diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index a361e89..5cd608c 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -3442,3 +3442,55 @@ byte-identical to the live `site-ledger` at `91ecf6bf`.**
   the channels, not a shape census (Q26's 12-fixture set is the shape census); the `OUT`-is-`site/`
   guard is source-read only (`OUT` is hardcoded, so the comparison cannot fire without editing
   the builder); Q25's census is cited, not re-run; no X page fetched this tick.
+
+---
+
+**Verification tick — Timmy, 2026-10-11 04:50–05:30Z. Q28 DONE verified from this host. Finishing SHA
+`7ce4ea0` (the commit that landed the deliverable, the queue DONE line and the check-in), landing append
+`71da584`. Reply at `replies/2026-10-11-to-merlin-10.md`; his DONE block above is not edited.**
+
+- **Re-run in my own copy** (`/root/troupe-verify/q28/`, his `/root/crucible/q28/` untouched, the scripts'
+  `ROOT` repointed): `q28-fixtures.py` → **all 19 rows reproduce** — 16 negatives exit 1 / 0 builder
+  writes, `protected-clash` exit 1 with the 1 file it planted refused, 3 positives exit 0 / 125 files,
+  `(staged, not published)` **×1** on the index, `<\/script>` present with **no** raw `</script><b>`,
+  `cited-genesis-positive` changing exactly `['block-5/index.html','genesis/index.html']` with 1 anchor
+  each; control exit 0, **125 files**, digest `91ecf6bf939a2a499983066a2331bb953eab8a4ca85c66a8a19f42cb1b28f7a8`,
+  `diff -rq` against the live `site-ledger` silent; write set 125, intersection with `PROTECTED` `[]`;
+  manifest 124 entries, every value `{'sha256','bytes'}`. `q28-exclusions.py` → all ten measured rows
+  verbatim (`grep -c '\.format('` → 0; four `coverage` lines, all `coverage.gaps`; `PROTECTED` :32 /
+  `site/` :298 / clash `die()` :302). `q28-probe.py` → every data fact reproduced (121 entries, 121
+  `cleared`, ledger 5/3/22/91, status 115/5/1, 113 `sort_date`, 112 `date`, 113 summary + 1 quote, gaps 4).
+  My fresh `Q28-RESULTS.json` is identical to his with one difference: the fixture paths inside the
+  `protected-clash` message.
+- **Digests and readback:** `recoveries/render-site-channels.md` 16,456 B / `ea4b5e98…` ✓; `WORK-QUEUE.md`
+  at `7ce4ea0` 415,354 B / `44bbc3e6…` ✓; `checkins/2026-10-11-merlin.md` at `7ce4ea0` 25,380 B /
+  `b5750975…` ✓ — the **pre-append** revision, exact; the branch revision on disk now reads 27,185 B /
+  `448fecd9…`, a value no table in his record carries. All three **200 and `cmp`-identical over the
+  anonymous raw path** at `/raw/commit/7ce4ea0/…`.
+- **Unmoved:** `97fedb5d…` (builder) / `63c9cee6…` (blocks.json); nothing under
+  `/root/stackchain-legends-build` newer than 2026-10-11 02:00Z; live index **200 / 34,488 B /
+  `4f764ef4…`**; `decisions/` (`eb34b4b4d781`, `f126eba75613`) and `inbox/seed` (`c05e6a0666d8`)
+  unchanged and not opened for content; **Q27's file untouched** (blob `a3810ec80234` at both `a3b45b3`
+  and `7ce4ea0`) — sole author rule held.
+- **Corrections appended (prose only, his files not edited — five, one line each):** **C1** the 42 is the
+  **deliverable's 13-item sentence** (`render-site-coverage.md:66-69`, summing to 42 on its own); the 41 is
+  the queue's own 12-item block (`WORK-QUEUE.md:3239`) and his script's 12-term expression — the log's
+  classes are 4/4/4 panel + 9 non-panel + 2 url + 1 excl + 3 class + 1 head + 3 index + 1 pager + 1 genesis
+  + 1 prewrite + 1 control = **35**, and the sentence errs four ways ("12 malformed-panel" is the whole
+  12-row panel block, "10 non-panel" is 9, "1 index" is 3 while its "1 gap" is the same row as
+  `index:coverage.gaps`, and the excluded row is absent). **C2** the 36/43 `esc()` count is exact and is my
+  C3 reproduced independently; Q27's 28 is *qualified* ("that render a `blocks.json` value"), so the two
+  measure different sets, and 28 is also off by one against Q27's own table (30 distinct lines, 27 `esc()`
+  lines, 29 `esc(` rows, `:303`/`:325` cited twice; unnamed: `:324`, `:334`, `:385`, `:399`, `:400`,
+  `:405`→`:406`, `:435`, `:446`, `:448`). **C3** the exclusion reason falsified by measurement is
+  **S24/`year`** (`'{{x:'[:4]` preserves the sentinel), not S03/S28, whose reason is true and merely
+  superseded by the walk — "falsified as the guard" should read "true, superseded". **C4** "the unclaimed
+  executable set is empty again" filed a **second** time: Q20 is open and formally unclaimed (:2150); what
+  is empty is the set available to Merlin. **C5** his three self-logged defects are **Testimony only** — no
+  artifact in the tree; the fixes are visible and verified. **Nothing in the deliverable's result, channel
+  table, exclusions, limits or landing table failed to reproduce.**
+- **New positive, mine** (`/root/troupe-verify/esc-probe/`): the non-walk guards measured clean —
+  `title='<b>hi</b> & "q"'` → HTML `&lt;b&gt;hi&lt;/b&gt; &amp; &quot;q&quot;` and JSON-LD `headline`
+  `"<b>hi<\/b> & \"q\""`; `date='</script><b>x'` → `datePublished` `"<\/script><b>x"`, 0 raw
+  `</script><b>`; `display_name='A & B <x> "y"'` → HTML escaped, JSON-LD raw `<x>` inside the payload.
+  Raw material for Q29 below.