@rungs/cli 0.1.2 → 0.2.0

package/modules/README.md

@@ -91,6 +91,19 @@ whether its guard has ever actually fired.
    `module.toml`, per skill, with the portability cost stated there.
 5. **Every gate declares a self-test asserting both directions.** A gate whose rules are currently
    satisfied is indistinguishable from a gate that matches nothing.
+5b. **Every gate declares its `applicability`**, next to its `engine`, and there is no default:
+
+   | Value | Means | Runs on a repo that is not ours? |
+   | --- | --- | --- |
+   | `repo-content` | Measures the repo's own content — a count, a length, whether a link resolves | **Yes** |
+   | `our-artifacts` | Checks something rungs wrote, which cannot exist unless we installed | No |
+   | `our-schema` | Reads their file against a shape we defined | No |
+
+   `doctor --explain` runs only `repo-content` against a repo that has its own equivalent of a
+   module. Omitting the field does not mean "safe": the gate is skipped **and named**, and
+   `rungs modules` refuses the manifest. This exists because the first version of `--explain`
+   decided it centrally by engine name, and produced 71 findings that were true about our
+   conventions and meaningless about the repos they landed on.
 6. **`[detect]` must correctly classify all four source repos.** That is the Phase 6 acceptance
    criterion, and it is why detection is biased toward false negatives.
 7. **A managed-block marker uses the target file's comment syntax** — `<!-- rungs:begin x -->` in

package/modules/adr/gates/adr.toml

@@ -23,6 +23,10 @@ enum     = { status = ["proposed", "accepted", "rejected", "superseded"] }
 # supersession leaves a reader on the stale record with no way to find the live one.
 [frontmatter_schema.reciprocal]
 pairs = [{ from = "superseded_by", to = "supersedes" }]
+# A record cannot declare itself superseded without saying by what. Stated
+# separately from `pairs` because it is a different failure: `pairs` catches a
+# one-way link, this catches a missing one.
+required_when = { superseded = "superseded_by" }
 
 # Sections, not prose quality. The gate can check that `Alternatives considered` exists and is not
 # empty; it cannot judge whether the alternatives were real, and one that tried would be the
@@ -40,12 +44,12 @@ done rather than a decision — which is what admission criterion 2 is guarding
 # ── self-tests ────────────────────────────────────────────────────────────────
 
 [[self_test]]
-gate    = "adr-required-fields"
+gate    = "adr-sections-present"
 expect  = "fail"
 fixture = { file = "{{path}}/{{id_prefix}}-0001-x.md", sections = ["Context", "Decision", "Consequences"] }
 
 [[self_test]]
-gate    = "adr-required-fields"
+gate    = "adr-sections-present"
 expect  = "pass"
 fixture = { file = "{{path}}/{{id_prefix}}-0001-x.md", sections = ["Context", "Decision", "Consequences", "Alternatives considered", "Revisit triggers"] }
 
@@ -54,6 +58,14 @@ gate    = "adr-required-fields"
 expect  = "fail"
 fixture = { frontmatter = { id = "{{id_prefix}}-0001", title = "x", status = "superseded", date = "2026-01-01" } }
 
+# The pass direction was missing entirely: both of this gate's fixtures described *sections* and
+# were relabelled to `adr-sections-present` (F-018), which left it asserting only that something
+# fails. A gate with no passing fixture cannot tell "correct" from "matches nothing".
+[[self_test]]
+gate    = "adr-required-fields"
+expect  = "pass"
+fixture = { frontmatter = { id = "{{id_prefix}}-0001", title = "x", status = "accepted", date = "2026-01-01" } }
+
 [[self_test]]
 gate    = "adr-index-current"
 expect  = "fail"

package/modules/adr/module.toml

@@ -1,6 +1,6 @@
 [module]
 name    = "adr"
-version = "1.0.0"
+version = "1.1.0"
 rung    = 1
 summary = "Numbered, immutable decision records, with an admission rule that keeps the directory from becoming a second documentation tree."
 
