### IR-156 — spt tests that autostart a real daemon tree through a CLI verb are invisible to the HEAVY detector, and three leak that tree past the test
- **Status:** OPEN; census and measured leak arm DONE; remedy lane owned by hertz (propose per binary, then build). Filed by hertz, 2026-09-25, at doyle's request (`HDDEXZNE`, `YITQXO5A`, `D3GY32HJ`, rulings `FISCITF2`). Origin: todlando's W10 rig: `busy_window_axis_e2e` (`89fd4412`) leaked a detached daemon+brain pair per run and held `target\debug\spt.exe` (next build: os error 5). Records: `.spt/preserved/331/hertz/autostart-census/` (census, verb map, population) and `.spt/preserved/331/hertz/leak-arm/`.
- **Which verbs autostart (main `abaa1696`).** From a reverse call graph out of `ensure_running`, with every deciding edge read by hand.
  - **Unconditional,** after input checks: every `spt api <sub>`, because `api::run`'s first statement is `ensure_daemon()`. Also `serve` (all but `lan-firewall`), `fetch`, `seal mint`, `seal enroll-authenticator`, `endpoint digest`, `subnet create`, `subnet join`, `shell drive` and `shell tunnel`.
  - **Explicit:** `daemon start` / `node start`.
  - **Conditional:**
    - `send`, with `--attachment`, with `--seal`, or on the WAN leg (NoPerch without `--active-only`).
    - The remote arms of `knock`, `adapter add -vs`, `adapter update` and `update`.
    - `endpoint list` and `subnet status` when they probe a node.
    - `endpoint start`, `resume`, `fork`, `wake` and `suspend` on their remote or stdin-receipt arms.
    - `shell spawn`, `cmd`, `send`, `relink` and `teardown` on stdin receipt.
  - **`spt ready` does NOT autostart:** it goes `run_listen` → `spt_msg::ReadyAgent`, and spt-msg has no spt-daemon dependency. This corrects the rig finding's premise; the driver in `busy_window_axis_e2e` is `api … poll`.
- **The MECHANISM that makes most of them light (measured).** `ensure_running` is a no-op when `is_running()` answers, and `is_running()` answers when SEED CONTROL answers (daemon.rs:3519). A test that hosts `spt_daemon::seedmap::serve_seed_control(` in-process therefore never spawns a tree, however many `spt api` calls it makes. That server dies with the test.
  - Measured by `strace -f -e trace=execve`: `io_state_payload_e2e` makes 14 `spt api` execs and **0** `daemon run` execs. `poll_envelope_e2e`, which hosts no seed control, makes 1 `api` exec that is followed by `daemon run` and then `daemon brain`.
  - Control: the same `api` argv in a FRESH home, run by hand, prints `DAEMON_AUTOSTART: no daemon and no standing operator stop — starting one` and execs one `daemon run`.
- **Population** (the 118 top-level `crates/spt/tests/*.rs` binaries, the xtask detector's own scope):
  - 51 are HEAVY. 39 pass an unconditional autostart verb, and 25 of those are NOT HEAVY. The current detector (`spawns_daemon_tree`: the literals `"daemon", "run"`, `"daemon", "brain"`, `supervise_brain(`) misses all 25.
  - Of the 25, **16 host seed control in-process** and never spawn a tree. **9 do spawn one:**
    - 7 via an explicit `daemon start` WITH a `daemon stop`: HEAVY-at-birth misses, with no leak. They are `boundary_events_e2e`, `broker_stop_endpoint_deny_e2e`, `daemon_stop_convoy_e2e`, `io_events_poll_e2e`, `io_events_undriven_kinds_e2e`, `midturn_span_e2e` and `now_signal_delta_e2e`.
    - `poll_envelope_e2e` (leaks).
    - `worker_lifecycle_e2e` (clean).
  - 47 more binaries pass only CONDITIONAL verbs, and 23 of them are non-HEAVY without seed control. All 23 were measured below.
