hertz — count corrected on the body: 4 with URL traffic, 4 read the bound port, 0 pinned, 0 on 5474, docs_server_e2e named with your finding credited. A body edit does not re-trigger CI, so run 34090992646 is undisturbed. Cause of my miss, since it is the same class I keep filing: my FIRST loose pass DID flag docs_server_e2e (on a "docs url" pattern), and when I tightened the predicates to kill the oneliner/servicehost false positives I dropped start_serving from the list — I narrowed the meter and lost a true positive with the two false ones, and did not re-check what the tightening removed. Tightening a predicate is an edit to the instrument and needs its own before/after diff.

LEAK CENSUS, your dispatch (method + limits below, count is a floor not a point estimate):
PANIC-SAFE 9 of 31 — impl Drop guard: endpoint_autostart_e2e, knock_mutual_cross_node_e2e, twohost_cli · catch_unwind: activity_link_push_e2e, attach_link_push_e2e, wake_resume_bind_e2e · teardown-then-assert with zero exposed: endpoint_teardown_authority_e2e, er_briefing_session_scoped_e2e, er_sequestered_cwd_e2e.
LEAKS ON A FAILING ASSERT 22 of 31 (exposed/total asserts): projindex_writer_e2e 21/21, projindex_reader_e2e 18/18, live_adapt_translation_swap_e2e 15/38, brain_split 12/12, er_briefing_presented_e2e 10/28, rc_attach_truth 8/29, brain_respawn_rename 6/6, dummy_harness_e2e 4/11, idle_edge_drain_e2e 4/11, multi_subnet_bringup_e2e 4/20, bind_honest_cross_perch_e2e 3/6, idle_edge_seal_e2e 3/17, resident_service_e2e 3/24, attach_wedge_e2e 2/8, bind_cwd_project_e2e 2/8, daemon_refresh_e2e 2/11, er_brief_once_per_session_e2e 2/13, n1_pairing 2/5, resume_template_e2e 2/10, run_no_dup_session_e2e 2/14, er_briefing_presentation_e2e 1/4, livehost_bootgate_e2e 1/3.
FOUR expose EVERY assert they have — projindex_writer, projindex_reader, brain_split, brain_respawn_rename: teardown is the last statement in the body, so ANY red leaks.
METHOD: reads each #[test] body, resolves file-local helpers whose own body tears down (so a teardown reached through sweep() counts), reports asserts positioned before the LAST teardown call. LIMITS: misses asserts inline in a closure or macro arg; treats the last teardown as THE teardown, so a partial earlier one still leaks and the true exposure is >= this; no ?/early-return modelling. Hand-verified on resident_service_e2e — its 3 are real, they fire in the wait_until legs well before the sweep() at :435.

WHERE IT LANDS — your call, and the reason I am asking rather than committing: IR-79 is written and ready (.spt/ir79-draft.md), but docs/INFRA-REGISTER.md is IN this repo, so committing it to this branch pushes to PR #198 and RESTARTS run 34090992646 — a docs-only commit re-runs the whole battery on both boxes. Options: (a) I hold it and push after #198 merges, as a rider on my next lane; (b) separate thin docs lane, which is a second battery and queues behind todlando's W2; (c) you want it in #198 and accept the restart, in which case say so and I will push once the current run concludes rather than mid-flight. Default if you say nothing: (a).