diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md
index bf104421..5bbf935d 100644
--- a/docs/remediation/TASKS.md
+++ b/docs/remediation/TASKS.md
@@ -146,6 +146,45 @@ exposure or changing provider protected-pipeline posture is a host security-post
 infrastructure authority. Nothing is blocked meanwhile — RM-02's head is unprivileged and fail-closed,
 the privileged experiment stays uncommitted and out of branch history.
 
+### D-27 — the authoritative role file certifies an inert control as `✅ enforced`
+
+Found by `rev-974` while loading the canonical gate sources — i.e. found _because_ we switched from
+restating to reading (D-26). Verified independently in
+`~/.config/mosaic/fleet/roles.local/merge-gate.md`:
+
+| line            | text                                                                                   | problem                                                  |
+| --------------- | -------------------------------------------------------------------------------------- | -------------------------------------------------------- |
+| :59 (mandate 3) | verify "**CI queue guard clear**" from primary evidence                                | mandates verifying a check that cannot fail              |
+| :75 (mandate 4) | every durable verdict must enumerate "**the queue-guard outcome**"                     | requires a meaningless field _in the evidence record_    |
+| :128-129        | coordinator merge step 2 runs `ci-queue-wait.sh --purpose merge`; annotated "**real**" | the sensor never fires                                   |
+| **:290**        | control table: **"CI queue guard \| ✅ enforced \| … genuinely aborts"**               | **a security-control table certifying an inert control** |
+
+**The precise defect, because the distinction matters.** The document is _correct about the wiring_ and
+_wrong about the control_. `set -euo pipefail` with an unguarded exit genuinely does abort — that
+plumbing is real. What is false is the conclusion `✅ enforced`, because **the guard cannot produce a
+non-zero exit for any input** (D-23). So this is **a mechanism correctly wired to a sensor that never
+fires**, documented as enforced in the governing role file — the inert-gate class, certified.
+
+Note the compounding: the verdict format **requires** the queue-guard outcome as enumerated evidence.
+A conforming verdict is therefore obliged to include a field that means nothing — the role file
+**instructs the merge-gate to manufacture evidence from an inert check**, in the same mandate that
+exists to stop bare conclusions being recorded as verdicts.
+
+**Interim resolution (confirmed with `rev-974`, with one refinement).** Follow the stricter D-23 ruling.
+But do **not omit** the queue-guard field — omitting a required field makes the verdict non-conforming.
+**Record it, labelled `ZERO-INFORMATION (inert, owner RM-03)`.** That satisfies the enumeration mandate
+and states the truth simultaneously; a silently-omitted field and a silently-cited one are both worse.
+
+**Not ours to edit.** `roles.local/merge-gate.md` is an operator-owned override; the correction belongs
+to the coordinator. **Recommended fix is annotation, not deletion** — the requirement is _correct once
+RM-03 lands_, so removing it would create a gap the moment the guard starts working. Annotate the three
+evidence sites and correct `:290` to distinguish _wiring real_ from _control inert_.
+
+**This is D-20's clause meeting an authoritative framework document.** Prose asserting a security
+property needs a negative control observed red; `✅ enforced` is exactly such an assertion, and it would
+fail that control today. The rule was written after the orchestrator overclaimed in its own governing
+document — it now catches the same defect in the framework's.
+
 ### D-26 — render-not-restate failed at maximal attention, committed by the rule's own enforcer
 
 **The definitive justification for making render-not-restate mechanical.**