@@ -27,14 +27,32 @@ default     = "ADR"
 id     = "adr-index-current"
 kind   = "declared"
 engine = "render-freshness"
+applicability = "our-artifacts"
 table  = "gates/adr.toml"
 tier   = "fast"
 why    = "An index that has stopped listing every record is a routing table that silently drops decisions."
 
+[[gates]]
+id     = "adr-sections-present"
+kind   = "declared"
+engine = "sections"
+applicability = "our-schema"
+table  = "gates/adr.toml"
+tier   = "fast"
+why    = """
+The `[sections]` table required Context, Decision, Consequences, Alternatives considered and
+Revisit triggers with non-empty bodies, and **no gate declared it** — a fully specified check that
+nothing ran, found 2026-08-16 by executing the self-test fixtures (F-018). Two fixtures were even
+labelled for `adr-required-fields`, which checks frontmatter and could never have satisfied them.
+A record without alternatives is a description of what was done rather than a decision, which is
+what the admission rule's second criterion guards against.
+"""
+
 [[gates]]
 id     = "adr-required-fields"
 kind   = "declared"
 engine = "frontmatter-schema"
+applicability = "our-schema"
 table  = "gates/adr.toml"
 tier   = "fast"
 why    = """

package/modules/audit/module.toml

@@ -28,6 +28,7 @@ default     = "docs/audit-criteria.md"
 id     = "audit-output-is-rows"
 kind   = "declared"
 engine = "file-population"
+applicability = "repo-content"
 table  = "gates/audit.toml"
 tier   = "fast"
 why    = """

package/modules/backlog/gates/ids.toml

@@ -104,3 +104,36 @@ fixture = { items = ["{{id_prefix}}-001-a.md", "{{id_prefix}}-002-b.md"] }
 gate    = "backlog-ids"
 expect  = "fail"
 fixture = { items = ["{{id_prefix}}-001-a.md"], marker = "{{id_prefix}}-001" }
+
+# ── backlog-board-reconciled ──────────────────────────────────────────────────
+#
+# The board groups rows by status; each item declares its own. Nothing checked
+# that the two agreed, and on 2026-08-16 fourteen rows disagreed — nine under
+# `Proposed` and five under `Planned`, all naming files whose status was `done`,
+# nine of them already moved into `archive/`.
+#
+# The heading map is data, not code, because a repo may rename a column or drop
+# one. An undeclared heading is reported rather than skipped: a row that hides
+# from the check is exactly the case this exists for.
+
+[board_reconcile]
+file          = "docs/{{root}}/BACKLOG.md"
+exempt_marker = "board-ok:"        # ignored unless it states a reason
+
+[board_reconcile.groups]
+"In progress" = ["in_progress"]
+"Review"      = ["review"]
+"Planned"     = ["planned"]
+"Accepted"    = ["accepted"]
+"Proposed"    = ["proposed"]
+"Deferred"    = ["deferred"]
+
+[[self_test]]
+gate   = "backlog-board-reconciled"
+expect = "fail"
+input  = "## Proposed\n| [{{id_prefix}}-001](items/{{id_prefix}}-001-x.md) | done item filed as proposed | docs |"
+
+[[self_test]]
+gate   = "backlog-board-reconciled"
+expect = "pass"
+input  = "## Proposed\n| [{{id_prefix}}-001](items/{{id_prefix}}-001-x.md) | a genuinely proposed item | docs |"

package/modules/backlog/module.toml

@@ -1,6 +1,6 @@
 [module]
 name    = "backlog"
-version = "1.0.0"
+version = "1.1.0"
 rung    = 1
 summary = "Work items with stable ids, an eight-status lifecycle, a board, and the three gates that keep the bookkeeping honest."
 
