---
name: pool-scoped-sweep-blind-to-system32-leak
description: "The path-scoped exe sweep protects the build pool and CANNOT see a test's leaked OS-image tree (cmd/ping/sh) — different leak, different predicate, and the rig's own forced red creates one"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 75169a53-ec72-4b1d-a014-0b77de26bf48
  modified: 2026-08-04T22:07:19.222Z
---

The gate-rig sweep predicate — `Get-Process | Where { $_.Path.StartsWith($pool) }` — is
correct for what it defends (a running image out of the pool blocks the next relink,
[[gate-rig-mechanisms-not-remembered-steps]] bite #8). It is **blind by construction** to a
leaked process tree whose image lives in `System32`: `cmd.exe`, `PING.EXE`, `sh`. Those are
the processes a teardown test spawns as its VICTIM, and they are exactly what leaks when the
teardown under test does not fire.

MEASURED 2026-08-04 (lane `test/teardown-bound-shape` @`579e0b3`, forced red on
`a_tree_teardown_reaches_a_grandchild_the_service_spawned`): I withheld `child.kill_tree()` to
exercise the elapsed-wait message. The row then leaked its own `cmd /c "ping -n 120
127.0.0.1"` tree, and my pool sweep reported 0 both before and after — a true statement about
the pool and a clean zero about the leak. Found it only by asking a DIFFERENT predicate:
`Get-CimInstance Win32_Process | Where { $_.CommandLine -match 'ping -n 120 127\.0\.0\.1' }`
→ 1 survivor (pid 8404), killed by id, 0 after.

**Why:** the two leaks have different images, so one path predicate cannot cover both, and the
pool sweep's zero READS like "nothing leaked" when it only ever meant "nothing in the pool".
Worse in this shape than usual: a teardown test is the rig most likely to leave a victim
alive, so the rig whose defect leaks is the rig whose sweep cannot see it
([[rig-inherits-the-defect-it-studies]]).

**How to apply:**
- Any forced red that WITHHOLDS a kill owns the cleanup of what it deliberately spared. Reap
  by COMMAND LINE (the argv the fixture spawns is the only thing that identifies it), never by
  image name — `cmd.exe` and `ping.exe` machine-wide are other people's processes on a shared
  box ([[no-machinewide-killon-shared-runner]] is the standing rule).
- Report both predicates' counts. "Pool sweep 0/0" alongside "victim sweep 1 → 0" is the
  honest pair; either alone is a clean zero on the other's population
  ([[zero-match-filter-reads-as-absent]]).
- A self-limiting victim (`ping -n 120` dies in ~2 min) is still worth reaping explicitly —
  the bound is the fixture's, not a guarantee, and the next fixture may sleep forever.