docs(#834): document T-C branch protection posture

docs/architecture/compaction-revocation.md

@@ -40,4 +40,20 @@ This is the named D2-v5 T-A residual. It is distinct from an observer that fires
 | Generation advances on reload/new/resume/fork                   | Prior incarnation revoked; replacement starts `UNVERIFIED`.                                                           |
 | Lifecycle observers and all-tools gate both fail or are removed | T-C total-hook-miss residual; protected-branch controls remain required.                                              |
 
+## T-C server-side branch-protection posture
+
+The required posture is that `main` is push-blocked and PR-only-merge is **MANDATORY**, regardless
+of client-gate state. The client-side gate narrows the exposure window only; it is not the T-C
+guarantee. The server-side protected-branch configuration is the irreducible guarantee for protected
+repository actions. Status-check enforcement and approval enforcement are **RECOMMENDED**.
+
+## Current-vs-required gap (recorded, not enacted)
+
+The current empirical configuration is recorded here without re-probing or mutating live branch
+protection. `enable_push=False` (push-block present), so the mandatory push-block/PR-only-merge core
+holds. `require_approvals=0` (approvals not enforced), `enable_status_check=False` (status checks not
+enforced), and `block_on_official_review=False` (official review not enforced). Those recommended
+merge-quality controls are the current gap; changing them is a separate, owner-gated operations
+decision and is not enacted by this documentation change.
+
 The permanent T12b/T30 acceptance case prints both required outcomes: dual-hook miss within TTL is **ALLOWED**, and the same lease after TTL is **DENIED**. Separate real-socket tests prove each Claude observer and same-PID generation rollover; Pi lifecycle tests exercise pre/post observers, all four replacement reasons, and local failure closure.