gate: check 7 (register citations) + content WARNings on the memory index

Check 7 catches "cites a register item and calls it open when it is not" -- the R-168 class, four
files, one self-contradicting. Trigger is an openness CLAIM, not any citation: policing every
mention would fire on ~30 legitimate provenance citations and the gate would be switched off.
Deliberate deviation from the task's literal wording, to keep it alive.

Two bugs found by the check's own red-proofs, both of which would have shipped:
- the state marker is not self-closing (**SHIPPED - text**), so the first parser read R-168 itself
  as OPEN -- a gate that cannot convict its founding case is decoration;
- the CLOSED exemption was line-wide, so "shipped" in a title pardoned "OPEN R-25b".

Check 6 gains WARN-only content classes on MEMORY.md. Link targets are stripped first: the earlier
scan reported three expired statements, all three false (dates in filenames), while missing the one
real expired claim, whose deadline was written ~08-02 with no ISO date.

39 -> 60 assertions. All four runners green.

scripts/CHANGELOG.md

@@ -1,3 +1,36 @@
+## instructions_gate.py — check 7 (register citations) and content WARNings on the index (2026-08-06)
+
+**Check 7: a citation that calls a register item OPEN must be right.** Four instruction files said CI
+was still owed, citing R-168, four days after it closed; one contradicted itself. A trim is a VOLUME
+operation and does not validate content — this class, at least, is mechanical.
+
+Three design decisions, each earned during the build:
+
+- **The trigger is an OPENNESS CLAIM, not any citation.** Requiring every mention of a non-open item
+  to carry "CLOSED" would fire on ~30 legitimate provenance citations (`(R-161)`, `R-117 spike §6.3`)
+  that cite an item as the source of a fact. A gate that noisy gets switched off — R-29's own lesson.
+  **This is a deliberate deviation from the task's literal wording**, taken to keep the gate alive.
+- **The state marker is not self-closing.** Real rows read `**SHIPPED — and the alarm is
+  DEMONSTRATED**`. The first parser required `**SHIPPED**` and therefore read **R-168 — the row this
+  check exists for — as OPEN**. A gate that cannot convict its own founding case is decoration.
+- **The exemption is scoped to the citation's CLAUSE.** A line-wide test pardoned `OPEN R-25b`
+  because "shipped" appeared earlier in the same line, in a title and a filename. Found only because
+  the red-proof failed to go red.
+
+**Check 6 gains content WARNings on `MEMORY.md`** — version literals, host addresses, expired
+statements, and stale-open citations — all WARN, never FAIL. Claude writes that file between
+sessions, so a hard failure would refuse a human's push over a line no human typed; the warning is
+read by the same model that will next edit the file, which makes the loop self-correcting.
+
+**The expired-statement class carries the sharpest lesson.** A scan on 2026-08-06 reported three
+expired statements in the index and **every one was false** — each matched the ISO date inside a
+markdown link TARGET, i.e. a filename — while **missing the one real expired claim** in the same
+file, whose deadline was written `~08-02` and contained no ISO date at all. Link targets are now
+stripped before any content judgement, and the deadline pattern matches the bare `MM-DD` form.
+
+First run over the real index: 32 version literals, 4 host addresses, 0 expired, 0 stale citations.
+Suite 39 -> 60 assertions. Red-proofs against real files both ways, quoted in the ledger.
+
 ## install_workspace.py + rules_report.py — the workspace survives the machine (2026-08-06, R-229)
 
 The workspace-root `CLAUDE.md` and the `InstructionsLoaded` hook shape every session and existed on