p = 'docs/INFRA-REGISTER.md'
raw = open(p, 'rb').read()
crlf = b'\r\n' in raw
s = raw.decode('utf-8').replace('\r\n', '\n')

ir155 = """### IR-155 — the brainproc supervisor tests' Windows `long_child()` leaks a PING.EXE grandchild for ~29 s: the kill hits `cmd`, not the process holding the pipe
- **Status:** OPEN; fix owned by hertz (test-only, next lane after this one). Filed by hertz, 2026-09-24, from doyle's W7 gate at `a1f4901e` (msg `AJHFJFWD`); RCA accepted by doyle `M4SBCVOC`. Gate record: `.spt/preserved/331/gate-W7-a1f4901e.md`.
- **Observed (doyle).** `cargo nextest run -p spt-daemon --lib` over 10 pinned promotion tests, hfenduleam Windows: 10 passed, and TWO reported LEAK: `brainproc::tests::ready_but_old_gen_never_drains_does_not_promote_rolls_back` (0.913 s) and `brainproc::tests::trial_kills_alive_never_ready_candidate_before_rollback` (1.469 s). Both spawn `long_child()` candidates. The hazard assert HELD: A11 asserts the candidate is dead before the rollback binary spawns, and it passed. So the kill happened, and the leaked handle is something else outliving the test.
- **Mechanism (source, identical at `9315f649` and `a1f4901e`).** On Windows, `long_child()` is `cmd /C ping -n 30 127.0.0.1` with ONLY stdout nulled. stderr and stdin are inherited, which means nextest's capture pipe. The supervisor kills the `Child`, and that is `cmd.exe`. The grandchild `PING.EXE` is never killed, and it holds the inherited stderr for up to ~29 s. nextest reports that as LEAK. A11 checks the killed pid (`cmd`), which is why it holds while the process tree leaks.
- **PROVEN on hfenduleam (PowerShell only, no cargo).** Spawned `cmd /C ping -n 30 127.0.0.1`; its children were `PING.EXE` 55420 and `conhost.exe` 48852. After `Stop-Process -Force` on `cmd` (TerminateProcess, the same call `Child::kill` makes), `cmd` was dead and `PING.EXE` and `conhost` were both ALIVE. Cleaned up to 0 survivors.
- **W7 exonerated by hunk.** `git diff 9315f649..a1f4901e -- crates/spt-daemon/src/brainproc.rs` has 4 hunks: `BRAIN_EXE_ENV`/`canonical_exe`/`brain_launch_exe`; `run_brain` (the launch pin and `spawn_adapters_leg`); `spawn_brain_child` (the env stamp); `spawn_brain_supervisor` (`canonical_exe()`). None touches the test module, `long_child`, or `supervise_brain`'s kill path. Both tests call `supervise_brain` directly with a closure spawn, so no hunk is on their path.
- **INFERRED, NOT MEASURED: that both also LEAK at base `9315f649`.** The direct discriminator is a Windows base run. doyle declined it on purpose: the mechanism is in the source at BOTH shas and no hunk is on the path, so a reading would confirm an argument rather than discriminate anything. **kitsubito cannot discriminate:** Linux `long_child()` is a bare `sleep 30` that the kill ends, so Linux returns a clean zero at both shas. A probe that cannot express the hunt is not a negative result.
- **Predicted population:** every `long_child()` test whose candidate the supervisor KILLS. At `a1f4901e` the users are at `brainproc.rs` :1529, :1953, :2227, :2271 and :2313. Only 2 of them were in doyle's pinned 10.
- **Fix.** On Windows, spawn PING directly (`Command::new("ping").args(["-n", "30", "127.0.0.1"])`), so the kill hits the process that holds the handles. Also null its stderr and stdin. **Acceptance:** those tests report no LEAK on Windows nextest, and A11 still holds.
- **Ripe when:** now, and small. It is not urgent for the golden, but a test tagged `REQ-HAZARD-BROKER-PROCESS-ISOLATION` that itself leaks a process tree should not sit unfiled. **Size:** one helper, test-only.

"""
anchor = "### IR-154 — worktree residue"
assert s.count(anchor) == 1
s = s.replace(anchor, ir155 + anchor)
out = s.replace('\n', '\r\n') if crlf else s
open(p, 'wb').write(out.encode('utf-8'))
print('ok crlf', crlf)