docs(remediation): bank D-28 — a swallowed diagnostic destroyed a fail-closed check's evidence

RM-02 CI failed on four sandbox tests. Bubblewrap is installed by the gate step but not
the test step, so spawnSync returned ENOENT; replayCommit replaced the spawn diagnostic
with an empty string, so the classifier could not prove Bubblewrap provenance and
correctly refused to treat it as expected sandbox unavailability.

The refusal was right; the information loss was the bug. For a classifier, error text is
not decoration — it is the input. Widening acceptance to make the test pass would be a
finding, not a fix.

Linkages: D-16 again (local has bwrap, CI does not — local and CI disagree a third
time), and diagnostic-preservation registered as an RM-02 gate requirement with a
must-fail control proving a swallowed message is detected.

Process note: the orchestrator's hypothesis that the coincident ci-postgres FAIL caused
this was WRONG and was refuted with log evidence. D-21 stands unchanged as a teardown
artifact and is NOT upgraded — it was about to be re-classified on a false premise.
Asking the seat to confirm or refute rather than accept is what prevented that.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -146,6 +146,42 @@ exposure or changing provider protected-pipeline posture is a host security-post
 infrastructure authority. Nothing is blocked meanwhile — RM-02's head is unprivileged and fail-closed,
 the privileged experiment stays uncommitted and out of branch history.
 
+### D-28 — a swallowed diagnostic destroyed the evidence a fail-closed check needed
+
+RM-02's CI run failed on four `scripts/gate-history.test.mjs` sandbox tests. **The fail-closed logic
+behaved correctly; the defect was that it was denied the evidence to decide.**
+
+Chain: Bubblewrap is installed by the **gate** step but not the **test** step, so `spawnSync('bwrap', …)`
+returned `status=null` / `ENOENT`. `replayCommit` then **replaced the spawn diagnostic with an empty
+string** (`historical frozen dependency install failed:`). With the underlying error destroyed, the
+classifier **could not prove Bubblewrap provenance** — and, correctly, **refused** to treat an
+unprovable condition as expected sandbox unavailability.
+
+**The refusal was right. The information loss was the bug.** A fail-closed check is only as good as the
+evidence reaching it: strip the diagnostic and a correct classifier is forced into a correct-but-opaque
+refusal that looks like a defect in the thing being tested. **Error text is not decoration — for a
+classifier it is the input.**
+
+**Fix requirements** (and what review must scrutinise): preserve `install.error.message` in replay
+diagnostics, and accept **only Bubblewrap-provenance** `EPERM`/`EACCES`/`ENOENT` as terminal sandbox
+refusal — unrelated command errors stay rejected. **Widening the acceptance to make the test pass would
+be a real finding**, not a fix: it would convert a precise fail-closed check into a permissive one.
+
+**Two linkages worth recording:**
+
+- **D-16 again** — it did not reproduce locally because `bwrap` _is_ installed there. Local and CI
+  disagreeing about what passing means, a third time.
+- **Diagnostic-preservation is a gate requirement, not hygiene.** RM-02 registers it: where a check
+  classifies on the basis of an error, the case must assert the **diagnostic survives** to the
+  classifier, with a must-fail control proving a swallowed message is detected.
+
+**Process note.** The orchestrator's hypothesis — that the coincident `ci-postgres` FAIL caused the test
+failure — was **wrong**, and refuted with direct evidence: the log shows `ci-postgres:5432 - accepting
+connections` and migrations completing. **D-21 therefore stands unchanged as a teardown artifact and is
+NOT upgraded.** It was about to be re-classified as "intermittently takes out the test step" on a false
+premise; asking the seat to _confirm or refute_ rather than accept is what prevented a finding being
+corrupted by a plausible guess.
+
 ### D-27 — the authoritative role file certifies an inert control as `✅ enforced`
 
 Found by `rev-974` while loading the canonical gate sources — i.e. found _because_ we switched from