@@ -42,6 +42,7 @@ default     = "feature"
 id     = "backlog-ids"
 kind   = "declared"
 engine = "id-integrity"
+applicability = "our-schema"
 table  = "gates/ids.toml"
 tier   = "fast"
 why    = "An id claimed twice is two items the board shows as one."
@@ -50,6 +51,7 @@ why    = "An id claimed twice is two items the board shows as one."
 id     = "backlog-stale-blocker"
 kind   = "declared"
 engine = "id-integrity"
+applicability = "our-schema"
 table  = "gates/ids.toml"
 tier   = "fast"
 why    = """
@@ -62,6 +64,7 @@ finished item as next owner, then found those routes quoted in a code comment as
 id     = "backlog-merged-status"
 kind   = "declared"
 engine = "git-status-reconcile"
+applicability = "our-schema"
 table  = "gates/ids.toml"
 tier   = "fast"
 why    = """
@@ -70,6 +73,22 @@ rift-forge: 37 items sat at `review` with their code already landed, and one sat
 for eight days after its own merge.
 """
 
+[[gates]]
+id     = "backlog-board-reconciled"
+kind   = "declared"
+engine = "board-reconcile"
+applicability = "our-artifacts"
+table  = "gates/ids.toml"
+tier   = "fast"
+why    = """
+The board groups rows by status and each item declares its own; nothing checked that the two agreed.
+Measured here 2026-08-16: fourteen rows disagreed — nine under `Proposed`, five under `Planned`, all
+naming items whose files read `status: done`, and nine of them already moved into `archive/`, so the
+board called work proposed while pointing at the directory for work that cannot change. An outside
+reader checking whether that work was done would have been told no. `backlog-merged-status`
+reconciles a branch against the same field; this is the layer above it.
+"""
+
 # ── skills ────────────────────────────────────────────────────────────────────
 # SKILL.md files stay restricted to the six Agent Skills spec fields (ADR-0001).
 # Claude Code extensions are opted into here, per skill, with the cost stated.
@@ -110,6 +129,47 @@ coexist — a milestone overlay sits on top of items. Three real options: adopt
 unit and install only the missing gates, install items alongside, or skip.
 """
 
+# The repo's work lives in an issue tracker. Without this, a team running
+# everything through GitHub Issues matched no backlog signature at all, was
+# reported `absent`, and `doctor` proposed installing a Markdown backlog beside
+# the one they actually use — which is exactly the "why isn't this Jira?"
+# objection, earned.
+#
+# **Detection only, and deliberately so.** An adapter that read or wrote an
+# external tracker would need credentials, network and a client inside the
+# consumer repo, which ADR-0002 rules out. ADR-0004 already answers the
+# ownership worry the right way: adoption is a mapping, not a migration. So
+# rungs' job here is to notice and stop, not to sync.
+#
+# Only configured issue *intake* counts. A `.github/` directory does not — 76
+# local repos have one and none of them run their work in Issues (measured
+# 2026-08-16). An `ISSUE_TEMPLATE` directory or a root issue template is
+# somebody deliberately configuring how work arrives, which is the narrowest
+# in-repo evidence that the tracker is the unit of work.
+#
+# Linear and Jira are **not** listed. They leave no reliable file-level trace —
+# usually nothing but a URL in a PR template — and a signature guessed from a
+# link is the confidently-wrong probe this repo refuses everywhere else.
+# The note covers them because the trade-off does not depend on the vendor.
+[[detect.paradigm]]
+id      = "external-tracker"
+paths   = [
+  ".github/ISSUE_TEMPLATE/**",
+  ".github/issue_template.md",
+  ".github/ISSUE_TEMPLATE.md",
+]
+compare = "docs/research/synthesis.md#33-unit-of-work"
+note    = """
+Work items here are Markdown files in the repo; your tracker is a system outside it. Neither is
+better — they fail differently. A tracker gives you queries, notifications and non-engineers; files
+give you review, history and offline agents, and they are the only form a gate can mechanically
+check against a branch.
+
+rungs will not sync, import or export. Three real options: keep the tracker as the unit of work and
+install only the modules that do not duplicate it (`findings`, `adr`, `session`), install items
+alongside for agent-facing work while humans stay in the tracker, or skip the module.
+"""
+
 # Proposes a parameter once presence is already established. Never concludes
 # presence — hexguard-templates has 207 well-formed `FOUND-US-###` matches and
 # no backlog; they are spec story ids.