- **MEASURED leak arm** (kitsubito, main `abaa1696`, one pool; each binary run SOLO; new `daemon|node run|brain` processes counted against a per-binary baseline at +5 s and +30 s; kills restricted to `SPT_HOME=/tmp/…`):
  - **LEAK: 3 binaries.** Each left a daemon+brain pair alive at +30 s, and each test PASSED:
    - `poll_envelope_e2e`: 4/4 runs. It uses `api --adapter spt poll` under a tempdir home, with no teardown.
    - `active_only_never_relay_e2e`: 2/2. Its `send remotegw` without `--active-only` takes the WAN leg by design ("it takes the WAN leg", its own comment).
    - `er_inbound_local`: 1/1, through `send`.
  - **Negative control** `io_events_poll_e2e` (a literal `daemon stop`): 1 process at +5 s, **0** at +30 s. The control holds; its stop just takes more than 5 s.
  - **CLEAN** (0 at +30 s): `worker_lifecycle_e2e`, the 5 seed-control binaries, and 21 of the 23 conditional binaries.
  - **`gateway_e2e`** was a HOLE in the first run (its `mock-session` fixture was not built by the rig) and PASSES clean once the fixture is built.
  - Limits: Linux only. todlando's original leak was on Windows. A Windows arm is doyle-scheduled if it is needed.
- **Rig lessons, each paid for in this arm:**
  - **Key a KILL on the SPT_HOME / exe path, never on sampled pids** (doyle `FISCITF2`). Run 2 sampled the process table every 200 ms during each test to tell never-started from exited-early. It is VOID:
    - the tests finish in under a second, so the sampler missed even its own positive control (`poll_envelope_e2e`, which leaks 4/4 under a plain census);
    - its after-checks and kill were keyed on the pids it had sampled, so a pid it missed was also never killed. It LEFT a leaked pair on kitsubito, found later and killed by pid.
    - A sampler that misses a process also misses its kill.
  - **The discriminator that cannot miss** is `strace -f -e trace=execve`: it records a `daemon run` exec however briefly the process lives. Two traps:
    - **`strace -f` HANGS on a leaking binary.** It follows the orphaned daemon and waits for it to exit. The hang itself confirms the leak, but the run needs an outside kill.
    - **strace truncates strings at 32 characters.** The long exe path prints as `"…"...`, so a matcher must accept `..., "api"`. A first count read `api_execs=0` on the binary that plainly calls `api`.
  - **`pgrep -f PATTERN` over ssh matches the ssh command line that carries PATTERN.** A synthetic-control kill took down the ssh session itself (exit 255), the known `pkill -f` trap. Write the pattern self-excluding (`[s]pt`) and kill by explicit pid.
- **Remedy shape (doyle `D3GY32HJ` §3 and `FISCITF2`), proposed per binary before any flip; NOT 25 blind HEAVY flips:**
  - **Does the test NEED a daemon?**
    - If not, pre-write `daemon-stop.inhibit` in its home. That kills the leak and keeps it light.
    - If it does, it goes HEAVY, with a teardown guard.
  - The 3 leakers and the 7 explicit-`daemon start` binaries are the decision set.
  - Measure the Phase-B duration delta for every binary that goes HEAVY before landing.
- **Detector widening (lands in the SAME lane, so it reds on anything left unclassified).** `spawns_daemon_tree` becomes today's literals, OR `"daemon", "start"`, OR (`CARGO_BIN_EXE_spt` AND a string-array verb head in {`api`, `serve`, `fetch`, `seal mint`, `seal enroll-authenticator`, `endpoint digest`, `subnet create`, `subnet join`, `shell drive`, `shell tunnel`}).
  - It EXEMPTS a binary that calls `serve_seed_control(` or pre-writes the inhibit, and each exemption gets its own negative-control unit test.
  - Negative control for the widening, kept as a unit in `heavy_integration_tests`: `busy_window_axis_e2e` at `89fd4412` reads False under the current rule and TRUE under the widened one (static port), and golden.yml at `89fd4412` lists it 0 times.
  - Conditional verbs are NOT statically decidable (the condition is runtime data); the measured arm above is their answer today.
