[quad341]

Summary

Fixes cmd/reviewer.go so a reviewer-resolution failure can never leave a
review-branch commit that nobody was ever told about. resolveReviewer now
runs before the commit/eviction/promotion-mark step at all 4 call sites
(requestReview, commitForBatchReview, requestCullReview,
requestPromotionReview) — true fail-closed instead of committed-but-
unnotified.

Also fixes defaultReviewer's rig-tier case: it now resolves from the
entry's own declared rig value (cairn.ResolvedTier's value) instead of
$GC_RIG. This fixes a silent-stuck-state bug flagged by deep-investigator
this session — city-scope agents with no $GC_RIG set previously got a
hard-to-diagnose failure on rig-tier resolution, even though the entry
itself already declared which rig it belonged to. role tier is deliberately
left $GC_RIG-based (role-tier storage carries no rig at all, so which
rig's role-holder should review is genuinely underspecified without it).

• Deploy bead: crn-9qlxu
• Review bead: crn-rott9.1 (epic: crn-rott9), verdict: PASS
• crn-rott9 is the delegated implementation of part of architect's design
  decision on crn-ry4zu (recall-vs-review-gate visibility problem); this fix
  is the reviewer-notification-ordering half of that decision, not a
  standalone change.

Gate result

PASS (7/7) — see release-gates/crn-9qlxu-gate.md
for full per-criterion evidence. Independently re-verified on the deployer
side in a fresh isolated scratch worktree (not inherited from the
reviewer's claimed results): go build/go vet/gofmt/golangci-lint
(isolated cache) all clean, go test ./... -race -count=1 — all 7 packages
PASS, 0 FAIL, including direct -v re-runs of all 5 new/changed regression
tests (TestDefaultReviewerRigTierIgnoresGCRig,
TestDefaultReviewerRigTierRequiresNonEmptyValue,
TestRememberBatchReviewerResolutionFailureCommitsNothing,
TestCullEvictReviewerResolutionFailureCommitsNothing,
TestPromoteMarkReviewerResolutionFailureCommitsNothing). The bead's
security claim (reusing the rig value for a mail-recipient string is not a
new trust extension, since the same value already flows into scopeDir's
filesystem path join) was independently checked against
internal/cairn/remember.go and confirmed accurate.

Diff scope independently confirmed single-themed: 7 files, all under
cmd/ — the fix itself (reviewer.go), its direct regression tests
(reviewer_test.go, remember_batch_test.go, remember_test.go,
cull_test.go, promote_test.go), and one necessary downstream fixture
fix (branches_test.go — an existing test could no longer force rig-tier
resolution to fail via $GC_RIG, so its fixture switched to role: to
keep testing the same failure path). Cleanly divergent from main
(assert_deploy_ancestry_scope against crn-rott9.1 — clean, no foreign
commits); one file-level overlap on cmd/remember_test.go against main's
intervening changes, confirmed via git merge-tree (clean tree, exit 0)
plus manual hunk-range inspection to be genuinely disjoint edits, not a
lucky non-conflict.

Merge authority

quad341/cairn — standing self-merge authorization applies (mayor ruling
gm-wisp-2yhv7u, 2026-08-19). This bead's own description already states
the 4 standing conditions explicitly and carries no stale mayor-routing
boilerplate. Deployer will merge directly (gh pr merge --squash, plain,
once CI is green) rather than routing to mayor.

Test plan

• go build ./...
• go vet ./...
• gofmt -l .
• golangci-lint run ./... (isolated cache)
• go test ./... -race -count=1 (all 7 packages)
• 5 named new/changed regression tests re-run individually with -v
• CI (build-test, lint) — to be confirmed green post-open

🤖 Opened by cairn/deployer on a green release gate.