package/modules/ci/module.toml

@@ -42,6 +42,7 @@ default     = ".github/workflows/checks.yml"
 id     = "ci-workflow-proliferation"
 kind   = "declared"
 engine = "file-population"
+applicability = "repo-content"
 table  = "gates/ci.toml"
 tier   = "fast"
 why    = """

package/modules/concurrency/module.toml

@@ -45,6 +45,7 @@ default     = "integ/"
 id     = "concurrency-no-integration-checkout"
 kind   = "declared"
 engine = "git-state"
+applicability = "our-schema"
 table  = "gates/concurrency.toml"
 tier   = "fast"
 why    = """
@@ -59,6 +60,7 @@ releases the branch mid-run. Two land processes were measured running at once.
 id     = "concurrency-generated-not-text-merged"
 kind   = "declared"
 engine = "merge-driver-check"
+applicability = "our-artifacts"
 table  = "gates/concurrency.toml"
 tier   = "fast"
 why    = """

package/modules/design-sync/module.toml

@@ -31,6 +31,7 @@ default     = "docs/design-requests"
 id     = "design-deltas-routed"
 kind   = "declared"
 engine = "register-schema"
+applicability = "our-schema"
 table  = "gates/design.toml"
 tier   = "fast"
 why    = """
@@ -44,6 +45,7 @@ they are aligned.
 id     = "design-mirror-not-edited"
 kind   = "declared"
 engine = "render-freshness"
+applicability = "our-artifacts"
 table  = "gates/design.toml"
 tier   = "fast"
 why    = "A hand-edit in the mirror is a local change that the next pull silently destroys, and until then it is a fact about the design system that the design system does not know."

package/modules/doc-authority/module.toml

@@ -38,6 +38,7 @@ default     = true
 id     = "docauth-ownership-respected"
 kind   = "declared"
 engine = "term-ownership"
+applicability = "our-schema"
 table  = "gates/authority.toml"
 tier   = "fast"
 why    = """
@@ -50,6 +51,7 @@ because the failure it catches is a whole section restated in the wrong file, no
 id     = "docauth-scope-headers"
 kind   = "declared"
 engine = "sections"
+applicability = "our-schema"
 table  = "gates/authority.toml"
 tier   = "fast"
 why    = "A mandatory rule with a zero-cost check has no excuse to be manual, and this one was manual in the repo that called it non-negotiable."
@@ -58,6 +60,7 @@ why    = "A mandatory rule with a zero-cost check has no excuse to be manual, an
 id     = "docauth-working-rules"
 kind   = "declared"
 engine = "rule-propagation"
+applicability = "our-schema"
 table  = "gates/authority.toml"
 tier   = "fast"
 why    = """
@@ -71,6 +74,7 @@ changes, and reads as verified precisely because it names a source.
 id     = "docauth-no-redirect-stubs"
 kind   = "declared"
 engine = "file-population"
+applicability = "repo-content"
 table  = "gates/authority.toml"
 tier   = "fast"
 why    = "A file that exists only to say 'go elsewhere' is a bug: it will be cited, and the citation will look authoritative."

