chore: record the per-request model rulings and align the maintainer gate

.abcd/development/intents/drafts/itd-2610290858115394-a-repository-s-maintainers-hold-its.md

@@ -42,10 +42,11 @@ We expect write access to be enough to define the maintainer, with no team, beca
 
 - **Given** an account with Read or Triage access, **when** it runs a gated act (start a release cut, reserve a release, promote a private lab or ideate verdict to public, adopt an intent, lift an embargo), **then** abcd refuses before writing anything, names the act, says that it needs Write, Maintain or Admin access, and names the GitHub setting that is the real boundary.
 - **Given** an account with Admin access, **when** it runs a gated act, **then** abcd treats it as a maintainer.
-- **Given** an account whose repository role is a custom role, **when** abcd reads its role, **then** it is judged by the custom role's base role; **given** a pull request author who is not a collaborator at all (a fork's author, for whom the forge reports no role), **then** abcd treats them as a contributor.
+- **Given** an account whose repository role is a custom role, **when** abcd reads its role, **then** it is judged by the custom role's base role; **given** a pull request author who is not a collaborator at all (a fork's author, for whom the forge answers not found or reports no role), **then** abcd treats them as a contributor.
+- **Given** a role abcd cannot read (the forge answers with an error other than not found, or a custom role whose base role it cannot read), **when** a gated act's check or the merge path runs, **then** abcd says the role is unverified, never treats the account as a maintainer, and arms nothing.
 - **Given** the forge requires no approval on its own (the live setting since the code-owners file was removed), **when** a contributor's pull request reaches abcd's merge path, **then** abcd itself holds it until a maintainer has approved; the forge only guarantees that whoever merges has write access.
-- **Given** a contributor's pull request, **when** abcd's merge path is asked to queue it or arm auto-merge, **then** it does so only once a maintainer has approved the pull request, whatever the facilitator's mode.
-- **Given** a maintainer's own pull request, **when** the facilitator's mode is autonomous, **then** abcd's merge path queues it with no approval asked, subject to the review-receipt condition the facilitator's merge gate already sets for autonomous mode; **when** the mode is a person, **then** abcd arms nothing until the technical facilitator has approved, and then arms it.
+- **Given** a contributor's pull request, **when** abcd's merge path is asked to queue it or arm auto-merge, **then** it does so only once the pull request is approved, whatever the facilitator's mode, where approved means either the technical facilitator's approval act below, recorded for the pull request's head commit, or a review approving that head commit on the forge from a maintainer other than the author.
+- **Given** a maintainer's own pull request, **when** the facilitator's mode is autonomous, **then** abcd's merge path queues it with no approval asked, subject to the review-receipt condition the facilitator's merge gate already sets for autonomous mode; **when** the mode is a person, **then** abcd arms nothing until the technical facilitator has approved it through an abcd approval act, which records the approval for the pull request's head commit in the checkout's local tier, is run by the person and is refused to an agent, and then arms it; a commit pushed after the approval needs approving again.
 - **Given** the forge cannot be reached, **when** a gated act's check runs, **then** abcd says the caller's role is unverified and never reports it as verified; a point where abcd itself is the enforcement (the merge path) arms nothing.
 - **Given** the live settings differ from what the repository declares (a base permission above Read, a version-tag rule that lets any writer create tags, a required check whose source app is not pinned, a protection switched off since the last run), **when** abcd runs its settings check, **then** it reports each difference with the exact setting and the forge page that changes it, and changes nothing.
 - **Given** the docs check's ban on the word "maintainer", **when** this intent ships, **then** the ban is lifted and "maintainer" is defined in the glossary as an account with Write, Maintain or Admin access.
@@ -71,6 +72,8 @@ Technical choices with one defensible state-of-the-art answer, recorded rather t
 - Each required check is pinned to the app that must post it, so a writer cannot post a passing status under its name (same source).
 - Settings drift is detected and proposed, never applied, extending the ruleset mirror and its drift check (itd-92) to the base permission, environments and team access, in the manner of OpenSSF Allstar's issue mode ([Allstar](https://github.com/ossf/allstar)).
 - Never use the ruleset "exempt" bypass type, which skips enforcement silently ([GitHub changelog](https://github.blog/changelog/2025-09-10-github-ruleset-exemptions-and-repository-insights-updates/)).
+- In human mode the facilitator's approval is abcd's own act, not a forge review: a project with one maintainer has no second maintainer to review, and the forge does not let an author approve their own pull request. The act is recorded for the head commit, so a later push voids it, and agents are refused it as they are refused every person-only act. Agreed with the lane building the facilitator's merge gate (itd-2610150602547271) on 2026-10-29, so the two records give one model.
+- An unreadable role is unverified, never a contributor and never a maintainer: treating it as a contributor would hold a maintainer's change on a forge outage, and treating it as a maintainer would arm a contributor's. A not-found answer is different, because the forge gives it for an account with no access, so it reads as a contributor.
 - No two-person rule for releases while a project has one or two maintainers. Projects of that size self-approve releases, and the release approval this project removed had not been an independent check (adr-2610281718537125).
 
