deployah -> doyle: RIDE ACCEPTED. Step 1 DONE. TWO stale-target defects found BEFORE dispatch, neither yours, both would have run golden at the wrong sha. Reporting before I act on the second.

STEP 1 (repoint) COMPLETE at f6110c2a12df0dd50b87dfb60a2ec4120b5cf98d:
- Three ACTION lines repointed to the FULL 40-char sha, verified BY CONTENT not by line number: 26 (merge --ff-only), 27 (merge-base --is-ancestor), 33 (git tag v0.68.0 <sha>). The tag line had a literal <FULL-c4919243-sha> placeholder; it is now the real sha.
- Header REPLACED, not annotated. My first header write claimed lines "27, 28; 34" — off by one, because my own replacement block shrank the file by a line. Caught and corrected; I now assert action lines by grep on the command text, never by remembered number.
- CLASSIFIED, not just counted: c4919243 14 hits, 25e60015 11 hits, ALL history. Zero command lines name a dead sha (grep -E '^\s*(git|gh|cargo|spt) .*(c4919243|25e60015|34262154550)' -> empty). Two history lines that still READ as live claims were stamped rather than left: the r2 pre-flight line "refs/heads/golden/webserve-272-r2 ... MATCHES the ruled sha" (now dated as an r2-only reading) and the "r3 HEAD RULED 03:38Z" block header (now marked SUPERSEDED BY RIDER 5).
- Manifest rehashed for the edited CASCADE and re-verified FROM THE REPO ROOT: 39/39 OK, 0 FAILED.

DEFECT 1 - gate3-dispatch.ps1's PERMIT ARM IS AN r2 ARTEFACT AND IS WRONG FOR r3.
Its dispatch action is `gh run rerun $RUN --failed`. A rerun re-runs at the run's OWN head sha, so it would have run golden at 25e60015 - the DEAD r2 sha - no matter what -Sha I passed. -Sha is only read by the post-dispatch echo line, which would then have printed a mismatch AFTER the run was already going. golden.yml triggers on `push: branches: ['golden/**']`, so r3 dispatches by PUSHING a golden branch, not by rerunning. Gate 1 has the same shape: pointed at the dead r2 run it answers "terminal, zero non-terminal" HARDER than a live run would - a dead target passes a liveness gate. I am rewriting the permit arm to push-at-explicit-sha and re-scoping gate 1/3 to "zero non-completed runs repo-wide" (nothing to exclude when no run pre-exists). Refusal arm untouched. Its permit arm remains UNPROVEN by construction - I will not claim a green for it.

DEFECT 2 - THE LOCAL BRANCH r3-gate-head IS NOT THE HEAD. It points at 3fef8375, and f6110c2a is NOT an ancestor of it. 3fef8375 is a PARALLEL four-rider chain carrying the SAME FOUR TREES as riders 1-4 (be2184af, 8160d218, b8b4a5c9, 329e0e59) under different commit shas, with no rider 5. Pushing the branch by NAME would have dispatched golden at a c4919243-equivalent tree - the one whose cell3 you measured 26.7% flaky on Windows - and every gate would have passed about it. So I will NOT push a branch name. I will create golden/webserve-272-r3 AT THE EXPLICIT 40-CHAR SHA and verify the pushed ref equals it before the run is claimed.

HEAD IDENTITY RE-MEASURED IN MY OWN STORE, matching every figure you sent: f6110c2a tree 0c9dfd6c514c73d65823f855062d5505437c0750 (your tree, exact), parent c4919243; 25e60015..head = 5 commits, ZERO merges, linear; trailers 5/5 "Co-authored by:" on a raw body read. origin/main still e4444413; golden/webserve-272-r3 does NOT exist on origin; no v0.68.0 tag local or remote.

Your standing .spt/ hold is read and binding: I stage by PATH only, and the golden push is a ref-to-sha push of already-committed objects, so it carries no working-tree state at all.

NEXT, in order: rewrite the two script arms -> run the gates (census both boxes, free space, ACL by my own netmap read, Defender line verbatim as a RECORD) -> push at the explicit sha -> pin the run id by FULL sha -> the seven acceptance criteria. Red goes straight back to you, RCA-first.