(at) if at > TRANSPORT_STDERR_LIMIT => {
-            read.truncate(at);
+    match announcement(read) {
+        Announcement::Overran(transport) => {
+            read.truncate(transport);
             Some(Settled::Ended(std::mem::take(read)))
         }
         // A password `sudo` did not read is still written in full first, so
         // that the start script can discard it as one whole line.
-        Some(at) if fed => Some(Settled::Started(read.split_off(at + sentinel.len()))),
+        Announcement::Started(from) if fed => Some(Settled::Started(read.split_off(from))),
+        Announcement::Started(_) | Announcement::Undecided => None,
+    }
+}
+
+/// Where standard error read so far places a start's [`SUDO_OK_SENTINEL`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Announcement {
+    /// The sentinel arrived within [`TRANSPORT_STDERR_LIMIT`]; the command's
+    /// own bytes begin at this offset, just past it.
+    Started(usize),
+    /// The transport wrote more than [`TRANSPORT_STDERR_LIMIT`] ahead of the
+    /// sentinel, whether or not the sentinel has arrived since. The
+    /// transport's bytes are the first this many.
+    Overran(usize),
+    /// Neither yet.
+    Undecided,
+}
+
+/// Returns what the standard error `read` so far says of a start announced
+/// with [`SUDO_OK_SENTINEL`]: the one rule every start through `sudo` or SSH
+/// is settled by, whoever reads the stream.
+///
+/// What precedes the sentinel is the transport's, and is held to
+/// [`TRANSPORT_STDERR_LIMIT`] wherever the sentinel lands — in the same read
+/// that passes the limit included. Before the sentinel has arrived, only a
+/// trailing fragment that may still grow into it is not yet counted, and such
+/// a fragment is never taken for the sentinel itself.
+pub(super) fn announcement(read: &[u8]) -> Announcement {
+    let sentinel = SUDO_OK_SENTINEL.as_bytes();
+    match find(read, sentinel) {
+        Some(at) if at > TRANSPORT_STDERR_LIMIT => Announcement::Overran(at),
+        Some(at) => Announcement::Started(at + sentinel.len()),
         None if read.len() - partial_suffix(read, sentinel) > TRANSPORT_STDERR_LIMIT => {
-            Some(Settled::Ended(std::mem::take(read)))
+            Announcement::Overran(read.len())
         }
-        Some(_) | None => None,
+        None => Announcement::Undecided,
     }
 }
 

From 57a49c3b6d2c0a414dd0678ea92111e14ee2142a Mon Sep 17 00:00:00 2001
From: Aco Piper <acopiper26@gmail.com>
Date: Mon, 28 Sep 2026 10:31:40 +0900
Subject: [PATCH 2/5] Require no terminal for the real sudo descent test

Under a controlling terminal, sudo with use_pty -- the Debian and
Ubuntu default -- runs the command in a session of its own, so the
process-group check fails for a reason that is the test's environment
and not the descent. That is exactly the condition descent_command
documents, but the test's instructions said to run it from a shell.

Say so, suggest setsid -w, and refuse up front with that advice rather
than failing on the group assertion.

Part of #133
---
 src/executor.rs | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/executor.rs b/src/executor.rs
index 7856ab7..4967ac5 100644
--- a/src/executor.rs
+++ b/src/executor.rs
@@ -9734,8 +9734,12 @@ done
             /// directory and the process group the command gets.
             ///
             /// Needs root, `sudo`, and a `nobody` account that root may run
-            /// as, with its group; CI runs none of that. Run it as
-            /// `cargo test -- --ignored descent_through_the_real_sudo`.
+            /// as, with its group; CI runs none of that. It also needs no
+            /// controlling terminal, as in the systemd service the caller
+            /// runs in: under one, `sudo` with `use_pty` — Debian's and
+            /// Ubuntu's default — moves the command into a session of its
+            /// own. From a terminal, run it as
+            /// `setsid -w cargo test -- --ignored descent_through_the_real_sudo`.
             #[cfg(target_os = "linux")]
             #[test]
             #[ignore = "runs the real sudo as root to a real account"]
@@ -9747,6 +9751,10 @@ done
                     rustix::process::geteuid().is_root(),
                     "this test runs `sudo` as root"
                 );
+                assert!(
+                    std::fs::File::open("/dev/tty").is_err(),
+                    "this test runs without a controlling terminal; start it under `setsid -w`"
+                );
                 let id = |flag: &str| {
                     let out = Command::new("/usr/bin/id")
                         .args([flag, ACCOUNT])

