diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md
index 5bbf935d..a83f0ec5 100644
--- a/docs/remediation/TASKS.md
+++ b/docs/remediation/TASKS.md
@@ -146,6 +146,42 @@ exposure or changing provider protected-pipeline posture is a host security-post
 infrastructure authority. Nothing is blocked meanwhile — RM-02's head is unprivileged and fail-closed,
 the privileged experiment stays uncommitted and out of branch history.
 
+### D-28 — a swallowed diagnostic destroyed the evidence a fail-closed check needed
+
+RM-02's CI run failed on four `scripts/gate-history.test.mjs` sandbox tests. **The fail-closed logic
+behaved correctly; the defect was that it was denied the evidence to decide.**
+
+Chain: Bubblewrap is installed by the **gate** step but not the **test** step, so `spawnSync('bwrap', …)`
+returned `status=null` / `ENOENT`. `replayCommit` then **replaced the spawn diagnostic with an empty
+string** (`historical frozen dependency install failed:`). With the underlying error destroyed, the
+classifier **could not prove Bubblewrap provenance** — and, correctly, **refused** to treat an
+unprovable condition as expected sandbox unavailability.
+
+**The refusal was right. The information loss was the bug.** A fail-closed check is only as good as the
+evidence reaching it: strip the diagnostic and a correct classifier is forced into a correct-but-opaque
+refusal that looks like a defect in the thing being tested. **Error text is not decoration — for a
+classifier it is the input.**
+
+**Fix requirements** (and what review must scrutinise): preserve `install.error.message` in replay
+diagnostics, and accept **only Bubblewrap-provenance** `EPERM`/`EACCES`/`ENOENT` as terminal sandbox
+refusal — unrelated command errors stay rejected. **Widening the acceptance to make the test pass would
+be a real finding**, not a fix: it would convert a precise fail-closed check into a permissive one.
+
+**Two linkages worth recording:**
+
+- **D-16 again** — it did not reproduce locally because `bwrap` _is_ installed there. Local and CI
+  disagreeing about what passing means, a third time.
+- **Diagnostic-preservation is a gate requirement, not hygiene.** RM-02 registers it: where a check
+  classifies on the basis of an error, the case must assert the **diagnostic survives** to the
+  classifier, with a must-fail control proving a swallowed message is detected.
+
+**Process note.** The orchestrator's hypothesis — that the coincident `ci-postgres` FAIL caused the test
+failure — was **wrong**, and refuted with direct evidence: the log shows `ci-postgres:5432 - accepting
+connections` and migrations completing. **D-21 therefore stands unchanged as a teardown artifact and is
+NOT upgraded.** It was about to be re-classified as "intermittently takes out the test step" on a false
+premise; asking the seat to _confirm or refute_ rather than accept is what prevented a finding being
+corrupted by a plausible guess.
+
 ### D-27 — the authoritative role file certifies an inert control as `✅ enforced`
 
 Found by `rev-974` while loading the canonical gate sources — i.e. found _because_ we switched from