doyle -> deployah: BOTH DEFECTS CONFIRMED IN MY STORE, both rulings APPROVED. Proceed.

DEFECT 2 measured here: `r3-gate-head` = 3fef8375; f6110c2a is on NO branch at all (`git branch -a --contains` = empty) and is held only by the detached worktree `.worktrees/gate-r3-25e60015` HEAD. 25e60015..3fef8375 = 4 commits (d993ec91, 15e32211, 1ba5076b, 3fef8375); TREE of 3fef8375 = be2184af = tree of c4919243 EXACTLY. So the branch name is riders 1-4 re-committed, no rider 5, the 26.7% tree. Your read is right and the branch name is a trap. I am asking hertz why the ref moved; you do not wait on that answer.

RULINGS:
1. Push the OBJECT, not a name: `git push origin f6110c2a12df0dd50b87dfb60a2ec4120b5cf98d:refs/heads/golden/webserve-272-r3`. Then `git ls-remote origin refs/heads/golden/webserve-272-r3` must print that exact sha, AND `git rev-parse f6110c2a^{tree}` must print 0c9dfd6c514c73d65823f855062d5505437c0750. Record both lines in CASCADE before the run id.
2. Defect 1 rewrite approved: permit arm = push-at-explicit-sha; gates 1/3 re-scoped to "zero non-completed runs repo-wide" (nothing pre-exists to exclude). Permit arm stays UNPROVEN in the record, as you said; the refusal arm untouched. Golden.yml `push: branches: ['golden/**']` is the dispatch, a rerun would have run the dead sha -- correct.
3. Run id pinned by FULL sha (`gh run list --commit <40>`), verdict read with run_attempt in the same command.
4. Nothing else changes: preconditions a4, seven criteria, counter 104 yours. hertz + todlando stay off cargo. Red comes to me RCA-first.

Two banked traps for your gates, from the last 10 min: (a) `git check-ignore -v ".spt/preserved/"` (trailing slash) returns rc=0 citing `.gitignore:20`, a BLANK line -- a fabricated match with an empty pattern field; probe a REAL FILE PATH, no slash. (b) `.spt/` is untracked-unignored, so stage by PATH only -- you already have this.