From 2591559315788135188542aae1c73f4ab1fb6bbb Mon Sep 17 00:00:00 2001
From: Aco Piper <acopiper26@gmail.com>
Date: Mon, 28 Sep 2026 10:53:08 +0900
Subject: [PATCH 3/5] Note when the real sudo test can see groups

Stock `nobody` has only its primary group, so the ignored real-sudo
test's groups assertion cannot tell group-database groups apart from a
descent that dropped them all -- the very property `sudo` was chosen
over `CommandExt::uid` for. Say how to make a run that shows them.

Part of #133
---
 src/executor.rs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/executor.rs b/src/executor.rs
index 4967ac5..d65a27c 100644
--- a/src/executor.rs
+++ b/src/executor.rs
@@ -9740,6 +9740,13 @@ done
             /// Ubuntu's default — moves the command into a session of its
             /// own. From a terminal, run it as
             /// `setsid -w cargo test -- --ignored descent_through_the_real_sudo`.
+            ///
+            /// The groups check tells `sudo`'s group-database groups apart
+            /// from none at all only when `nobody` belongs to a supplementary
+            /// group: stock `nobody` has only its primary group, which a
+            /// descent that dropped every supplementary group reports too.
+            /// Add one first (`usermod -aG users nobody`) for a run that
+            /// shows them arriving.
             #[cfg(target_os = "linux")]
             #[test]
             #[ignore = "runs the real sudo as root to a real account"]

From 938a07e93b8dfa647d5ce31ee42426bde8ecb480 Mon Sep 17 00:00:00 2001
From: Aco Piper <acopiper26@gmail.com>
Date: Mon, 28 Sep 2026 11:10:40 +0900
Subject: [PATCH 4/5] Keep a failed cd from forging a descent's start

The descent script let cd print its diagnostic, which echoes the
requested directory. A missing directory whose name contains the start
sentinel therefore put the sentinel on stderr ahead of the no-directory
marker, and settle_descent reported a command as started that never
ran. The script now discards cd's diagnostic, so nothing it writes
before its fixed words comes from the caller.

settle_descent also stopped looking for the marker once more than
64 KiB preceded it, reporting a known missing directory as a sudo
refusal. The marker is now honoured wherever it lands ahead of any
sentinel, with its reason still capped at 64 KiB.

Part of #133
---
 src/executor.rs | 120 ++++++++++++++++++++++++++++++++----------------
 1 file changed, 80 insertions(+), 40 deletions(-)

diff --git a/src/executor.rs b/src/executor.rs
index d65a27c..9ed51af 100644
--- a/src/executor.rs
+++ b/src/executor.rs
@@ -520,8 +520,8 @@ const SUDO_OK_SENTINEL: &str = "__BOOTLER_SUDO_OK__";
 /// [`SUDO_OK_SENTINEL`], when the target identity cannot enter the profile's
 /// working directory: `sudo` descended, but the command was never started.
 const NO_WORKING_DIRECTORY_MARKER: &str = "__BOOTLER_NO_WORKING_DIRECTORY__";
-/// The `$0` the descent script runs under, so a shell diagnostic — `cd`'s,
-/// above all — names what printed it.
+/// The `$0` the descent script runs under, so a shell diagnostic — one for an
+/// `exec` that fails, say — names what printed it.
 const DESCENT_ARG0: &str = "bootler-descent";
 
