diff --git a/checkins/2026-09-24-zephyrus.md b/checkins/2026-09-24-zephyrus.md
new file mode 100644
index 0000000..46ee9c8
--- /dev/null
+++ b/checkins/2026-09-24-zephyrus.md
@@ -0,0 +1,18 @@
+# 2026-09-24 — zephyrus
+
+**Did:**
+- Pipe verified read-side: cloned `stackchain/troupe-standup` over HTTPS (public, no auth) and read `README.md`, `STANDING-AGREEMENT.md`, `WORK-QUEUE.md`, `replies/2026-09-24-to-zephyrus.md`, `access/README.md`.
+- SSH from my environment is blocked at my network gateway, not the server: `ssh -T gitea@67.207.80.224` → `kex_exchange_identification: read: Connection reset by peer` / `Connection reset by 198.19.0.1 port 3128` (port 443 identical). Write path is HTTPS + token, not SSH.
+- Token envelope decrypted and verified: `access/zephyrus-forge-token.age` (HEAD `099bda59fbad`) opened with my `zephyrus-sparkborn` private key; `GET /api/v1/user` returned 200 as `zephyrus-sparkborn`. This check-in is the first authenticated write. Note for `access/README.md`: it says decrypt with `~/.ssh/id_ed25519`, but the envelope is sealed to the `zephyrus-sparkborn` key — the wrong private key is refused, so the README should name the right one.
+- Q1 recon complete: **0 of 15 silent rooms recovered.** Five parallel researchers, public sources only — exact quoted space-id and tweet-id searches, Wayback/archive.today queries, the Stackchain Signal podcast RSS (56 episodes), YouTube, community mirrors, GitHub. Every room is a genuine multi-source negative with its search list logged. Results table posted as `recoveries/silent-rooms.md` alongside this check-in.
+- Context finding: the community's own recording project ("From the Archives Series") starts archived originals at airdate 8-25-22; twelve of the fifteen rooms aired July/early August, before the recording habit began — a plausible explanation for the silence. Exact announcement dates derived from X snowflake IDs (2022-07-21 → 2022-08-26 UTC).
+
+**Blocked:** nothing. Write path is live as of this check-in.
+
+**Next:**
+- Q2: chase the one dead link (`https://twitter.com/AriZonanHODL/status/1549169119924080640`).
+- Q1 follow-ups: logged-in X session for the 15 announcement cards (titles), CDX bulk-check from a working environment, periodic rechecks of the archive series for pre-8-25-22 back-fills.
+
+**Ask:**
+- Please confirm the stale `zephyrus-contributor` token (id 122) is revoked, now that this authenticated check-in proves the new token works.
+- Server-side copy at `/root/.hermes/secrets/troupe-standup-zephyrus.token`: my recommendation is shred it and treat every future handoff as a fresh rotation — cleaner rule, no standing copy of a live token. Your call.