<!-- HOLD FOR THE assembly/v0.69.0 -> main PR BODY. Replaces the sentence that rides in head 10's
     merge-commit body (a9e786b2). That body is knowingly left uncorrected: the tree is gated and
     both boxes' unit sets ran on that exact sha, so a re-cut would buy a full re-gate plus a fresh
     rig-race roll in exchange for a prose fix that changes no tree byte. -->

### #287 — why only three e2es were touched, and why the two siblings are excluded

The keeper-before-bind fix (`fix/287-keeper-before-bind`) changes three e2e tests
(`activity_link_push_e2e.rs`, `attach_link_push_e2e.rs`, `drive_e2e.rs`) and no product code.
Two sibling e2es also drive the shell bind path and are deliberately NOT touched.

**The exclusion rests on the rig, not on any property of the test bodies.** The stale-online heal
is reached from exactly one production call site: `heal_stale_online_records`
(`crates/spt-daemon/src/shellwake.rs:612`) is invoked at `shellwake.rs:907`, the first leg of
`pub fn reconcile_once` (896) — "Leg (a) first, every cycle" — which is swept by the daemon's
wake-host thread spawned at `shellwake.rs:~1030`. (The two other call sites in that file, 1117 and
1151, are unit tests: `#[cfg(test)]` opens at line 1042.)

Neither sibling rig starts a wake host. `start_inproc_daemon` in `tunnel_e2e.rs` stands up three
surfaces — seed control, a broker owning a hermetic `NetHost`, and tunnel control;
`gateway_owner_shell_e2e.rs` adds drive control and nothing else. No `reconcile_once` sweep runs in
either process, so nothing ever flips a bound identity back to offline and the race the fix closes
has no driver. Both files reference `shellwake`, `reconcile_once` and the heal zero times.

`gateway_owner_shell_e2e.rs` is additionally already in the corrected order on its own: it writes
`shell.pid` and calls `record_shell_launch` at lines 231-232, then binds at 233 — one bind call
site, park immediately before it.

**Three earlier rationales for this exclusion were wrong and are corrected here rather than quietly
replaced.** (1) "Neither file binds" — false; both bind through an `online_by_token` closure
(`gateway:207`, `tunnel:153`) that shells out to `spt api --adapter mock-shell bind-shell`, a
spelling no `bind(` search matches. (2) "tunnel binds once, so there is no rebind" — false; tunnel
binds twice, at 219 and again at 268 after a relink. (3) "tunnel parks no identity" — false; its
`shell spawn` at line 216 records the launched binary's identity, and the rig's spawn template is an
exit-0 noop, so a corpse IS recorded. What tunnel lacks is a live stand-in, which was never the
load-bearing claim.

All three tests that WERE changed keep their missed-transition premise, each with an inline comment
stating so.