Function decide 

fn decide(
    did: &str,
    client_id: &str,
    scope: &ScopeSet,
    subject: &Subject<'_>,
    seams: &DecisionSeams<'_>,
) -> Verdict

The verdict for one request: what the ceiling narrows or denies. The gate is not asked here — push_authorization_request already asked it, once, before this account was even known to exist, because didbot_policy::Subject::Grant has no account for this function’s did to change the answer of. A gate’s own refusal is ParError::ClientRefused, not a Verdict this function could return; only the ceiling’s per-account narrowing lives here.

didbot_pds::policy_tree::TreePolicyGate::judge records its own refusal as it makes it, naming the policies that fired and the version they were judged under; nothing here writes that down a second time. What only this function knows is what the ceiling did, which no gate saw, and that is the one row it writes.

subject is push_authorization_request’s own — built once there for the gate it already asked, and borrowed here rather than rebuilt, since the two calls describe the same request.