package/modules/findings/module.toml

@@ -30,6 +30,7 @@ default     = "docs/{{backlog.root}}/FINDINGS.md"
 id     = "findings-ids"
 kind   = "declared"
 engine = "id-integrity"
+applicability = "our-schema"
 table  = "gates/findings.toml"
 tier   = "fast"
 why    = "Two findings sharing an id are one finding as far as every citation is concerned."
@@ -38,6 +39,7 @@ why    = "Two findings sharing an id are one finding as far as every citation is
 id     = "findings-disposition-has-reason"
 kind   = "declared"
 engine = "register-schema"
+applicability = "our-schema"
 table  = "gates/findings.toml"
 tier   = "fast"
 why    = """
@@ -49,6 +51,7 @@ is the same observation the next session will record again. The reason is what t
 id     = "findings-self-declared-closure"
 kind   = "declared"
 engine = "self-declared-closure"
+applicability = "our-schema"
 table  = "gates/findings.toml"
 tier   = "fast"
 why    = "An open finding whose own detail says it is fixed contradicts the register; this narrow text check catches drift without pretending to prove code-level closure."

package/modules/gates/gates/structural.toml

@@ -5,7 +5,13 @@
 
 # ── gates-links-resolve · gates-paths-exist ───────────────────────────────────
 
-[link_integrity]
+# Two entries, one per gate. They were a single table shared by both gate ids, which ran the
+# identical markdown-link scan twice and reported every finding twice — 224 lines for 112 broken
+# links on one repo (F-007). Splitting them also lets `gates-paths-exist` do the job its `why`
+# actually describes: hexguard's instruction files name paths in code spans, not in markdown links.
+[[link_integrity]]
+id         = "gates-links-resolve"
+check      = ["relative_markdown_links"]
 scan       = ["**/*.md", ".ai/**/*.toml"]
 # `modules/**` is a rungs module source tree, not repo content: a fragment's
 # links are relative to the file it merges *into*, not to where it is authored,
@@ -13,14 +19,23 @@ scan       = ["**/*.md", ".ai/**/*.toml"]
 # repo nothing — it has no `modules/` — and was found by running this against
 # the rungs repo itself.
 exclude    = ["node_modules/**", "**/archive/**", ".git/**", "modules/*/fragments/**", "modules/*/files/**"]
-check      = ["relative_markdown_links", "backticked_paths"]
-# Backticked paths are checked only when they look like paths — containing a `/` or a known
-# extension — because prose is full of `identifiers` that are not files. Under-detection is the
-# correct bias: a missed stale path is a nuisance, a false refusal on every code span is a gate
-# people delete.
-path_hint  = ["/", ".md", ".ts", ".cs", ".mjs", ".toml", ".json", ".ps1"]
 exempt     = "path-ok:"       # ignored unless it states a reason
 
+[[link_integrity]]
+id         = "gates-paths-exist"
+check      = ["backticked_paths"]
+# Instruction files, where a named path going stale is the measured incident. Deliberately not
+# every markdown file: prose about a repo cites paths that were true when written, and a gate that
+# refuses history is one people delete.
+scan       = ["AGENTS.md", "CLAUDE.md", ".ai/**/*.md", ".ai/**/*.toml", ".github/instructions/**/*.md"]
+exclude    = ["node_modules/**", "**/archive/**", ".git/**"]
+# Checked only when it looks like a path — containing a `/` or a known extension — because prose is
+# full of `identifiers` that are not files. Resolved from the repo root, which is what an
+# instruction file's reader does. Under-detection is the correct bias: a missed stale path is a
+# nuisance, a false refusal on every code span is a gate people delete.
+path_hint  = ["/", ".md", ".ts", ".cs", ".mjs", ".toml", ".json", ".ps1"]
+exempt     = "path-ok:"
+
 [link_integrity.notes]
 external = "not fetched — a gate that needs the network is a gate that fails on a plane"
 
@@ -84,11 +99,39 @@ gate   = "gates-links-resolve"
 expect = "pass"
 input  = "The module writes [its readme](${{path}}/README.md) once installed."
 
