0020 — A ruling goes back to whoever is blocked

• Status: Accepted (the rule). The mechanism is in gera-propflow/local-bin#117. This ADR does not wait on that merge, because ADR-0004 puts the record at decision time. ⚠️ VOCABULARY: the role this ADR calls the Operator is the Driver since 2026-09-10 — operator is the product's word for a PM company. Decision text below is unchanged; ids, binaries, trigger phrases and the OperatorTaskWorkflow type that still say operator are live invocations and deliberately lag. See ADR-0021. (Appended to Status on purpose: this adds NO line, so every line-number citation into this file stays true.)
• Date: 2026-09-10
• Deciders: Gera, 2026-09-10 at 22:33 local (CDT), closing on *"Like, there is no reason for us to be blocked about anything."* Written at decision time by the Worker in the room.
• Scope — read this first. That statement had two halves. The first half — HOW a block is decided (which rungs are asked, what agreement means, who breaks a tie, what a wall does) — is ADR-0019, and this ADR restates none of it. This ADR is the second half, and it is the half nothing else covers: the last hop. A ruling was obtained and the session parked on the question was never told. An earlier draft of this ADR recorded the ladder too, and contradicted ADR-0019 doing it; that content is deleted rather than reconciled, because two records of one ruling is the defect, not the fix.

The decision

Obtaining an answer is not delivering one. A rung that can rule on a block and cannot reach the session waiting on that block has not unblocked anything. The ruling is delivered, once, to the raiser — and delivering is a distinct act with its own failure mode, its own signal, and its own place in puller's contract.

1. The ruling goes back to the raiser, and that is not optional. One message, once, to the one session parked on that question, naming the choice, the receipt id, and the model that ruled. A ruling that lands in routed.json and nowhere else is not a ruling anybody received.
2. It decides and returns; it never resolves. It writes no state on a block, answers no decision page, executes nothing. Applying a ruling remains the raiser's act — which is also why the raiser has to be told.
3. Provenance travels with the ruling, and is never Gera's by default. A matched option with an invented answeredBy is a forged decision. Every message names the rung, the model and the receipt id; a single-rung ruling (ADR-0019 decision 4) says on its face that it was not corroborated.
4. The message says in as many words that it is not Gera's answer, and tells the raiser to apply it or to say on the block why it will not. A raiser that mistakes a model's ruling for the founder's has been handed a forged decision by a well-meaning courier.
5. Delivery is a carve-out from puller's contract 5, taken explicitly. One message, once, to one session, about one question that session is parked on. It is not a delta ping, it never reaches the Operator, and §1's ~30-firings cap on Operator judgement is untouched.
6. The last hop gets its own signal, because every other signal stays green through its failure. puller DELIVERED, on a three-day window. puller OK is true of a puller that reads the whole fleet, asks the ladder, obtains a ruling and hands it to nobody — which was the live state of this rung.
7. What this ADR does NOT decide: which rungs are asked, what their agreement means, who settles a disagreement, what happens when a rung is walled or refuses, and when a human is woken. All of that is ADR-0019. If this document and ADR-0019 ever appear to disagree about the ladder, ADR-0019 is the record and this one is wrong.

Why

The rung existed and answered into the void

puller already routed un-ruled blocks to the ladder, ledgered them, and rendered the rulings in a digest. What it never did was tell the session that had stopped working. A ruling landed in routed.json and the blocked lane learned nothing — it was still parked, still waiting, still counted as "waiting on Gera" by anyone reading the decisions surface.

And the path that was supposed to carry it is measured broken. Answering by clicking an option on the /agents Decisions tab resolves the ledger row atomically, so SmithDecisionBlockWorkflow polls, sees RESOLVED, and early-returns before the wake. Measured live on three of Gera's real decisions: zero wakes in the raiser's transcript. Not misrouted — never sent.

So the fleet had a decider that could obtain an answer and no way for the answer to reach the thing that needed it. That is a system in the shape of a system, and the last hop is the part that makes it one.

⚠️ This is the fact that justifies a separate ADR at all. ADR-0019 can be entirely correct — both rungs asked, agreement observed, a ruling produced — and the lane stays parked, because the defect is downstream of every rule ADR-0019 states. A reader who takes ADR-0019 as the whole of that night's decision will build a decider that answers into the same void.

Why extend puller rather than build a decider daemon

Two scheduled jobs on one decision queue double-spend and double-answer, and the queue has no lock of its own. Everything that makes routing safe already lives in puller — the ledger's terminality rules, the retry_after windows, the block↔receipt join that stops a ruled question reading as "never asked", one launchd label. A rival binary would have had to reimplement all of it and then race it.

The cost is honest and is recorded here: puller's contract 5 said it was not a wake source, and now it sends one message. That contract was written against a puller that pinged on every delta and rebuilt the 1,064-stop polling failure one layer up. The carve-out is decision 5 above — the decisions wake the blocked contract always promised. The amendment is written into the contract rather than taken silently, which is the point of ADR-0004.

Why it is not a subagent

A subagent dies with its pane. On the night this was designed that happened three times: a Fable weekly wall killed four lanes at 02:5x, and two ccswitch respawns killed every child process. A decider that dies when the Operator dies is worth nothing, because the entire point is that it keeps working while Gera sleeps. It is a launchd job in the shape of puller and astra-relaunch (ADR-0003: rungs integrate by signals, never by calls).

Why the delivery signal is three days and not fifteen minutes

Deciding is demand-driven. A quiet week raises no blocks and delivers nothing, and a signal that went red for a quiet week would train everyone to ignore it — ADR-0009 cuts both ways, and a signal that fails while the system is fine is as useless as one that cannot fail. Three days is long enough that silence is unusual and short enough that a return hop broken on Monday is visible by Thursday.

Consequences

• A settleable block no longer waits on a person. It is decided within a tick or two — by the ladder ADR-0019 defines — and the raiser is told. blocked raise is now for questions that are genuinely his: a preference, a risk appetite, money, a promise to a person, or a fact nobody wrote down.
• A ruling can be wrong, and it is applied by the raiser, not this rung. Delivery is not execution. The message is an input to a session that still owns the act.
• Escalations that remain are more expensive to reach, and so more credible. A question that lands on Gera now carries either a refusal from a reached model, a flip under reversal, or a human-only action — each one a fact, not a default. Which of those it is, and whether it wakes him, is ADR-0019 decisions 5 and 9.
• Spend is bounded and accounted on disk — a per-tick question cap and a per-day invocation ledger, and an unreadable ledger holds routing for the day. Stated in full in ADR-0019 The cost, stated plainly; named here only so a reader of the delivery rung does not assume it is unbounded.

Related

• ADR-0019 — two rungs are asked on one snapshot, and agreement drives. The other half of the same 22:33 statement, and the governing record for the ladder. This ADR is downstream of it and restates none of it.
• ADR-0016 — a model that cannot be reached is not a model that declined. Superseded in its ordering by ADR-0019; its reached/declined distinction is intact and both ADRs rest on it.
• ADR-0017 — the Operator is fed, it does not poll. puller's contract, which decision 5 amends.
• ADR-0009 — a signal must fail when the system fails. Why puller DELIVERED exists and why its window is three days.
• ADR-0004 — a decision that changes how systems relate is written at decision time.
• ADR-0003 — rungs integrate by signals, never calls.