 /// Errors raised by an executor primitive.
@@ -2301,9 +2301,13 @@ fn sudo_sentinel_script() -> String {
 /// `env -i`, which takes the `K=V` words as the whole environment and the first
 /// word without `=` as the utility. Every value is a positional word, never
 /// spliced into the script text.
+///
+/// `cd`'s own diagnostic is discarded: it would echo `<cwd>`, and a path that
+/// contains the sentinel would then announce a start that never happened.
+/// Nothing the script writes before its fixed words derives from the caller.
 fn descent_script() -> String {
     format!(
-        "cd -- \"$1\" || {{ printf '%s' '{NO_WORKING_DIRECTORY_MARKER}' >&2; exit 1; }}; \
+        "cd -- \"$1\" 2>/dev/null || {{ printf '%s' '{NO_WORKING_DIRECTORY_MARKER}' >&2; exit 1; }}; \
          shift; printf '%s' '{SUDO_OK_SENTINEL}' >&2; exec {env} -i \"$@\"",
         env = bounded::ENV,
     )
@@ -3398,11 +3402,15 @@ pub enum DescentSettle {
     /// `sudo` descended, but the target identity could not enter the
     /// profile's working directory, so the command was never started.
     NoWorkingDirectory {
-        /// What the shell wrote on failing to enter it, trimmed.
+        /// What preceded the failure on standard error — `sudo`'s and its
+        /// PAM session's, if anything — capped at 64 KiB and trimmed. The
+        /// shell's own `cd` diagnostic is not among it, since it would echo
+        /// the directory; the caller already knows which one it asked for.
         reason: String,
     },
     /// `sudo` refused before the command could start — or wrote more than
-    /// 64 KiB before announcing a start, which is treated the same way — with
+    /// 64 KiB before announcing a start or a missing directory, which is
+    /// treated the same way — with
     /// the error [`Executor::run`] reports for that refusal. The caller kills
     /// the child.
     Refused(ExecutorError),
@@ -3535,15 +3543,17 @@ impl InDaemonExecutor {
     /// - The start announced within the first 64 KiB is
     ///   [`DescentSettle::Started`]; the bytes after it are the command's.
     /// - The working directory the target could not enter is
-    ///   [`DescentSettle::NoWorkingDirectory`].
+    ///   [`DescentSettle::NoWorkingDirectory`], however much standard error
+    ///   preceded it.
     /// - A stream that ended with neither is [`DescentSettle::Refused`],
     ///   carrying the [`ExecutorError::SudoRefused`] that [`Executor::run`]
     ///   reports for the same standard error.
-    /// - More than 64 KiB ahead of any announcement — not counting a trailing
-    ///   fragment that may still grow into one — is
-    ///   [`DescentSettle::Refused`] too, ended or not, with the first 64 KiB
-    ///   as its reason; the caller then kills the child. An announcement that
-    ///   arrives only past the limit does not excuse what precedes it.
+    /// - More than 64 KiB ahead of any announcement, with no missing
+    ///   directory reported before it — not counting a trailing fragment that
+    ///   may still grow into the announcement — is [`DescentSettle::Refused`]
+    ///   too, ended or not, with the first 64 KiB as its reason; the caller
+    ///   then kills the child. An announcement that arrives only past the
+    ///   limit does not excuse what precedes it.
     /// - Anything else is [`DescentSettle::Pending`]. A fragment of the
     ///   announcement is never taken for it.
     ///
@@ -3553,25 +3563,26 @@ impl InDaemonExecutor {
     pub fn settle_descent(&self, stderr: &[u8], ended: bool) -> DescentSettle {
         let limit = bounded::TRANSPORT_STDERR_LIMIT;
         let capped = |end: usize| stderr.get(..end.min(limit)).unwrap_or_default();
-        match channel::announcement(stderr) {
-            channel::Announcement::Started(from) => DescentSettle::Started {
-                command_stderr_from: from,
-            },
-            channel::Announcement::Overran(transport) => {
-                DescentSettle::Refused(elevation_refusal(capped(transport), None, &self.host))
-            }
-            channel::Announcement::Undecided => {
-                let marker = NO_WORKING_DIRECTORY_MARKER.as_bytes();
