FINAL UPDATE: exact-candidate gate COMPLETE at a2eb40c4ed4e4bce2022a5d103474cda2b03f834.
Restacked Linux: fetch=0, checkout=0, claim=0, fixture=0, touched=0, traceability=0, read from individual exit files. subject.sha matches exact candidate. One Summary: "Summary [ 29.020s] 3 tests run: 3 passed, 0 skipped". Run ID c0b263be-80f1-4fd8-a87a-bdeffb0b4c7c. Drive 0.315s, activity 16.043s, attachment 12.977s. Remote raws /home/reavus/gate-294-hertz/keeper-head9/; local copy .spt/preserved/hertz-287-linux-head9/. Verified own hertz-287-head9 pool record before pool-release; release exit0. KITSUBITO FREE.
Together with the five exact-candidate Windows passes below, the requested gate is complete. The earlier BLOCKED and remaining-todo paragraphs below are retained only as pre-release history and are superseded by this update.

Candidate: a2eb40c4ed4e4bce2022a5d103474cda2b03f834
Parent: 578ad38b568df3214501f258eecfcc1572f84430 (assembly head 9)
Published origin branch: fix/287-keeper-before-bind; no PR created.
Original pre-restack: f0e120924babd73d1032f07777b2638afe012883 on head 8.
Stable patch-id both: 0e9ba83416900778a55cbab39672c4af3cc661ed.

Scope: test-only, three files, existing traceability tags retained. Attachment initial and rebind keeper records precede binding; viewer-present barrier remains before keeper replacement and binding, and changed=None assertion remains. Activity initial and rebind keeper records precede binding; missed busy transition remains before fresh keeper/binding. Drive initial setup already correct; relink now replaces the dead stand-in before fresh binding; stale pending drive/link-break/token-rotation assertions retained. Gateway already records keeper before its only bind; no second bind after relink. Tunnel has no keeper or reconciliation loop (in-process seed/broker/tunnel fixture), so no matching bind-before-keeper shape. Gateway/tunnel unchanged. Rustfmt ran on the three changed files; no product/config/doc changes.

Windows exact-candidate proof COMPLETE: .spt/preserved/hertz-287-windows-gate-v2/ stores subject SHA, commands, raws, exits, timestamps, summary counts. Five independent runs, each 782 run/782 passed/0 skipped, exactly one Summary. All three touched e2es PASS in each. Durations 162.955,146.205,133.271,117.642,140.009 seconds. Existing default scheduling; real spt bin unit workload supplies load. Fixture and traceability exit0. Condensed proof: hertz-287-windows-proof.json.
Attempt1 is preserved separately in hertz-287-windows-gate/: no library target in spt, exit101, zero tests/zero Summary. Corrected command removes nonexistent --lib, retains --bins plus the three test binaries. Not a failing test and not hidden.
Windows gate-293c pool released successfully after proof. RIG FREE sent to Doyle.

Linux ORIGINAL-HEAD proof COMPLETE, NOT restacked proof: original f0e12092 ran three touched e2es 3/3 pass,0 skipped,one Summary,32.654 seconds, run ID31dcc845-5209-43c7-b632-2b51ec8cb1c0. Fixture/traceability exit0. Local raws hertz-287-linux-gate/; remote /home/reavus/gate-294-hertz/keeper-before-bind/. Restack file equality and patch IDs saved in hertz-287-restack.json.
Linux RESTACKED proof BLOCKED on Doyle's KITSUBITO FREE for /home/reavus/spt-core-gate-w2, retained by his head9 compile/full gate since03:46Z. Do not inspect his session logs or touch the tree until released. Prepared bundle hertz-287-head9.bundle and script hertz-287-head9-linux.sh have NOT been transferred/run. After release: scp both to /home/reavus/ then ssh reavus@kitsubito bash /home/reavus/hertz-287-head9-linux.sh. Script pins exact candidate, claims existing target, builds fixture, runs3 touched binaries, records one-Summary count and traceability. Preserve remote keeper-head9 raws locally, release pool, report exact verdict to Doyle/deployah.

Authoring worktree hertz-287-rig removed successfully. Its gitdir had malformed backslash registration ending in .git; git worktree repair of the named path fixed its record (also printed errors for unrelated existing malformed records, which were not edited manually), then absolute-path worktree remove succeeded. No authoring target existed; no gate target deleted. Branch and evidence retained. No lifecycle action performed.

Remaining todos: Verify restacked candidate on released Linux slot (blocked), Commit thin lane and deliver gate evidence (commit and push done; final two-platform handoff pending Linux). Do not call the whole gate complete before Linux result.