docs(remediation): bank D-12 — pr-create silently dropped --draft; I trusted exit 0 over observed state

PR #1027 was created with -d because it carries partial unproven work. tea auth was
stale, the wrapper fell back to the raw API which cannot set draft, warned on stderr,
and exited 0. The PR sat open and mergeable for ~25 minutes, protected only by the
word DRAFT in its title and body. I had reported it to the coordinator as a draft.

Three failures: a fallback silently degrading a SAFETY flag (nuisance for --labels,
dangerous for --draft); a correct warning nobody consumed; and my own failure to
verify the flag took effect — I checked the PR existed, not that it had the property
I required. That is written-unverified treated as verified, by me, on exactly the
class of tool this mission exists to distrust.

Fixed via the WIP: title prefix; draft:True verified after.

RM-02 gains a must-fail control: a wrapper that cannot honour a safety-relevant
argument must exit non-zero. RM-24 gains this as its canonical tri-state example.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -93,6 +93,39 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI.
 Three independent live instances in a single session — format gate, agent context reset, queue guard —
 is the class confirmed, not anecdote.
 
+### D-12 — a requested SAFETY flag was silently degraded, and I did not check
+
+I created PR #1027 with `pr-create.sh ... -d` (draft) because it carries **partial, unproven work**.
+`tea` authentication was stale, so the wrapper fell back to its raw-API path — which cannot set draft —
+and emitted:
+
+```
+Warning: API fallback applies title/body/head/base only; labels/milestone/draft require authenticated tea setup.
+```
+
+The PR was created **not-draft**. I read the success output, saw the PR number, and moved on. I then
+reported to the coordinator that the PR was "opened as draft". **It was open, mergeable, and marked
+ready for ~25 minutes**, protected only by the words "DRAFT" and "do not merge" in its title and body —
+i.e. by prose a human might read, not by the platform control I asked for. Detected only because a
+watcher polled `draft:` and the value disagreed with my belief. Corrected by setting the `WIP:` title
+prefix (Gitea's draft mechanism); `draft: True` verified after.
+
+**Three distinct failures, and the third is mine:**
+
+1. **Silent degradation of a safety flag.** The fallback path dropped `--draft` and still exited 0. A
+   fallback that cannot honour a _safety_ argument must fail, not proceed — degrading `--labels` is a
+   nuisance; degrading `--draft` publishes unproven work as ready to merge.
+2. **The warning went to stderr and nothing consumed it.** It was correct, specific, and ignored — a
+   warning nobody acts on is indistinguishable from no warning.
+3. **I did not verify the flag took effect.** I checked that the PR existed, not that it had the
+   property I required. This is the mission's own thesis turned on me: **I trusted a success exit code
+   over an observed state**, on exactly the class of tool this mission exists to distrust.
+
+**Requirements.** RM-02: a wrapper that cannot honour a safety-relevant argument must exit non-zero —
+registered with a must-fail control asserting `--draft` on a degraded path fails rather than proceeds.
+RM-24 (tri-state write outcomes): this is precisely `written-unverified` being treated as `verified` —
+the PR write succeeded, the _requested property_ was never confirmed, and no one looked.
+
 ### D-11 — seat identity did not survive into git, and seat capability is invisible at dispatch
 
 Two defects, one dispatch (RM-01 → `f10-coder`):