docs(remediation): RM-03 CANNOT_ASSERT semantics ruled (option B)

Resolves an ambiguity in the orchestrator's own brief, which required CANNOT_ASSERT to
neither silently pass nor permanently block without distinguishing push from merge.
coder-mos1 stopped and asked rather than inferring authorisation; Codex security
independently flagged CWE-693.

Ruled B: merge fails CLOSED (proceeding without exact-head CI evidence is D-23's
condition in a narrower costume), push degrades AUDITED (blocking during an outage
bricks delivery — the Pi-brick class we already banked). A temporary block pending
evidence is not a permanent block, and merge is separately gated by the merge-gate and
coordinator, so nothing is stranded.

Conditions: distinct exit code or the tri-state is destroyed; the audit record asserted
by a registered case, not assumed, or 'audited' is a claim dressed as a property;
retryable and self-clearing; cases observed RED first; no silent degraded merge path —
break-glass belongs to RM-05.

Option C rejected: it bricks push during an outage and defers the degraded path, which
in this codebase means a silent bypass appears under incident pressure. Three are
already on the books.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -146,6 +146,39 @@ exposure or changing provider protected-pipeline posture is a host security-post
 infrastructure authority. Nothing is blocked meanwhile — RM-02's head is unprivileged and fail-closed,
 the privileged experiment stays uncommitted and out of branch history.
 
+### RM-03 — CANNOT_ASSERT semantics: RULED (option B), 2026-08-01
+
+Recorded because it resolves an **ambiguity in the orchestrator's own brief**, and because the reasoning
+generalises beyond the queue guard.
+
+The brief required that `CANNOT_ASSERT` "must NOT silently pass and must NOT permanently block" —
+**without distinguishing push from merge.** Those need different answers. `coder-mos1` stopped and asked
+rather than inferring authorisation from an ambiguous instruction plus a "carry on"; a Codex security
+review independently flagged **CWE-693** on the same point.
+
+**Ruling — B: push degrades audited/exit 0; merge returns a distinct non-zero/HOLD until the provider
+recovers.** The asymmetry is the substance, not a compromise:
+
+| action    | consequence                                                                                                                                            | posture              |
+| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------- |
+| **merge** | proceeding without exact-head CI evidence is **D-23's condition in a narrower costume** — the guard passing exactly when its answer matters most       | **fail CLOSED**      |
+| **push**  | blocking during a provider outage **bricks delivery** — the Pi-brick class (P-RECOVERY-001), a gate whose own unavailability prevents recovery from it | **degrade, AUDITED** |
+
+**"Must not permanently block" is satisfied:** a _temporary_ block pending evidence is not a _permanent_
+one. Merge HOLD clears on provider recovery, and merge is separately gated by the merge-gate verdict and
+the coordinator, so a non-zero `CANNOT_ASSERT` strands nothing.
+
+**Conditions.** Distinct exit code (`CANNOT_ASSERT` never conflated with `ASSERTED_NOT_READY`, or the
+tri-state is destroyed) · **the audit record is ASSERTED by a registered case, not assumed** — otherwise
+"audited" is an integrity _claim_ dressed as a _property_ · retryable and self-clearing, documented ·
+registered cases observed RED first for each arm · **no silent degraded merge path, ever** — any
+authorised degraded merge is break-glass (loud, audited, expiring) and belongs to RM-05, not here.
+
+**Option C (always non-zero) rejected:** cleaner to specify, worse in practice. It bricks push during an
+outage and defers the degraded path to "later", which in this codebase means **a silent bypass appears
+under incident pressure**. Three such bypasses are already on the books; do not create the conditions
+for a fourth.
+
 ### D-28 — a swallowed diagnostic destroyed the evidence a fail-closed check needed
 
 RM-02's CI run failed on four `scripts/gate-history.test.mjs` sandbox tests. **The fail-closed logic