_scrubbed_env wrapped the scoped_passthrough_additions overlay in try/except Exception with a debug log; a scope or config failure there would silently drop the declared secret again — the exact failure mode #114209 complains about. The import cannot fail in-tree and _scrub_child_env already calls it unguarded, so the guard is removed and one test pins that both local surfaces propagate the error.