+# WI-042. `path/file.ts:387` is a code reference, not a broken link — it is the form CLAUDE.md
+# mandates. Resolved literally it reported 1,794 false findings on rift-forge, 46.6% of that repo's
+# link findings. Both directions, because the strip must narrow what is reported and never widen it:
+# an existing file with a line number passes, a missing one with a line number still fails.
+[[self_test]]
+gate   = "gates-links-resolve"
+expect = "pass"
+input  = "The store is built in [forge-store](./structural.toml:222)."
+
+[[self_test]]
+gate   = "gates-links-resolve"
+expect = "fail"
+input  = "The store is built in [forge-store](./no-such-file.toml:222)."
+
 [[self_test]]
 gate   = "gates-paths-exist"
 expect = "pass"
 input  = "The `Result<T>` type wraps it."          # a code span that is not a path
 
+# F-007. `backticked_paths` was declared in the table's `check` list and implemented nowhere, so
+# this gate silently ran the markdown-link scan instead and double-reported it. Implemented now,
+# and narrowed by measurement: the first run produced ten findings on this repo and all ten were
+# wrong — slash commands, `WI-###` placeholders, illustrative directories, bare filenames.
+[[self_test]]
+gate   = "gates-paths-exist"
+expect = "fail"
+input  = "Claim an id from `docs/backlog/DOES-NOT-EXIST.md` first."
+
+[[self_test]]
+gate   = "gates-paths-exist"
+expect = "pass"
+input  = "Run `/work-item`, branch `feature/WI-###-slug`, and read `.cursor/rules/`."
+
 [[self_test]]
 gate   = "gates-rules-declare-enforcement"
 expect = "fail"
@@ -99,10 +142,20 @@ gate   = "gates-rules-declare-enforcement"
 expect = "pass"
 fixture = { file = ".ai/rules/x.md", frontmatter = { description = "d", enforcement = "review-only" } }
 
+# F-018. This gate's three fixtures all described `.claude/skills/**/SKILL.md`, and the skill
+# frontmatter schema moved to the `skills` module — so they asserted a schema this table no longer
+# contains and could never pass or fail for the stated reason. They were left behind by the move and
+# nobody noticed, because no fixture had ever been executed. Replaced with the schema that is
+# actually here.
 [[self_test]]
 gate   = "gates-frontmatter-valid"
 expect = "fail"
-fixture = { file = ".claude/skills/x/SKILL.md", frontmatter = { name = "x", description = "d", "argument-hint" = "y" } }
+fixture = { file = ".ai/rules/x.md", frontmatter = { enforcement = "gated" } }
+
+[[self_test]]
+gate   = "gates-frontmatter-valid"
+expect = "pass"
+fixture = { file = ".ai/rules/x.md", frontmatter = { description = "d", enforcement = "gated" } }
 
 [[self_test]]
 gate   = "gates-self-tests-both-directions"
@@ -130,12 +183,3 @@ gate   = "gates-paths-exist"
 expect = "pass"
 input  = "The mapper lives in [`structural.toml`](./structural.toml)."
 
-[[self_test]]
-gate    = "gates-frontmatter-valid"
-expect  = "pass"
-fixture = { file = ".claude/skills/x/SKILL.md", frontmatter = { name = "x", description = "d" } }
-
-[[self_test]]
-gate    = "gates-frontmatter-valid"
-expect  = "fail"
-fixture = { file = ".claude/skills/x/SKILL.md", frontmatter = { description = "d" } }

