diff --git a/doc/execution-semantics.md b/doc/execution-semantics.md
index 3846253c80..bb5c14a503 100644
--- a/doc/execution-semantics.md
+++ b/doc/execution-semantics.md
@@ -1222,3 +1222,8 @@ Local and remote runners use the same attachment publication contract. Remote
 files are read through the bound environment runner, with workspace confinement,
 no symlinks or hardlinks, stable file identity, a 10 MiB bound, and exact size and
 SHA-256 checks before storage. Remote paths are never opened on the controller.
+
+An asynchronous remote signal failure, including a sandbox already removed by
+the operator, must not crash the controller. Logging that failure must also be
+contained. A rejected signal does not prove termination: existing process and
+provider monitoring still own stop acknowledgement and cleanup proof.