docs: record the rulesets on main, the push rule and Gmail identity

.claude/CLAUDE.md

@@ -19,7 +19,7 @@ The operator's personal CV and portfolio, served at https://roanny.github.io/. T
 
 ## Serving
 
-GitHub Pages serves the root of `main`; a push to `main` is live in 1–2 minutes. There is no release and no `/release`: the fleet's `release` shared block does not apply, and a landing that changes the pages is a deploy (`git-hygiene.md`).
+GitHub Pages serves the root of `main`; a push to `main` is live in 1–2 minutes. Two rulesets guard `main`: "Protect main branch" (24806684: no deletion, no force push, linear history; no bypass) and "Require Validate" (24807145: `Validate` green; the repository admin bypasses it so the operator can fix by hand — a session never does, `git-hygiene.md`). There is no release and no `/release`: the fleet's `release` shared block does not apply, and a landing that changes the pages is a deploy (`git-hygiene.md`).
 
 ## The one coupling
 
@@ -31,7 +31,7 @@ The content is English by default with Spanish, by audience; the working documen
 
 ## Git identity
 
-Commits are authored as the operator's global git config has it: `Roanny Lamas <roanny.lamaslopez@viajeseci.es>`.
+Commits are authored as `Roanny Lamas <roannylamaslopez@gmail.com>`, set in this checkout's local git config; the corporate address is never used here.
 
 ## Index
 

.claude/rules/git-hygiene.md

@@ -5,10 +5,11 @@ Loads in every session: it carries the authorization clause, which has to be pre
 ## History and landing
 
 - **Linear history.** A branch lands on `main` by fast-forward, `git push origin <branch>:main`, once `Validate` is green on the pull request's head SHA. No merge commits; `gh pr merge` is denied, because it and the UI button collapse or rewrite the branch's commits.
+- **A session never pushes to `main` on its own.** The ruleset "Require Validate" (24807145) requires a green `Validate` but lets the repository admin bypass it, so the operator can push a fix by hand; sessions push with his credentials and inherit that bypass, so for them this rule is the gate, not the server. A session pushes to `main` only the head of a pull request whose `Validate` is green, by the fast-forward above.
 - **Commit subjects.** The whole first line at most 72 characters, no trailing period; measure it before the push (`printf '%s' "$subject" | wc -m`), because correcting a pushed subject is a force push. CI's "Commit subjects" step reads every commit a pull request adds.
 - **No force push, in any spelling** — `--force`, `-f`, `--force-with-lease`, a `+refspec` — on any branch.
 - **A landing can be a deploy.** GitHub Pages publishes `main` within minutes of every push to it: a landing that changes what a visitor sees is a deploy of the public site, and Round authorization says whose word that takes.
-- **No remote-ref deletion.** Deleting a remote branch or tag is the operator's act. The colon-refspec deletion (`git push origin :<ref>`) has no working deny; the rule is the guard, and the server rulesets on `main` and tags, once the operator adds them, are the floor.
+- **No remote-ref deletion.** Deleting a remote branch or tag is the operator's act. The colon-refspec deletion (`git push origin :<ref>`) has no working deny; the rule is the guard, and the ruleset "Protect main branch" (24806684: deletion, non-fast-forward, linear history; no bypass) is the floor on `main`. There are no tags here.
 
 ## Dependabot
 

README.md

@@ -58,7 +58,7 @@ python3 .github/scripts/check_site.py i18n
 python3 .github/scripts/check_site.py sitemap
 ```
 
-`Validate` (`.github/workflows/ci.yml`) runs on every pull request and every push to `main`: HTML validity of both pages, the `i18n` key parity, the sitemap, the fleet's shared blocks and the commit subjects (at most 72 characters, no trailing period). Changes land on `main` by fast-forward once `Validate` is green.
+`Validate` (`.github/workflows/ci.yml`) runs on every pull request and every push to `main`: HTML validity of both pages, the `i18n` key parity, the sitemap, the fleet's shared blocks and the commit subjects (at most 72 characters, no trailing period). Changes land on `main` by fast-forward once `Validate` is green. Two rulesets guard `main`: "Protect main branch" (no deletion, no force push, linear history; nobody bypasses it) and "Require Validate" (a green `Validate` before a push lands; the repository admin may bypass it to push a hand fix, and `Validate` still runs on that push).
 
 ## Deployment