Record release decisions, OpenDota permission, and the revised change rule

README.md

@@ -9,7 +9,7 @@ Research pipeline for forecasting the compendium prediction card of The Internat
 | [Historical validation and weaknesses](docs/ti26/2026-08-08-known-weaknesses.md) | Raw rating models did not clear the constant baseline; calibrated Glicko cleared the narrowly registered D3b gate. Repeat-event card skill remains unproven. |
 | [Series scoring](reports/series_score/series_score.md) | Positive historical diagnostic; within-event dependence limits its nominal significance calculation. |
 | [Group postmortem](reports/card_postmortem.md) and [playoff postmortem](reports/playoff_postmortem.md) | Dependent diagnostics from the same tournament, not independent replications. Group results feed playoff strengths. |
-| [External playoff cards](data/ti2026_playoff_cards.yaml) | Owner-supplied comparisons with incomplete generation provenance, not a controlled model benchmark. Original [LLM evidence](predictions-from-llms/) is frozen. |
+| [External playoff cards](data/ti2026_playoff_cards.yaml) | Comparisons the owner generated with consumer AI apps (Gemini and ChatGPT, Deep Research), not a controlled model benchmark. Prompts and settings are not recorded; see [data sources](docs/data-sources.md). Original [LLM evidence](predictions-from-llms/) is frozen. |
 | Simulated category marginals | Conditional on point strengths and assumed rules. Glicko rating-deviation uncertainty is not propagated. Map calibration does not establish card calibration. |
 
 Registered gates remain immutable. Diagnostics cannot promote, demote, or change the shipping card. Measurements live in producer artifacts rather than copied headline numbers.

docs/audits/2026-09-27-release-candidate-verification.json

@@ -381,7 +381,8 @@
     "pip-audit resolved lock markers for this macOS host, so colorama (win32-only) was not queried; the 2026-09-26 supplement records it with no advisories.",
     "The frozen output oracle re-derives the historical gate refusals and failures as part of its replay; its final comparison is the result.",
     "Commits after candidate_sha may touch only this receipt and docs/release-checklist.md.",
-    "Historical receipts remain unchanged and do not attest later edits."
+    "Historical receipts remain unchanged and do not attest later edits.",
+    "Superseded on 2026-09-28 for commits after 3b1cb7c: see addendum.rule_revision."
   ],
   "recorded_at_utc": "2026-09-27T19:21:31Z",
   "addendum": {
@@ -416,6 +417,11 @@
       {"name": "verify-61c63f4a.log", "path": "/private/tmp/ti26-addendum/verify-61c63f4a.log", "sha256": "1293c8e3d01ef576d81e464420b065c4fb0d40b63f340f0c384c8407f43dbdd0"}
     ],
     "rule_after_addendum": "Commits after 3b1cb7c may touch only this receipt and docs/release-checklist.md.",
+    "rule_revision": {
+      "date": "2026-09-28",
+      "rule": "After 3b1cb7c, frozen paths must not change: `git diff --name-only 3b1cb7c HEAD -- src tests config data reports predictions-from-llms pyproject.toml uv.lock .github LICENSE .gitignore` stays empty. Documentation may change: README.md, CONTRIBUTING.md, SECURITY.md, CITATION.cff, mlsd-scorecard-ti26.md and docs/. Hosted CI must pass on every published or tagged commit, and the local-link check is re-run and recorded as an addendum before tagging.",
+      "reason": "The receipt-and-checklist-only rule contradicted the completion plan's release-docs step. This verification re-derives code, tests, config, data, reports, analyses, the lock and CI. Of documentation, it attests only local links, which the pre-tag check re-establishes. The revision widens what may change to documentation only."
+    },
     "recorded_at_utc": "2026-09-27T20:01:35Z"
   }
 }