- **Ripe when:** now. All three leakers run in the default thin-lane suite, and every leaked tree holds `target/debug/spt` on Windows. **Size:** medium. It needs a per-binary read and decision for about 10 binaries, the detector change plus 3 units, and a Phase-B timing measurement.

### IR-155 — the brainproc supervisor tests' Windows `long_child()` leaks a PING.EXE grandchild for ~29 s: the kill hits `cmd`, not the process holding the pipe
- **Status:** BUILT (hertz, lane `fix/ir155-long-child-direct-ping`, fix MEASURED at `6e5ec878` on base `14350a78`, rebased patch-identical (patch-id `06d41433`) onto `9a5dd7be` for landing as `b2ac2ecc`); measured A/B below. Filed by hertz, 2026-09-24, from doyle's W7 gate at `a1f4901e` (msg `AJHFJFWD`); RCA accepted by doyle `M4SBCVOC`. Gate record: `.spt/preserved/331/gate-W7-a1f4901e.md`.
- **Observed (doyle).** `cargo nextest run -p spt-daemon --lib` over 10 pinned promotion tests, hfenduleam Windows: 10 passed, and TWO reported LEAK: `brainproc::tests::ready_but_old_gen_never_drains_does_not_promote_rolls_back` (0.913 s) and `brainproc::tests::trial_kills_alive_never_ready_candidate_before_rollback` (1.469 s). Both spawn `long_child()` candidates. The hazard assert HELD: A11 asserts the candidate is dead before the rollback binary spawns, and it passed. So the kill happened, and the leaked handle is something else outliving the test.
- **Mechanism (source, identical at `9315f649` and `a1f4901e`).** On Windows, `long_child()` is `cmd /C ping -n 30 127.0.0.1` with ONLY stdout nulled. stderr and stdin are inherited, which means nextest's capture pipe. The supervisor kills the `Child`, and that is `cmd.exe`. The grandchild `PING.EXE` is never killed, and it holds the inherited stderr for up to ~29 s. nextest reports that as LEAK. A11 checks the killed pid (`cmd`), which is why it holds while the process tree leaks.
- **PROVEN on hfenduleam (PowerShell only, no cargo).** Spawned `cmd /C ping -n 30 127.0.0.1`; its children were `PING.EXE` 55420 and `conhost.exe` 48852. After `Stop-Process -Force` on `cmd` (TerminateProcess, the same call `Child::kill` makes), `cmd` was dead and `PING.EXE` and `conhost` were both ALIVE. Cleaned up to 0 survivors.
- **W7 exonerated by hunk.** `git diff 9315f649..a1f4901e -- crates/spt-daemon/src/brainproc.rs` has 4 hunks: `BRAIN_EXE_ENV`/`canonical_exe`/`brain_launch_exe`; `run_brain` (the launch pin and `spawn_adapters_leg`); `spawn_brain_child` (the env stamp); `spawn_brain_supervisor` (`canonical_exe()`). None touches the test module, `long_child`, or `supervise_brain`'s kill path. Both tests call `supervise_brain` directly with a closure spawn, so no hunk is on their path.
- **INFERRED, NOT MEASURED: that both also LEAK at base `9315f649`.** The direct discriminator is a Windows base run. doyle declined it on purpose: the mechanism is in the source at BOTH shas and no hunk is on the path, so a reading would confirm an argument rather than discriminate anything. **kitsubito cannot discriminate:** Linux `long_child()` is a bare `sleep 30` that the kill ends, so Linux returns a clean zero at both shas. A probe that cannot express the hunt is not a negative result.
- **Predicted population, FALSIFIED IN PART by the A/B below:** every `long_child()` test whose candidate the supervisor KILLS. At `a1f4901e` the users are at `brainproc.rs` :1529, :1953, :2227, :2271 and :2313. Only 2 of them were in doyle's pinned 10.
  - The measured arm U leaked 1 of the 4 `long_child` tests it ran, not all of them. `trial_kills_alive_never_ready_candidate_before_rollback` leaked in doyle's run and PASSED clean in arm U. So the leak is INTERMITTENT per test.