-                if let Some(at) = bounded::find(stderr, marker) {
-                    DescentSettle::NoWorkingDirectory {
-                        reason: String::from_utf8_lossy(capped(at)).trim().to_string(),
-                    }
-                } else if ended {
-                    DescentSettle::Refused(elevation_refusal(stderr, None, &self.host))
-                } else {
-                    DescentSettle::Pending
-                }
+        let (transport, overran) = match channel::announcement(stderr) {
+            channel::Announcement::Started(from) => {
+                return DescentSettle::Started {
+                    command_stderr_from: from,
+                };
             }
+            channel::Announcement::Overran(transport) => (transport, true),
+            channel::Announcement::Undecided => (stderr.len(), false),
+        };
+        let before_any_start = stderr.get(..transport).unwrap_or_default();
+        if let Some(at) = bounded::find(before_any_start, NO_WORKING_DIRECTORY_MARKER.as_bytes()) {
+            DescentSettle::NoWorkingDirectory {
+                reason: String::from_utf8_lossy(capped(at)).trim().to_string(),
+            }
+        } else if overran {
+            DescentSettle::Refused(elevation_refusal(capped(transport), None, &self.host))
+        } else if ended {
+            DescentSettle::Refused(elevation_refusal(stderr, None, &self.host))
+        } else {
+            DescentSettle::Pending
         }
     }
 }
@@ -9405,13 +9416,21 @@ done
             fn a_missing_directory_starts_nothing_and_settles_as_such() {
                 let dir = tempfile::tempdir().expect("tempdir");
                 let exec = daemon(descending_sudo(dir.path()));
-                let missing = real(&dir).join("missing");
                 let marker = real(&dir).join("ran");
-                let profile = DescentProfile {
-                    env: PROFILE_ENV,
-                    cwd: &missing,
-                };
-                for who in both_descents() {
+                // The second names the start announcement, which a shell
+                // diagnostic echoing the path would forge.
+                let missing = [
+                    real(&dir).join("missing"),
+                    real(&dir).join(format!("missing-{SUDO_OK_SENTINEL}")),
+                ];
+                for (who, missing) in both_descents()
+                    .into_iter()
+                    .flat_map(|who| missing.iter().map(move |missing| (who, missing)))
+                {
+                    let profile = DescentProfile {
+                        env: PROFILE_ENV,
+                        cwd: missing,
+                    };
                     let cmd = exec
                         .descent_command(
                             who,
@@ -9421,14 +9440,20 @@ done
                         )
                         .expect("a valid descent");
                     let out = output(cmd);
-                    assert!(!out.status.success(), "{who:?}");
+                    assert!(!out.status.success(), "{who:?} {missing:?}");
                     assert!(!marker.exists(), "{who:?}: the command must not run");
+                    assert_eq!(
+                        out.stderr,
+                        NO_WORKING_DIRECTORY_MARKER.as_bytes(),
+                        "{who:?}: nothing but the marker, and nothing echoing the path"
+                    );
                     match exec.settle_descent(&out.stderr, true) {
                         DescentSettle::NoWorkingDirectory { reason } => {
-                            assert!(reason.contains("missing"), "{who:?}: reason: {reason}");
-                            assert!(!reason.contains(NO_WORKING_DIRECTORY_MARKER));
+                            assert_eq!(reason, "", "{who:?} {missing:?}");
+                        }
+                        other => {
+                            panic!("{who:?} {missing:?}: expected no directory, got {other:?}")
                         }
-                        other => panic!("{who:?}: expected no directory, got {other:?}"),
                     }
                 }
             }
@@ -9536,10 +9561,25 @@ done
                 ));
 