 ## Open Questions

.abcd/development/specs/open/spc-2610240951109420-a-person-sets-how-many-models-review.md

@@ -80,6 +80,7 @@ intent-auditor's fan-out.
    - packages: internal/core/implement/loop, commands
    - tests: two reviewers of one role get distinct round paths, briefs differing only in the return path, and receipts matched by index; an older run state migrates its reviewer to index 0 or is refused by version; both reviewers are handed out within the sub-agent ceiling; a host-run reviewer's model is recorded as asked, not confirmed; pass against fail is a disagreement, two failing verdicts are not, and any failing reviewer fails the round
    - needs: 1, 2
+   - rulings: dcn-2610292236161673 (a request for a model the machine pins is refused on claude with no fallback; a request model and a --route model that differ are refused before launch, naming both)
 4. The per-reviewer findings record
    - packages: internal/core/implement/loop, internal/surface/cli, commands
    - tests: each `file:line` under a return's findings is one located finding of its reviewer; a return with none records zero and is not refused; the fix report's applied or rejected status is joined to each finding, `unknown` where it is silent; two findings at the same file and line are marked as cited by both; `implement record --json` carries them

.abcd/work/decisions/dcn-2610292236161673-decided-by-the-technical-facilitator-on.md

@@ -0,0 +1,6 @@
+---
+id: dcn-2610292236161673
+slug: decided-by-the-technical-facilitator-on
+date: 2026-10-29
+---
+2026-10-29 — Decided by the technical facilitator on delegation (coordinator rulings on the review of the merge that landed step 2 of spc-2610240951109420, 2026-10-29), two rules for a model asked per request, for step 3 to build. (a) When a request asks the claude runner for a model the machine pins, the dispatch is refused before anything launches and nothing falls back, to the host or to any other runner, with the words the refusal of a --route to a pinned model on claude already uses: claude can hold no pin, and a run on another model is a run nobody asked for. As merged, the request is refused at launch and the role is handed back to the host; step 3 makes that refusal final. (b) When a request names a model and a --route names a model too, and the two differ, the dispatch is refused before anything launches, naming both; when they are the same model it runs, and the up-front pin check vets that one model.

.abcd/work/issues/open/iss-2610290811187925-abcd-should-help-the-technical.md

@@ -9,7 +9,7 @@ found_during: "coordinator session, product-thinker ruling on personal identifie
 origin: researcher-authored
 production_mode: hand-written
 found_at: ".abcd/development/brief/04-surfaces/20-banlist.md"
-remedy: "Add an abcd step (through ahoy and the GitHub settings audit of itd-2610290746077716) that: derives the private-names layer deterministically on every run from the machine's host and computer names, the local user accounts and the forge's org members and collaborators, never printing them; scans the tracked tree and abcd's own pushed refs for those names and reports counts only; proposes the replacements (roles, the organisation, a team handle, persona names in fixtures) for a yes; and for the web-only steps (creating a visible team with write access) gives exact prefilled links, then verifies the result through the API <!-- record-lint: forward-looking -->"
+remedy: "Add an abcd step (through ahoy and the GitHub settings audit of itd-2610290746077716) that: derives the private-names layer deterministically on every run from the machine's host and computer names, the local user accounts and the forge's org members and collaborators, never printing them; scans the tracked tree and abcd's own pushed refs for those names and reports counts only; proposes the replacements (roles, the organisation, a team handle, persona names in fixtures) for a yes; and for the web-only steps (creating a visible team with write access) gives exact prefilled links, then verifies the result through the API"
 ---
 
 abcd should help the technical facilitator of every abcd-managed repository set up the same personal-identifier protection this repository now has, as easily as possible. That means: no org member's login or name in any tracked file or anything abcd pushes or publishes (records, fixtures, credits, the site's contributors page, reservation and announcement trailers and ref names), with commit author fields left as the person's identity; code-owner sign-off through an org team rather than named people; test fixtures that use the standard abcd personas from .abcd/development/personas.json instead of invented or real names; and a private-names list that always and automatically includes the machine's names, its local user accounts and the org's members and collaborators. Today each of these was set up by hand in one repository, and a managed repository gets none of it.

.abcd/work/issues/open/iss-2610292237259195-embargo-check-range-flags.md

@@ -0,0 +1,15 @@
+---
+schema_version: 1
+id: "iss-2610292237259195"
+slug: "embargo-check-range-flags"
+severity: "minor"
+category: "bug"
+source: "user-observation"
+found_during: "lane E report relayed by the coordinator, 2026-10-29"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "internal/core/embargo/check.go"
+remedy: "Judge only the commits the default branch's tip does not already reach, so a merge of the default branch brings in nothing to judge, and add a test with a branch that merged a default branch carrying an advisory-shaped id"
+---
+
+embargo check --range flags advisory-shaped ids that the default branch already carries once a branch has merged the default branch in, though the branch's own changes add none. The merge commit itself is not the cause: mergeAdds keeps only lines the merge adds against every parent. The likely cause is the range's commit list: rev-list a..b lists every commit reachable from b and not from a, so with a base older than the merged default branch, that branch's own commits brought in by the merge are judged as the branch's.