package/modules/gates/module.toml

@@ -39,6 +39,7 @@ default     = 30000
 id     = "gates-links-resolve"
 kind   = "declared"
 engine = "link-integrity"
+applicability = "repo-content"
 table  = "gates/structural.toml"
 tier   = "fast"
 why    = "A relative link that stopped resolving is the cheapest possible signal that a document moved and its citers did not."
@@ -47,6 +48,7 @@ why    = "A relative link that stopped resolving is the cheapest possible signal
 id     = "gates-paths-exist"
 kind   = "declared"
 engine = "link-integrity"
+applicability = "repo-content"
 table  = "gates/structural.toml"
 tier   = "fast"
 why    = "Instruction files name paths. hexguard's seven instruction files describe workspace registration and CI wiring across 105 packages, and nothing detected a moved path."
@@ -55,6 +57,7 @@ why    = "Instruction files name paths. hexguard's seven instruction files descr
 id     = "gates-frontmatter-valid"
 kind   = "declared"
 engine = "frontmatter-schema"
+applicability = "our-schema"
 table  = "gates/structural.toml"
 tier   = "fast"
 why    = "A skill with malformed frontmatter does not fail; it silently never loads."
@@ -63,6 +66,7 @@ why    = "A skill with malformed frontmatter does not fail; it silently never lo
 id     = "gates-rules-declare-enforcement"
 kind   = "declared"
 engine = "frontmatter-schema"
+applicability = "our-schema"
 table  = "gates/structural.toml"
 tier   = "fast"
 why    = """
@@ -75,6 +79,7 @@ not check, and all four decayed — including inside the file that states the ru
 id     = "gates-self-tests-both-directions"
 kind   = "declared"
 engine = "gate-meta"
+applicability = "our-artifacts"
 table  = "gates/structural.toml"
 tier   = "fast"
 why    = """

package/modules/instructions/module.toml

@@ -45,6 +45,7 @@ default     = 200
 id     = "instructions-core-size"
 kind   = "declared"
 engine = "file-budget"
+applicability = "repo-content"
 table  = "gates/core.toml"
 tier   = "fast"
 why    = "rift-forge's entry document reached 1513 lines and every session read all of it, in the one repo that otherwise measured everything."
@@ -53,6 +54,7 @@ why    = "rift-forge's entry document reached 1513 lines and every session read
 id     = "instructions-render-current"
 kind   = "declared"
 engine = "render-freshness"
+applicability = "our-artifacts"
 table  = "gates/core.toml"
 tier   = "fast"
 why    = "A rendered rule that no longer matches its source is a rule the agent is not reading. A green check means 'not yet regenerated', never 'current'."
@@ -61,6 +63,7 @@ why    = "A rendered rule that no longer matches its source is a rule the agent
 id     = "instructions-repo-map-current"
 kind   = "declared"
 engine = "render-freshness"
+applicability = "our-artifacts"
 table  = "gates/core.toml"
 tier   = "fast"
 why    = "Every source repo hand-maintained a repo map and one of them grew five duplicated entries — in the file every session reads first."
@@ -72,6 +75,7 @@ why    = "Every source repo hand-maintained a repo map and one of them grew five
 id      = "instructions-shell-backticks"
 kind    = "declared"
 engine  = "shell-safety"
+applicability = "our-schema"
 table   = "gates/core.toml"
 trigger = "pre-tool-use"
 matcher = "Bash|PowerShell"

package/modules/release/gates/release.toml

@@ -47,6 +47,25 @@ uncovered = [
 ]
 note = "A green check means these files agree, not that the version is correct everywhere."
 
+# ── release-fragment-current ──────────────────────────────────────────────────
+#
+# The other half of the fragment discipline. `release-changelog-fragment` catches a release-worthy
+# change that added no fragment; this catches a fragment that was consumed and never deleted.
+#
+# Only filenames that parse as a version are judged. A repo whose fragments are named per-change
+# (`42.feature.md`) states no version, so there is nothing to compare and nothing is claimed — a
+# gate that refused a naming convention it was not asked about is one people turn off.
+
+[[changelog_freshness]]
+id        = "release-fragment-current"
+fragments = ["{{changelog_dir}}/*.md"]
+version   = { file = "package.json", path = "version" }
+message = """
+This fragment names a version below the one being prepared, so it belongs to a release that already
+shipped. Delete it — fragments are consumed, not archived, and one left behind is republished as
+though it were new work.
+"""
+
 # ── self-tests ────────────────────────────────────────────────────────────────
 