                 // A sentinel arriving past the limit does not excuse what
-                // precedes it.
+                // precedes it, and a marker after it is the command's.
                 let mut read = vec![b'x'; TRANSPORT_STDERR_LIMIT + 1];
                 read.extend_from_slice(sentinel);
                 assert_refused_with_the_limit(exec.settle_descent(&read, false));
+                read.extend_from_slice(NO_WORKING_DIRECTORY_MARKER.as_bytes());
+                assert_refused_with_the_limit(exec.settle_descent(&read, true));
+
+                // A missing directory past the limit is still one, and its
+                // reason is capped.
+                let mut read = vec![b'x'; TRANSPORT_STDERR_LIMIT + 1];
+                read.extend_from_slice(NO_WORKING_DIRECTORY_MARKER.as_bytes());
+                for ended in [false, true] {
+                    match exec.settle_descent(&read, ended) {
+                        DescentSettle::NoWorkingDirectory { reason } => {
+                            assert_eq!(reason, "x".repeat(TRANSPORT_STDERR_LIMIT));
+                        }
+                        other => panic!("expected no directory, got {other:?}"),
+                    }
+                }
             }
 
             /// Asserts a refusal whose reason is the first

From 5520909ff533e2e3e1211d5dd67531cd1d19d195 Mon Sep 17 00:00:00 2001
From: Aco Piper <acopiper26@gmail.com>
Date: Mon, 28 Sep 2026 11:25:26 +0900
Subject: [PATCH 5/5] Keep a sudoers denial from reading as a start

When sudoers denies a command, sudo repeats the whole command line on
stderr. The descent script held the start sentinel and the
no-directory marker literally, so a denial echoed them and
settle_descent reported a start for a command that never ran.

The script now prints each word from two halves, so its text holds
neither. The caller's command, arguments, profile entries and working
directory reach the same echoed line, so any of them holding either
word is refused before building. Arguments had no variant for this,
so DescentError gains InvalidArgument, which carries only the
argument's position.

Part of #133
---
 src/executor.rs | 221 ++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 196 insertions(+), 25 deletions(-)

diff --git a/src/executor.rs b/src/executor.rs
index 9ed51af..840be16 100644
--- a/src/executor.rs
+++ b/src/executor.rs
@@ -2305,14 +2305,32 @@ fn sudo_sentinel_script() -> String {
 /// `cd`'s own diagnostic is discarded: it would echo `<cwd>`, and a path that
 /// contains the sentinel would then announce a start that never happened.
 /// Nothing the script writes before its fixed words derives from the caller.
+///
+/// Nor does the script's text contain either word it prints, since `sudo`
+/// repeats the command line — this script among it — when sudoers denies it,
+/// and a denial must not read as a start or a missing directory. Each word is
+/// printed from two halves; [`check_descent`] keeps the caller's words from
+/// holding one.
 fn descent_script() -> String {
     format!(
-        "cd -- \"$1\" 2>/dev/null || {{ printf '%s' '{NO_WORKING_DIRECTORY_MARKER}' >&2; exit 1; }}; \
-         shift; printf '%s' '{SUDO_OK_SENTINEL}' >&2; exec {env} -i \"$@\"",
+        "cd -- \"$1\" 2>/dev/null || {{ {no_directory}; exit 1; }}; \
+         shift; {started}; exec {env} -i \"$@\"",
+        no_directory = print_split(NO_WORKING_DIRECTORY_MARKER),
+        started = print_split(SUDO_OK_SENTINEL),
         env = bounded::ENV,
     )
 }
 
+/// A shell command printing `word` on standard error from two halves, so the
+/// command's own text never contains `word`.
+///
+/// Only called with this module's ASCII markers, so the midpoint is a
+/// character boundary.
+fn print_split(word: &str) -> String {
+    let (head, tail) = word.split_at(word.len() / 2);
+    format!("printf '%s%s' '{head}' '{tail}' >&2")
+}
+
 /// Removes the first [`SUDO_OK_SENTINEL`] from `stderr`, reporting whether it was
 /// present (i.e. whether `sudo` elevated and started the wrapped command).
 fn take_sudo_sentinel(stderr: &mut Vec<u8>) -> bool {
@@ -3350,19 +3368,33 @@ pub struct DescentProfile<'a> {
 /// this error.
 #[derive(Debug, thiserror::Error)]
 pub enum DescentError {
-    /// `command` is not an absolute path, or contains `=`.
+    /// `command` is not an absolute path, contains `=`, or holds a word the
+    /// descent reports its outcome with.
     ///
     /// The command runs with only the profile's environment, and is started
     /// through `env -i`, which reads an operand containing `=` as an
-    /// assignment rather than the utility.
-    #[error("command `{command}` is not an absolute path free of `=`")]
+    /// assignment rather than the utility. The outcome words are reserved
+    /// because `sudo` repeats the command line when sudoers denies it, and a
+    /// denial repeating one would read as a start or a missing directory.
+    #[error(
+        "command `{command}` is not an absolute path free of `=` and of the descent's outcome words"
+    )]
     InvalidCommand {
         /// The command as the caller named it.
         command: String,
     },
+    /// An argument of the command holds a word the descent reports its
+    /// outcome with, which `sudo` would repeat were sudoers to deny the
+    /// descent, making the denial read as a start or a missing directory.
+    #[error("argument {index} holds a word the descent reports its outcome with")]
+    InvalidArgument {
+        /// The argument's position in `args`, from `0`.
+        index: usize,
+    },
     /// An entry of [`DescentProfile::env`] was refused: its name is not
-    /// `[A-Za-z_][A-Za-z0-9_]*`, it is given twice, or its value contains a
-    /// NUL byte. The value is never carried.
+    /// `[A-Za-z_][A-Za-z0-9_]*`, it is given twice, its value contains a
+    /// NUL byte, or its name or value holds a word the descent reports its
+    /// outcome with. The value is never carried.
     #[error("environment variable `{name}` {reason}")]
     InvalidEnvironment {
         /// The variable's name.
@@ -3370,8 +3402,9 @@ pub enum DescentError {
         /// Why it was refused.
         reason: &'static str,
     },
-    /// [`DescentProfile::cwd`] is not absolute, or contains a NUL byte.
-    #[error("working directory `{}` is not an absolute path free of NUL", cwd.display())]
+    /// [`DescentProfile::cwd`] is not absolute, contains a NUL byte, or holds
+    /// a word the descent reports its outcome with.
+    #[error("working directory `{}` is not an absolute path free of NUL and of the descent's outcome words", cwd.display())]
     InvalidWorkingDirectory {
         /// The directory as the caller named it.
         cwd: PathBuf,
@@ -3418,12 +3451,26 @@ pub enum DescentSettle {
 
