diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index c382cea..47b6509 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -132,14 +132,13 @@ jobs:
   # suites scale themselves down when they detect valgrind, which turns them
   # into the broadest path coverage in the tree at a cost this job can afford.
   #
-  # continue-on-error until TODO.md "Memory checking" items 34-39 are closed.
-  # The findings are real and they are all in libakgl, so this job is red today
-  # by telling the truth; gating on it now would only teach everyone to ignore a
-  # red build. Remove the flag with the commit that closes the last item -- and
-  # the JSON one (item 34) is four lines, so that should not be a long wait.
+  # This job gates. A definite leak, a read past the end of an allocation, or a
+  # branch on uninitialised memory fails the build on the push that introduced
+  # it -- not on the day somebody gets around to caring. The six findings this
+  # job had on its first run were fixed to make that possible rather than
+  # excused into a warning.
   memory_check:
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - name: Check out repository code
         uses: actions/checkout@v4
diff --git a/AGENTS.md b/AGENTS.md
index 0f28e46..1dd1a78 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -88,7 +88,7 @@ because the others cannot do its work:
 |---|---|---|
 | `cmake_build` | Debug + `AKGL_COVERAGE=ON` | The unit suites and the coverage report. The perf suites run here too, at `AKGL_BENCH_SCALE=0.02`, for path coverage only — a timing taken under gcov is a measurement of gcov. |
 | `performance` | RelWithDebInfo | `ctest -L perf`. The only job where budgets are enforced, because `tests/benchutil.h` enforces them only when compiled optimized at full scale. Keeps the tables as an artifact. |
-| `memory_check` | RelWithDebInfo | `scripts/memcheck.sh`, every suite under valgrind. `continue-on-error` until TODO.md "Memory checking" items 34-39 are closed; keeps the valgrind logs as an artifact. |
+| `memory_check` | RelWithDebInfo | `scripts/memcheck.sh`, every suite under valgrind. Gates: a definite leak, an invalid access or a branch on uninitialised memory fails the build. Keeps the valgrind logs as an artifact. |
 | `mutation_test` | Debug | One focused source file, so CI stays bounded. |
 
 The `character` suite is excluded wherever a whole run is selected: it fails