Under multiplex (and the Desktop/dashboard backend) every record is
formatted on the log QueueListener thread, after the profile scope that
produced it is gone. _ProfileRoutingFileHandler still writes a routed
profile's records to <profile>/logs/*.log, but RedactingFormatter ran
there with no home override, so _redact_enabled() returned the LAUNCH
profile's import-time snapshot and the vault scrub keyed on the launch
home. A launch profile with security.redact_secrets: false (or
HERMES_REDACT_SECRETS=false) therefore wrote every routed profile's
credentials raw into that profile's agent.log/errors.log/gateway.log,
and a routed profile's own opt-out was ignored.
The routing handler now binds the record's stamped home while a record
for another profile is formatted. Launch-profile records are untouched.
With no live secret scope (that thread has none), _redact_enabled reads
the profile's own .env for HERMES_REDACT_SECRETS, as its scope would;
without it the first call there cached a config-only answer for the
process.
d9199d8e8d