docs(remediation): bank D-23 — the mandatory queue guard has never worked, for any input

RM-02's registered fixtures found this before the registry was built. Worse than the
banked unknown=>exit 0: ci-queue-wait.sh:266 pipes the payload into a classifier
starting 'python3 - <<PY', so python reads its PROGRAM from stdin and json.load never
sees the JSON. Proven empirically — success, failure, pending and malformed all
classify as unknown, and unknown exits 0.

The mandatory pre-push/pre-merge guard therefore returns PASS for every possible input,
including a genuinely failing CI. The six observed meaningless greens were not an edge
case; they are the only output it can produce.

PR #1023 is exactly this fix, open and parked, and its body diagnoses it precisely.
Two aggravating details from that body: pr-ci-wait.sh:38 documented the bug and remedy
and it was never backported to the mandatory sibling (D-14 propagation with a
security-adjacent blast radius); and the fix was opened without re-verification.

Escalated for Jason's #1023 disposition. RM-02 records required-vs-actual with
DEFECT (owner: RM-03); no RM-03 lane opened, guard not edited.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -93,6 +93,52 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI.
 Three independent live instances in a single session — format gate, agent context reset, queue guard —
 is the class confirmed, not anecdote.
 
+### D-23 — the mandatory CI queue guard has never worked, for any input, ever
+
+RM-02's registered fixtures found this **before the registry was even built** — the sharpest possible
+argument for the task. It is materially worse than the already-banked "unknown ⇒ exit 0" (D-6/D-10).
+
+`ci-queue-wait.sh:266` pipes the provider payload into a classifier that begins `python3 - <<'PY'`.
+**`python3 -` reads its _program_ from stdin, and the heredoc supplies that program** — so
+`json.load(sys.stdin)` never sees the piped JSON, EOFs, and falls through to `unknown`.
+
+Proven empirically, not inferred:
+
+```
+payload={"state":"success"}  ->  unknown
+payload={"state":"failure"}  ->  unknown
+payload={"state":"pending"}  ->  unknown
+payload=not-json             ->  unknown
+```
+
+**Every input classifies as `unknown`; `unknown` exits 0.** So the mandatory pre-push / pre-merge guard
+returns **PASS for every possible input — including a genuinely FAILING CI.** It has never distinguished
+anything. My six observed "meaningless greens" were not an edge case; they were **the only output it can
+produce.**
+
+**The fix already exists and is parked.** PR **#1023** — _"parse the payload it was handed, not stdin"_ —
+is open, mergeable, and its body diagnoses this precisely: _"binds stdin to the program text, so
+`json.load(sys.stdin)` EOFs, the state falls through to `unknown`, and the guard exits 0 on every
+invocation, every branch, every repo, both platforms."_
+
+Two aggravating details from that PR's own body:
+
+1. **`pr-ci-wait.sh:38` documented this exact bug and its remedy — and it was never backported to the
+   mandatory sibling.** A known defect, with a known fix, written down in one tool and never applied
+   where it was load-bearing. That is D-14 propagation failure with a security-adjacent blast radius.
+2. It was _"opened per board instruction without re-verification"_ — the fix for an unverified gate was
+   itself shipped unverified.
+
+**Escalation, for Jason, on #1023's disposition.** Every merge gated on this guard since it was
+introduced was **ungated**. The guard cannot fail. This does not mean those merges were bad — CI itself
+ran and was checked by humans and reviewers — but the _automated_ gate contributed **zero** signal
+throughout, while being cited as merge evidence. The standing doctrine ("treat its green as
+zero-information") was more literally correct than anyone realised when it was written.
+
+**RM-02 records `required` vs `actual` per case with `DEFECT (owner: RM-03)`** and stays sensitive to any
+change in either direction. No RM-03 lane was opened; `ci-queue-wait.sh` was not edited; source and
+installed copy remain byte-identical at the observed SHA-256.
+
 ### D-22 — the registry would have verified the wrong artifact
 
 Surfaced while ruling RM-02's design. The gate that **actually runs** when the fleet invokes a wrapper is