deployah -> hertz (doyle cc, this rewrites a triage arm we all agreed to): CORRECTION ACCEPTED IN FULL, and you were right to catch it against your own mechanism — that is the hardest direction to argue and the one that makes the arm usable.

ARM 3, REWRITTEN. Discard my "the stall OUTRANKS the load" wording; it cited you for an outcome you never measured. You measured a GREEN at 63.371 s (Win) / 69.096 s (Linux) with the retry loop six deep; you have never observed this mechanism produce a red. The honest arm, which I am adopting verbatim as the one I will apply:

  On a role-A READINESS red, the read is BOTH, and they compose:
  - the STALL explains WHY THIS LEG is the one that breaks first — it spends ~63 s and six retries of its readiness budget before doing any work, so it enters any contention with its margin already gone ("A not ready" 6 -> 1 is the margin number, not a colour);
  - the LOAD explains WHY ON THIS RUN and not on your quiet-box run.
  Naming only the stall falsely exonerates a real load window. Naming only the load misses a measured, cross-OS, fixed-and-proven cause. Neither alone is the verdict.

The practical consequence survives on firmer ground, exactly as you put it: a leg with six retries of margin already spent is not a fair test of todlando's splice fix under any load — so on a role-A readiness red, lane 3 is fix-set, not optimization. Doyle has already ruled it into r2, so this now governs how I WRITE the red up, not what we do about it. Arms 1 and 2 stand unchanged.

WINDOW BOUND, corrected with your detail: two chains, two end times — yours killed ~15:29Z, todlando's driver walked on to its clippy leg and exited naturally ~15:30Z, and 15:31:02Z (doyle's census, corroborated by mine at 15:31:47Z) bounds only the LATER one. I will state it as "load ended by 15:31:02Z, with the last user-shell chain exiting ~15:30Z" rather than implying one chain ran the whole span.

THE FALSE GREEN: recorded as a NON-RESULT, and thank you for flagging it to the person who keeps the record, because you are right that it is exactly the artifact shape that gets filed as a pass later. What I have written down: watcher exit 0 is the WATCHER's exit, not clippy's; clippy.exit ABSENT; clippy.raw truncated at 11,081 bytes mid "Checking anstyle-wincon", i.e. the chain died inside DEPENDENCY compilation and never linted a workspace crate; nothing claimed from it; the rider's gate remains UNFIRED. It will not appear in the greenlit-form record as anything but unfired, and since the rider is not in r2 at all, there is no head it can leak onto.

That artifact is a sharper version of a rule I already hold — a verdict comes from the exit FILE's content, never from a harness completion status — and your case adds the face where the exit file is ABSENT and a wrapper's own 0 stands in for it, with an empty diagnostics section reading as "no problems found" rather than "nothing ran". I have banked it with your numbers.

Box still yours to hold. Both twohost legs in_progress, run status in_progress. My release line names both conclusions and the run status, and goes to you and doyle together.