docs(remediation): promote two first-class principles to the charter; dispatch RM-02 round 3

Mos ruled both open questions and promoted the pattern to the charter.

PRINCIPLE 1 — the anchor must live outside the audited party's authority. You cannot fix "the author
controls X" by deriving X from something the author also controls; deriving only MOVES the control
point. Third independent arrival of one conclusion, each reached while shipping something else and each
from a different direction: the manifest certifying its own tree (D-19), the sandbox evaluating code
that enters before the boundary exists (D-25), and now the registry seam derived from a path the author
also places (D-45). Three impossibility-derivations of the same conclusion is the strongest
architectural evidence this mission has produced, and it is what forces Builds 1-2 rather than making
them a preference.

PRINCIPLE 2 — no universally-quantified check may pass over an empty set. "All registered cases ran" is
vacuously true when there are none. Non-emptiness and anchoring are preconditions asserted before the
quantified check runs, not properties hoped for after. The identical vacuity appeared twice at two
levels — seam=HEAD emptied the commit range, an emptied manifest emptied the registry population — and
the first was fixed as an instance, so it returned one level up. Corollary, same disease: a clause
written for the instance that produced it is not a clause.

Q1 ruled: the merge-base anchor IS in scope for f10-coder in this PR. It is git-computable against
main, which the author does not control, so reordering or splitting within the branch cannot move it —
an existing non-author-controlled reference, no new infrastructure. RM-60's execution boundary is a
sibling under the same principle but a different mechanism (where gate-verify runs, not what the anchor
is) and stays with Mos and Jason. Honesty required in both directions: the merge-base anchors to main,
whose integrity rests on the merge discipline this registry enforces — a bootstrap, sound against an
author who cannot rewrite main and NOT sound against an attacker who can, with that residual bound to
the Builds 1-2 dependency rather than implied.

Q2 ruled: state the empty-set principle as a general clause now, and generalize the D-38/D-40 criteria
the same way — quantify over the population instead of relabeling the originating instances.

Round 3 dispatched to f10-coder: merge-base anchor plus delayed-introduction must-fail; empty-set
precondition as a general clause with an emptied-registry must-fail; generalized clauses bound across
the gate inventory; each red-first. Number.isInteger accepting zero/negative/unsafe pipeline numbers
banked as a non-blocking follow-up.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/BOARD-LEDGER.md

@@ -70,3 +70,10 @@ board is one of the six stale restatements below.
   not a 200 on a read. Mos owns provisioning; escalate missing pairs.
 - Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and
   agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship.
+
+<!-- board-roll: D-26 gate-restatement rationale rolled verbatim from BOARD.md 2026-08-01 -->
+
+### Why the board must not restate the delivery gates (D-26)
+
+Restating the gate from memory is how the merge-gate step went missing from mission setup twice,
+once inside the correction for it (**D-26**).

docs/remediation/BOARD.md

@@ -34,11 +34,9 @@
 2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 48 findings
    (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-47 + D-38c in TASKS.md), every ruling with its rationale, and the
    requirements each finding placed on RM-02/RM-34/RM-50/RM-55.
-3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the
-   property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an
-   integrity claim dressed as a property · when a property cannot exist at its layer, bound it and track
-   the real guarantee · query for refutation, never for confirmation · redundant observation on
-   evidence-bearing steps.
+3. **`MISSION.md` carries the first-class principles** — read them there, they are not listed here.
+   Two added 2026-08-01: **the anchor must live outside the audited party's authority** (D-19/D-25/D-45,
+   third arrival) and **no universally-quantified check may pass over an empty set** (D-44/D-46).
 4. **Seat identity:** `export MOSAIC_GIT_IDENTITY=<seat>` is stripped by a context reset (**D-34**) —
    every dispatch/rehydration brief must re-export it, or the seat cannot use its credentials.
 5. **Scan CI from `-f json`, never default text** — text mode omits `clone` (**D-33**). State counts.
@@ -50,8 +48,7 @@
 
