docs(remediation): bank D-27 — role file certifies the inert queue guard as enforced

rev-974 found this while loading the canonical gate sources, i.e. because we switched
from restating to reading. Verified in roles.local/merge-gate.md: mandate 3 requires
verifying 'CI queue guard clear', mandate 4 requires enumerating 'the queue-guard
outcome' in every durable verdict, the merge path annotates it 'real', and the control
table at :290 certifies it '✅ enforced … genuinely aborts'.

The document is correct about the WIRING and wrong about the CONTROL: set -euo pipefail
with an unguarded exit does abort, but the guard cannot produce a non-zero exit for any
input (D-23). A mechanism correctly wired to a sensor that never fires, certified as
enforced.

Compounding: the verdict format REQUIRES the queue-guard outcome as evidence, so a
conforming verdict must include a meaningless field — the role file instructs the gate
to manufacture evidence, in the mandate that exists to stop bare conclusions.

Interim: record the field labelled ZERO-INFORMATION (inert, owner RM-03) rather than
omitting it — omission makes the verdict non-conforming; silent citation is worse.

Escalated: operator-owned file, coordinator's to fix. Recommend annotation not deletion
— the requirement is correct once RM-03 lands.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -146,6 +146,45 @@ exposure or changing provider protected-pipeline posture is a host security-post
 infrastructure authority. Nothing is blocked meanwhile — RM-02's head is unprivileged and fail-closed,
 the privileged experiment stays uncommitted and out of branch history.
 
+### D-27 — the authoritative role file certifies an inert control as `✅ enforced`
+
+Found by `rev-974` while loading the canonical gate sources — i.e. found _because_ we switched from
+restating to reading (D-26). Verified independently in
+`~/.config/mosaic/fleet/roles.local/merge-gate.md`:
+
+| line            | text                                                                                   | problem                                                  |
+| --------------- | -------------------------------------------------------------------------------------- | -------------------------------------------------------- |
+| :59 (mandate 3) | verify "**CI queue guard clear**" from primary evidence                                | mandates verifying a check that cannot fail              |
+| :75 (mandate 4) | every durable verdict must enumerate "**the queue-guard outcome**"                     | requires a meaningless field _in the evidence record_    |
+| :128-129        | coordinator merge step 2 runs `ci-queue-wait.sh --purpose merge`; annotated "**real**" | the sensor never fires                                   |
+| **:290**        | control table: **"CI queue guard \| ✅ enforced \| … genuinely aborts"**               | **a security-control table certifying an inert control** |
+
+**The precise defect, because the distinction matters.** The document is _correct about the wiring_ and
+_wrong about the control_. `set -euo pipefail` with an unguarded exit genuinely does abort — that
+plumbing is real. What is false is the conclusion `✅ enforced`, because **the guard cannot produce a
+non-zero exit for any input** (D-23). So this is **a mechanism correctly wired to a sensor that never
+fires**, documented as enforced in the governing role file — the inert-gate class, certified.
+
+Note the compounding: the verdict format **requires** the queue-guard outcome as enumerated evidence.
+A conforming verdict is therefore obliged to include a field that means nothing — the role file
+**instructs the merge-gate to manufacture evidence from an inert check**, in the same mandate that
+exists to stop bare conclusions being recorded as verdicts.
+
+**Interim resolution (confirmed with `rev-974`, with one refinement).** Follow the stricter D-23 ruling.
+But do **not omit** the queue-guard field — omitting a required field makes the verdict non-conforming.
+**Record it, labelled `ZERO-INFORMATION (inert, owner RM-03)`.** That satisfies the enumeration mandate
+and states the truth simultaneously; a silently-omitted field and a silently-cited one are both worse.
+
+**Not ours to edit.** `roles.local/merge-gate.md` is an operator-owned override; the correction belongs
+to the coordinator. **Recommended fix is annotation, not deletion** — the requirement is _correct once
+RM-03 lands_, so removing it would create a gap the moment the guard starts working. Annotate the three
+evidence sites and correct `:290` to distinguish _wiring real_ from _control inert_.
+
+**This is D-20's clause meeting an authoritative framework document.** Prose asserting a security
+property needs a negative control observed red; `✅ enforced` is exactly such an assertion, and it would
+fail that control today. The rule was written after the orchestrator overclaimed in its own governing
+document — it now catches the same defect in the framework's.
+
 ### D-26 — render-not-restate failed at maximal attention, committed by the rule's own enforcer
 
 **The definitive justification for making render-not-restate mechanical.**