docs(r3): revert row #66 over-promotion — preserve canonical PB-Runtime acceptance

[briansrls]

Summary

Reverts row #66 lens_producer_retirement_executable_witness in docs/r3-program-plan.md §1.8 from CONSUMER_LANDED back to DECLARED, and removes #66 from the post-T-LP drift-sweep brief's promotion set.

Why

briansrls + codex/codex-default posted BLOCKING reviews on already-merged PR #2631 at 2026-05-10T20:15Z catching a canonical-acceptance violation:

• lens_producer_files_remaining census check shipped via PR [codex] Add lens producer retirement witness #2595 is the r3-structure.md:184 "near-term demo = retirement state-check + doc receipts" placeholder.
• It is NOT the canonical demonstration consumer.
• Canonical Pass-condition: "lens_apply reflection routes via PB-Runtime on representative lens program" with execution-ready witness DEFERRED to Row-4 equivalence receipt + Item 4 landing per docs/design-pb-runtime-interpreter.md §5.1.

Promoting #66 to CONSUMER_LANDED on substrate plumbing dilutes the demonstration gate against INVARIANTS.md P2 single-authority discipline. Status re-promotes only when Row-4 + Item 4 receipts land.

Scope

• Row Tighten SDLC design gaps for dry-run deployment readiness #66 in docs/r3-program-plan.md: CONSUMER_LANDED → DECLARED with explicit canonical-acceptance framing in Notes cell.
• docs/briefs/r3-pb-status-drift-sweep-post-tlp.md: removes Tighten SDLC design gaps for dry-run deployment readiness #66 from promotion table; adds Excluded-by-canonical-acceptance-scope section citing the codex/operator findings.

NOT reverted

Other PR #2631 promotions stand — those rows have canonical-fit consumers landed:

• feat(cloud): add cloud resource management layer with GCP and AWS sup… #6 lens_testgen_dot_rs_retired — PASSING (file absent + regression-guard test)
• Refactor DI boundaries: inject env dict, tool resolver, and platform #33 bridge_canonical_lens_name_dispatch_retired — CONSUMER_LANDED (PR R3 gate #33: bridge canonical lens name dispatch retired #2449)
• Introduce unified resource model with manifest-based freshness tracking #34 bridge_include_str_side_channels_retired — CONSUMER_LANDED (slice scope; PR [codex] Retire pipeline include_str bridge #2459)

Refs

• merged PR docs(r3): §1.8 ledger Status drift sweep — post-T-LP / T-Bridge wave #2631 (the over-promotion)
• briansrls inline review on docs/r3-program-plan.md:292 + docs/briefs/r3-pb-status-drift-sweep-post-tlp.md:16 (2026-05-10T20:15Z)
• codex/codex-default BLOCKING review (sha 18d279c)
• r3-structure.md:184
• docs/design-pb-runtime-interpreter.md §5.1

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 2d288996 · Trigger: schedule
• Thinking: 149s wall

---

Non-blocking — Strengths

• docs/r3-program-plan.md Row #66 now matches the canonical R3 acceptance boundary by keeping lens_producer_retirement_executable_witness DECLARED until Row-4 plus PB-Runtime Item 4 receipts provide the actual representative lens witness.
• docs/briefs/r3-pb-status-drift-sweep-post-tlp.md The drift-sweep brief correctly excludes gate #66 from the T-LP promotion set, so PR #2595 remains placeholder state-check evidence rather than a CONSUMER_LANDED claim.

✅ Docs-only PR preserves the Pure Bootstrap acceptance meaning and I found no blocking concerns.