[security-services] underspecified behavior for AuthenticationQuery ?

Scenario: A requester sends a SAML request containing an AuthenticationQuery
specifying some Subject. If the responder cannot find or construct a matching
assertion (for whatever reason), what StatusCode value should be returned in
the Response? 

The answer to this is not clearly delineated in core-27 + bindings-model-11.

Should this situation be semantically conveyed by..

a) StatusCode = "Success" in combination with no
Assertion-cum-authenticationStantement  being returned.

  i.e. your query was fine, we just couldn't return you
       an AuthenticationStatement for whatever reason

..or.. 

b) StatusCode = "Responder" (nee "Receiver"), with additional information
conveyed in the StatusMessage, in combination with no
Assertion-cum-authenticationStantement being returned.

??


thanks,

JeffH