queue: Q25 verification tick (control plane) - Q25 DONE at a9f23a6 (landing 0c48152) verified from this host 22:2x-22:5xZ, with four corrections appended (finding 1's 19-vs-16 arithmetic, the display_name exclusion reason, the six diff lines, and the demo's 6th delta as H2's missing plain_summary op), our own two errors logged first, and one new finding (a malformed token exits 0 and prints raw braces). Q26 opened: harden the token sentinel so both silent classes die loudly, and measure the contributor.display_name fifth slot. Q7 depth re-measured: executable set was empty, Q26 is its successor; Q20 remains active.

WORK-QUEUE.md

@@ -2906,3 +2906,123 @@ Zephyrus still read *"Q10 batch grading"* (closed 13:30Z; his own 13:27Z Ask ask
 2026-10-07, and his lane has been silent since — three days, which the churn contract says is a decision, not
 silence), and Merlin read 2026-10-08. All three fixed, Zephyrus pointed at **Q20**, and an as-of clock added so
 the table's currency is checkable rather than assumed.
+
+---
+
+**Q25 verification tick (control plane) — Q25 DONE at `a9f23a6`, landing `0c48152`, verified from this host
+22:2x–22:5xZ (Timmy).** The SHA that finished it is **`a9f23a6`** — the commit that landed
+`recoveries/prose-anchor-convention.md`, the Q25 status block and the check-in section — with **`0c48152`** as
+the landing append. The status block names the deliverable and the date but no commit, so the SHA is recorded
+here, the item's own rule again.
+
+- **Reproduced, not accepted.** All three Q25 files byte-identical over the anonymous raw path at `0c48152`
+  (`recoveries/prose-anchor-convention.md` **16,728 B / `f029000f01d13452…`**, `WORK-QUEUE.md` **365,227 B /
+  `ce9a8cafc0c7c1ee…`**, `checkins/2026-10-10-merlin.md` 72,198 B, and at `a9f23a6` **70,077 B / `89515bb8…`**);
+  a pristine build from a fresh copy of `blocks.json` (`63c9cee6…`) → **`Built 123 pages from 121 entries (121
+  cleared, 0 research-only)`**, tree digest **`91ecf6bf939a2a49…`** on both the scratch output and the live
+  `site-ledger`, **125 files each**, `diff -rq` silent; the prototype with **zero tokens** → the same digest;
+  `diff -u` **+63 / −6**, `DIFF.txt` **4,960 B**; registry **8** handles, and **9** with the reserved-path
+  stoplist removed (the extra member is `i`, admitted by a real `https://x.com/i` string in `blocks.json`, so
+  the stoplist is exercised rather than hypothetical); the negative test → **exit 1** with the exact
+  `block-25:uncertainty: prose-anchor token names handle @NotACitedHandle which no entry cites`, plus **our own
+  positive control the deliverable did not claim** (the same field carrying `{{x:saylor}}` builds exit 0 and
+  emits `<a href="https://x.com/saylor">@saylor</a>`); the token demo → **6 deltas, 3 of 125 emitted files**,
+  the emitted anchor byte-equal to the contributor anchor already on `block-7`
+  (`<a href="https://x.com/satskeeper_">@satskeeper_</a>`); the census → **46 rows with the row set identical to
+  `census.json` in both directions**, **23** distinct handles case-insensitively, **5 anchored rows of 46**
+  recomputed from the emitted pages, **4 of 23** in the registry; **all 25 X targets re-fetched here** →
+  **21 `resolve` / 1 `resolve-moved` / 3 `404`** (among the 23 prose handles exactly his 20/1/2, `@captainsiddh`
+  200 / 68,579 B with `Now at @captainsidd` in the fetched body), the three 404s all titled `User Profile Not
+  Found`; **nothing published** — live index **200 / 34,488 B /
+  `4f764ef4dfb9c08b2654ff0783550d20ad1bb7a31cb0c32070974a5fe451557e`**, the three affected live pages
+  byte-identical to the no-token build, `grep -c '{{x:'` **0** on all of them; the scratch-tree condition
+  honoured (**`97fedb5d…`**, `find /root/stackchain-legends-build -newermt '2026-10-10 18:00' -type f` → **0
+  files**); `decisions/2026-09-26.md` still `eb34b4b4d781` and `inbox/seed-2026-09-26.json` still
+  `c05e6a0666d8`.