docs/data-sources.md

@@ -4,9 +4,9 @@
 
 | Material | Provenance and treatment |
 |---|---|
-| [Raw snapshots](../data/raw/) | OpenDota responses with chunk hashes and acquisition manifests; Steam news is listed separately below. No blanket dataset redistribution license established. Public release held pending applicable terms or written permission. |
-| [Rules evidence](../data/evidence/) and quoted rules | Valve/Steam sources and owner-imported rendered text. Preserve attribution and manifests. Public release held pending an applicable redistribution basis; see the source register below. |
-| [External analyses](../predictions-from-llms/) and cards | Vitalii Babenko confirms generating the analyses using Gemini, ChatGPT, and other unspecified services. File-specific service/account details, generation settings, and copied-material status remain unconfirmed. Public release held pending that review. |
+| [Raw snapshots](../data/raw/) | OpenDota responses with chunk hashes and acquisition manifests; Steam news is listed separately below. No blanket dataset license is established. An odota maintainer approved publishing them in [odota/core#2989](https://github.com/odota/core/issues/2989#issuecomment-5865765389); see the source register below. |
+| [Rules evidence](../data/evidence/) and quoted rules | Valve/Steam sources and owner-imported rendered text. Preserve attribution and manifests. No permission from Valve; published with attribution and a takedown route as accepted risk under the [publication decision](#publication-decision). |
+| [External analyses](../predictions-from-llms/) and cards | Vitalii Babenko generated both analyses on personal accounts: one in Google's Gemini app and one in OpenAI's ChatGPT app, each with Deep Research. The owner approved publishing both as they are on 2026-09-28; see the source register below. |
 | Derived reports | Repository-produced research, still subject to review of underlying data restrictions and incorporated quotations. |
 | Dependencies | Separate upstream licenses apply. Review dependency notices before distributing bundled dependencies. |
 
@@ -18,31 +18,33 @@ Owner approval records a release decision; it cannot supply missing third-party
 
