The process census covers one of about twenty-five spawn sites

[rainmanjam]

From the poka-yoke audit of 2026-09-04. Lens: fixed-value. Today: rung 3, scoped narrower than it reads. Device reaches: rung 2 (Warning). Silent.

The mistake available

Read an empty surviving-children report as "the teardown was clean", or spawn a
long-running child anywhere outside internal/supervisor.

internal/supervisor/census.go — enrol/discharge are unexported, and
their only writers are supervisor.go:862 and :979. The consumer is
cmd/polyemesis/main.go:492 → reportSurvivingChildren.

exec.CommandContext also appears in internal/media,
internal/transcribe (x4), internal/clipper, internal/playlistmedia,
internal/api/expert.go, internal/api/playout.go, internal/ffmpeg,
internal/recording. None enrol, and none can.

What happens

census.go:11-19 frames the device as "WHAT HAVE WE ACTUALLY SPAWNED?" and
main.go:1011-1022 says it "would have said it on the first occurrence" of
#631. Both are true only for supervisor children.

A transcode or a whisper child surviving shutdown produces exactly the silence
#631 produced — and now the shutdown log actively reports that nothing is wrong.
A detection device that under-reports is worse than none, because its green is
read as an all-clear.

(Filed by the same author who added the census this morning. The scope was not
stated when it was added, and it reads wider than it is.)

Related: media.Exec does not call setProcessGroup, so its grandchildren are
outside even the systemd KillMode=mixed reasoning in proc_unix.go:29-32.
Probably worth its own look.

Device → rung 2, Warning

Two parts:

1. Export supervisor.Enrol/Discharge, or extract a childproc.Spawn that
   every site uses; and make the report name its scope so a clean report
   cannot be read as more than it is.
2. A forbidigo rule in .golangci.yml banning exec.Command* outside an
   allowlisted package, so the next omission fails CI.

Control is not available: nothing in Go prevents a package calling
exec.Command directly.

[rainmanjam]

Device built — PR #722. Rung 2, Warning — as proposed, and both parts of it.

The census had to move packages, not just export two functions.
internal/supervisor imports internal/ffmpeg, so ffmpeg could never have
enrolled in a census that lived inside supervisor — the import would have been a
cycle. internal/childcensus is a leaf package importing nothing from this
module, so every spawner can reach it. Enrol/Discharge are exported there.

The spawners that can outlive a call now enrol: media.Exec (every
transcode and derivative encode), the live-caption whisper and audio tap, and
the transcription extract and whisper workers. Discharge is paired at the
Wait, which is the only moment the pid is genuinely gone.

Part two, in the tool this repo actually runs. There is no .golangci.yml,
so forbidigo was not available — but npm run lint and go test both gate CI,
and the repo already enforces this class of rule with build-time guards (see
#713). TestEverySpawnSiteIsAccountedFor walks every non-test .go file and
requires each package calling exec.Command to be either a package that enrols
or one listed with a reason saying what bounds its child's life. Seven silent
omissions became seven stated decisions; the twenty-first spawner fails the
build. The excuses are checked too: under 40 characters, or containing TODO,
fails — and an entry for a package that no longer spawns anything fails, so the
list cannot rot into a standing excuse nobody re-earned.

The walker skips every dot-directory, not just .git: .claude/worktrees
holds checkouts of this same repository, and walking them reported every spawn
site three times under a path nobody can act on.

reportSurvivingChildren now names its scope, as this issue asked. Its test
asserted the opposite — "a line here on every clean stop would teach operators
to skim past the one that matters" — and that reasoning was sound while the
scope was narrow enough to make silence ambiguous. The test now pins the new
property and records why it changed.

Not done: the media.Exec / setProcessGroup observation at the end of this
issue. It is a real second finding and deserves its own issue rather than riding
in on this one.

Three mutations red.

[rainmanjam]

Split the tail observation out to #723 — the media.Exec / setProcessGroup asymmetry — rather than letting it ride in on this one. It is a genuine second finding with a decision in it (whether these spawners should have their own group at all, given #448 argued a new group is what detaches a child from an abrupt supervisor death), and it needs arguing before it is coded.