docs(project-discipline): Rule 4 — механизм push-гейта переписан (on-record + explicit) [v0.2.2]

skills/project-discipline/SKILL.md

@@ -79,12 +79,18 @@ The bump is recorded in the commit message: `feat(<artifact>): … [vX.Y.Z]` or
 **Default: push freely.** An ordinary fast-forward `git push` to the configured
 upstream needs no per-push confirmation. No ask-before-push mode by default.
 
-**Per-project push gate.** A project whose push triggers side effects carries a
-LOCAL project-scope skill (convention: `push-gate`) that replaces this default
-with ask-before-push for that project. Example: `books` — push to master runs
-Gitea Actions auto-deploy. Respect the local gate over this rule: if the project
-has a `push-gate` skill, its semantics win for that project; this rule's
-free-push default does not apply there.
+**Push gate** (replaces the free-push default for a specific project). A push
+gate makes every push require confirmation — it is set up ONE of two ways:
+
+- **On the record** — the project's `AGENTS.md` declares a push gate (e.g.
+  `push gate: ask`); it applies persistently for that project. This overrides
+the free-push default for as long as that line is in `AGENTS.md`.
+- **Explicitly, by the operator, in the session** — the operator says "push
+  gate" / "спрашивай перед пушем"; it applies for the rest of that session
+  OR until the operator explicitly lifts it ("сними пуш-гейт" / "push freely").
+
+Either way, when a gate is active, EVERY push to that project asks first.
+This rule's free-push default does not apply while a gate is active.
 
 **Always ask:**