+- **Four corrections, appended rather than edited into Merlin's text** (detail in
+  `replies/2026-10-10-to-merlin-07.md` §3). (1) Finding 1's *"19 of the 23 prose handles resolve and are not
+  cited"* joins two numbers: **19 are cited nowhere, and 16 of those 19 resolve** (1 `resolve-moved`, 2 `404`);
+  the sentence as printed asserts all 19 live, and the same string is in the queue block and the check-in. (2)
+  The §6 exclusion reason for `@BTC_Freeborn` / `@RedTailHawk1923` is backwards — both entries carry
+  `contributor.handle: null` and print the names inside **`contributor.display_name`**, which the build emits
+  through `esc()` with **no anchor at all** (`magazine-035`/`magazine-056` carry zero `x.com` anchors); those are
+  Q24's **G1/G2** clauses, and `display_name` is a **fifth handle-shaped slot the convention does not cover**.
+  (3) §3's "six removed lines … plus two unchanged context lines" is wrong: the other two are the
+  `render_entry` signature and its call site, changed to thread `cited`. (4) §5/§7's *"Q24's clauses H1–H4
+  staged as tokens (6 deltas)"* — the clauses carry **5** ops; the sixth delta is `plain_summary.text` of
+  `event-2022-07-18…` for `and Satskeeper with $7`, a panel **H1 stages and H2 does not**, so the demo exposed a
+  **missing H2 second op** rather than adding a delta. Nothing was re-staged; the H2b row belongs to the Q13
+  pack's undecided set and stays Alexander's.
+- **Our own defects first, as the screen requires.** This tick's first anchored-already count was **4**, my
+  Python `set` collapsing two rows that share an entry and a token but differ by field; the row-granular count
+  is **5** and matches his flags row-for-row. A case-sensitive first pass read **29** handles; his lowercased
+  **23** is right. And the §6 heading's *"every handle-shaped token"* traces to **my** item text — the rule
+  Merlin implemented cannot enumerate the two names he reports below the table (`Satskeeper`,
+  `StackchainQuant`), which he handled correctly.
+- **One finding of our own, new:** a **malformed token exits 0 and prints raw braces on a live page**. With
+  `{{x:saylor}`, `{{x:}}` and `{{ x:saylor }}` in a `uncertainty` field the prototype builds
+  `Built 123 pages from 121 entries` and the page carries all three literals — the validator only inspects text
+  its own regex matched, so a one-character typo in an approved token ships `{{x:…}}` to readers silently. This
+  extends the deliverable's own limit 3 from the quote branch into the four panels. Graded **Documented**
+  (reproduced here on his prototype). It is Q26.
+- **Both asks answered, neither executed.** (1) *Publish the convention?* — a build change, so **Alexander's**,
+  exactly as Q13 states; this tick records it as a live candidate for his review and recommends it **in the same
+  review as the staged clauses**, because H1–H4 then become links rather than wording edits and `@satskeeper_`
+  can be linked by no other route. (2) *Cite the 19 live names?* — **no bulk citation**: 16 of them are live and
+  uncited, and citing them is content work that changes what the archive claims to hold, so it is a per-name
+  decision for Alexander; the other 3 do not resolve (`@_overflow__`, `@humblebitcoiner` 404, `@captainsiddh`
+  moved) and are wording, already in his mapping. Both halves are recorded as waiting on him, assigned to
+  nobody.
+- **Nothing was executed.** No clause applied, no rebuild, no publish, no third-party contact, nothing in
+  `decisions/` run, no other party's file edited, no secret printed. Corrections logged, not deleted.
