RCA on run 34239258523 job 102104983586 — MECHANISM NAMED at source, respin accepted, 2f422990 dead as a candidate. My own copy of the job log: 580,307 B, grep -c Summary = 1, 3323 run / 3320 passed / 3 failed / 1 skipped, exactly the three FAIL lines you named and no other.

MECHANISM (product, W2, one seam): crates/spt-msg/src/emit.rs `splice_typed_msg` — new in W2 commit 92715374 — rebuilds a delivered msg envelope from `parsed.attrs`, and spt-proto's `parse_attrs` keeps `type` in that list (event.rs:542-550: event_type is a find, not a removal), while `compose_typed_event` (event.rs:437) writes `type` itself first. Hence `type="msg" type="msg"` on every delivered envelope. Your claim was right; the caller-passes-type reading is exactly it. Before W2 a plain send never reached the splice; W2 pre-composes every non-empty send (its commit message says so), so every delivery now does. W2's own unit cell passes because `ParsedEvent::attr` returns the first match and nothing counts occurrences.

THE THIRD RED is the other face, as you suspected, and it is a REPIN not the same fix: gateway_e2e.rs:225 asserts the SPOOLED body == "do this" (raw), and the spool now holds the pre-composed `<EVENT type="msg" from=... msg-id=...>` (single type there — the doubling is at delivery, not at spool). W2's commit predicted "cells that assert a plain send spools a RAW body will red, and each one gets named and repinned" — this one was never named, because nobody ran it post-W2.

MY GATE GAP, stated: all three cells last PASSED at W1 (9489ef60; preserved gate-w0 + w1-kitsubito raws). No preserved raw at bccfaee8 or fd296557 carries them — my W2/W3 targeted legs never re-ran the `spt` e2e crate, and the W2 thin-CI unit job runs libs only. Pre-existing cells with a stale denominator, not never-executed ones; your list was right that they were not on it, and that is the lesson: the changed seam's consumers, not the added cells, were the population I failed to run. The fix lane's battery runs `-p spt` in full on both OSes.

DISPATCHED: todlando — product fix (splice must not re-emit `type`) + a COUNTING regression cell in spt-msg, branch fix/272-splice-double-type off fd296557. hertz — repin gateway_e2e:225 to the W2 contract, own branch. Both thin; I assemble the respin head on main after both land (ff, tested==merged) and hand you the sha, re-shaped from scratch, never on 2f422990. Windows evidence from the held run is welcome: the mechanism is OS-independent by construction (pure string composition), so a Windows red on the same three cells confirms and a Windows green would be the surprise worth a second look.

Yes, move lin-test-102104983586.log to Documents\spt-preserve\; I hold a byte-count-matched copy in my scratchpad and will preserve it under .spt/preserved/golden-272-r1/ with the verdict.