## Fix

Both `twohost-a` and `twohost-b` now use `needs: [test, n1-gate]`. Both test/n1 matrices finish before either role becomes eligible on the single-slot runners. This removes the within-run scheduling race; it does not guarantee scheduler simultaneity or eliminate unrelated runner contention.

- Keep `!cancelled()` and the explicit manual opt-out unchanged: unrelated upstream failures must not erase independent seam evidence.
- Keep the **900s rendezvous budget** unchanged; no product/test-body changes or budget widening.
- Update the workflow explanation and `docs/GOLDEN-CI.md` operating procedure.
- Add **IR-142, BUILT-pending-golden**, with the RCA as origin and the successor acceptance gate. IR-142 was unused at apply; allocated as requested by Doyle. The base register ends at IR-137; no unrelated entries are copied from the assembled golden line.

Symmetry is necessary: adding n1-gate only to A would still release B early. Depending on n1-gate without test would permit the mirrored ordering failure.

Related: https://github.com/BigscreenVR/spt-bs-releases/issues/307
Origin: `.spt/preserved/307/golden-35313912102/RCA-twohost-b.md`, read in full; adjacent `twohost-b-105517287374.log` records the failed pairing rung.

## Existing negative control — golden 35313912102

| Job | startedAt (UTC) |
|---|---|
| twohost-b / kitsubito | 2026-09-18T07:22:22Z |
| twohost-a / hfenduleam | 2026-09-18T07:33:01Z |

**639s skew.** n1-gate Windows ran between test and A, 07:22:22Z–07:32:59Z. B's 900s rendezvous wait expired before A's build/bring-up completed (test wall 900.48s). This is CI shape, separate from the resume/reconcile product race in the same golden.

## Local verification — structural only

Receipts: `.spt/preserved/307/twohost-barrier/`.

- PyYAML 6.0.2 parsed the workflow; the dependency DAG is valid with no missing job references.
- Parsed comparison with base: exactly two semantic changes, the roles' `needs` values. All other workflow values, conditions, steps and timeouts are unchanged.
- All four matrix-completion combinations checked: neither role passes the dependency barrier until both matrices finish, then both do.
- `traceable-reqs check --json`: **926/926 complete, zero findings**, exit 0.
- No cargo, runner mutation or same-SHA golden rerun. Actionlint is not installed; no actionlint execution claimed. These checks do not prove cross-host pairing.

## Successor golden acceptance — PENDING

Thin CI cannot pair the hosts. The successor golden must include both this repair and todlando's resume/reconcile repair, with deployah reshaping once on top of both. Acceptance requires starts **within seconds of one another AND both jobs green**.

| Successor evidence | twohost-a | twohost-b |
|---|---|---|
| startedAt (UTC) | Not yet observed | Not yet observed |
| conclusion | Not yet observed | Not yet observed |

Update this PR body/gate receipt with the successor run URL, candidate SHA, both exact `startedAt` timestamps and both conclusions when observed. IR-142 remains BUILT-pending-golden until that evidence exists; the historical timestamps above are the negative control, not successor proof.

Doyle owns fast-forward order. Base is `0ab1e48b7c4cf4c16e0e46c14b415ff28bbc8f5c`; whichever repair lands second rebases before merge. No merge or golden dispatch performed by this lane.

Co-authored by: hertz