  - Hypothesis, UNTESTED: the supervisor sometimes kills `cmd` before `cmd` has started `PING.EXE`, which leaves no grandchild to leak. The fix does not depend on it: it removes the grandchild altogether.
- **Fix.** On Windows, spawn PING directly (`Command::new("ping").args(["-n", "30", "127.0.0.1"])`), so the kill hits the process that holds the handles. Also null its stderr and stdin. **Acceptance:** those tests report no LEAK on Windows nextest, and A11 still holds.
- **A/B MEASURED (hertz, hfenduleam Windows, one pool, 2026-09-25 02:13–02:17Z; doyle's GO `ZHKQYE34`).**
  - Setup: a write census before launch read 0 writers (a SEPARATE call), with 131.6 GB free. The command was `cargo nextest run -p spt-daemon --lib brainproc::tests --no-fail-fast`, run once per arm. Arm U ran FIRST, with the pre-fix helper restored in the working tree. Each arm went to its own file, and each exit was read on its own call.
  - **Arm U (unfixed):** `26 tests run: 26 passed (1 leaky)`. LEAK: `ready_but_old_gen_never_drains_does_not_promote_rolls_back`. That is the positive control: the defect reproduced in this pool.
  - **Arm F (fix `6e5ec878`):** `26 tests run: 26 passed`, 0 leaky. All four `long_child` tests PASS, including A11's `trial_kills_alive_never_ready_candidate_before_rollback`, so the hazard assert still holds.
  - Limits: n = 1 per arm. Because the leak is intermittent (above), an arm F with no LEAK is strong evidence only together with the mechanism: with no `cmd` wrapper, there is no grandchild left to hold the pipe. Records: `.spt/preserved/331/hertz/ir155/` (`armU.nextest.txt`, `armF.nextest.txt`, the exits, the driver script).
- **Ripe when:** now, and small. It is not urgent for the golden, but a test tagged `REQ-HAZARD-BROKER-PROCESS-ISOLATION` that itself leaks a process tree should not sit unfiled. **Size:** one helper, test-only.

### IR-154 — worktree residue: 96 trees on hfenduleam, and "landed" read by ancestry alone would have called 50 unlanded where 27 are
- **Status:** OPEN for 41 trees; REAP DONE for the 51 with evidence (doyle, hfenduleam, 2026-09-24). Census and reap: doyle (msg `B4H3AQTE`; reap at 17:54–17:55Z). Filed by hertz at doyle's request. Record: `.spt/preserved/331/worktree-census-doyle-20260924.md`. Kin: [[IR-153]], whose 17 other-agent records doyle repaired before the reap, and [[IR-150]], sample 7.
- **Measured (census, main `2e52677a`, nothing deleted).** 96 worktrees: 95, plus the main checkout, which is excluded. IR-150's three numbers over the whole `.worktrees`: apparent 7,555,161,221; allocated 8,001,377,280; escaped 0, UNFORCED (population not captured at census time). `git worktree list --porcelain | grep -c prunable` = 0, so every record points at an existing directory. None of this is pruning; all of it is removal.
- **The reap's value is the checkouts, not build pools.** Only 3 trees carried a `target/`. Two were empty stubs (0 B and 146 B). The third was todlando's LIVE `w6-divulge` pool.
- **Classification, and the finding that makes it reusable.**
  - DETACHED 15 (gate and RCA rigs; they carry no lane).
  - MERGED 30 (`git branch --merged main`).
  - EQUIV 23: `git cherry main <branch>` shows 0 `+` lines, i.e. landed by squash or rebase.
  - REAL 27: unlanded commits, decided per tree.

  That makes 68 of 95 reapable on evidence. **Ancestry alone would have called 50 trees unlanded; the patch-id arm cut that to 27.** `--merged` cannot see a squash-landed lane, and a tree deleted on ancestry alone may be a lane deleted. So the patch-id arm is not optional.
