docs(p022): state the protocol door rules as the tree proves them, and caveat BR-V5

Two places where a document said less, or other, than the evidence:

* The cp4b note's §3.2 (written at 4b.0) claimed the tolerant door's
  protocol rules — malformed-entry skip and first-wins — are unreachable
  through the typed Rust constructor and pinned only by unit controls. The
  constructor checks protocol blocks for nesting depth alone; the grammar
  runs in the strict door, so the rules are reachable end to end, the
  synthetic case verdict_protocol_tolerant_door_rules replays them against
  Python's golden, and cp4b.2's M21–M23 are caught by that replay. The
  section now says so and names the one rule (non-list block) that is a
  unit control.
* spec/Bridge.md BR-V5 states a slice shorter than two steps is dropped;
  _protocol_findings does not do that, so a leak off the end carries a
  one-step slice, and the port reproduces the reference. The sentence now
  carries the exception and points at the note that records the open
  Python-first decision, instead of a normative line one family knowingly
  does not implement.

No code, fixtures or evidence change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016vuEiNoEXaooMDRu6tXrZ6

Author: PhysShell

docs/notes/p022-bridge-verdict-checkpoint4b.md

@@ -239,16 +239,26 @@ The strict door's error texts do not move by a byte. The cp1 ledger
 accept/reject verdict and their category; red there is a stop, not a thing to
 re-baseline.
 
-### 3.2 The door difference, and where it is pinned (OD-1)
-
-Three of the tolerant door's protocol rules — the malformed-entry skip (H24,
-H25) and first-wins on a duplicate name (H26) — are **unreachable through the
-typed Rust constructor**, exactly as the effect-entry skip already is. They are
-pinned at the raw-document level with unit controls in the bridge (the shape
-`malformed_effect_entries_are_skipped_not_coerced` established at cp4), not by
-quietly coercing a document into shape. If a synthetic case needs such a
-document to travel through the door, it becomes a **declared** `verdict_door_*`
-exclusion with a reason — never a silent coercion.
+### 3.2 The door difference, and where each rule is pinned (OD-1)
+
+The typed Rust constructor (`OwnIr::from_json`) keeps `protocols[]` and
+`protocol_functions[]` as raw values and checks only their nesting depth; the
+protocol grammar runs in the **strict** door alone. So, unlike the effect-entry
+skip — which the typed `Effect` shape makes unreachable, the OD-1 case cp4
+recorded — the tolerant door's protocol rules are reachable **end to end**: a
+malformed `protocols[]` entry is skipped (H24), a malformed
+`protocol_functions[]` entry is skipped without taking the rest of the list
+with it (H25), and a duplicate name resolves first-wins (H26). All three are
+replayed against Python's golden by the synthetic case
+`verdict_protocol_tolerant_door_rules`, and the cp4b.2 campaign's M21–M23 are
+caught by that replay, not by a unit test. Only the non-list block rule (H23)
+is pinned at the unit level (`protocol_blocks_that_are_not_lists_yield_nothing`,
+M24), in the shape cp4 established for the effect skip. Nothing here coerces a
+document into shape: a record the grammar refuses is dropped whole on the
+tolerant path, and the strict door still refuses the same document at load —
+its 216 controls are unchanged by 4b. (An earlier draft of this section, written
+at 4b.0 before the case existed, said the three rules were unreachable; the
+tree proved otherwise and this paragraph follows the tree.)
 
 ## 4. The surfaces 4b moved
 

spec/Bridge.md

@@ -304,7 +304,12 @@ anchorless. Related locations and ordered `flow` slices are attached exactly
 where §4/§5 say (DI consumer ctor; DI paths via `di_path_steps`; the capture
 escape slice subscribe-site → registration-site; flow-local origin→violation
 2-step; effect re-run→mint; protocol opened→barrier). Steps with unknown lines
-(`< 1`) are omitted; a slice shorter than 2 steps is dropped.
+(`< 1`) are omitted; a slice shorter than 2 steps is dropped — **except on the
+protocol path**: `_protocol_findings` filters unknown lines and stops there, so
+an obligation leaking off the end of its method carries a **one-step** slice
+(its second step would repeat the first). The port reproduces the reference;
+whether this sentence or that code should move is a Python-first decision still
+owed (#259 cp4b note §6.7).
 
 **BR-V6 (severity and suppression).** `advisory` findings (OWN050/051/052,
 OBL005) render as warnings, SARIF `note`, and are excluded from the exit code.