Preserve asset inspection error causes through delivery

docs/roadmap/remediation.md

@@ -1,13 +1,14 @@
 # Remediation: forge boundary and credential preflight review
 
-Status: remediation in progress; completion is recorded per issue below.
+Status: complete; all eight issues are addressed, with completion recorded below.
 
 ## Review baseline and scope
 
 Reviewed `cbdba90`, including the implementation commits after `9d6952a`,
 against the [feature roadmap](forge-boundary.md),
 [implementation plan](implementation.md), and the user's selected scope.
-This document records work identified by the review; it does not implement it.
+This document records review findings and their remediation. Findings describe
+the reviewed revisions; completion notes record their corrections.
 
 A follow-up integration audit reviewed `72de187`. Its production source is
 unchanged from `cbdba90`. That audit traced the new boundary and preflight
@@ -338,7 +339,14 @@ successful upload coordination can avoid its quadratic bookkeeping term.
 
 ## 8. Preserve asset-inspection failure causes during aggregation — P2
 
-Status: open.
+Status: complete.
+
+**Completed:** Joined per-asset inspection causes with filename context in
+unverifiable and conflict summaries, retaining conflict precedence and existing
+states/categories. Added focused multiple-cause coverage and public API
+regressions for cancellation and truncated downloads. Both regressions detect
+the original defect and pass with the fix. Full offline tests, focused race
+tests, and the API/dependency check passed; final verification is recorded below.
 
 **Evidence:** `inspectRemoteAssets` and `uploadMissingAssets` in
 [shared asset delivery](../../internal/delivery/remote_assets.go), and the
@@ -438,3 +446,20 @@ finding 8; it was removed after the check. Findings 6 and 7 follow from
 source-level operation counts. No benchmarks
 or real-world performance measurements were run, and no production code or
 permanent tests changed.
+
+### Remediation verification
+
+All eight issues were addressed sequentially and marked complete with their
+implementation or documentation changes. Final checks used Go 1.26.10 on
+linux/amd64 with `GOTOOLCHAIN=local`, `GOPROXY=off`, and `GOSUMDB=off`:
+
+- `go test ./...` passed.
+- `go run ./internal/apicheck` passed.
+- `go test -race ./internal/delivery ./internal/gitea` passed.
+- Focused public API and CLI regressions also passed with the race detector:
+  invalid destinations, CI module/tag mismatch, phase-specific statuses, and
+  asset-inspection cause preservation.
+- A temporary source overlay verified that the new aggregation/public API
+  cause-preservation regressions fail against the previous implementation.
+- Local links and heading fragments across changed Markdown files resolved;
+  whitespace checks passed. No benchmark measurements were needed.