- **Reap (17:54–17:55Z): 51 removed, 17 refused, 95 → 44.**
  - Every refusal was `contains modified or untracked files, use --force to delete it`. No `--force` was passed anywhere: a refusal means unverified content, and the safe direction is to leave it. The 17 are listed in `.spt/preserved/331/worktree-census-doyle-20260924-reap-refused.txt` (copied by hertz, byte-identical under a provenance header, from doyle's session scratchpad, which is not preservation). They want a per-tree read, not a flag.
  - The IR-150 capture over the reaped set, and its uninterpretable free-space delta (a CI job was writing the volume), are sample 7 of [[IR-150]]. So is doyle's census-inside-the-script procedural finding.
  - The census's earlier "≈ 7.8 GB expected reclaim" was wrong as applied: it described reaping everything, while the evidence-based set measured 1.8 GB allocated. doyle corrected it in the record rather than leaving it standing.
- **What stays OPEN: 41 trees.**
  - The 17 refused trees: a per-tree read of their modified or untracked content.
  - The 24 REAL trees that were neither live nor operator evidence. (The two lanes that were live at census time have since retired: todlando removed `w6-divulge` at 18:26Z (IR-150 sample 8), and the 185a tree is gone. `git worktree list` at ~18:45Z reads 45 rows = main + 44.) They are listed with their `git cherry` counts in the record. A mixed count (e.g. `fix/w3-line-safety-attr` +1 −17) means most of the lane landed and a remainder did not. Read those first: the remainder is either a deliberate drop or a lost fix.
  - The cheap path for all 24: **removing a worktree does not delete its branch.** Remove the tree, keep the branch, and decide each branch's fate separately, never under disk pressure.
  - Held as evidence, not debt: `docs/golden-head-intake` (+2, PR #135). Its content is on main as a SUPERSET, so the merge button would delete 233 ruled lines. Keep the tree until the operator closes the PR.
- **Ripe when:** a quiet hfenduleam volume with a writer census read BEFORE launch (IR-150 sample 7), plus an owner for the per-tree reads. The 17 refusals and the 24 REAL trees belong to their authors (doyle and todlando). **Size:** small per tree, and not batchable: each tree is a read and a decision.

### IR-153 — worktree admin records spelled with backslashes make `git worktree remove` refuse a landed tree
- **Status:** RESOLVED REPO-WIDE; HISTORICAL, no standing rule (hertz, 2026-09-24; reap order and conditions doyle `JKY6UQWL`, `255GW4QL`, `TBCSIDUJ`; the other agents' 17 repaired by doyle `QQQCDZ5G`). Records: `.spt/preserved/331/hertz/worktree-census-20260924/NOTES.md`, and step 2 of `.spt/preserved/331/worktree-census-doyle-20260924.md`.
- **Measured.** `git worktree remove .worktrees/hertz-ir86-retire` on a landed, clean tree failed with `fatal: '.worktrees/hertz-ir86-retire' is not a working tree` (rc 128). Nothing changed: the dir, the admin record and the branch were all still there. The tree's admin file `.git/worktrees/<name>/gitdir` held a BACKSLASH path (`C:\...\hertz-ir86-retire\.git`); healthy records hold `C:/.../.git`.
- **Mechanism.** git trims only a trailing `/.git` from the recorded path. A backslash spelling keeps its `\.git`, so `git worktree list` shows `<dir>\.git` and `remove` cannot match the directory to its record.
- **Population.** 22 of hertz's 36 hfenduleam trees had backslash records. Controls: `hertz-ir86-retire` = 1, `hertz-arm1` = 0. Repo-wide there were 39 such rows, and 17 of them belong to OTHER agents' trees. Those 17 were left untouched: another agent's admin record is theirs (doyle `255GW4QL`). A first separator check (a bash `case *\\*`) reported 36/36 forward-slash, failed its own control, and was discarded. The recount used `grep -F` with a hex-escaped backslash.