 | Source and retained material | Terms reviewed and attribution | Publication decision / missing evidence |
 |---|---|---|
-| OpenDota API responses in timestamped `data/raw/` snapshots | [Core software MIT license](https://github.com/odota/core) does not establish API dataset rights. Retain OpenDota attribution, request provenance, acquisition manifests, and chunk hashes. Exact dataset attribution conditions remain unresolved. | **Hold.** Permission inquiry sent through the official Discord help channel; response pending. Ask whether underlying Valve restrictions apply to snapshots and player IDs. |
-| [Dota rules page](https://www.dota2.com/esports/ti15/tirules): `data/evidence/imports/valve-group-stage-rendered.txt`, corresponding `data/evidence/rules/` captures, [archival text](ti26/2026-08-08-ti2026-rules-fetched.md), and [owner transcription](ti26/2026-08-08-published-format-rules.md) | Rendered-page capture/transcription, not an established Steam API response. Retain source URL, acquisition records, and embedded Valve copyright/trademark notice. [Valve legal page](https://www.valvesoftware.com/en/legal) restricts republication of its site material, but applicability to this Dota page is unconfirmed. | **Hold.** Identify governing Dota-page terms or obtain written permission for the retained verbatim text and duplicates. Steam API terms cannot be assumed to cover it. |
-| [Steam announcement](https://steamstore-a.akamaihd.net/news/externalpost/steam_community_announcements/1840944183772671): [raw response](../data/raw/steam-news/1840944183772671.json), `data/evidence/imports/valve-ti2026-format-rendered.txt`, and matching `format-rendered.txt` capture | Acquired through `ISteamNews/GetNewsForApp/v2`; metadata attributes author `krAnk0r`. Preserve title, author, source/feed metadata, links, and capture manifests. [Steam API terms](https://steamcommunity.com/dev/apiterms) condition distribution on the application/use and include privacy, branding, disclaimer, and termination obligations. [Subscriber Agreement](https://store.steampowered.com/subscriber_agreement/) also reserves rights. | **Hold.** Confirm whether API terms cover this endpoint and permanent public Git archival, and how their conditions would be met. No unconditional MIT grant established. |
-| [Gemini-named analysis](../predictions-from-llms/gemini-3-1-pro.md) | Owner confirms generating the supplied analyses with AI services; filename is not verified model provenance. Retain AI-generation provenance disclosure and the works-cited list. [Google generative-AI terms](https://policies.google.com/terms/generative-ai) are a review starting point; account/product and applicable terms at generation remain unknown. | **Hold.** Record file-specific service/account provenance and whether prompts or outputs contain copied passages; review those sources separately. |
-| [GPT-named analysis](../predictions-from-llms/gpt-5-6-xhigh.md) | Owner confirms generating the supplied analyses with AI services. Opaque citation markers lack persisted source URLs. [OpenAI terms](https://openai.com/policies/row-terms-of-use/) distinguish consumer, regional, and business use; output ownership does not grant third-party rights. Applicable account/region/version remains unknown. | **Hold.** Resolve citation sources, file-specific service/account provenance, and copied-material status. Preserve AI-generation provenance disclosure. |
+| OpenDota API responses in timestamped `data/raw/` snapshots | [Core software MIT license](https://github.com/odota/core) does not establish API dataset rights. Retain OpenDota attribution, request provenance, acquisition manifests, and chunk hashes. The reply states no attribution conditions; OpenDota is credited, as the request committed. | **Permission granted** on 2026-09-28 by `howardchung` (odota organization member; top contributor to `odota/core`) in [odota/core#2989](https://github.com/odota/core/issues/2989#issuecomment-5865765389): "This sounds fine to me." It covers the request as described there: frozen OpenDota explorer responses, including match and player account IDs, published in a public repository, with OpenDota credited and removal on request. No conditions were stated. The request's question about Valve's terms was not answered. |
+| [Dota rules page](https://www.dota2.com/esports/ti15/tirules): `data/evidence/imports/valve-group-stage-rendered.txt`, corresponding `data/evidence/rules/` captures, [archival text](ti26/2026-08-08-ti2026-rules-fetched.md), and [owner transcription](ti26/2026-08-08-published-format-rules.md) | Rendered-page capture/transcription, not an established Steam API response. Retain source URL, acquisition records, and embedded Valve copyright/trademark notice. [Valve legal page](https://www.valvesoftware.com/en/legal) restricts republication of its site material, but applicability to this Dota page is unconfirmed. | **Accepted risk** under the [publication decision](#publication-decision): published with attribution and a takedown route. The governing Dota-page terms were not identified, and no written permission exists for the retained verbatim text and duplicates. Steam API terms cannot be assumed to cover it. |
+| [Steam announcement](https://steamstore-a.akamaihd.net/news/externalpost/steam_community_announcements/1840944183772671): [raw response](../data/raw/steam-news/1840944183772671.json), `data/evidence/imports/valve-ti2026-format-rendered.txt`, and matching `format-rendered.txt` capture | Acquired through `ISteamNews/GetNewsForApp/v2`; metadata attributes author `krAnk0r`. Preserve title, author, source/feed metadata, links, and capture manifests. [Steam API terms](https://steamcommunity.com/dev/apiterms) condition distribution on the application/use and include privacy, branding, disclaimer, and termination obligations. [Subscriber Agreement](https://store.steampowered.com/subscriber_agreement/) also reserves rights. | **Accepted risk** under the [publication decision](#publication-decision): published with the Valve/Steam credit line and a takedown route. Whether the API terms cover this endpoint and permanent public Git archival remains unconfirmed. No unconditional MIT grant established. |
+| [Gemini-named analysis](../predictions-from-llms/gemini-3-1-pro.md) | Generated by the owner in Google's Gemini app with Deep Research, on a personal account. The filename is not verified model provenance. Retain the AI-generation disclosure and the works-cited list. [Google generative-AI terms](https://policies.google.com/terms/generative-ai) are a review starting point; the terms version in force at generation is not recorded. | **Approved as-is** by the owner on 2026-09-28, as risk acceptance under the [publication decision](#publication-decision). |
+| [GPT-named analysis](../predictions-from-llms/gpt-5-6-xhigh.md) | Generated by the owner in OpenAI's ChatGPT app with Deep Research, on a personal account. Opaque citation markers lack persisted source URLs. [OpenAI terms](https://openai.com/policies/row-terms-of-use/) distinguish consumer, regional, and business use; output ownership does not grant third-party rights. The region and terms version in force at generation are not recorded. | **Approved as-is** by the owner on 2026-09-28, as risk acceptance under the [publication decision](#publication-decision). The unresolved citation markers remain disclosed. |
 