 /// Refuses a descent [`InDaemonExecutor::descent_command`] cannot build as
 /// asked.
-fn check_descent(command: &str, profile: &DescentProfile<'_>) -> Result<(), DescentError> {
-    if !is_absolute_and_plain(command) {
+///
+/// Every word the caller supplies reaches `sudo`'s command line, which `sudo`
+/// repeats on standard error when sudoers denies it; none may therefore hold
+/// a word [`InDaemonExecutor::settle_descent`] reads as an outcome.
+fn check_descent(
+    command: &str,
+    args: &[&str],
+    profile: &DescentProfile<'_>,
+) -> Result<(), DescentError> {
+    if !is_absolute_and_plain(command) || holds_outcome_word(command.as_bytes()) {
         return Err(DescentError::InvalidCommand {
             command: command.to_string(),
         });
     }
+    if let Some(index) = args
+        .iter()
+        .position(|arg| holds_outcome_word(arg.as_bytes()))
+    {
+        return Err(DescentError::InvalidArgument { index });
+    }
     let mut seen = std::collections::HashSet::new();
     for &(name, value) in profile.env {
         let refuse = |reason| DescentError::InvalidEnvironment {
@@ -3439,9 +3486,13 @@ fn check_descent(command: &str, profile: &DescentProfile<'_>) -> Result<(), Desc
         if value.contains('\0') {
             return Err(refuse("has a value containing a NUL byte"));
         }
+        if holds_outcome_word(name.as_bytes()) || holds_outcome_word(value.as_bytes()) {
+            return Err(refuse("holds a word the descent reports its outcome with"));
+        }
     }
     let cwd = profile.cwd;
-    if !cwd.is_absolute() || cwd.as_os_str().as_encoded_bytes().contains(&0) {
+    let cwd_bytes = cwd.as_os_str().as_encoded_bytes();
+    if !cwd.is_absolute() || cwd_bytes.contains(&0) || holds_outcome_word(cwd_bytes) {
         return Err(DescentError::InvalidWorkingDirectory {
             cwd: cwd.to_path_buf(),
         });
@@ -3449,6 +3500,14 @@ fn check_descent(command: &str, profile: &DescentProfile<'_>) -> Result<(), Desc
     Ok(())
 }
 
