diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 42cc34c0..debe6ad1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -144,10 +144,10 @@ jobs:
           AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
         run: cargo check --workspace --all-features --locked --target aarch64-unknown-linux-gnu
 
-  # Advisory guard that nexum-runtime stays venue-agnostic: crate graph, symbol
-  # scan, and nexum:host WIT leaf-ness (scripts/check-venue-agnostic.sh).
-  # `continue-on-error` keeps this a signal, not a gate, until the physical
-  # host cut lands; the flip to a blocking gate is tracked for M2.
+  # Advisory zero-leak guard that nexum-runtime stays venue-agnostic: crate
+  # graph, charter symbol scan, and nexum:host WIT leaf-ness
+  # (scripts/check-venue-agnostic.sh). `continue-on-error` keeps this a
+  # signal, not a gate; it flips to a required check at the physical repo cut.
   venue-agnostic:
     name: venue-agnostic (advisory)
     runs-on: ubuntu-latest
diff --git a/crates/nexum-runtime/src/lib.rs b/crates/nexum-runtime/src/lib.rs
index 1d200b90..b4cccbdd 100644
--- a/crates/nexum-runtime/src/lib.rs
+++ b/crates/nexum-runtime/src/lib.rs
@@ -1,6 +1,11 @@
 //! Nexum runtime: a wasmtime-based host for WASM Component Model
 //! modules, usable as an embeddable library. The bundled binary is a
 //! thin consumer of the same public surface.
+//!
+//! Zero-leak charter: this crate is settlement-domain-agnostic. It
+//! carries no domain symbol or WIT reference, `nexum:host` stays a
+//! leaf WIT package, and no crate edge reaches a domain crate. The
+//! zero-leak script under `scripts/` enforces this in CI.
 
 #![cfg_attr(not(test), warn(unused_crate_dependencies))]
 
diff --git a/scripts/check-venue-agnostic.sh b/scripts/check-venue-agnostic.sh
index 26d60d3a..3c262410 100755
--- a/scripts/check-venue-agnostic.sh
+++ b/scripts/check-venue-agnostic.sh
@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
-# Venue-agnosticism check for the host layer: no host-layer crate graph
+# Zero-leak check for the host layer: no host-layer crate graph
 # (runtime, launcher, bare engine) reaches a videre/intent/venue/cow
-# crate, the runtime sources carry no venue symbol, and nexum:host
-# resolves as a leaf WIT package. Advisory in CI until the physical cut
-# lands; run locally via `just check-venue-agnostic`.
+# crate, the runtime sources carry no charter symbol
+# (videre:|videre_host|Venue[A-Z]|EgressGuard|synthesize_venue|value-flow),
+# and nexum:host resolves as a leaf WIT package. Advisory in CI until
+# the physical cut lands; run locally via `just check-venue-agnostic`.
 
 set -uo pipefail
 
@@ -34,14 +35,16 @@ for crate in nexum-runtime nexum-launch nexum-cli; do
     fi
 done
 
-# 2. Symbol scan: no venue vocabulary anywhere in the crate. Word shapes
-#    skip std::borrow::Cow, ProviderError, and "intentional".
-symbols='\b[Vv]idere|\b[Ii]ntent([_A-Z-]|s?\b)|\b[Vv]enue|\bcow|CoW|\bCow[A-Z]'
-rg -n --no-heading -e "$symbols" crates/nexum-runtime
+# 2. Symbol scan: the charter set (the current venue vocabulary that would
+#    signal a leak - videre WIT/crate refs, the Venue* types, the egress
+#    guard). Section 1 guards dependency edges; this scan stays curated to
+#    the live post-rename names so opaque extension payloads never false-flag.
+charter='videre:|videre_host|Venue[A-Z]|EgressGuard|synthesize_venue|value-flow'
+rg -n --no-heading -e "$charter" crates/nexum-runtime/src
 case $? in
-    0) fail "venue symbols leak into nexum-runtime" ;;
+    0) fail "charter symbols leak into nexum-runtime" ;;
     1) pass "symbol scan empty" ;;
-    *) fail "symbol scan errored (crates/nexum-runtime missing?)" ;;
+    *) fail "symbol scan errored (crates/nexum-runtime/src missing?)" ;;
 esac
 
 # 3. WIT DAG: nexum:host is a leaf. No cross-package use/import, and the