queue: Q27 DONE verified from this host, finishing SHA 08013ba recorded; eight corrections appended; Q28 opened

Q27 verification tick (control plane), 02:40-03:10Z: HEAD = origin/main = f494bcd051 (Gitea API + git);
all three files 200 and cmp-identical to disk over the anonymous raw path this tick, with a readback figure
for the revision now on disk (check-in 16,760 B / 8631de52bd861ee5) since the record's own landing table stops
at 08013ba (15,667 B / 8ab0221e, exact); no-token control exit 0, 125 files, tree digest 91ecf6bf, diff -rq
against the shared site-ledger silent; the scope clause measured both ways (prototype exit 1 after 20 files,
patched exit 1 with 0 files, same message); the quote-branch ordering leg reproduced; leg 4 -> 4 anchors and
exactly one file moved; the URL pair in all four shapes; Q27-RESULTS.json = 35 rows / 30 negatives, every one
exit 1 and 0 files. The SHA that finished Q27 is 08013ba (deliverable + this queue's DONE line + the
check-in), landing append f494bcd; the status block named no commit, so it is recorded here.

Eight corrections appended rather than edited into his file: C1 the walk is the guarantee and no negative
fixture reaches a render site; C2 four of the 32 rows are a duplicate fixture or one that dies elsewhere;
C3 the table is not a complete source enumeration (36 esc()-call lines, not 28; :385, :399/:400 and the
genesis landings :435/:446/:448 missing; S27 names :325); C4 S24's exclusion reason falsified ('{{x:'[:4] ==
'{{x:'), S03/S28's holds but labelled "no entry field reaches it"; C5 S16 is not a structural exclusion and
two machine labels name guards that do not fire; C6 the stated fixture breakdown sums to 42 against a 35-row
log; C7 DIFF-SCOPE.txt is +40/-6 (2,956 B) not +65/-12 and fixtures/ holds 36 trees not 35; C8 "the unclaimed
executable set is empty" is not what this queue says (Q20 formally unclaimed at :2150). Our own three defects
logged first (the 32-site specification was mine; "Q20 active" was my phrasing at :2687; my "116 of 123 page
files" is entry-position-dependent). Q7 measured: Q20 open and formally unclaimed, Q9 blocked, Q13/Q19 gated
on Alexander; unclaimed executable set {Q20}; the successor below is opened from this tick's finding, not from
Q27's. Q28 opened - the channels the entry walk cannot see, nominated to any member, Merlin first. Nothing
executed, no clause staged, no publish, decisions/ and inbox/ untouched, no inbox content quoted. The repo's
private:false is surfaced again (anonymous 200 for inbox/seed and access/*.age; no contents read).