+/// Reports whether `word` holds [`SUDO_OK_SENTINEL`] or
+/// [`NO_WORKING_DIRECTORY_MARKER`].
+fn holds_outcome_word(word: &[u8]) -> bool {
+    [SUDO_OK_SENTINEL, NO_WORKING_DIRECTORY_MARKER]
+        .iter()
+        .any(|outcome| bounded::find(word, outcome.as_bytes()).is_some())
+}
+
 /// Reports whether `name` matches `[A-Za-z_][A-Za-z0-9_]*`, the portable form
 /// of an environment variable name.
 fn is_env_name(name: &str) -> bool {
@@ -3509,6 +3568,11 @@ impl InDaemonExecutor {
     /// whose name is malformed or repeated or whose value holds a NUL byte, and
     /// [`DescentError::InvalidWorkingDirectory`] when `profile.cwd` is relative
     /// or holds a NUL byte.
+    ///
+    /// `sudo` repeats its command line when sudoers denies it, so no word the
+    /// caller supplies may hold one of the two words the descent reports its
+    /// outcome with: a `command`, an argument ([`DescentError::InvalidArgument`]),
+    /// a profile entry or a `profile.cwd` holding one is refused as above.
     pub fn descent_command(
         &self,
         who: Descent,
@@ -3516,7 +3580,7 @@ impl InDaemonExecutor {
         args: &[&str],
         profile: &DescentProfile<'_>,
     ) -> Result<Command, DescentError> {
-        check_descent(command, profile)?;
+        check_descent(command, args, profile)?;
         let mut cmd = self.sudo_descent(who);
         cmd.arg(bounded::SUPERVISOR_SHELL)
             .arg("-c")
@@ -9081,7 +9145,7 @@ exec "$@"
             use super::super::super::{
                 CommandOutput, Descent, DescentError, DescentProfile, DescentSettle, Executor,
                 ExecutorError, Identity, InDaemonExecutor, NO_WORKING_DIRECTORY_MARKER,
-                OperatorIds, SUDO_OK_SENTINEL, ServiceAccount, classify_elevation,
+                OperatorIds, SUDO_OK_SENTINEL, ServiceAccount, classify_elevation, descent_script,
                 spawn_retrying_text_busy,
             };
             use super::write_script;
@@ -9162,6 +9226,20 @@ done
                 )
             }
 
+            /// A `sudo` stub that denies the command as sudoers does, repeating
+            /// the command line it was asked to run.
+            fn denying_sudo(dir: &Path) -> PathBuf {
+                write_script(
+                    dir,
+                    "denying-sudo",
+                    &format!(
+                        "#!/bin/sh\n{SKIP_SUDO_FLAGS}\
+                         echo \"Sorry, user root is not allowed to execute '$*' as insight on mgmt.\" >&2\n\
+                         exit 1\n"
+                    ),
+                )
+            }
+
             fn daemon(sudo: PathBuf) -> InDaemonExecutor {
                 InDaemonExecutor::new("mgmt").with_sudo_bin(sudo)
             }
@@ -9417,19 +9495,11 @@ done
                 let dir = tempfile::tempdir().expect("tempdir");
                 let exec = daemon(descending_sudo(dir.path()));
                 let marker = real(&dir).join("ran");
-                // The second names the start announcement, which a shell
-                // diagnostic echoing the path would forge.
-                let missing = [
-                    real(&dir).join("missing"),
-                    real(&dir).join(format!("missing-{SUDO_OK_SENTINEL}")),
-                ];
-                for (who, missing) in both_descents()
-                    .into_iter()
-                    .flat_map(|who| missing.iter().map(move |missing| (who, missing)))
-                {
+                let missing = real(&dir).join("missing");
+                for who in both_descents() {
                     let profile = DescentProfile {
                         env: PROFILE_ENV,
-                        cwd: missing,
+                        cwd: &missing,
                     };
                     let cmd = exec
                         .descent_command(
@@ -9582,6 +9652,38 @@ done
                 }
             }
 
