VG-1 Gates before done

Work MUST NOT be called done until every gate that covers it has run and passed on the change as it will be committed, unless a red-suite exception covers the red.

Field	Value
Keyword	MUST NOT
Level	2
Checked	by judgement
Findings	F305, F303, F104
Harness facts	none
Threat	construct: a failure is known only if someone recorded it
Status	active

Rationale: in Shio, winwright and freewilly a task was closed on a report that looked right, a look by hand, or a run that came before the last edit, and the defect surfaced later for whoever came next (F305, R3/S3). In winwright the shipping step itself edited what the gate reads after the run that proved the work, so the red landed on the next session twice in one session. Ledger entries written by the shipping session recorded its own claim and were later found untrue (F104, R3/S3). A gate that the agent must remember to run holds only in the sessions that remember it (F303), so running it is part of closing, and the run must be on the tree that will be committed. The only red this rule lets through is one recorded as a red-suite exception (VG-7).