diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 5774dbf..8ac2187 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -831,8 +831,38 @@
   **`creds-mint.sh` STAYS QUEUED for its own ruling** -- orthogonal, since it prevents the NEXT
   unregistered mint but makes no existing key reproducible and fixes no staging; bundling it
   would have made urgent no-tool work wait on unscoped tooling work.
-  Remaining: R15 standing; G18 deferred-and-gated. **All Stage-5 BLOCKING rulings (R1-R11) are
-  closed.**
+  **R15 RULED 2026-07-27 -- exact utterance "All three, with a harness MANIFEST rather than a
+  count (Recommended)". OPS under GA-R3** (three script fixes; no D-number). **It
+  OPERATIONALISES GA-R6:** that ruling lets a stage close only on a named executable check,
+  so the check must be capable of FAILING -- these three were not. Scope:
+  **(1) `repo-lint` gains a valid-root check and a files-scanned floor.** `repo_lint.py:132-135`
+  strips only the two KNOWN flags, so any other `--flag` becomes `argv[0]` i.e. the ROOT, with
+  no `R.is_dir()` check and no floor -- a ONE-CHARACTER typo of either the flag or the path
+  resolves to a nonexistent directory, `rglob` yields nothing, and it reports `PASS (0 fail,
+  0 warn)` over ZERO files. Reproduced twice this session. **This is the gate whose "0-fail"
+  every GA-R6 stage close in this project's history cites**, and it cannot distinguish a clean
+  repo from an unexamined one.
+  **(2) The gauntlet pins a checked-in MANIFEST of harness NAMES, drift-checked -- not a
+  count.** `run-tests-all.sh:35` already has a ZERO-floor (`RAN -eq 0` -> exit 2); what is
+  absent is any pin on WHICH harnesses ran. `81` exists only as prose in this document.
+  A manifest catches a RENAME that a bare count would miss (add one, remove one, count holds).
+  Mirrors two proven in-repo patterns: `clientdocs/sweep-receipt.txt` hash-pinning and the
+  D-137 creds-manifests derive-plus-drift gate.
+  **(3) `preflight` stops failing open.** `preflight.sh:27` `note()` tests only `rc -eq 1` and
+  `rc -eq 2`, so 127/126/130 and any rc>=3 leave `PREFLIGHT: PASS -- clear to add-model /
+  deploy` -- measured with a sub-gate exiting 127. And rc=2, which is how these checkers
+  signal "I could not evaluate anything", is remapped to WARN in P1/P2/P3. The project ALREADY
+  fixed exactly this for P5 (harness T9); this extends the proven pattern. Preflight is the
+  gate that AUTHORISES the deploy, which is why it was included rather than deferred.
+  All three are one defect class -- the audit's central finding, already carried in the skill
+  as "A CHECKER THAT CANNOT FAIL IS NOT A GATE". Execution is a SEPARATE gated step under
+  standard delivery discipline (harnesses green, gauntlet ALL GREEN, repo-lint 0-fail,
+  changelog with revert). **NOTE the ordering trap: these changes alter what "green" MEANS, so
+  the gauntlet and lint runs that certify them must be read with that in mind -- and a manifest
+  introduced mid-session must be seeded from a tree that is itself verified, not from whatever
+  happens to be on disk.**
+  **ALL QUEUED RULINGS ARE NOW CLOSED: R1-R13 and R15 ruled, R2a and R14 WITHDRAWN as raised
+  in error, G18 opened deferred-and-gated.**
 - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6
   exact; convergence zero --
   `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B