diff --git a/tests/hermes_cli/test_gateway_proc_fallback.py b/tests/hermes_cli/test_gateway_proc_fallback.py
index c2f4479650..b11fecad1f 100644
--- a/tests/hermes_cli/test_gateway_proc_fallback.py
+++ b/tests/hermes_cli/test_gateway_proc_fallback.py
@@ -182,7 +182,13 @@ class TestGetServicePidsAllProfiles:
 
     def test_default_scope_uses_current_profile_label(self):
         """Without all_profiles, only the current profile's launchd agent is
-        queried (``launchctl list <label>``)."""
+        located (per-label domain-explicit probe, #73627)."""
+        located = []
+
+        def _fake_locate(label):
+            located.append(label)
+            return ("gui/501", 123)
+
         with (
             patch("hermes_cli.gateway.is_macos", return_value=True),
             patch("hermes_cli.gateway.supports_systemd_services", return_value=False),
@@ -190,55 +196,81 @@ class TestGetServicePidsAllProfiles:
                 "hermes_cli.gateway.get_launchd_label",
                 return_value="ai.hermes.gateway.myprofile",
             ),
+            patch(
+                "hermes_cli.gateway._locate_launchd_gateway_service",
+                side_effect=_fake_locate,
+            ),
             patch("subprocess.run") as mock_run,
         ):
-            mock_run.return_value = MagicMock(
-                returncode=0, stdout="123\t0\tai.hermes.gateway.myprofile", stderr=""
-            )
             pids = gateway_mod._get_service_pids()
 
         assert pids == {123}
-        # Must have used ``launchctl list <label>``, not bare ``launchctl list``
+        # Default scope: exactly the current profile's label, no fleet
+        # enumeration and no bare `launchctl list` scan.
+        assert located == ["ai.hermes.gateway.myprofile"]
         launchctl_calls = [
             c[0][0]
             for c in mock_run.call_args_list
             if c[0] and c[0][0] and c[0][0][0] == "launchctl"
         ]
-        assert len(launchctl_calls) == 1
-        assert launchctl_calls[0][1] == "list"
-        assert launchctl_calls[0][2] == "ai.hermes.gateway.myprofile"
+        assert launchctl_calls == []
 
     def test_all_profiles_enumerates_all_gateway_labels(self):
-        """With all_profiles=True, ``launchctl list`` is called without a label
-        filter, and every row whose last column starts with ``ai.hermes.gateway``
-        is collected."""
+        """With all_profiles=True, every install-derived gateway label is
+        located (#73627), and the bare ``launchctl list`` prefix scan still
+        widens the EXCLUDE set with unmapped ai.hermes.gateway* agents
+        (#74075 belt-and-suspenders)."""
+        located = []
+        label_pids = {
+            "ai.hermes.gateway": 123,
+            "ai.hermes.gateway-profile-b": 456,
+        }
+
+        def _fake_locate(label):
+            located.append(label)
+            pid = label_pids.get(label)
+            return ("gui/501", pid) if pid else (None, None)
+
         with (
             patch("hermes_cli.gateway.is_macos", return_value=True),
             patch("hermes_cli.gateway.supports_systemd_services", return_value=False),
+            patch(
+                "hermes_cli.gateway.get_launchd_label",
+                return_value="ai.hermes.gateway",
+            ),
+            patch(
+                "hermes_cli.gateway.launchd_gateway_labels_for_install",
+                return_value=["ai.hermes.gateway", "ai.hermes.gateway-profile-b"],
+            ),
+            patch(
+                "hermes_cli.gateway._locate_launchd_gateway_service",
+                side_effect=_fake_locate,
+            ),
             patch("subprocess.run") as mock_run,
         ):
             mock_run.return_value = MagicMock(
                 returncode=0,
                 stdout=(
-                    "123\t0\tai.hermes.gateway.profile-a\n"
-                    "456\t0\tai.hermes.gateway.profile-b\n"
+                    "999\t0\tai.hermes.gateway-unmapped\n"
                     "789\t0\tcom.apple.some.other.agent\n"
                 ),
                 stderr="",
             )
             pids = gateway_mod._get_service_pids(all_profiles=True)
 
-        assert pids == {123, 456}
-        # The non-gateway label (789) must NOT be included.
+        # Label-derived fleet + prefix-scan stragglers; non-gateway excluded.
+        assert pids == {123, 456, 999}
         assert 789 not in pids
-        # Must have used bare ``launchctl list``
+        assert sorted(located) == [
+            "ai.hermes.gateway",
+            "ai.hermes.gateway-profile-b",
+        ]
         launchctl_calls = [
             c[0][0]
             for c in mock_run.call_args_list
             if c[0] and c[0][0] and c[0][0][0] == "launchctl"
         ]
-        assert len(launchctl_calls) == 1
-        assert launchctl_calls[0] == ["launchctl", "list"]
+        assert launchctl_calls == [["launchctl", "list"]]
 
     def test_all_profiles_empty_when_no_gateway_labels(self):
         """When no ai.hermes.gateway* labels exist, all_profiles returns empty."""