diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index 5cd608c..f92c133 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -3494,3 +3494,59 @@ byte-identical to the live `site-ledger` at `91ecf6bf`.**
   `"<b>hi<\/b> & \"q\""`; `date='</script><b>x'` → `datePublished` `"<\/script><b>x"`, 0 raw
   `</script><b>`; `display_name='A & B <x> "y"'` → HTML escaped, JSON-LD raw `<x>` inside the payload.
   Raw material for Q29 below.
+
+---
+
+## Q29 — The guards that are not the walk: what protects a page when the value is not a token
+
+*(archive-side; opened 2026-10-11 by the pipe on the residue of its own Q28 verification tick — Q28 closed
+at `7ce4ea0` and is verified. **Not** a reopening: Q28's target, the one-sentence guarantee over walked
+entry strings, is met and verified, and its 20 channels are reproduced row for row in the tick above.)*
+
+Q28 accounted for every channel the walk cannot **reach**. Nothing yet accounts for the mechanism that
+guards the channels the walk does not **scan**: `esc()` on the HTML side and `json.dumps` plus the `</`
+replacement (`build_blocks.py:362`, pristine numbering) on the JSON-LD payload side. The gap is measured,
+not asserted: three of Q27's 32 rows carry **no** `esc()` call at all (`:208` the payload `json.dumps`,
+`:286` `ld["datePublished"] = b["date"]`, `:405` where the call is at `:406`), and across Q26, Q27 and Q28
+**no fixture has ever placed a non-token metacharacter in a field** — `<`, `&`, `"`, `'`, `</script>`,
+`<!--` — so escaping is the one guard in this builder with zero coverage. My three probes this tick
+(`/root/troupe-verify/esc-probe/`, the patched builder, one mutated `blocks.json` each) are raw material,
+not the item: `title = '<b>hi</b> & "q"'` → exit 0, HTML `&lt;b&gt;hi&lt;/b&gt; &amp; &quot;q&quot;`, JSON-LD
+`headline` `"<b>hi<\/b> & \"q\""`; `date = '</script><b>x'` → exit 0, `datePublished` `"<\/script><b>x"`,
+0 raw `</script><b>` in the page; `display_name = 'A & B <x> "y"'` → exit 0, HTML escaped, JSON-LD
+`author.name` raw `<x>` inside the payload (safe, because `</` is the only sequence that terminates the
+element and it is escaped).
+
+**Do this:**
+
+1. **State the second guarantee in one sentence**, symmetric to Q28's: which mechanism guards which emit
+   path when the value carries no token, and why that mechanism is sufficient **for that context**
+   (HTML text, HTML attribute, JSON-LD script data, URL).
+2. **One fixture per mechanism**, each with the raw exit code and the bytes actually emitted: HTML text
+   and attribute contexts (`<`, `&`, `"`, `'` in `title`, `date`, `display_name`, `body_provenance`, an
+   excerpt's `text`); the JSON-LD payload (the four sequences that can end or confuse script data — `</`,
+   `<!--`, `<script`, a bare `<`); a URL field (`safe_url`'s scheme check plus `esc()` in the attribute);
+   the sitemap; the manifest.
+3. **Prove or falsify each sequence against the emitted byte, not the intent:** `</script>` in each of
+   `title`, `date`, `display_name`, `plain_summary.text`; `<!--`; a lone `"` in an attribute-rendered
+   field; `&` in each context.
+4. **Say where no mechanism is needed, with a measured reason** — Q28's E5/E6/E7 already measure output
+   rather than reachability, and the same standard applies here: CSS/FOOT literals, `blocks-build.json`,
+   and the receipt arithmetic's formatted strings.
+
+**Done means:** a recovery file (e.g. `recoveries/render-site-guards.md`) with one row per mechanism, the
+second guarantee in the author's own words, re-runnable scripts in the author's scratch tree, and every
+"safe" claim carrying the emitted byte or the command that produced it. The Q28 release valve applies:
+an exclusion is legitimate only with a reason that is a measurement. Sole author rule applies (**never**
+overwrite a file another party authored); declining with a reason is legitimate (§3.7).
+
+**Evidence:** raw exit codes and files-written per fixture; the emitted HTML and JSON-LD lines; the control
+build unchanged at tree digest `91ecf6bf…` with 125 files; the patched builder's sha256; the shared tree's
+`blocks.json` (`63c9cee6…`) read-only throughout.
+
+**Why it earns a slot:** the publish decision (Alexander's) now rests on a guarantee about tokens; this is
+the guarantee about **everything else** — the values that carry no token at all — and escaping is the only
+guard in the builder with no fixture behind it. It is one pass over one source file, it is the complement
+of Q28 rather than a re-run, and it does **not** gate the decision: it is opened on a measurement, not on a
+suspicion, and nothing found so far is wrong. **Nominated to any member**, Merlin first as the author of
+the harness and of the patched builder.