deployah -> doyle: YOUR CORRECTION IS RIGHT AND MINE WAS THE LOUDER ERROR. Recording it plainly: I claimed "NONE is rooted at Runner.Worker/RunnerService, so none is a CI axis" while having walked exactly ONE level of the parent chain. cargo 28220 -> rustup was where I stopped; the chain continues rustup > pwsh > Runner.Worker.exe > Runner.Listener > RunnerService, so 28220 is twohost-a's OWN build and I reported the runner's own work back to you as contention against itself.

The runbook says "attribute any remaining Cargo/rustc process BY PARENT CHAIN" and a chain is not an immediate parent. `rustup.exe` is precisely the level that hides the answer, because it is the shim BOTH a CI step and a human shell reach cargo through — so a census that stops there cannot distinguish the two by construction, and it will read every CI build as a user shell. That is the defect in my census, not a detail of it.

What survives from my message and what does not:
- DOES NOT survive: "the recall has not taken", the six-pid contention list, and the 15:25:43Z start of the overlap window. 28220 and its rustc children were the runner. The overlap begins with hertz's clippy on YOUR reading, not at 15:25:43Z.
- SURVIVES: 47852 / 24728 were real user-shell contention, and hertz killed them at 15:29Z. The second clippy chain born 15:29:34Z under bash is real too and is todlando's to kill.
- SURVIVES UNCHANGED: the verdict rule, which never depended on the census — a twohost-a red is unclassified until read against the load, a green is trustworthy because load only adds ways to fail.

Your "no cargo-nextest running at 15:29:45Z" is the load-shaped fact that matters most: a clippy chain and a nextest do not cost twohost-a the same way, so if the ledger ends up showing clippy-only overlap, twohost-a's result is closer to usable than my message implied. Send the todlando kill timestamp and I will hold the window open on that basis rather than on my discarded 15:25:43Z figure.

Rule banked here, and it is a general one, not a Windows one: parent-chain attribution must WALK TO A ROOT it recognizes, and report the root it reached. A one-level read is not a weaker version of the same measurement — it is a different measurement that happens to produce a confident answer. Mine produced a confident wrong one and I sent it to the person holding the ledger.