0026 — The decider rules, and it is the only writer of questions for Gera

• Status: Accepted.
• Date: 2026-09-13
• Deciders: Gera, 2026-09-13, after answering two questions a Driver put to him directly. His words, on the second: "I've said it a million times that you should merge. And it's like, oh, only you can merge that one. It's like, why is there a rule around only me? So the decider should be able to say, oh yeah, merge that. The decider is the only one that should be able to write questions for me on the decisions section on that board doc."

The decision

1. The decider may authorise a merge. A reviewed, green PR that is in the plan is IN-PLAN and REVERSIBLE — a merge is undone by a revert — so ADR-0025 §7's test already puts it on the decider's side. Any rule that reads "only a human may merge this" for such a PR is superseded as an INDEPENDENT gate.
2. THE DECIDER IS THE ONLY WRITER OF A QUESTION FOR GERA. No Driver, worker, lane or reflex may put a question on the decisions surface, or in a message to him, on its own authority. It asks the decider; the decider rules or returns NEEDS HUMAN; only a NEEDS HUMAN becomes a question he sees. A question that did not come through the decider is a bug, not an escalation.
3. The irreversible half stands, and is the only thing that does. Out of plan, OR genuinely irreversible in the world — a production data write, a deploy, money, a customer promise, branch protection — still reaches a human, and it reaches him through the decider, which is what decision 2 means.
4. DANGEROUS_GLOBS is not repealed; it is RE-READ. auto-merge-all.yml holds .github/*, *CODEOWNERS, infra/*, lambda/*/deploy.sh, scripts/iam/* and friends out of AUTO-merge. That remains correct: those paths must not merge on a timer with nobody looking. What is superseded is treating that list as "a human must be the one to click merge". The decider may rule on such a PR, and its ruling is the authority a session merges under. The distinction is auto-merge without judgement (still refused) versus a judged merge (now the decider's to authorise).

Why

Two questions reached Gera on 2026-09-13. Both were answered in seconds and neither needed him:

• "Can I delete an old row?" — in plan, reversible, and the answer was yes.
• "Can we merge this?" — a green, reviewed PR. He had already said, repeatedly and in writing, that the standing instruction is to drive work to merged.

The second is the one that matters, because the session was not being lazy. It was obeying a rule — this path needs a human — that was written before the decider existed and was never reconciled with it. That is the shape of the whole failure class this fleet spent 2026-09-12 on: a correct rule, from an earlier world, still being honoured after the thing that replaced it shipped. The same unreconciled pair is recorded on the vendor backfill, whose script header still reads "A HUMAN RUNS --mode=apply, NEVER AN AGENT".

Decision 2 exists because the failure had a second half: the Driver did not consult the decider at all. blocked check read no open blocks while the questions sat in a chat message. A question typed into prose was never put to anything — it reached a log, not a queue. Making the decider the only writer of the question queue is what makes "did anyone ask?" answerable, because the queue then IS the set of questions, and an empty queue means none were raised rather than none were routed.

What this is not

It is not "agents may merge anything". The irreversible test is untouched, and a session still may not merge on its own judgement — it merges on a ruling. The change is about who may issue that ruling, not about removing the requirement for one.

It is also not a claim that the decider is always right. It returns NEEDS HUMAN whenever it cannot settle something, and 74 of its 350 recorded runs did exactly that. The point is that Gera should see those 74, and nothing else.

Consequences

• blocked check becomes the honest answer to "is anything waiting on me". It could not be before: a question in prose was invisible to it. Measured at the time of writing — 0 open blocks, while two answered questions had reached him by message the same hour.
• A session that says "needs you" without an open block is malfunctioning, and the Stop gate in ~/.local/bin/canon/drive-gate.py already refuses that stop. ⚠️ Its scope was GATE-marker-based and therefore inert for most Drivers — a marker is keyed on the session id, and a ccswitch respawn changes the id, so 51 loop directories on this box held only 7 markers. It now derives a Driver from the task files instead. That fix is a prerequisite for this ADR being enforced rather than merely written.
• The merge carve-outs in auto-merge-all.yml need their comments updated to say "held from AUTO-merge, mergeable on a decider ruling" rather than "held for a human". The workflow's behaviour does not change; the sentence a session reads to decide what to do next does.
• Five PRs that were held on 2026-09-12 for "needs a human" (pf#8056, pf#8058, pf#8053, pf#8033, pf#8035) are re-classified: each goes to the decider, and merges on its ruling unless the ruling is NEEDS HUMAN.
• An open question with no decider receipt is now a defect with a name. The six PENDING receipts on this box — asked, never answered, nothing watching — are the next thing to close, because a queue only means something if a swallowed entry is visible.