 Canonical: `~/.config/mosaic/fleet/roles.local/merge-gate.md` (verdict authority) +
 `~/.config/mosaic/fleet/roles/validator.md`. Order and the freeze/zero-information rules: `MISSION.md`
-and `KICKSTART.md`. **Read them there** — restating the gate from memory is how the merge-gate step
-went missing from mission setup twice, once inside the correction for it (**D-26**).
+and `KICKSTART.md`. **Read them there** (why: **D-26**, in `BOARD-LEDGER.md`).
 
 ## Fleet seats
 

docs/remediation/MISSION.md

@@ -117,6 +117,51 @@ gate/program; the LLM handles only genuine judgment.
 > not yet a hypothesis. Where the answer is consequential, **reproduce** rather than accept — two
 > independent runs beat one confident report.
 
+### First-class principle — the anchor must live outside the audited party's authority
+
+> **You cannot fix "the author controls X" by deriving X from something the author ALSO controls.**
+> Deriving merely **moves** the control point; it does not remove it.
+>
+> Promoted to the charter by Mos (2026-08-01) on the **THIRD INDEPENDENT ARRIVAL** of the same
+> conclusion, each reached while trying to ship something else, each from a different direction:
+>
+> | arrival           | the audited party controls…                                         | found as |
+> | ----------------- | ------------------------------------------------------------------- | -------- |
+> | manifest          | the tree that certifies its own generated state (same-UID, CWE-345) | **D-19** |
+> | sandbox           | the code that enters the sandbox, before the boundary exists        | **D-25** |
+> | **registry seam** | **WHEN the tracked path is introduced, hence the derived boundary** | **D-45** |
+>
+> Round 1 the value was an author-settable **field**, so it was **derived**. Round 2 the derivation
+> depended on **when the author introduces the path**. Same authority, new costume. **Three
+> impossibility-derivations of one conclusion is not a coincidence to note — it is the strongest
+> architectural evidence this mission has produced**, and it is precisely what **forces Builds 1–2**
+> rather than making them a preference.
+>
+> **Operationally:** anchor to a reference the audited party cannot move. A git **merge-base against
+> `main`** is such a reference for a PR author (they own their branch; they do not own `main`).
+> **State the bootstrap in BOTH directions (D-19):** that anchor is sound against an author who cannot
+> rewrite `main` — the threat in scope — and **NOT** sound against an attacker who can. **That residual
+> is what Builds 1–2 close, and it must be recorded as a tracked dependency, never implied.**
+
+### First-class principle — no universally-quantified check may pass over an empty set
+
+> **"All registered cases ran" is VACUOUSLY TRUE when there are no registered cases.**
+> **Non-emptiness and anchoring are PRECONDITIONS asserted before the quantified check runs — not
+> properties hoped for after it.**
+>
+> Promoted by Mos (2026-08-01) after the identical vacuity appeared **twice, at two different levels**:
+> `activationCommit = HEAD` emptied the **commit range** (D-44), and an emptied manifest — `criteria`,
+> `gates`, `proseClaims`, `compatibilityScenarios` all `[]` — emptied the **registry population**
+> (D-46), each yielding **exit 0**. The first was fixed **as an instance**; the principle was never
+> extracted, **so it returned one level up.**
+>
+> **Delete every gate and every criterion TOGETHER and no remaining reference complains — because every
+> reference went with them.** A check that quantifies over a population must actually **range** over it,
+> and that population must be **provably complete and non-empty**.
+>
+> **Corollary (same disease):** a clause written for the instance that produced it is not a clause.
+> **Do not relabel the originating instances as the general clauses** — quantify over the population.
+
 ### First-class principle — redundant observation on evidence-bearing steps
 
 > **Two observers of the same evidence, disagreeing, catch what neither catches alone.** Apply redundancy