 ### Publication decision
 
-Recorded 2026-09-27 by Vitalii Babenko. If no permission response arrives by 2026-10-11, the owner publishes the full repository history on the terms below. This accepts residual legal risk; it does not establish permission. The owner re-posts the inquiry in a durable public channel before the deadline. A reply before then supersedes this decision.
+Recorded 2026-09-27 by Vitalii Babenko. If no permission response arrives by 2026-10-11, the owner publishes the full repository history on the terms below. This accepts residual legal risk; it does not establish permission. The owner re-posted the inquiry publicly as [odota/core#2989](https://github.com/odota/core/issues/2989) on 2026-09-28. A reply before then supersedes this decision.
+
+Update 2026-09-28: OpenDota granted permission (see the register above), so the deadline no longer gates publication. Valve and Steam material is still published on the terms below as accepted risk. The owner decides when to publish.
 
 - **Attribution:** match data comes from [OpenDota](https://www.opendota.com). Rules text and the Steam news response are Valve material from [dota2.com](https://www.dota2.com) and [Steam](https://store.steampowered.com). Dota 2, The International and Steam are trademarks of Valve Corporation. This repository is not affiliated with or endorsed by Valve or OpenDota.
 - **Takedown:** a rights holder may request removal through the contact in [SECURITY.md](../SECURITY.md). Removal happens in a new commit, per the [release checklist](release-checklist.md). Earlier public history, forks and clones are not retracted.
-- **Owner-generated analyses:** publishing full history publishes both files, so there is no per-file hold under this route. Before the deadline, the owner must either approve both files as they are or switch to a fresh-history repository. Their bytes are digest-bound, so any edit needs a new replay attestation, and history keeps the originals.
+- **Owner-generated analyses:** the owner approved both as they are on 2026-09-28 (see the register above). Full-history publication includes them. Their bytes are digest-bound, so any edit needs a new replay attestation, and history keeps the originals.
 
 ### OpenDota inquiry
 
-Sent by Vitalii Babenko through [OpenDota Discord — help](https://discord.com/channels/144629812982448128/421587769664471069), the contact server linked from the official core README. Delivery was observed in the channel; no permission response has been recorded.
+Sent by Vitalii Babenko through [OpenDota Discord — help](https://discord.com/channels/144629812982448128/421587769664471069), the contact server linked from the official core README. Delivery was observed in the channel. On 2026-09-28 the owner re-posted the question as the GitHub issue [odota/core#2989](https://github.com/odota/core/issues/2989), which states the planned publication date. At 2026-09-28T07:52:54Z, `howardchung` replied there: ["This sounds fine to me."](https://github.com/odota/core/issues/2989#issuecomment-5865765389)
 
 > I maintain a reproducible Dota 2 research repository. May I publicly redistribute frozen historical API-response snapshots, including match and player account IDs, with source attribution? My original code is MIT-licensed; third-party data would retain its applicable terms. Please identify the terms or permission covering this use, including any underlying Valve restrictions.
 
 Record any reply with its source link, sender's authority, covered materials, conditions, and release decision before closing the checklist. Preserve original captures while clarification is pending.
 
 ## Identifiers
 
-Match rows retain player account identifiers, match identifiers, timestamps, and team/roster links. These are pseudonymous, not anonymous. Roster identity depends on account sets; removing them changes reproducibility. Vitalii Babenko approves retaining player IDs for reproducibility, subject to source permission. Do not silently redact frozen evidence.
+Match rows retain player account identifiers, match identifiers, timestamps, and team/roster links. These are pseudonymous, not anonymous. Roster identity depends on account sets; removing them changes reproducibility. Vitalii Babenko approves retaining player IDs for reproducibility, subject to source permission. OpenDota's permission covers the player account IDs named in the request; no position from Valve is recorded. Do not silently redact frozen evidence.
 
 Local author/committer review found the owner's personal Gmail, work-domain email, and GitHub noreply identity. Vitalii Babenko chose to preserve history and explicitly allowed the work email to remain public after reviewing removal's impact. Rewriting identities changes affected commits and descendants; historical verification resolves manifest-bound original Git revisions, so deleting those objects would break that verification. A `.mailmap` or new Git identity changes presentation/future commits, not stored historical addresses. The configured identity for new commits uses the approved personal Gmail.