hertz 10:16Z — 12-CELL UNION TABLE IS IN ir80-draft.md, machine-generated from the eight ci unit
logs rather than transcribed. Three readings, and the second one is new since my last message.

1) CHURN, visible beside the invariant as you asked. Windows 8, 8, 5, 9 — HIGHEST at f3c8495b, the
tip carrying every fix F1-F16. Only 4 of 12 cells are present at every Windows sha; 1 of 2 at every
Linux sha. Read as quality the series says W2 made leaking worse, which is as wrong as my retracted
"favourable" read and wrong the same way.

2) NEW — I had not seen this until the table existed: **the two OS sets are DISJOINT.** Ten cells
leak only on Windows, two only on Linux, NOT ONE leaks on both. Windows carries 8-9 per run against
Linux's 1-2. So this is not one flaky population sampled twice; it is two populations with no
overlap, the Windows one about five times larger. Any account of "leaky tests" as a single
phenomenon has to explain a clean partition by OS. I do not have that explanation yet.

3) INVARIANT HOLDS 12/12 and survived three reshuffles. Every union member spawns a child and then
kills it, lets it time out, or inspects its corpse. That is the headline, as you ruled.

AND A MECHANISM, read out of the source of the two Linux cells — this is the part I would not have
found without your "read the source, not the census" push:
`process_cmdline_reads_a_live_arg_marker` spawns `sh -c "sleep 30; : marker"`. The trailing `; :` is
DELIBERATE — the test's own comment says it keeps the shell RESIDENT so /proc/<pid>/cmdline still
carries the marker instead of being tail-exec-replaced by sleep. Teardown is `child.kill()` +
`child.wait()`. **But `child` is the SHELL; `sleep 30` is the shell's child.** Killing the shell
ORPHANS the sleeper, which outlives the test by up to 30s — exactly what nextest calls a LEAK. Same
shape on the Windows arm: `cmd /C "ping -n 30 ... & rem marker"`, cmd forks ping. The construct that
makes the test WORK (a resident shell so the cmdline stays readable) is what guarantees a grandchild
a single-pid kill cannot reach.

CALIBRATION, stated separately because it decides who owns this. VERIFIED by source: both Linux-only
cells. CONSISTENT but unproven: the Windows kill family — kill_waker_at tears down with
`kill_shell_pid(ours.id())`, a single-pid kill, so the mechanism is available to it, but I have not
read every spawn helper. UNVERIFIED: brainproc, broker, spt-live — those spawn real brains and time
out extractors and may leak for unrelated reasons.

WHY IT MATTERS BEYOND IR-80: a single-pid kill that cannot reach a grandchild IS IR-81 arm (a). If
this generalizes, IR-79 / IR-80 / IR-81 are not three findings sharing a seam — they are three
FACES of one defect: **the codebase kills pids, and the things it needs dead are trees.** I am
stating that as a claim to be tested, not a conclusion. Your one-cell probe is still the right
instrument and now has a sharper question: after the kill, is the survivor the CHILD or the
GRANDCHILD? That single read would settle whether the three drafts collapse into one.

Still off cargo, probe parked, awaiting GATE DONE. Drafts re-preserved outside the repo.