docs: correct a misattributed review round and an unmeasured claim

Records only. No behaviour change; the focused suite stays 27/27 and
the full gate stays green.

**THE WITHDRAWN CAUSAL CLAIM WAS ASSIGNED TO THE WRONG ROUND.** The
framing credited it to round 4. It was round 3 --- whose subject line
says so plainly, "canonical ancestry, guard witnesses, and a withdrawn
claim". Round 4 was the four discriminators: it added the
canonical-traversal WITNESS (round 3 had fixed the traversal and
verified it by hand, which is the evidence that does not survive the
next edit), moved the guard rows onto the exact boundary, and covered
both managed areas on cleanup.

Rounds 1 and 2 were re-checked against their commits in the same pass,
and round 1 was also wrong: it carried ONE reserve finding, not two.
The nested-reserve ruling is round 2's. Each round is now described
from what its commit actually did.

**AND THE GATE CLAIMED A TMPFS QUOTA THAT WAS NEVER ESTABLISHED.**
`scripts/gate` said a build here "hit tmpfs quota mid-compile". Nothing
measured that, and it contradicts what was measured later: `/tmp` was
at 24G of a 30G tmpfs with 6G free --- NOT out of space. What actually
happened is worth keeping precisely because it is subtler than a quota:
24G of tmpfs is 24G of RAM, free memory fell to ~4G of 61G, process
spawning became unreliable, and eleven rows failed with EMPTY output.
That reads like a code defect. The comment records the measurement and
the symptom now, and drops the quota story.

The independent reason for a disk-backed TMPDIR is unchanged and is
still the measured one: tmpfs fixtures compete for memory.

Gates: all nine green under `env -u TMPDIR`, log 20260813T190456Z.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai

docs/gate-script-framing.md

@@ -9,16 +9,20 @@ lane.
 
 **Approved after four review rounds plus a locale follow-up, all of
 which turned on evidence rather than design.** Round 1 corrected a
-propagation witness that proved only that the variable was used, and
+propagation witness that observed no inheritance, a reserve that was
-two wrong guard reserves. Round 2 tightened the socket budget to the
+not the maximum, and a guard that leaked what it exists to manage.
-Darwin floor and replaced an existence-only ancestor check with one
+Round 2 tightened the socket budget to the Darwin floor, *ruled* the
-that honours marker types. Round 3 made the traversal canonical and
+nested case rather than accommodating it by loosening the reserve, and
-gave the length guard its first real witnesses. Round 4 moved those
+replaced an existence-only ancestor check with one that honours marker
-rows onto the exact boundary, covered both managed areas on cleanup,
+types. Round 3 made the traversal canonical, gave the length guard its
-and withdrew an unsupported causal claim. The follow-up required the
+first witnesses, and **withdrew an unsupported causal claim**. Round 4
-byte-versus-character row to *establish* its precondition rather than
+found four properties that were fixed or claimed but would have stayed
-name one. Each correction was a witness asserting something adjacent
+green if reverted: it added the **canonical-traversal witness**, moved
-to the contract while appearing to assert the contract itself.
+the guard rows onto the exact boundary, and covered both managed areas
+on cleanup. The follow-up required the byte-versus-character row to
+*establish* its precondition rather than name one. Each correction was
+a witness asserting something adjacent to the contract while appearing
+to assert the contract itself.
 
 **Previously, revision 5. Approved at revision 4 and IMPLEMENTED; revision
 5 records two safety defects review found in the implementation.**

scripts/gate

@@ -548,9 +548,12 @@ mkdir -p "$AMBIENT"
 # VERIFIES rather than assumes.
 #
 # Disk-backed matters independently. `/tmp` is commonly a tmpfs, so a
-# sweep's fixtures compete with the machine for RAM; a build here has
+# sweep's fixtures compete with the machine for RAM rather than for
-# hit tmpfs quota mid-compile. The gate root is on the same filesystem
+# disk. Measured here: `/tmp` is a 30G tmpfs that reached 24G occupied,
-# as the build artifacts, which is where the space is.
+# leaving ~4G of 61G free, at which point process spawning became
+# unreliable and rows failed with EMPTY output --- a symptom that reads
+# like a code defect. It was not out of space. The gate root is on the
+# same filesystem as the build artifacts, which is where the space is.
 #
 # IT HANGS OFF THE GATE ROOT, NOT THE PER-WORKTREE TARGET, AND THE NAME
 # IS SHORT ON PURPOSE --- see the SUN_LEN budget below. Note this