diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index dc76b499..9adac1ec 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -34,11 +34,9 @@ jobs:
       - uses: actions/checkout@v3
       - name: lint
         # Flags hash-number tracker tags in source (hive convention is
-        # prose, not tags — /knowledge/hive-rules.md). Runs as its own
-        # job, kept out of the required checks while the legacy backlog
-        # is cleaned up: a hit fails this check (red) without blocking
-        # merge. Promote to a required check once the tree is clean.
-        # See scripts/check-issue-refs.sh.
+        # prose, not tags — /knowledge/hive-rules.md). Its own job, and
+        # IS a required check on the forge (branch protection) — a hit
+        # blocks merge. See scripts/check-issue-refs.sh.
         run: sh scripts/check-issue-refs.sh
 
   comment-blocks:
@@ -51,7 +49,7 @@ jobs:
       - name: lint
         # Flags contiguous comment blocks over 30 lines (a giant prose
         # block belongs in docs/ as implementation notes, not in source).
-        # Own job, kept out of required checks while the tree settles: a
-        # hit reds this check without blocking merge. Promote to required
-        # once clean. See scripts/check-comment-blocks.sh.
+        # Own job, and IS a required check on the forge (branch
+        # protection) — a hit blocks merge. See
+        # scripts/check-comment-blocks.sh.
         run: sh scripts/check-comment-blocks.sh
diff --git a/scripts/check-comment-blocks.sh b/scripts/check-comment-blocks.sh
index 94da77cf..28b0abd5 100755
--- a/scripts/check-comment-blocks.sh
+++ b/scripts/check-comment-blocks.sh
@@ -5,9 +5,8 @@
 # comments stay, walls of text move out. See the hive convention in #2077.
 #
 # Emits a CI error annotation per offending block and exits 1 if any block
-# exceeds MAX. Runs as its own CI job, kept OUT of the required checks while
-# the tree settles: a hit turns the job red (visible, non-blocking) without
-# blocking merge. Promote to required once the tree is clean.
+# exceeds MAX. Runs as its own CI job and IS a required check on the forge
+# (branch protection) — a hit blocks merge.
 #
 # Scope: tracked *.rs *.nix *.sh *.js *.ts *.css *.html. Markdown is exempt
 # (it is prose by nature). Comment forms: `#` line comments (nix/sh), `//`
diff --git a/scripts/check-issue-refs.sh b/scripts/check-issue-refs.sh
index 8053bed2..66aa1fbf 100755
--- a/scripts/check-issue-refs.sh
+++ b/scripts/check-issue-refs.sh
@@ -5,11 +5,8 @@
 # targets and leak tracker coupling into the source tree.
 #
 # Emits a CI error annotation per hit and exits 1 if any tag is found,
-# 0 otherwise. It runs as its own CI job, deliberately kept OUT of the
-# required checks while the legacy backlog is cleaned up: a hit turns
-# the job red (a visible, non-blocking signal on the PR) without
-# blocking merge. Promote it to a required check once the tree is clean
-# to make it a hard gate — no code change, just branch-protection.
+# 0 otherwise. It runs as its own CI job and IS a required check on the
+# forge (branch protection) — a hit blocks merge.
 #
 # Scope: tracked *.rs *.nix *.js *.ts *.css *.html. Markdown is exempt
 # (prose docs may legitimately cite the tracker). The pattern matches a