 [[self_test]]
@@ -74,6 +93,30 @@ gate    = "release-changelog-fragment"
 expect  = "fail"
 fixture = { changed = ["src/a.ts"], fragments = [], exempt = "changelog-ok:" }
 
+[[self_test]]
+gate    = "release-fragment-current"
+expect  = "fail"
+fixture = { dir = "changelog.d", version = "0.2.0", fragments = ["0.1.1.md"] }
+
+[[self_test]]
+gate    = "release-fragment-current"
+expect  = "pass"
+fixture = { dir = "changelog.d", version = "0.2.0", fragments = ["0.2.0.md"] }
+
+# A fragment for a version *above* the one being prepared is not stale — it is a branch that
+# already decided it is a minor while the package has not been bumped yet.
+[[self_test]]
+gate    = "release-fragment-current"
+expect  = "pass"
+fixture = { dir = "changelog.d", version = "0.2.0", fragments = ["0.3.0.md"] }
+
+# Per-change fragment naming states no version, so there is nothing to compare and nothing is
+# claimed. The gate must stay silent rather than refuse a convention it was not asked about.
+[[self_test]]
+gate    = "release-fragment-current"
+expect  = "pass"
+fixture = { dir = "changelog.d", version = "0.2.0", fragments = ["42.feature.md"] }
+
 [[self_test]]
 gate    = "release-version-consistent"
 expect  = "fail"

package/modules/release/module.toml

@@ -1,6 +1,6 @@
 [module]
 name    = "release"
-version = "1.0.0"
+version = "1.1.0"
 rung    = 3
 summary = "Candidate, stable and deploy branch lines; one procedure for cutting a release, hotfixing and rolling back; changelog fragments instead of a shared file."
 
@@ -46,6 +46,7 @@ consumed_by = "render"
 id     = "release-changelog-fragment"
 kind   = "declared"
 engine = "file-population"
+applicability = "repo-content"
 table  = "gates/release.toml"
 tier   = "fast"
 why    = """
@@ -54,10 +55,24 @@ cut time when nobody remembers what it did. Cheaper to require the fragment on t
 the change.
 """
 
+[[gates]]
+id     = "release-fragment-current"
+kind   = "declared"
+engine = "changelog-freshness"
+applicability = "repo-content"
+table  = "gates/release.toml"
+tier   = "fast"
+why    = """
+Fragments are consumed at release time, not archived — one left behind appears in the next release
+too, where it reads as unreleased work. `cut-release` §3 has said so in prose since it was written,
+and prose did not hold it: this repo's own `0.1.1` fragment survived two releases (F-022).
+"""
+
 [[gates]]
 id     = "release-version-consistent"
 kind   = "declared"
 engine = "computed-claim"
+applicability = "our-schema"
 table  = "gates/release.toml"
 tier   = "fast"
 why    = "A version appears in several files and drifts in exactly one of them. It is derivable, so it is computed rather than typed."

package/modules/release/skills/cut-release/SKILL.md

@@ -22,9 +22,16 @@ mismatch is usually a fragment somebody skipped, not a versioning disagreement.
 ## 2. Gate
 
 ```bash
-rungs check --tier full
+rungs check
 ```
 
+Run **every** registered gate. This said `rungs check --tier full`, which selects only gates
+labelled `full` — on a repo whose gates are all `fast`, that is zero of them, and the run reports
+no gates rather than a pass. A release step that gates on nothing while looking green is worse than
+one that is skipped, because nobody goes back to check it.
+
+Narrow to a tier (`rungs check --fast`) only when you know the tier holds what you meant to run.
+
 **Do not proceed on a red gate**, and do not weaken one to get through. A release is exactly the
 moment the temptation is highest and the cost of yielding is highest.