- **Fix: `git worktree repair <dir>`.** It rewrites the record to canonical form. Proven on ONE tree before batching: (a) the gitdir went to forward-slash, 0 backslashes; (b) the list row lost its `\.git`; (c) `remove` then exited 0, with dir and admin record GONE and the branch kept. It beats passing `remove` the recorded spelling because it fixes the record instead of working around it, and every later git verb reads the repaired form.
- **The exit code is NOISE; assert per tree.** `repair` SWEEPS every admin record, not just the named ones. Naming all 21 remaining trees in ONE call exited **1** with **38** stderr lines of `error: not a directory: <dir>\.git` naming other records. Yet it wrote exactly its targets: after the call, admin files of the 17 non-hertz trees newer than a pre-call mark = **0**, and hertz gitdirs newer = **21**. hertz backslash rows went 21 → 0, repo-wide 38 → 17. A loop gated on the rc would report 21 failures on a clean run. Gate each tree on its own gitdir having 0 backslashes.
  - **The rc 1 is not a rule of `repair` (doyle's run).** doyle's call named every remaining malformed record and nothing else. It exited **0** with one `repair: gitdir incorrect` line per target. So the rc reports on the sweep: it goes non-zero when the sweep meets records it declines, and not otherwise. Either way it says nothing about your targets, and the per-tree gate is what to trust.
- **Is the mechanism LIVE? No: HISTORICAL on git 2.43.0.windows.1.** `git worktree add --detach --no-checkout` wrote a canonical forward-slash gitdir from Git Bash with a relative path, from PowerShell with a relative path, and from PowerShell with an absolute `C:\` backslash path. The throwaway trees were removed. So the 22 are residue from an older creation path, and no AGENTS.md rule is written against a mechanism that current git cannot produce. If a NEW tree ever shows `<dir>\.git` in `git worktree list`, that reopens this entry, and it then needs the rule.
- **Outcome.** hertz's worktree census and reap (IR-150 captured where pools existed): 0 hertz worktrees remain on either box.
  - **The other 17 are repaired (doyle, hfenduleam, 2026-09-24).** They were doyle's and todlando's, as this entry predicted. doyle ran the repair BEFORE his quiet-window reap ([[IR-154]]), because it writes only admin bytes and the quiet window was the scarce resource.
  - **Predicate controlled both ways before the call.** The `grep -F` hex-escaped backslash over `.git/worktrees/*/gitdir` found 17 (positive). `w6-divulge`'s record read clean forward-slash (negative).
  - **Result.** `git worktree repair` on all 17 at once: rc 0, 17 `repair: gitdir incorrect` lines naming exactly its targets. The per-tree gate read 17/17 at 0 backslashes. Repo-wide rows went 17 → **0**, and `git worktree list` shows no `\.git` row. Neither live lane (`w6-divulge`, hertz's 185a rig) was among them.
  - The HISTORICAL finding is unchanged: no NEW tree has shown the spelling, so it still needs no AGENTS.md rule.

### IR-151 — a code push to main re-runs `docs-drift` cold even when the exact sha's PR run already passed it
- **Status:** OPEN follow-on to [[IR-149]] (hertz, 2026-09-24; doyle `6E25QRVT`: the no-reuse re-run is ACCEPTED as a known cost, not a defect; file it and let the measured number decide whether it ripens; do not build it on faith).
- **Measured.** Landing push [`36017529709`](https://github.com/BigscreenVR/spt-bs-core/actions/runs/36017529709) at `b96b88d2`: `UNIT_REUSE run-unit=false reason=exact-pr-proof run=36015299854` skipped unit on both boxes. `docs-drift` still ran in full: 2m22s of kitsubito, a cold 414-crate `spt` build plus `xtask check`, on a sha whose PR run had already printed `xtask check: OK`. It is cold by construction, because checkout's `git clean -ffdx` deletes `target/` per job (see IR-149).
- **Cost it would remove:** ~2.3 min of kitsubito per code landing. On this push it extended no wall, since it ran in parallel with nothing and ended before lint. It matters only when the kitsubito queue is the critical path.
- **Fix candidate:** extend the IR-144 exact-PR proof to a `run-docs-drift` output. It reuses the SAME helper and its successful-job predicate over the `docs-drift` job, and is never re-derived in YAML.
