docs(remediation): bank D-32 — the repaired gate shipped with a documented switch to skip it

rev-974 blocked RM-03: pr-merge.sh still ships --skip-queue-guard at five sites
including a worked example. It proved this rather than reading it — stubbed the guard to
exit 99, ran a real fixture merge with the flag, and observed the guard never called,
provider payload created, 'merged successfully', exit 0.

Disqualifying because RM-03 repairs a mandatory gate that has never been able to fail;
shipping that repair with a documented bypass means the gate merely requires one flag
instead of zero, and every merge-side CANNOT_ASSERT/HOLD semantic is skipped. L0 bars
equivalent skip switches, and the merge-gate role doc names this exact hazard about
force_merge — adjacent to the field you came to edit, at the moment you are most
motivated to reach for it.

Generalizable: repairing a gate is incomplete while any supported path skips it. The
failure changes from 'cannot block' to 'can be told not to' — the same outcome one
keystroke later. Removing the bypass is part of the repair.

Everything else passed independently, including the 160 KiB stdin transport where #1023
regressed.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -221,6 +221,47 @@ reviewer, and no other seat holds mosaicstack write. Flagged to the coordinator
 busy lane. Not blocking today — RM-02's code blockers are independently disqualifying — but the next
 otherwise-clean PR meets this.
 
+### D-32 — the repaired gate shipped with a documented switch to skip it
+
+`rev-974` blocked RM-03 (PR #1032) on a single finding, and it is the one that mattered:
+**`pr-merge.sh` still ships `--skip-queue-guard`.**
+
+Verified independently at five sites in `packages/mosaic/framework/tools/git/pr-merge.sh` — usage line
+`:3`, help text `:29` ("Skip CI queue guard wait before merge"), a worked **example** at `:38`, the flag
+handler `:58`, and the conditional wrapping the entire `ci-queue-wait.sh` invocation at `:119`.
+
+**The reviewer did not report this from reading — it proved it.** It replaced the fixture queue guard
+with an `exit 99` stub, ran a real fixture merge with `--skip-queue-guard`, and observed: **the guard was
+never called, the provider payload was created, the wrapper printed "merged successfully", exit 0.**
+
+**Why this is disqualifying rather than a nitpick.** RM-03 repairs a mandatory merge gate that has never
+once been able to fail (D-23). Shipping that repair while leaving a **documented, advertised,
+worked-example** flag that skips the repaired gate means the gate still cannot be relied upon — **it
+merely requires one flag instead of zero.** Every merge-side `CANNOT_ASSERT`/`HOLD` semantic the task
+built is bypassed by it. L0 is explicit: _"Never use workarounds that bypass quality gates — `--no-verify`
+and equivalent skip switches are off-limits."_ This is an equivalent skip switch, sitting in the merge path.
+
+The merge-gate role doc names this exact hazard about `force_merge`, and the description transfers
+without modification:
+
+> _a `--no-verify` equivalent, **adjacent to the field you came to edit, at the exact moment you are most
+> motivated to reach for it** — red gate, queued PR._
+
+**The generalizable rule.** **Repairing a gate is incomplete while any supported path skips it.** A fix
+that restores a gate's ability to fail, but leaves a switch that turns it off, has changed the failure
+from _"the gate cannot block"_ to _"the gate can be told not to"_ — which under incident pressure is the
+same outcome reached one keystroke later. Removing the bypass is **part of the repair**, not a follow-up.
+
+**Required:** remove `--skip-queue-guard` from merge-capable execution — flag, usage, help text and
+example alike (**an undocumented-but-working bypass is worse than a documented one**) — plus a RED-first
+regression proving a merge-capable invocation cannot reach a provider merge call with the guard unrun.
+`--dry-run` may retain the skip since it does not merge, provided dry-run and merge-capable paths can
+never both be true.
+
+**Everything else in RM-03 passed independent verification**, including the 160 KiB stdin transport where
+#1023 regressed, the full classification matrix, the audited push-0/merge-75 tri-state, and the scope
+disposition. A strong PR with one hole in it.
+
 ### D-31 — a seat ran past 100% context with 28 uncommitted files and no commits
 
 `coder-mos1` reached **102.5% / 372k context** on RM-03 with **28 modified files uncommitted** and its