diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ebdac9b..c896084 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,7 +90,7 @@ jobs:
         run: |
           echo "release-type: $RELEASE_TYPE"
           cargo semver-checks --workspace \
-            --baseline-version 2.1.0 \
+            --baseline-version 2.2.0 \
             --release-type "$RELEASE_TYPE"
 
   # MSRV applies to the crates that do not need the pinned nightly
@@ -106,3 +106,33 @@ jobs:
         with:
           tool: just
       - run: just msrv
+
+  # One green check standing for every job in this workflow.
+  #
+  # `main`'s ruleset requires this rather than each job by name, so adding a
+  # job here protects `main` automatically instead of silently not being
+  # required until somebody remembers to edit the ruleset. That is the
+  # failure mode this exists to prevent: an unrequired gate is a gate that
+  # reports.
+  #
+  # `if: always()` plus an explicit scan, because `needs` alone would mark
+  # this skipped when a dependency fails — and a skipped required check does
+  # not block a merge. The three checks outside this workflow (`gate`,
+  # `check`, `termlens`) are required by name in the ruleset.
+  required-green:
+    name: required-green
+    if: always()
+    needs: [ci, semver, msrv]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify every gate succeeded
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "gate results: $RESULTS"
+          for r in $RESULTS; do
+            if [ "$r" != "success" ]; then
+              echo "a required gate did not succeed" >&2
+              exit 1
+            fi
+          done
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index eefe649..37839b8 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -74,7 +74,9 @@ tag had to be pushed by hand.
   ```sh
   gh workflow run install.yml
   ```
-- **Move the semver baseline, in a PR of its own after the publish.**
+- **Move the semver baseline, in a PR of its own after the publish.** It is
+  the `--baseline-version` literal in `ci.yml`'s `semver` job, not a YAML
+  input — `grep baseline-version .github/workflows/ci.yml` finds it.
   `baseline-version` in `ci.yml`'s `semver` job is a literal. Left at the old
   release it compares every PR against a version nobody can install any more,
   and it would also carry this release's own breaks forward as if they were
@@ -83,7 +85,7 @@ tag had to be pushed by hand.
   bump the literal.
 
   ```sh
-  $EDITOR .github/workflows/ci.yml   # baseline-version: X.Y.Z
+  $EDITOR .github/workflows/ci.yml   # --baseline-version X.Y.Z
   ```
 - **A break needs the `breaking` label on its PR**, which switches the semver
   job from `patch` to `major`. Without it the job fails, which is the point;