+- **Surfaced again, not new, both already on the open-human list:** the repo reads **`private: false`**, so the
+  anonymous raw path returns **200 / 9,484 B** for `inbox/seed-2026-09-26.json` and **200 / 252 B** for
+  `access/mercury-forge-token.age` — pending review material and the four sealed envelopes are world-readable
+  (no inbox content is quoted into any delivery or artifact by this tick); and the collaborator list is now
+  **four write accounts** (`zephyrus-sparkborn`, `cassian`, `merlin`, `mercury`) with `decisions/` still holding
+  no Mercury admission record — §4 is Alexander's.
+
+## Q26 — Make the silent token classes loud, and measure the fifth slot *(archive-side; opened 2026-10-10 by the pipe, per Q7's never-dry obligation — Q25 closed at `a9f23a6` and the unclaimed executable set fell to zero)*
+
+Q25 delivered a convention that fails closed on a token naming an uncited handle, and proved it. This tick
+measured the two ways a token still fails **silently**, and one slot the convention does not cover at all:
+
+1. **A malformed token passes the build and prints raw braces on the page.** Reproduced this tick: `{{x:saylor}`,
+   `{{x:}}`, `{{ x:saylor }}` in a prose field → `Built 123 pages from 121 entries`, all three literals on
+   `block-25`'s page. Cause: `expand_prose` returns `esc(text)` unless the text contains the literal `{{x:`, and
+   the validator only ever inspects what `TOKEN_RE` matched.
+2. **A token in the quote branch prints literally** — the deliverable's own limit 3, which is the same class.
+3. **`contributor.display_name` is not one of the four panels.** `magazine-035`, `magazine-056` and
+   `magazine-070` print `@`-tokens there today with no anchor and `handle: null` (Q24's **G1**, **G2**, **I2**),
+   so "the archive's handle-shaped tokens the build can render" is a larger set than the census's 46 rows.
+
+**Do this:** in a scratch tree under `/root/crucible/`, harden the Q25 prototype so both silent classes die
+loudly — scan every emitted field for the literal `{{`/`}}` sentinel and `die()` on (a) any occurrence outside
+the four panels and (b) any occurrence the token regex does not match — and re-run the five Q25 legs on the
+hardened prototype, adding a malformed-token test set (open brace, empty handle, whitespace-padded, wrong
+namespace, handle longer than 15 characters) beside the uncited-handle negative test. Then **measure, without
+building it**, what covering `contributor.display_name` would mean: for each of the three entries, what the
+display_name prints today, what Q24's G1/G2/I2 stage, and whether the convention, a `handle`-only fix, or a
+wording-only fix is the right instrument — and state which of Q24's 31 deltas the hardened convention can carry
+as links.
+
+**Scope boundary:** scratch tree only, nothing published, no `blocks.json` edit, and `build_blocks.py` in the
+shared build tree must still be at sha256 `97fedb5dd5e85d2b10071e8e4904b3a9b1573072149e722fbece93eaf0774672`
+with its `site-ledger` byte-identical when the item closes. This is **not** a re-run of Q25's census, not Q13's
+approval, and not a wording decision on `display_name` — it is the hardening Q25's limit 3 names plus the
+measurement that makes the fifth slot a decision Alexander can take.
+
+**Done means:** the hardened prototype as a diff against `97fedb5d…`, the five Q25 legs re-run and green, the
+malformed-token test set with its exit codes and messages, a note that the no-token build is still byte-identical
+at `91ecf6bf…`, and the `display_name` measurement with a stated recommendation.
+
+**Evidence:** the diff, the re-run leg outputs, the negative tests (both classes) with exact stderr, the
+before/after tree digests, and the three `display_name` rows read from `blocks.json` and from the built pages.
+
+**Why it earns a slot:** Q25 closed with zero unclaimed executable items, which is Q7's trigger; this is
+directly its next step — the convention cannot be published safely while a typo ships silent braces — and it is
+build work a member can do today with no human in the loop.
+
+**Nominated to Merlin**, who built the prototype and named the class; any member may take it, and declining it
+with a reason remains legitimate (§3.7). `Q20` remains active and zephyrus-sparkborn's.
+