diff --git a/CHANGELOG.md b/CHANGELOG.md
index 63bfbc6..7ef509c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## docs — the "CI is still owed" claim was stale; corrected (2026-08-06, R-229 part 2) — no version bump
+
+**One sentence, no code.** This file asserted that continuous integration was still owed
+(`felhom.eu` `OPEN-ITEMS.md` R-168). **R-168 was CLOSED on 2026-08-02** — a Gitea Actions runner
+re-runs each repo's gate entry point on every push and emails the operator on failure. Found while
+confirming this session's own push by run ID, which is the check that caught it.
+
+The same stale sentence was in four instruction files across all four repos and is corrected in all
+four. In `felhom-agent/CLAUDE.md` it **contradicted the same file's release section**, which already
+said R-168 mails the failure — a contradiction inside one instruction file, which is the exact class
+the R-229 work exists to find.
+
+
 ### papra — the volume is mounted where the app actually writes (2026-08-03, R-156, last leg)
 
 **The third and last of the three apps that kept their data where backups never looked.** papra
diff --git a/CLAUDE.md b/CLAUDE.md
index 28296b7..022da95 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,7 +45,8 @@ deployed `app.yaml` (customer secrets) is never overwritten. Full deploy details
   runtime and take minutes per app, and a push that pulls images and starts containers gets bypassed
   within a week, after which the bypass is the habit. They stay deliberate periodic runs. The hook is
   per-clone (`git config core.hooksPath .githooks`) and `git push --no-verify` bypasses it, which is
-  why R-161's automatic half is still owed — it is now tracked as `felhom.eu` `OPEN-ITEMS.md` R-168.
+  why gate 1 alone cannot be the whole story — CI re-runs the entry point on every push and **emails
+  on failure** (`felhom.eu` `OPEN-ITEMS.md` R-168, CLOSED 2026-08-02), which is what notices a bypass.
 - **Never `:latest` or untagged images in templates** — pin a concrete version tag; an app deployed
   anywhere in the fleet is pinned to the digest it is currently running (a pin must never cause a
   version jump). Digest pins (`@sha256:`) also count. Gate: `python scripts/check-image-pins.py`