docs(remediation): bank D-41 — the whole execution fleet is UNMANAGED, so RM-50/RM-58 have no surface

Went to rotate coder-mos1 mechanically; `mosaic fleet restart` cannot reach it. Every seat executing
this mission is systemd inactive/disabled and flagged UNMANAGED — coder-mos1, rev-974, f10-coder,
merge-gate, the pm-scouts, rev-3107b, ultron-3107, and mos-remediation itself. The roster-managed
population is a different set of seats from the ones doing the work.

RM-50 applied today would quarantine the entire remediation fleet including the seat implementing it.
RM-58's mechanical out-of-band reset cannot be performed at all, so the only rotation available is what
D-4 says does not count: asking the agent, or killing a pane by hand. Requirement banked on both: their
acceptance must be demonstrated against the UNMANAGED execution population, because a criterion proved
only on roster-managed canaries is tested on the wrong population — D-17's coverage class one layer up.

Today's rotation is therefore labelled honestly as a manual pane restart with a hand-verified handoff,
not as a lifecycle operation. The step ran; the property was not observed (cf. D-23).

Did not run fleet restart against a disabled unit while the live pane held RM-61 and RM-03 state.
Disposition escalated to Mos.

Also records the handoff artifact as the positive control: typed state, and it surfaced D-12 recurring
live (PR #1033's draft property silently dropped by a wrapper fallback), an unrunnable check declared
rather than substituted, and suspicions labelled as suspicions.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -322,6 +322,49 @@ merges cannot perform them.
 And the shape holds: **RM-03 is the fix for the queue guard, so this — the first delivery through the
 complete stack — is also the last one gated by a check that could not fail.**
 
+### D-41 — the entire execution fleet is UNMANAGED, so neither RM-50 nor RM-58 can be exercised against it
+
+Going to rotate `coder-mos1` mechanically, the orchestrator found `mosaic fleet restart` cannot reach it.
+`mosaic fleet ps` reports **every seat executing this mission** as `systemd inactive/disabled`, pane
+alive, flagged **UNMANAGED**: `coder-mos1`, `rev-974`, `f10-coder`, `merge-gate`, `pm-scout-a/b/c`,
+`pm-scout-coord`, `rev-3107b`, `ultron-3107` — **and `mos-remediation` itself.** The roster-managed
+population (`canary-pi`, `uc-*`, `auth-plan-*`) is a **different set of seats from the ones doing the
+work**.
+
+**Consequences, and they are structural rather than inconvenient:**
+
+- **RM-50** ("one roster-owned socket/host; **quarantine unmanaged**; deterministic reaper") applied
+  today would **quarantine the entire remediation fleet, including the seat implementing RM-50.**
+- **RM-58** ("**mechanical** pre-dispatch context reset — the orchestrator resets a seat out-of-band and
+  verifies it, rather than **asking** the agent to reset itself", D-4) **cannot be performed at all.**
+  There is no mechanical reset path for an unmanaged seat, so the only rotation available is precisely
+  what D-4 says does not count: asking the agent, or killing a pane by hand.
+- **P-LIFECYCLE-001** presumes rotation enforced by a deterministic coordinator. **That enforcement
+  surface does not exist for the seats that need it.**
+
+> **★ REQUIREMENT ON RM-50 AND RM-58: acceptance must be demonstrated against the UNMANAGED execution
+> population, not against roster-managed canary seats.** A criterion satisfied only on the managed
+> canaries is **tested on the wrong population** — the D-17 coverage class, one layer up. This is the
+> same shape as D-38: the check passes while the thing it claims to cover goes untested.
+
+**Honest labelling of today's rotation:** it is a **manual pane restart with a hand-verified handoff
+artifact, dressed as a lifecycle operation.** Acceptable as a stopgap; it must **not** be recorded as
+"rotation worked", because the mechanism that would make it repeatable is absent. Same distinction as
+D-23's inert queue guard — **the step ran; the property was not observed.**
+
+The orchestrator did **not** run `mosaic fleet restart` against the disabled unit of a live seat holding
+RM-61 and RM-03 state. Disposition (manual restart / Mos executes / leave parked) escalated to Mos.
+
+**Handoff quality note, worth keeping as the positive control:** `coder-mos1`'s artifact
+(`~/agent-work/handoffs/coder-mos1-20260801.md`, verified readable by the orchestrator **before** any
+reset) is typed state rather than transcript, and surfaced things not otherwise recoverable — including
+**D-12 recurring live** (PR #1033 was created through a wrapper API fallback and the requested `draft`
+property was silently not applied), an **unrunnable check declared as unrunnable rather than substituted**
+(`test:framework-shell` exits 97 on this host: Bash 5.2.15 reports `BASH_LINENO [3 5]` where the suite
+requires `[3 4]`; CI's Alpine environment is canonical), and **suspicions explicitly labelled as
+suspicions** ("11 observations are insufficient to establish causality — do not encode node, time, head,
+or retry correlates into policy"), which is RM-61's own doctrine applied by the seat to its own hunch.
+
 ### D-40 — a type confusion INSIDE the structural discriminator the whole design rests on
 
 `step.get("exit_code") == 0` is **True for JSON `false`**, because Python `False == 0`. Reproduced twice