diff --git a/tools/gitea-protect b/tools/gitea-protect
index c1ac40e8..8c52efa7 100755
--- a/tools/gitea-protect
+++ b/tools/gitea-protect
@@ -172,8 +172,20 @@ def verify(tok):
     # merge, so a green rule proves nothing on its own.
     for agent in AGENTS:
         status, perm = api("GET", f"/collaborators/{agent}/permission", tok)
+        # 🔴 A MISSING COLLABORATOR IS A FAILURE, not a blank. This branch used
+        # to print ⚪ and `continue`, leaving `ok` untouched -- so the one
+        # instrument that checks Phase 1.2 could not report Phase 1.2 being
+        # undone. An agent removed from the repository read as "nothing to say"
+        # rather than as a gate that is no longer there.
+        #
+        # It never actually fired: Gitea answers this endpoint with permission
+        # "read" for a non-collaborator rather than 404, so the case was caught
+        # by the role test below -- by luck, not by design. That is the same
+        # shape as a check that passes on an instance with no rule at all, and
+        # it is not worth keeping just because the luck has held.
         if status == 404:
-            print(f"  ⚪ {agent:<42} not a collaborator (yet)")
+            print(f"  🔴 {agent + ' is not a collaborator':<42} Phase 1.2 is undone")
+            ok = False
             continue
         if status != 200:
             print(f"  🔴 {agent:<42} permission unreadable ({status})")