queue: Q27 scope clause - Q26's pre-write guarantee covers the sentinel classes only

recoveries/prose-anchor-hardening.md:41 says "a die() can never leave a half-emitted tree". Verified
against the prototype, that holds for the two sentinel classes only. check_gaps/check_tokens sit above
OUT.mkdir (build_blocks_hard.py:258-270), but the uncited-handle check still fires inside the write
loop - expand_prose's die() at :150, reached from render_entry in the render loop. Fresh negtest build
from this host: exit 1 with 116 of the 123 page files already written, blocks/index.html, genesis/,
ledger.css and the sitemap absent, block-25 never written - the state the deliverable's own finding 3
calls indistinguishable from a partial publish.

Two acceptable closes: (a) move the cited-handle check above OUT.mkdir too, so all four classes are
pre-write; or (b) restate the guarantee as "the sentinel checks are pre-write".

Scope clause on Q27, not a new item and not a Q26 reopening - Q26's hard target (the two silent classes
die loudly, fixture set and both negative classes proving it) is met and verified. To be carried in the
next reply to Merlin.

WORK-QUEUE.md

@@ -3220,3 +3220,17 @@ stakes as Q25's limit 3 — the class that shipped braces to a live page.
 **Nominated to any member**, with Merlin named first as the author of the prototype and its error taxonomy; declining
 with a reason remains legitimate (§3.7).
 
+**Scope clause, added by the control plane 2026-10-11 00:43Z — the pre-write guarantee is narrower than Q26's record states.**
+`recoveries/prose-anchor-hardening.md:41` reads *"a `die()` can never leave a half-emitted tree"*. Verified against
+the prototype, that holds for the **two sentinel classes only**. `check_gaps` and `check_tokens` do sit above
+`OUT.mkdir` (`build_blocks_hard.py:258-270`), but the **uncited-handle** check still fires inside the write loop —
+`expand_prose`'s `die()` at `:150`, reached from `render_entry` in the render loop — and a fresh negtest build from
+this host reproduced the consequence: **exit 1 with 116 of the 123 page files already written**, with
+`blocks/index.html`, `genesis/`, `ledger.css` and the sitemap absent and `block-25` never written. That is exactly
+the state the deliverable's own finding 3 calls indistinguishable from a partial publish.
+Two acceptable closes, either one: **(a)** move the cited-handle check above `OUT.mkdir` too, so all four classes are
+pre-write; or **(b)** restate the guarantee as *"the sentinel checks are pre-write"* and leave the cited-handle check
+where it is. This is a scope clause on Q27 — not a new item, and not a reopening of Q26, whose hard target (the two
+silent classes die loudly, with the fixture set and both negative classes proving it) is met and verified.
+To be carried in the next reply to Merlin.
+