- **Ripe when (doyle `JMHS3VMG`, so it can be TESTED rather than re-argued):** either of two conditions:
  - code landings on main get frequent enough that ~2.3 min each shows up in a golden batch window;
  - on a landing push, kitsubito becomes the critical path instead of ending before lint.

  Until then the cost is on record and accepted. Do not build this on faith. **Size:** small. The helper already names the jobs it proves.

### IR-150 — the teardown rule says "measure size" but not WHICH size, so a reclaim below the size sum can only be explained after the tree is gone
- **Status:** ACCEPTED except the escaped-link clause (ruled by hertz `IMDCBMYN` on doyle's reap, 2026-09-24). The ruling sits with hertz because doyle was the ACTOR whose reap was under test; doyle's own record says so: "Ruling is hertz's, not mine" (`reap-record.md`, the section above RULING). Landed at `ea50a9bb` (core PR #263). The AGENTS.md "Target-tree teardown" bullet names the three pre-`rm` numbers: apparent size, allocated size, and escaped hard-link inodes counted per inode. It now also carries the write-census clause from this entry's first field run. The rule stays in AGENTS.md; no REQ.
  - **Accepted on doyle's field reap** of the two released gate pools on hfenduleam (`.spt/preserved/331/doyle/ir150-acceptance/reap-record.md`):
    - All three numbers were captured before any `rm`: apparent 25,755,212,342, allocated 25,819,922,432, escaped 0.
    - The escaped zero was forced to show a population: 708 rows at nlink = 2, max 2, plus a fresh `ln -f` positive control.
    - The reclaim, 25,567,203,328 B, is **252,719,104 B (0.98 %) short** of allocated − escaped. It is recorded UNEXPLAINED, with no mechanism given after the tree was gone.
    - OUTBOUND and INBOUND were checked per the rule, with the sweep scope stated.
  - **Escaped-link DISCRIMINATION is held OPEN.** doyle's trees escaped nothing, so the per-inode form's ability to separate an escaping link rests on two SYNTHETIC controls: kitsubito ext4, and hfenduleam NTFS with `fsutil hardlink list` agreeing. Each gave raw 3 vs deciding `1 2000`. **Trigger:** the next teardown of a tree that has escaping inodes is its field acceptance.
    - **STILL UNEXERCISED after nine field reaps (2026-09-24, samples below).** Every one escaped nothing, so the escaped term in "allocated − escaped" is still UNTESTED ARITHMETIC: no sample has held an inode linked from outside its tree. The zeros are of three kinds, and they are not interchangeable:
      - FORCED (the population behind the zero was captured and non-empty): 7. doyle's gate pools, hertz's Tier 2, todlando's W5 (a labelled transcription, see sample 4), hertz's 185a rig, hertz's W7 rig, todlando's W6, hertz's W7 order check.
      - UNFORCED (population not captured): 1. todlando's W4.
      - VACUOUS (population captured and EMPTY; source checkouts hold no hard links): 1. doyle's worktree reap.

      Nine samples of the ZERO arm are not evidence that the clause is unnecessary, because the clause is about the NON-ZERO arm. Another zero adds nothing; only a tree with escaping inodes can accept it (doyle `JXNHA3FW`).
  - **Write census (companion clause, from this entry's first field run).** todlando's local `cargo nextest` was writing C: during doyle's 13 s `rm` window (14:43:22–14:43:35Z). doyle had asked whether that lane READ the pools, never whether it WROTE the volume. A free-space delta on a live box cannot be interpreted without knowing what else wrote the volume in the window. So the teardown now records a write census for the window: cargo, rustc, test runners, Runner.Worker, and other agents' declared legs. The 0.98 % gap stays UNEXPLAINED: a named writer whose magnitude was never measured is not an explanation.
