docs: record the witness as closed, and what the audit found next door

Revision 5's ledger edits were written while the witness was still the
open blocker, and landed alongside the commit that closed it --- so the
entry asserted both at once: an OPEN BLOCKER bullet saying this lane
"currently ships without the regression guard it was created to
provide", and, further down, that same gap closed at 677fd25. A
recovering machine reads the top of an entry first, so the stale half
is the half that gets acted on. Reconciled in place: the heading, the
framing bullet and the blocker bullet now say re-opened by review and
CLOSED at 677fd25, and point at the bullet that closed it.

The script header cited framing revision 4; it is revision 5.

Also recorded, from auditing whether any OTHER assertion in that suite
is detached from the thing it names: renaming every other plan step ---
fmt, clippy, lib, m4, gpu, sweep, diff-check, acceptance-<suite> ---
leaves all 20 tests green. For most that is only a log filename and a
FAILED: entry. `sweep` is not: the runner's end-of-run listing globs
*-sweep.log and *-sweep-crdt.log, so renaming that step silently
empties the "read these, do not re-run and grep" listing that is the
U2/U3 remedy, with the suite still green. Left open deliberately and
said so --- that listing exists only on the RUN path, and every test in
this file is no-gates by design, so there is no cheap witness for it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai

docs/active-work.md

@@ -265,7 +265,7 @@ also removed: this branch's "R8 NEEDS A LANE" investigation block, and
 durable facts are in the retired registry row and the handoff §6
 census.
 
-## `scripts/gate --protocol` build step — IMPLEMENTED at `49bc141`, then RE-OPENED by review
+## `scripts/gate --protocol` build step — IMPLEMENTED at `49bc141`, RE-OPENED by review, witness CLOSED at `677fd25`. No PR yet
 
 **Written with the lane's first commit**, per the standing correction
 from #171 and #215.
@@ -276,23 +276,27 @@ authoritative tip** — the ref, not a SHA. Recover with
 `git fetch githubsucks && git checkout gate-protocol-build`.
 
 - **Framing `docs/gate-protocol-build-framing.md`, revision 5.** The
-  fix itself is implemented and green at `49bc141`; **the regression
-  witness is NOT, and that is an open blocker.** Narrow by design: one
-  missing step in one script, plus the boundary question that let it go
-  missing. No `src/`, no protocol, no feature work.
-- **OPEN BLOCKER — the witnesses do not reach the step they name.**
-  `--print-plan` **strips names** before printing, so the ordering
-  assertion sees only commands; `--self-test` **hardcodes**
-  `build-crdt` inside its own synthetic plan. Review demonstrated the
-  consequence: **renaming the real build step to `sweep-crdt` left both
-  tests passing.** So this lane currently ships without the regression
-  guard it was created to provide. §7 now requires **both** real
-  emitter pairs — `build-crdt` and `sweep-crdt`, name *and* exact
-  command — because the hole is symmetric and revision 4 closed only
-  half of it. The synthetic `--self-test` stays: it witnesses the
-  *runner* (failure naming, `FAILED:` list, log paths, non-zero exit,
-  and continuation via the sentinel), which is a different thing from
-  attributing the real step, and it may no longer stand in for it.
+  fix itself is implemented and green at `49bc141`; **its regression
+  witness landed separately at `677fd25`**, after review found the
+  original witness did not reach the step it named. Narrow by design:
+  one missing step in one script, plus the boundary question that let
+  it go missing. No `src/`, no protocol, no feature work.
+- **WAS THE OPEN BLOCKER — the witnesses did not reach the step they
+  name. CLOSED at `677fd25`.** `--print-plan` **strips names** before
+  printing, so the ordering assertion saw only commands; `--self-test`
+  **hardcodes** `build-crdt` inside its own synthetic plan. Review
+  demonstrated the consequence: **renaming the real build step to
+  `sweep-crdt` left both tests passing.** So the lane had shipped
+  without the regression guard it was created to provide. §7 requires
+  **both** real emitter pairs — `build-crdt` and `sweep-crdt`, name
+  *and* exact command — because the hole is symmetric and revision 4
+  closed only half of it. The synthetic `--self-test` stays: it
+  witnesses the *runner* (failure naming, `FAILED:` list, log paths,
+  non-zero exit, and continuation via the sentinel), which is a
+  different thing from attributing the real step, and it may no longer
+  stand in for it. **What closed it is the "THE WITNESS DID NOT REACH
+  THE STEP" bullet further down** — `--print-plan-named`, with all four
+  renames and drifts mutated red.
 - **The defect, as found.** `--protocol` adds the CRDT workspace sweep,
   whose documented precondition is `cargo build --workspace
   --no-default-features --features luajit,crdt` — documented in handoff

scripts/gate

@@ -10,7 +10,7 @@
 #   scripts/gate --self-test
 #
 # Framing: docs/gate-script-framing.md (revision 4, approved), and
-# docs/gate-protocol-build-framing.md (revision 4, approved) for the
+# docs/gate-protocol-build-framing.md (revision 5, approved) for the
 # crdt build step, --self-test and --print-plan-named.
 #
 # WHY A PER-WORKTREE TARGET DIRECTORY. This machine exports one