diff --git a/.github/workflows/dep-check.yml b/.github/workflows/dep-check.yml
index 7c5edca..10d2112 100644
--- a/.github/workflows/dep-check.yml
+++ b/.github/workflows/dep-check.yml
@@ -32,7 +32,7 @@ on:
           TOOL is a semver artifact, so a behaviour change is a version bump somebody reviewed.
           The pin lives here rather than in eleven callers.
         type: string
-        default: '0.9.0'
+        default: '0.9.1'
       run-floor-check:
         description: |
           Also run the suite against the BOTTOM of every declared sibling range, not only
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ac1b42..61817d9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [dep-check 0.9.1] - 2026-08-27
+
+### Fixed
+
+- The organisation-wide audit labels an `ahead` range the same way check C does. `0.9.0` gave
+  `ceilingDrift` a direction and taught check C to use it, and left the audit reading the old
+  shape — so a published package whose floor sits above `latest` would have printed
+  `(undefined behind)` and been filed under `contract`. Introduced by `0.9.0` and caught before
+  it ran anywhere (#24)
+
+
 ## [dep-check 0.9.0] - 2026-08-27
 
 ### Fixed
diff --git a/packages/dep-check/index.mjs b/packages/dep-check/index.mjs
index c71f9ea..0a4e430 100755
--- a/packages/dep-check/index.mjs
+++ b/packages/dep-check/index.mjs
@@ -290,7 +290,9 @@ async function commandAudit() {
             dep,
             ...drift,
             deprecated: Boolean(manifest.deprecated),
-            severity: field === "peerDependencies" ? "contract" : "behind",
+            // Same three-way severity as check C: a floor above latest means the published
+            // package installs nowhere, which outranks a merely stale contract.
+            severity: drift.direction === "ahead" ? "unpublished" : field === "peerDependencies" ? "contract" : "behind",
           });
         }
       }
@@ -301,7 +303,9 @@ async function commandAudit() {
     title: "audit) every published package in the scope",
     findings,
     note: `  Swept ${names.length} published packages. \`deprecated\` means the registry already warns people.`,
-    columns: (f) => `[${f.severity}]${f.deprecated ? "[deprecated]" : ""} ${f.pkg.padEnd(30)} ${f.field.padEnd(17)} ${f.dep.padEnd(20)} ${f.range.padEnd(16)} latest ${f.latest} (${f.majorsBehind} behind)`,
+    columns: (f) =>
+      `[${f.severity}]${f.deprecated ? "[deprecated]" : ""} ${f.pkg.padEnd(30)} ${f.field.padEnd(17)} ${f.dep.padEnd(20)} ${f.range.padEnd(16)} latest ${f.latest} ` +
+      (f.direction === "ahead" ? "(nothing published satisfies this)" : `(${f.majorsBehind} behind)`),
   });
   return 0;
 }
diff --git a/packages/dep-check/package-lock.json b/packages/dep-check/package-lock.json
index b4b2b56..56ddc37 100644
--- a/packages/dep-check/package-lock.json
+++ b/packages/dep-check/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@theokit/dep-check",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@theokit/dep-check",
-      "version": "0.9.0",
+      "version": "0.9.1",
       "license": "Apache-2.0",
       "dependencies": {
         "semver": "^7.7.2"
diff --git a/packages/dep-check/package.json b/packages/dep-check/package.json
index e0774c7..83f4dcd 100644
--- a/packages/dep-check/package.json
+++ b/packages/dep-check/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@theokit/dep-check",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "The ecosystem dependency gate: does a package's declared range still describe the sibling it ships against? Four checks, kept apart by what they need to answer and therefore by whether they may fail a build.",
   "type": "module",
   "engines": {