diff --git a/RELEASE-EVIDENCE-internal.md b/RELEASE-EVIDENCE-internal.md
index 90bd424..41d7f7b 100644
--- a/RELEASE-EVIDENCE-internal.md
+++ b/RELEASE-EVIDENCE-internal.md
@@ -44,13 +44,18 @@ BIND 9 endpoint. Resolution (fix commit acd0352):
    AXFR path works across both server implementations; BIND is the
    judge-required one and is satisfied above. Older-dig (9.11–9.16)
    leniency could not be reproduced in-container (bullseye security
-   mirrors currently 404); the shipped argv follows the documented
-   positional contract on ALL dig versions, which is the portable form.
-3. Suites at acd0352: DNS parity 23/23; full backend 174/3754; frontend 68/68.
+   mirrors currently 404); the shipped argv follows dig's documented
+   `[name] [type]` positional contract (man dig) and was live-verified
+   against BIND 9.18.50; no portability claim is made for other dig
+   versions beyond the documented contract itself.
+ 3. Suites at acd0352: DNS parity 23/23; full backend 174/3754; frontend 68/68.
 
 ### Production gate record (this deploy)
-- Deploy tree HEAD at gate time: 1747c23 (dc167-deploy2 = 9f5e97c + the
-  DC-171 batch); production rollback target: 9f5e97c (current prod HEAD).
+- Deploy tree HEAD at gate time: 1747c23 for r3, then 0e58ca9 for r4
+  (dc167-deploy2 = 9f5e97c + the DC-171 batch); production rollback
+  target: 9f5e97c (current prod HEAD).
+- r3 remediation commit: 9d5d640 (qualifies the dig version comment;
+  adds this gate record).
 - Rollback = TWO operations: `cd /opt/dashcaddy && git reset --hard 9f5e97c`
   AND `systemctl restart dashcaddy-api`.
 - Bundles at gate time: SW cache `dashcaddy-shell-b87d8c8095`, CSP hash
@@ -62,4 +67,9 @@ BIND 9 endpoint. Resolution (fix commit acd0352):
 - Judge grades for this deploy: r1 D (urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq),
   r2 C (urn:ump:2d5onfwgvcigrutqjhoege3ao6mtdxup57accoaumyaqsu7jniqq),
   r3 C (urn:ump:bayk3f2ibc3nffwv7wiprdts2xegcp2pac525zwabp7dst37ecbq —
-  blocker: unqualified 9.11-9.16 comment in rfc2136.js, since qualified).
+  blocker: unqualified 9.11-9.16 comment in rfc2136.js, fixed by 9d5d640),
+  r4 C (urn:ump:iysmn53oxuhn57y5v6emmztvbissz275wl3wbp2pa2w5ou77mvua —
+  blockers: stale gate record naming 1747c23, the 'ALL dig versions'
+  phrasing, and no r4 entry; all three addressed in this update).
+- Timestamp note: dates in this file are host-local (UTC+8); the judge
+  sandbox observed 2026-10-29 — same moment, different timezone.