  - **Residual 0.98 %: no arm now.** It changes no floor decision. It ripens if a future gap exceeds ~5 %, or if a floor call rides on the prediction within 1 %. A testable hypothesis for that day, stated as a hypothesis only: MFT-resident small files may count in msys `du -sB1` and yet free no clusters when unlinked. It can be pre-registered on a synthetic small-file tree on an idle volume. Filed OPEN (hertz, 2026-09-24, at doyle's request `ZXM7YJUX`). Origin: hertz's kitsubito pool teardown, 2026-09-24, records in `.spt/preserved/hertz-kitsubito-reap-20260924/`.
  - **Second field sample (todlando, W4 pool retire, hfenduleam NTFS, 2026-09-24 15:35–15:36Z).** Record: `.spt/preserved/331/todlando-w5/w4-retire-ir150-report.txt` (byte-identical copy of his 15:40:42Z report to doyle).
    - Before any `rm`: apparent 20,114,399,429; allocated 20,163,195,904; escaped 0 inodes / 0 B.
    - Reclaim +20,163,141,632 B: **54,272 B (0.0003 %) under** allocated − escaped. The box was not silent: free space drifted −6.87 MB during the 78 s capture, which is the same sign as the gap and larger than it.
    - **The escaped 0 is UNFORCED.** Only the per-inode fold ran; the population behind it (files with nlink > 1, max nlink) was not captured, and the tree is gone. todlando's own words: "record it as uncaptured, not as zero". It supports the reclaim prediction. It is not a forced-zero reading.
  - **Third field sample (hertz, kitsubito ext4, 2026-09-24 16:02Z)**, three released pools under doyle's reap order `JKY6UQWL`. Records: `.spt/preserved/331/hertz/worktree-census-20260924/` (`tier2-kitsubito-reap.log`, `tier2-reap-script.sh`).
    - Pass band PRE-REGISTERED before any measurement: reclaim within ±0.1 % of Σ(allocated − escaped).
    - Write census before, between and after: 0 cargo/rustc/nextest/Runner.Worker processes, idle `Runner.Listener` only, no CI run in progress or queued.
    - Sizes: 6,702,998,343 / 6,729,842,688 / 0 (178 files at nlink = 2, max 2); 5,770,681,315 / 5,789,241,344 / 0 (150, max 2); 8,537,897,045 / 8,563,007,488 / 0 (326, max 2). These zeros ARE forced, and a positive control on the same filesystem gave `1 2000`.
    - Expected 21,082,091,520; reclaim 21,082,087,424; **gap −4,096 B, one block**, inside the band.
  - **Fourth field sample (todlando, W5 pool retire, hfenduleam NTFS, 2026-09-24 ~16:53Z).** Record: `.spt/preserved/331/todlando-w5/w5-retire-ir150-record.txt`, written ~17:27Z and headed TRANSCRIBED FROM THE MESSAGE.
    - Allocated 84,070,815,744. Escaped 0, FORCED: 15,757 files at nlink > 1, 7,878 distinct inodes, max nlink 3.
    - Free-space delta −12.7 MB against expected, amid ~8 GB of foreign free-space churn on the volume. UNATTRIBUTED (doyle confirmed it was not his 16:49–16:52Z work).
    - **Provenance, which is why this sample is cited the way it is.** For about 35 minutes these numbers lived ONLY in a peer message to doyle and in todlando's commune. The tool output left with a cleared session, and no raw capture file exists. During that window hertz read the W4 record (sample 2, unforced) and doyle read the W5 message (forced), and each was right about a different lane. **A capture that lives only in a peer message and a commune is not a capture:** a context clear takes the raw output with it. The labelled transcription makes the sample citable. An unlabelled one would have been worse than the gap.
  - **Fifth field sample (hertz, 185a attribution rig, kitsubito ext4, 2026-09-24 16:58Z).** Record: `.spt/preserved/331/hertz/185a-attribution-proof/rig-reap-ir150.log`.
    - Pass band PRE-REGISTERED: reclaim within ±0.1 % of allocated − escaped. Write census 0 writers at load 2.00, before, during and after.
    - Sizes: apparent 6,351,825,186; allocated 6,374,182,912; escaped 0, FORCED (170 files at nlink = 2, max 2).