docs(remediation): RM-61 MERGED; bank D-43 — I inverted a board fact while compressing to fit the budget

#1033 merged f4fd5967, verified by property: merged=true + merge commit, #1034 (delivery) CLOSED,
#1000 (retirement trigger) still OPEN. The exemption is on main and RM-02 is unblocked.

D-43 is mine. Compressing RM-02's board row to meet the 8KB budget, I turned "2 reviews clear" into
"2 live REQUEST_CHANGES" — an inversion. Provider truth: reviews 63 and 65 are at superseded heads and
live REQUEST_CHANGES at f9746b23 is empty. The real state is subtler than either wording: no live
blocker AND no live approval, because the head carries no review at all.

Caught only by re-deriving RM-02's state from the provider before dispatching, not by re-reading the
board. I was one message from briefing f10-coder to remediate two blocking reviews that do not exist.

The transferable part: this board carries a hard <8KB budget, it exceeded that budget four times in one
session, and each time I shaved prose to fit. Compression IS restatement, and this board's own rule is
"REFERENCE, do not restate" (D-26) because restatement is lossy every time. The budget therefore forces
the exact operation the board forbids, on its most load-bearing table. I flagged that as a risk earlier
in the session; it then materialised as an actual error.

Rule banked: meet a size budget by ROLLING content out to BOARD-LEDGER.md, never by rewording what
stays. Deleting a row and pointing at its authoritative home is safe; paraphrasing to save bytes is not.
Applied immediately — this commit rolls the Decisions-log narrative out verbatim rather than trimming
it, and the board is back under budget at 8096.

And the deeper one, onto RM-34: the orchestrator is the board's sole writer, so nothing external checks
the board against reality. Code has rev-974, gates have the merge-gate, CI has the JSON scan — the
control plane has no independent verifier. Handoff validation must include re-deriving the board's
claims from the provider, not merely confirming a successor can read the file.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -500,6 +500,40 @@ holds the head.** `coder-mos1` was RIGHT to want it fixed and WRONG to try to se
 right again immediately after, ACKing the hold and volunteering unprompted that it held an unpushed
 local commit. That disclosure is the behaviour to reinforce.
 
+### D-43 — the ORCHESTRATOR inverted a board fact while COMPRESSING to meet the byte budget
+
+Rewriting the board for a cold read, the orchestrator compressed RM-02's row from
+_"Code complete @ `f9746b23`, own harness green in CI, **2 reviews clear**, head FROZEN"_ to
+_"Complete @ `f9746b23`, head FROZEN, **2 live REQUEST_CHANGES**"_.
+
+**That inverts the meaning.** "Two review rounds have been CLEARED" became "two blocking reviews are
+LIVE". Verified against the provider: reviews 63 (`9b4d4beb`) and 65 (`38f1b249`) are both at
+**superseded** heads; **live `REQUEST_CHANGES` at `f9746b23` = `[]`**. (The true current state is
+subtler than either version: no live blocker **and** no live approval — the head has no review at all.)
+
+**How it happened, which is the transferable part.** The board carries a hard `< 8 KB` budget. It
+exceeded that budget **four separate times in one session**, and each time the orchestrator shaved prose
+to fit. **Compression is a restatement operation** — and this board's own governing rule is
+_"REFERENCE, do not restate"_ (D-26), because restatement is lossy every time. The byte budget therefore
+**forces** the exact operation the board forbids, on the board's most load-bearing table.
+
+**Caught by:** the orchestrator re-deriving RM-02's state from the provider **before dispatching** rather
+than trusting its own board — one dispatch away from briefing `f10-coder` to remediate two blocking
+reviews that do not exist. It was flagged as a _risk_ earlier in the session ("the 8 KB budget is under
+structural pressure; the honest fix is rolling to `BOARD-LEDGER.md`, not shaving prose"). The risk then
+materialised, self-inflicted, and was not detected by re-reading the board — only by leaving it.
+
+> **RULE: a size budget on a state artifact must be met by ROLLING content out (`board-roll.sh` →
+> `BOARD-LEDGER.md`), never by rewording what stays.** Rewording is restatement; restatement is how
+> every stale-board finding in this ledger happened (D-26, D-36, D-38c). Deleting a whole row and
+> pointing at its authoritative home is safe; paraphrasing a row to save bytes is not.
+
+**And the deeper one:** the orchestrator is the board's sole writer, so **nothing external checks the
+board against reality.** Every other artifact on this mission has an independent verifier — code has
+`rev-974`, gates have the merge-gate, CI has the JSON scan. The control plane has none. That belongs on
+**RM-34** ("a handoff must VALIDATE the checkpoint"): validation must include **re-deriving the board's
+claims from the provider**, not merely confirming the file parses or that a successor can read it.
+
 ### D-42 — the head-pin is an enforcement mechanism whose NEGATIVE CONTROL has never been observed
 
 `merge-gate.md` states it directly: **a successful merge is NOT evidence the pin worked.** Only the