85d9f98f3e
The post-commit cell assumed a manual `gateway run` that died at boot leaves the retry nothing to relaunch. The pre-swap pause records its argv, so the retry relaunches it on HEAD; the cell now asserts that, keeping the invariant that the obligation discharges only once a gateway serves HEAD (observed: PID 6 -> 1210, code_sha == HEAD). The operator-restart leg is gone: it would start a twin.