hertz -> doyle: RCA on the two brainproc LEAKs at a1f4901e. PRE-EXISTING by construction; W7 is not implicated. I did NOT spend a base rebuild on it. Here is why, and what is proven vs inferred.

MECHANISM (source, identical at 9315f649 and a1f4901e): the tests' long_child() on Windows is `cmd /C ping -n 30 127.0.0.1` with ONLY stdout nulled. stderr and stdin are INHERITED, i.e. nextest's capture pipe. The supervisor kills the Child, which is cmd.exe. The grandchild PING.EXE is never killed and holds the inherited stderr for up to ~29 s, and nextest reports that as LEAK. This matches your observation exactly: A11's assert checks the killed pid (cmd) is dead, and it HELD. The handle outliving the test is ping's. Linux long_child is a bare `sleep 30` that the kill ends, so kitsubito would read no-leak at BOTH shas. That is vacuous, and it is why I did not use kitsubito as the discriminator.

PROVEN just now on hfenduleam (PowerShell only, no cargo): I spawned cmd /C ping -n 30, whose children were PING.EXE 55420 + conhost 48852. After Stop-Process -Force on cmd (TerminateProcess, the same call Child::kill makes): cmd dead, PING.EXE ALIVE, conhost ALIVE. Cleaned up, 0 survivors.

W7 PATH EXONERATION (diff read): git diff 9315f649..a1f4901e -- brainproc.rs has 4 hunks: BRAIN_EXE_ENV/canonical_exe/brain_launch_exe, run_brain (launch pin + spawn_adapters_leg), spawn_brain_child (env stamp), spawn_brain_supervisor (canonical_exe()). ZERO touch the test module, long_child, or supervise_brain's kill path. Both tests call supervise_brain directly with a closure spawn, so none of the 4 hunks is on their path.

INFERRED, NOT MEASURED: that they also LEAK at base. The direct discriminator is still a Windows base run. If you want it as a reading rather than an argument, it is yours or a GO on hfenduleam. Prediction for anyone who runs it: LEAK on both, on EVERY long_child test whose candidate gets killed (users at :1529 :1953 :2227 :2271 :2313 in a1f4901e). Only 2 of your pinned 10 were such tests.

FIX (small; not W7's, and not urgent for the golden): make the Windows long_child spawn PING directly (`Command::new("ping").args(["-n","30","127.0.0.1"])`), so the kill hits the process that holds the handles. Also null stderr/stdin there. A test tagged REQ-HAZARD-BROKER-PROCESS-ISOLATION should not itself leak a process tree. File it as an IR, or route it: your call. I can take it after the #274 rebase.