diff --git a/desktop/src-tauri/src/managed_agents/runtime.rs b/desktop/src-tauri/src/managed_agents/runtime.rs
index 7972bb1aa3..43e473fe1b 100644
--- a/desktop/src-tauri/src/managed_agents/runtime.rs
+++ b/desktop/src-tauri/src/managed_agents/runtime.rs
@@ -542,9 +542,10 @@ pub fn spawn_agent_child(
     // slow-starting harness (e.g. a gateway-backed adapter at several
     // seconds per worker) took minutes — and a mention sent in that window
     // predated the watermark and could be missed permanently. There is
-    // deliberately no parameter for this: no Desktop flow may spawn eager
-    // (see the F1 note in restore.rs; `spawn_lazy_pool_env_is_unconditional`
-    // pins the env contract).
+    // deliberately no parameter for this: the compiler is the guard — no
+    // Desktop flow can express an eager spawn (see the F1 note in
+    // restore.rs; `spawn_lazy_pool_env_writes_literal_true_once` pins the
+    // literal and single-write-site residue a scanner can catch).
     command.env("BUZZ_ACP_LAZY_POOL", "true");
     command.env("BUZZ_ACP_AGENT_COMMAND", &resolved_agent_command);
     command.env("BUZZ_ACP_AGENT_ARGS", agent_args.join(","));
diff --git a/desktop/src-tauri/src/managed_agents/runtime/tests.rs b/desktop/src-tauri/src/managed_agents/runtime/tests.rs
index 7515d4c8e5..0bb3bb1b38 100644
--- a/desktop/src-tauri/src/managed_agents/runtime/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/runtime/tests.rs
@@ -1059,17 +1059,24 @@ fn restart_eligible_false_when_non_orphan_has_no_drift() {
 // initialize the FULL worker pool before connecting to the relay. For a
 // slow-starting harness that is minutes of startup, and any mention sent
 // in that window predates the startup watermark and can be missed
-// permanently. The fix removed the `lazy` parameter entirely so eager
-// spawning is structurally unrepresentable: `spawn_agent_child` writes
-// the env var as an unconditional literal.
+// permanently. The fix removed the `lazy` parameter entirely from
+// `spawn_agent_child` and `start_pair`, so no Desktop caller can choose
+// eager — THAT structural deletion is the primary guard, enforced by the
+// compiler, not by this test.
 //
-// This test pins that contract at the source level (the function spawns
-// a real OS process, so it cannot run under `cargo test`): the env write
-// must be the unconditional literal `"true"` — no conditional, no
-// parameter, no second write site. If a future change reintroduces an
-// eager mode, it must be deliberate enough to rewrite this test.
+// This test pins the two residual regressions a line scanner CAN catch
+// (the function spawns a real OS process, so the contract can't be
+// exercised under `cargo test`):
+//   1. the literal flipping to "false" (or any non-"true" value), and
+//   2. a second BUZZ_ACP_LAZY_POOL write site appearing in runtime.rs.
+//
+// Known, accepted limitation: a scanner that trims single lines cannot
+// see surrounding control flow — wrapping the write in a conditional
+// while keeping the line byte-identical passes this test. Guarding that
+// shape needs syntax-aware analysis, which is disproportionate here;
+// the parameter deletion plus review is the defense for it.
 #[test]
-fn spawn_lazy_pool_env_is_unconditional() {
+fn spawn_lazy_pool_env_writes_literal_true_once() {
     let source = include_str!(concat!(
         env!("CARGO_MANIFEST_DIR"),
         "/src/managed_agents/runtime.rs"
@@ -1082,8 +1089,9 @@ fn spawn_lazy_pool_env_is_unconditional() {
     assert_eq!(
         writes,
         vec![r#"command.env("BUZZ_ACP_LAZY_POOL", "true");"#],
-        "BUZZ_ACP_LAZY_POOL must be written exactly once, as the \
-         unconditional literal \"true\" — all Desktop spawns are lazy. \
-         See this test's doc comment before changing."
+        "BUZZ_ACP_LAZY_POOL must be written exactly once in runtime.rs, \
+         with the literal \"true\" — all Desktop spawns are lazy. See \
+         this test's doc comment (and its stated limitation) before \
+         changing."
     );
 }