diff --git a/specs/013-expand-test-coverage/coverage-gaps.md b/specs/013-expand-test-coverage/coverage-gaps.md
index 085d874cf..7797de831 100644
--- a/specs/013-expand-test-coverage/coverage-gaps.md
+++ b/specs/013-expand-test-coverage/coverage-gaps.md
@@ -1,6 +1,6 @@
 # Coverage Gap Record
 
-**Summary**: 9/24 closed · 0 closed unproven · 1 in progress · 13 open · 1 unit-only by design
+**Summary**: 9/24 closed · 1 closed unproven · 1 in progress · 12 open · 1 unit-only by design
 **Last updated**: 2026-10-12
 
 | ID | Category | Gap | Story | FR | Priority | Status | Evidence | Notes |
@@ -8,7 +8,7 @@
 | G-01 | static | govulncheck gate | US1 | FR-001 | P1 | closed | `vuln (go)` https://github.com/GameplanePanel/Gameplane/actions/runs/38312206591 | Green on #673 after the Go patch, cosign v3 and rekor v1.5.4 bumps (T021); the proof shows the gate fails on a vendored vulnerable fixture. |
 | G-02 | static | container image scan gate | US1 | FR-001 | P1 | open |  |  |
 | G-03 | static | Dockerfile lint gate | US1 | FR-001 | P1 | closed | `workflow lint` https://github.com/GameplanePanel/Gameplane/actions/runs/38286000942 | First run on #674 flagged DL3008/DL3018/DL4006 in 13 Dockerfiles; pinned apk/apt versions and pipefail SHELL fixed them, and every game image still builds (run 38286000940). |
-| G-04 | static | dependency-review gate | US1 | FR-001 | P1 | open |  |  |
+| G-04 | static | dependency-review gate | US1 | FR-001 | P1 | closed-unproven | `dependency review` job, added in https://github.com/GameplanePanel/Gameplane/pull/676 | OD-4: proven by configuration review only (`fail-on-severity: high`, PR-only); no throwaway PR, no fixture branch, no local act run. |
 | G-05 | static | codegen / tidy drift gate | US1 | FR-001 | P1 | closed | `codegen drift` https://github.com/GameplanePanel/Gameplane/actions/runs/38189397259 | First run on #672 found no drift; the proof shows the job fails on injected drift. |
 | G-06 | static | submodule pointer freshness gate | US1 | FR-001 | P1 | closed | `submodule freshness` https://github.com/GameplanePanel/Gameplane/actions/runs/38189409720 | First run on #675 green; the proof covers a stale and a fresh pointer. |
 | G-07 | e2e-dashboard | live: notification webhook config | US2 | FR-002 | P1 | open |  |  |
diff --git a/specs/013-expand-test-coverage/tasks.md b/specs/013-expand-test-coverage/tasks.md
index a50d1979a..6ee158a0d 100644
--- a/specs/013-expand-test-coverage/tasks.md
+++ b/specs/013-expand-test-coverage/tasks.md
@@ -97,9 +97,9 @@ description: "Task list for 013-expand-test-coverage"
 
 ## Phase 3: User Story 1 – Static gates (Priority: P1) 🎯 MVP
 
-**Goal**: six blocking gates, each proven able to fail, with zero pre-existing findings left (contracts/static-gates.md G1–G6).
+**Goal**: six blocking gates, each proven able to fail except `dependency-review`, which OD-4 proves by configuration review only, with zero pre-existing findings left (contracts/static-gates.md G1–G6).
 
-**Independent Test**: for each gate, its `hack/check-<gate>_test.sh` step is green, the gate job is green, and the gap record links a run where the gate was red on a real violation (quickstart.md, "US1").
+**Independent Test**: for each gate, its `hack/check-<gate>_test.sh` step is green, the gate job is green, and the gap record links a run where the gate was red on a real violation (quickstart.md, "US1") `dependency-review` is the OD-4 exception: no test script or red run, only a configuration review.
 
 **PR boundaries**: one PR per gate, in the order G5 → G1 → G3 → G2 → G4 → G6 (plan "Phase sequencing").
 
@@ -201,7 +201,7 @@ description: "Task list for 013-expand-test-coverage"
   - uses `actions/dependency-review-action`, SHA-pinned, with `fail-on-severity: high` and `comment-summary-in-pr: on-failure`
 
   Register it in `report`, and make the report treat `skipped` on push events as neutral, the same way other PR-only jobs are tallied.
-- [ ] T033 [US1] Once the T032 PR merges, set G-04 to `closed-unproven` in `coverage-gaps.md`: Evidence names the `dependency review` job and that PR, and Notes cite OD-4 (configuration review only; no throwaway PR, no fixture branch, no local act run).
+- [X] T033 [US1] Once the T032 PR merges, set G-04 to `closed-unproven` in `coverage-gaps.md`: Evidence names the `dependency review` job and that PR, and Notes cite OD-4 (configuration review only; no throwaway PR, no fixture branch, no local act run).
 
 ### G6 submodule freshness: PR `ci: submodule freshness gate` (OD-1 ruled)
 
@@ -219,7 +219,7 @@ description: "Task list for 013-expand-test-coverage"
 
   Register it in `report`. Depends on T007, T034 and T035. Flip G-06.
 
-**Checkpoint**: all six gates are blocking and proven. The gap rows G-01 to G-06 are `closed` with run links (quickstart.md "US1" items 1–4).
+**Checkpoint**: all six gates are blocking. G-01, G-02, G-03, G-05 and G-06 are `closed` with run links; G-04 is `closed-unproven` under OD-4 (quickstart.md "US1" items 1–4).
 
 ---