diff --git a/scripts/test.sh b/scripts/test.sh
index cdc6d3e1d..1b4873c9f 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -267,6 +267,9 @@ bash "$ROOT/tests/test_activation_diagnostic_contract.sh"
 echo "=== Step 0e3: security gate fail-closed contract ==="
 bash "$ROOT/tests/test_security_gate_fail_closed.sh"
 
+echo "=== Step 0e4: memory-analyzer gate warning-suffix contract (#2442) ==="
+bash "$ROOT/tests/test_lint_mem_gate.sh"
+
 echo "=== Step 0f: tree-sitter runtime Makefile dependencies ==="
 bash "$ROOT/tests/test_makefile_ts_runtime_dependencies.sh"
 
diff --git a/tests/test_lint_mem_gate.sh b/tests/test_lint_mem_gate.sh
index 05c2bd4a3..c6a655222 100755
--- a/tests/test_lint_mem_gate.sh
+++ b/tests/test_lint_mem_gate.sh
@@ -1,20 +1,56 @@
 #!/usr/bin/env bash
-# Regression contract for clang-tidy's `,-warnings-as-errors` diagnostic suffix.
+# Regression contract for clang-tidy's `,-warnings-as-errors` diagnostic suffix
+# (#2442). With WarningsAsErrors enabled, clang-tidy prints an analyzer check as
+# [clang-analyzer-<check>,-warnings-as-errors]; a gate that only accepts
+# [<check>] drops every such line and reports a clean gate. A suffixed finding
+# WITH an argued whitelist entry must be counted under its plain check name and
+# suppressed (exit 0, "1 argued false positive"). Every assertion is reported,
+# so a regression names what broke.
+#
+# The gate runs from inside the fixture directory with RELATIVE paths. On the
+# Windows leg python3 is a native MSYS2 build: MSYS converts path ARGUMENTS for
+# it, but never the diagnostic text on stdin, so an absolute /c/... path in a
+# finding would not resolve there, and a C:/... one would not parse (the file
+# field ends at the first colon).
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+GATE="$ROOT/scripts/lint-mem-gate.py"
 FIX="$(mktemp -d "${TMPDIR:-/tmp}/lint-mem-gate.XXXXXX")"
 trap 'rm -rf "$FIX"' EXIT
 
+failures=0
+fail() {
+    echo "FAIL: $*" >&2
+    failures=$((failures + 1))
+}
+
+show() {
+    sed 's/^/    | /' "$1" >&2
+}
+
+# A subshell, so the test's own shell never sits inside $FIX (Windows cannot
+# remove a directory that is a process's working directory).
+run_gate() {
+    (cd "$FIX" && LINT_MEM_WHITELIST=whitelist.txt python3 "$GATE" "$@")
+}
+
 cat > "$FIX/sample.c" <<'EOF'
 int sample(int *value) {
     return *value;
 }
 EOF
 
+# A native Windows python3 writes CRLF; strip it before the hash is reused.
+HASH="$(run_gate --hash sample.c sample | tr -d '\r' | awk '/^segment-sha256:/ {print $2}')"
+if [[ ! "$HASH" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "FAIL: lint-mem-gate.py --hash sample.c sample printed no segment hash (got '$HASH')" >&2
+    exit 1
+fi
+
 cat > "$FIX/whitelist.txt" <<EOF
-## $FIX/sample.c :: sample :: clang-analyzer-core.NullDereference
-segment-sha256: PLACEHOLDER
+## sample.c :: sample :: clang-analyzer-core.NullDereference
+segment-sha256: $HASH
 why: |
   The test deliberately models a diagnostic that is suppressed by the fixture whitelist.
   This text is long enough to exercise the gate's normal argument validation path.
@@ -22,18 +58,23 @@ tried: |
   The fixture is intentionally minimal and only verifies diagnostic parsing.
 EOF
 
-HASH="$(LINT_MEM_WHITELIST="$FIX/whitelist.txt" python3 "$ROOT/scripts/lint-mem-gate.py" --hash "$FIX/sample.c" sample | awk '/^segment-sha256:/ {print $2}')"
-python3 - "$FIX/whitelist.txt" "$HASH" <<'PY'
-from pathlib import Path
-import sys
+SUFFIX='[clang-analyzer-core.NullDereference,-warnings-as-errors]'
 
-path = Path(sys.argv[1])
-text = path.read_text(encoding="utf-8").replace("PLACEHOLDER", sys.argv[2])
-path.write_text(text, encoding="utf-8")
-PY
+# Whitelisted: counted under the plain check name, then suppressed.
+rc=0
+printf '%s\n' "sample.c:2:12: warning: possible null dereference $SUFFIX" \
+    | run_gate > /dev/null 2> "$FIX/whitelisted.err" || rc=$?
+if [ "$rc" -ne 0 ]; then
+    fail "a whitelisted suffixed finding left the gate at exit $rc, expected 0"
+    show "$FIX/whitelisted.err"
+fi
+if ! grep -q 'memory gate clean (1 argued false positive' "$FIX/whitelisted.err"; then
+    fail "a whitelisted suffixed finding was not counted as 1 argued false positive"
+    show "$FIX/whitelisted.err"
+fi
 
-printf '%s\n' "$FIX/sample.c:2:12: warning: possible null dereference [clang-analyzer-core.NullDereference,-warnings-as-errors]" \
-  | LINT_MEM_WHITELIST="$FIX/whitelist.txt" python3 "$ROOT/scripts/lint-mem-gate.py" 2> "$FIX/stderr"
-
-grep -q 'memory gate clean (1 argued false positive' "$FIX/stderr"
+if [ "$failures" -ne 0 ]; then
+    echo "lint-mem-gate warning suffix contract: $failures assertion(s) failed" >&2
+    exit 1
+fi
 echo 'lint-mem-gate warning suffix contract passed'