hertz — W2 shape noted, third term held until e3bd53d4 is pushed. While checking one thing that
could have bitten todlando, I found two more. All three measured at main = ff4b405d, no box.

FINDING 1 (the one I went looking for, and it is GOOD news for W2): the gate is ONE-DIRECTIONAL.
check_heavy_integration_classification asserts qualifying-subset-of-HEAVY only — the loop `continue`s
on any binary that does not match spawns_daemon_tree, and names_only_in is used ONLY for the
two-string identity assert, never for a reverse membership check. So todlando hand-adding
webserve_attachment_e2e (which carries NO qualifying literal — his and your measurements agree it has
only "daemon","stop" x2) CANNOT red his lane. A hand-added non-qualifying member is legal by
construction. That question is closed.

FINDING 2 — THE GATE'S SCAN ROOT IS `crates/spt/tests` ONLY (main.rs:584). crates/spt-daemon/tests
and crates/spt-term/tests are never read. spt-term has no exposure (the filter takes the WHOLE
package: `package(spt-term) & kind(test)`). spt-daemon does. Applying the gate's OWN criterion to
crates/spt-daemon/tests yields exactly one binary that qualifies and is not in HEAVY:
`false_promote`. Control, same predicate over the scanned root: 38 qualify, 0 missing — the gate is
doing its job where it looks.

  BUT DO NOT WIDEN THE SCAN ROOT ON THAT BASIS, because the criterion is NOT PORTABLE and this is
  the more useful half of the finding. false_promote matches on `supervise_brain(` — and it matches
  it as an IN-PROCESS LIBRARY CALL: `use spt_daemon::brainproc::{supervise_brain, ...}` at :62,
  called at :298 with a scripted TrialEnv. Inside crates/spt-daemon that literal is an importable
  symbol; inside crates/spt it can only ever mean shelling out to the CLI. The same three literals
  therefore MEAN DIFFERENT THINGS in the two roots, and pointing the existing criterion at
  spt-daemon would import a false-positive class rather than close a hole. This is the same shape as
  my paren-riding miss you had me file: a population defined by where the instrument was pointed.

FINDING 3 — and this one is mine to own as RCA, independent of the criterion. false_promote may
belong in HEAVY on its OWN merits: its header says "a REAL broker hosting a REAL PTY child over the
real local IPC", which is verbatim the class heavy-broker-pty exists for, and it spawns cmd/sleep as
that child at :126-133. It runs in Phase A today, 1 cell per box. AND IT LEAKS ON WINDOWS.

  Baseline golden 34017906638 marks it `LEAK [1.744s]` on hfenduleam, PASS 1.315s on kitsubito.
  Reading the whole leak roster rather than only its row: Windows had 9 leaky cells (matching its
  Summary), Linux 1 (unrelated — livehost::legacy_psyche_sweep_guard). FIVE of the Windows nine are
  the SAME promotion path:
    spt-daemon brainproc::tests::clear_before_spawn_defeats_exact_generation_stale_file   0.457s
    spt-daemon brainproc::tests::ready_but_old_gen_never_drains_does_not_promote_rolls_back 0.554s
    spt-daemon brainproc::tests::stale_generation_minus_one_ready_never_promotes          0.731s
    spt-daemon brainproc::tests::trial_kills_alive_never_ready_candidate_before_rollback  0.582s
    spt-daemon::false_promote ready_candidate_does_not_promote_until_..._drains           1.744s
  Four lib unit tests plus the int rig, all on brainproc/supervise_brain. That is a cluster on one
  module, not scattered noise — and it is the same family as IR-79's second face: children outliving
  the cell. Note the four lib cells are kind(lib), so they run in ci.yml too, on every push.

LIMITS, stated: nextest LEAK is not a failure and none of these reds anything — it means a child
held the output pipe past the test's exit. I have NOT measured WHAT is left alive, and the
"one module, one cause" reading is a clustering of names plus a shared module, not a proven single
cause. Windows-only in this run; one run, not a trend. Everything above is source + one golden log,
no box, no build.

PROPOSED, your call: (a) close Finding 1 as answered; (b) file Finding 2 as an IR-37 rider —
"the criterion's scan root, and why the literals are not portable across crates" — since it is
exactly the arm-(c) argument in a second dress; (c) let me open a register entry for Finding 3, or
fold it into IR-79 as a third face if you prefer one lane. I have taken no action beyond measuring.