diff --git a/archreview/2026-10-21/remediation/00-tracking.md b/archreview/2026-10-21/remediation/00-tracking.md
index 32cf9c2..e0d35ff 100644
--- a/archreview/2026-10-21/remediation/00-tracking.md
+++ b/archreview/2026-10-21/remediation/00-tracking.md
@@ -126,7 +126,7 @@ All rows are on `fix/review-2026-10-21-e` (`7618caf`, follow-up `38fbbde`), not
 | R21-CG1 | Medium | Go client | Event buffer fixed at 16 | Done | H: `a3a7bd2` | `EventBufferSize` option, default 1024 |
 | R21-CG2 | Medium | Go client | Deprecated `DialContext` + `WithBlock` (cycle-1 `CLI-10`) | Done | H: `a3a7bd2` | `grpc.NewClient` |
 | R21-CG3 | Low | Go client | No typed diagnostics | Done | H: `a3a7bd2` | |
-| R21-CG4 | Low | Go client | `go vet` copylocks error in `types_alias_test.go` | Open | — | Pre-existing, not fixed by stream H. Next step: pass the type by pointer in the test; check `go vet` runs in CI |
+| R21-CG4 | Low | Go client | `go vet` copylocks error in `types_alias_test.go` | Done | see commit "fix(go-client): go vet copylocks" | The test declares pointer types; `go vet ./...` is clean |
 | R21-CR1 | Medium | Rust client | Blocking file read on an async path (CA file) | Done | I: `0345726` | Async read |
 | R21-CR2 | Low | Rust client | No typed diagnostics | Done | I: `0345726` | |
 | R21-CP1 | Low | Python client | No typed diagnostics | Done | J: `99347d3`, `d716dec` | The client already had no ack retry, no event buffer, and cancels on exit |
diff --git a/clients/go/mxgateway/types_alias_test.go b/clients/go/mxgateway/types_alias_test.go
index a783ffd..1dd8530 100644
--- a/clients/go/mxgateway/types_alias_test.go
+++ b/clients/go/mxgateway/types_alias_test.go
@@ -10,8 +10,9 @@ import (
 // the two status payloads carried by AlarmFeedMessage.
 func TestAlarmFeedStatusAliasesArePublic(t *testing.T) {
 	t.Helper()
-	var provider mxgateway.AlarmProviderStatus
-	var snapshot mxgateway.AlarmSnapshotStatus
+	// Pointers, not values: protobuf messages embed a mutex and must not be copied.
+	var provider *mxgateway.AlarmProviderStatus
+	var snapshot *mxgateway.AlarmSnapshotStatus
 	_ = provider
 	_ = snapshot
 }