+            #[test]
+            fn a_denial_repeating_the_command_line_settles_as_refused() {
+                let dir = tempfile::tempdir().expect("tempdir");
+                let exec = daemon(denying_sudo(dir.path()));
+                let profile = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: Path::new("/"),
+                };
+                let script = descent_script();
+                for word in [SUDO_OK_SENTINEL, NO_WORKING_DIRECTORY_MARKER] {
+                    assert!(!script.contains(word), "the script names {word}");
+                }
+                for who in both_descents() {
+                    let cmd = exec
+                        .descent_command(who, "/bin/cat", &["-u"], &profile)
+                        .expect("a valid descent");
+                    let out = output(cmd);
+                    let stderr = String::from_utf8_lossy(&out.stderr);
+                    assert!(
+                        stderr.contains(&script) && stderr.contains("/bin/cat -u"),
+                        "{who:?}: the denial repeats the command line: {stderr}"
+                    );
+                    match exec.settle_descent(&out.stderr, true) {
+                        DescentSettle::Refused(ExecutorError::SudoRefused { host, reason }) => {
+                            assert_eq!(host, "mgmt");
+                            assert_eq!(reason, stderr.trim(), "{who:?}");
+                        }
+                        other => panic!("{who:?}: expected a refusal, got {other:?}"),
+                    }
+                }
+            }
+
             /// Asserts a refusal whose reason is the first
             /// [`TRANSPORT_STDERR_LIMIT`] bytes of a run of `x`.
             fn assert_refused_with_the_limit(settled: DescentSettle) {
@@ -9673,6 +9775,75 @@ done
                 assert_eq!((ids.uid(), ids.gid()), (1000, 1001));
             }
 
+            /// `sudo` repeats its command line when sudoers denies it, so a
+            /// caller's word holding an outcome word would make the denial
+            /// read as that outcome.
+            #[test]
+            fn a_word_holding_an_outcome_word_is_refused_before_building() {
+                const SECRET: &str = "s3cret-value";
+                let dir = tempfile::tempdir().expect("tempdir");
+                let exec = daemon(descending_sudo(dir.path()));
+                let valid = DescentProfile {
+                    env: PROFILE_ENV,
+                    cwd: Path::new("/"),
+                };
+                let who = Descent::Operator(operator());
+
+                for word in [SUDO_OK_SENTINEL, NO_WORKING_DIRECTORY_MARKER] {
+                    let command = format!("/opt/{word}/bin/cat");
+                    let error = exec
+                        .descent_command(who, &command, &[], &valid)
+                        .expect_err("a command holding an outcome word is refused");
+                    assert!(
+                        matches!(&error, DescentError::InvalidCommand { command: named } if *named == command),
+                        "{word}: got {error:?}"
+                    );
+
+                    let arg = format!("x{word}x");
+                    let error = exec
+                        .descent_command(who, "/bin/cat", &["-u", &arg], &valid)
+                        .expect_err("an argument holding an outcome word is refused");
+                    assert!(
+                        matches!(error, DescentError::InvalidArgument { index: 1 }),
+                        "{word}: got {error:?}"
+                    );
+
+                    let value = format!("{SECRET}{word}");
+                    for (env, name) in [
+                        ([(word, "x")], word),
+                        ([("VALUE", value.as_str())], "VALUE"),
+                    ] {
+                        let profile = DescentProfile {
+                            env: &env,
+                            cwd: Path::new("/"),
+                        };
+                        let error = exec
+                            .descent_command(who, "/bin/cat", &[], &profile)
+                            .expect_err("an entry holding an outcome word is refused");
+                        assert!(
+                            matches!(&error, DescentError::InvalidEnvironment { name: named, .. } if named == name),
+                            "{word}: got {error:?}"
+                        );
+                        for text in [error.to_string(), format!("{error:?}")] {
+                            assert!(!text.contains(SECRET), "{word}: a value leaked: {text}");
+                        }
+                    }
+
+                    let cwd = PathBuf::from(format!("/tmp/{word}"));
+                    let profile = DescentProfile {
+                        env: PROFILE_ENV,
+                        cwd: &cwd,
+                    };
+                    let error = exec
+                        .descent_command(who, "/bin/cat", &[], &profile)
+                        .expect_err("a directory holding an outcome word is refused");
+                    assert!(
+                        matches!(&error, DescentError::InvalidWorkingDirectory { cwd: named } if *named == cwd),
+                        "{word}: got {error:?}"
+                    );
+                }
+            }
+
             /// `/proc/<pid>/stat`'s command name, parent pid and process group.
             #[cfg(target_os = "linux")]
             fn stat(pid: u32) -> Option<(String, u32, u32)> {