diff --git a/changelog.d/gsta209-gbrain-env-isolation.md b/changelog.d/gsta209-gbrain-env-isolation.md
new file mode 100644
index 000000000..512340e77
--- /dev/null
+++ b/changelog.d/gsta209-gbrain-env-isolation.md
@@ -0,0 +1,7 @@
+**gstack's own tests no longer write into a developer's real gbrain.** If you export `GBRAIN_DATABASE_URL` for your working brain and run gstack's test suite, tests that spawn bins with a temp `HOME` used to pass that URL straight through. With no gbrain config under the temp `HOME`, the real `gbrain` on your PATH then added `brain-sync-remote-*` sources and test pages to your live brain. From #3466 by @AndreIntelas.
+
+### Fixed
+- **The test preload (`test-setup.ts`) strips the variables gbrain uses to pick a brain** before any test module loads: `GBRAIN_DATABASE_URL`, `GBRAIN_DIRECT_DATABASE_URL`, `DATABASE_URL` and `GBRAIN_HOME`. It prints one line on stderr for each variable it strips. This covers `bun test <file>` and every shard of `bun run test`.
+
+### Tests
+- `test/state-root-config-merge.test.ts`: a `bun test` run with all four variables exported spawns a child under a temp `HOME` that calls `buildGbrainEnv`, and the child sees none of them. It fails on main.
diff --git a/test-setup.ts b/test-setup.ts
index 31234cc63..a9c6fc020 100644
--- a/test-setup.ts
+++ b/test-setup.ts
@@ -39,6 +39,15 @@ for (const name of ['GSTACK_STATE_ROOT', 'GSTACK_STATE_DIR']) {
 // an unattended Capy session it never set up. The shard engine strips the same
 // list for the lanes; this reaches direct runs too.
 for (const name of CAPY_LAUNCH_MARKERS) delete process.env[name];
+// The variables gbrain reads to pick a brain (#3466). Tests spawn bins with
+// { ...process.env, HOME: <tmp> }; with no gbrain config under the temp HOME,
+// buildGbrainEnv passes an exported URL through and a real gbrain on PATH
+// writes test pages and sources into the developer's live brain.
+for (const name of ['GBRAIN_DATABASE_URL', 'GBRAIN_DIRECT_DATABASE_URL', 'DATABASE_URL', 'GBRAIN_HOME']) {
+  if (process.env[name] === undefined) continue;
+  delete process.env[name];
+  process.stderr.write(`test-setup: stripped inherited ${name}; tests must not reach a live gbrain\n`);
+}
 process.env.GSTACK_TEST_LEGACY_ROOT = path.join(os.tmpdir(), `gstack-test-legacy-root-${process.pid}-${Date.now()}-unused`);
 // Workflow leases (bin/gstack-lease) default to the installation's git dir;
 // for the dev checkout under test that is this repo's .git, and a live test