AGENTS.md § Gates is the one gate list; cli_contract.GATES and docs verify hold it

The gate list contradicted itself across AGENTS.md, instructions/gates.md and the
command records' gate names. The Rebase-Review Gate is now listed, `new project`'s
exit 42 is no longer a pseudo-gate, gates.md and the explanation page link to the one
list instead of counting, and a register plus a docs verify check keep the three in step.

Files changed:
- AGENTS.md
- CHANGES.md
- VERSION
- docs/explanation/why-gates-are-code.md
- docs/reference/commands/pages.md
- docs/reference/commands/types-instructions-and-docs.md
- docs/reference/exit-codes.md
- instructions/gates.md
- tools/CONTRACT.md
- tools/chemenu/cli_contract.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/git_publish.py
- tools/chemenu/commands/new_page.py
- tools/chemenu/errors.py
- tools/chemenu/mcp/server.py
- tools/chemenu/tests/test_cli_contract.py
- tools/chemenu/tests/test_docs_verify.py
- tools/chemenu/tests/test_git_publish.py
- tools/chemenu/tests/test_reference_doc.py

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

instructions/gates.md

@@ -1,13 +1,14 @@
 ---
 type: types/instruction.md
 name: gates
-description: What to do when wikitool refuses a call - exit 42 (user clearance required) on publish, upload accept and export guidelines --push, and the Iteration Budget Gate and loop-breaker on every command.
+description: What to do when wikitool refuses a call - exit 42 (user clearance required) on publish, sync, upload accept and export guidelines --push, and the Iteration Budget Gate and loop-breaker on every command.
 ---
 
 # When a gate refuses a call
 
-Two limits are enforced in code rather than by instruction, because a prompt-level limit is one
-an agent can talk itself past.
+The limits listed in [AGENTS.md § Gates](../AGENTS.md#gates) are enforced in code rather than by
+instruction, because a prompt-level limit is one an agent can talk itself past. This file holds
+the procedure for each; it does not repeat the list.
 
 **Never open a gate on your own initiative.** Not `--override-budget`, not `budget reset`, not a
 `--confirm` token the user has not actually seen and approved.
@@ -34,24 +35,18 @@ Read the exit code first - it says which of these applies:
 ## Exit 42: user clearance required
 
 A `wikitool` command that exits **42** is not reporting an error. It is refusing to act until a
-human has *read its output*. Five gates use it today - the Mass-Update Gate (`publish`, on a
-change touching 10 or more counted files), the rebase-review gate (`sync` and `publish`, on
-a rebase whose incoming commits touch a file this session is also changing, generated files
-aside), the
-Publish-Remote Gate (`publish`, on a push to a target this checkout has not declared), the
-Upload Review Gate (`upload accept`, on a submission nobody has cleared yet), and the Guideline
-Push Gate (`export guidelines --push`, before a generated `GUIDELINES.md` goes into any captured
-repository) - but the rule is about the exit code, not the command:
+human has *read its output*. Which gates use it is [AGENTS.md § Gates](../AGENTS.md#gates); the
+rule is about the exit code, not the command:
 
 > **Copy the command's output into your reply - the substance of it, not a description of it -
 > and stop.** Run no further commands in that turn.
 
-For the Mass-Update Gate that substance is the grouped file breakdown: the area headings, every
+For the Mass-Update Gate (`publish`, on a change touching 10 or more counted files) that substance is the grouped file breakdown: the area headings, every
 path, and the sizes. It is already ordered for a reader - what a bad publish damages most comes
 first, and the mechanically-regenerated files come last - so reproducing it in order is both the
 cheapest and the most useful thing to do with it.
 
-For the rebase-review gate the substance is different: the commits arriving from the remote,
+For the Rebase-Review Gate (`sync` and `publish`) the substance is different: the commits arriving from the remote,
 the files they touch that this session is also touching, and a diff of those files. Read it -
 this is the check `sync`/`publish` cannot perform themselves, since a rebase between two commit
 ranges that touch disjoint files never reaches this gate at all (no content collision is