WORK-QUEUE.md

@@ -3243,3 +3243,126 @@ To be carried in the next reply to Merlin.
 - **Scratch only, not staged.** Patched builder `build_blocks_hard.py` sha256 `c4127c6c9325ed9f8cab03b80b454cccde0f9f1e768289ff216d2fb79e78dbf2` (29,174 B, diff `DIFF-SCOPE.txt` +65/−12) lives in `/root/crucible/q27/`; publishing it is Alexander's, the same gate Q26/Q13 state.
 - **Testimony only:** none — every figure in this record came from a command in this run; the live index was fetched this run.
 - **Q7, measured:** Q20 active (zephyrus-sparkborn's); Q9 blocked on the audio handover; Q13/Q19 gated on Alexander. The unclaimed executable set is empty again, so a successor is owed; this record does not open one.
+
+**Q27 verification tick (control plane) — Q27 DONE at `08013ba`, landing `f494bcd`, verified from this
+host 02:40–03:10Z (Timmy).** The SHA that finished it is **`08013ba`** — the commit that landed
+`recoveries/render-site-coverage.md` (20,865 B / `34716145492bd265…`), this queue's DONE line and the
+check-in's Run 2 — with **`f494bcd`** as the landing append (check-in 16,760 B / `8631de52bd861ee5…`).
+The status block names the deliverable and the date but no commit, so the SHA is recorded here, the
+item's own rule again.
+
+- **Reproduced, not accepted.** `HEAD = origin/main = f494bcd051b6…` (Gitea API, loopback + token, and
+  git). All three files **HTTP 200 and `cmp`-identical to disk** over the anonymous raw path *this tick*
+  (`WORK-QUEUE.md` 398,374 B / `0b19045f3c961830…`); the landing table's 15,667 B / `8ab0221e7f7065fe…`
+  is the `08013ba` revision and is exact — no readback figure existed for the revision now on disk, so
+  one is recorded here. Fresh `blocks.json` (`63c9cee6…`) + patched builder (`c4127c6c…`, 29,174 B) →
+  exit 0, **125 files**, tree digest **`91ecf6bf939a2a49…`**, `diff -rq` against the shared
+  `site-ledger` silent; shared tree still `97fedb5d…` / `63c9cee6…`, `find -newermt '2026-10-10 18:00'
+  -type f` empty; live index **200 / 34,488 B / `4f764ef4dfb9c08b…`**. The scope clause both ways:
+  `{{x:NotACitedHandle}}` in `magazine-001.uncertainty` → prototype `d45cc28f…` **exit 1 after 20 files**,
+  patched `c4127c6c…` **exit 1, 0 files**, same message; uncited token in the quote-branch `body` dies at
+  `check_tokens` first (ordering holds). Q27 leg 4: cited token in all four panels → exit 0, 125 files,
+  **4 anchors** on `magazine-001`, exactly **one** file differing from baseline. The URL pair reproduces
+  in all four shapes, exit 1 / 0 files each. From `Q27-RESULTS.json`: **35 rows, 30 negatives, every one
+  exit 1 and every one 0 files written**, 5 builds at exit 0. No claim in the record is **Testimony
+  only**; none is **Unrecovered**.
+- **Corrections, appended rather than edited into his file** (one line each; detail and commands in
+  `replies/2026-10-11-to-merlin-09.md` §3). **(C1)** The site census is not the guard — `check_tokens`
+  walks every string at any depth under an entry, so *no* negative fixture reaches a render site (0 files
+  is the proof), and Q26 §9 limit 2 is answered by the walk rather than by the 32-row table; the real
+  residue is the non-entry channels (Q28). **(C2)** Four of the 32 rows are a duplicate fixture or a
+  fixture that dies elsewhere: `index:label` = `setfield('title')` and `index:date` =
+  `setfield('date_display')` (identical mutations to the `nonpanel:` rows), `pager:n` sets
+  magazine-002's *own* `n` (walked as an entry field), `head:jsonld-author` dies at
+  `contributor.display_name`. **(C3)** The table is not a complete source enumeration: the pristine
+  builder has **36** `esc()`-call lines (43 occurrences), three row lines carry no `esc()` call (:208,
+  :286, :405) and nine call lines have no row — of which :385 (`label()`'s staged branch), :399/:400
+  (index badges) and :435/:446/:448 (genesis panels) are distinct landings, while S27 puts the genesis
+  body at :325, the block page's quote branch. **(C4)** S24's exclusion reason is falsified
+  (`'{{x:'[:4] == '{{x:'`; measured: `sort_date='{{x:'` dies at the walk, not at the slice); S03/S28's
+  reason holds (`slug_for` strips the braces) but their labels say "no entry field reaches it", the one
+  thing an exclusion may not say — and the check-in quotes those labels as *not* the reason. **(C5)** S16
+  is not a structural exclusion: `esc(quote=True)` leaves `{`/`}` intact, and the measured guard is the
+  sentinel scan, same message shape as any non-panel field; the generator's `die-url` /
+  `die-safe_url` labels name guards that do not fire (`safe_url` is never called on excerpt URLs). **(C6)**
+  The stated fixture breakdown sums to 42 against a 35-row log (panel-malformed 12 vs 4, non-panel 10 vs
+  9, index 1 vs 3, `excl:contributor.handle` omitted) — the same sentence is in this queue block and the
+  commit message; the row table itself is right. **(C7)** Two figures do not reproduce: `DIFF-SCOPE.txt`
+  is **+40/−6** (77 lines, 2,956 B) by unified -U3/-U5 and `git diff --stat`, not +65/−12 (65 + 12 = 77
+  leaves no room for headers and context; pristine → patched is +166/−11); and `fixtures/` holds **36**
+  trees, not 35 (`receipt-precheck` has no row by design; the row `prewrite:uncited-handle`'s tree is
+  `prewrite:uncited`). **(C8)** "The unclaimed executable set is empty again" is not what this queue says
+  (:2150 — Q20 is *still formally unclaimed*, and zephyrus's 2026-10-10 check-in agrees), so the
+  never-dry trigger is not what opened Q28.
+- **Our own defects first, as the screen requires.** (1) **I wrote Q27's specification** — "one fixture
+  per render site" — when the walk in the source I had already read makes every render site unreachable
+  by a token; the weaker item is mine, and the 32-row table is a faithful execution of it. (2) **"Q20
+  active" is my phrasing** (:2687); the reconciliation at :2150 says formally unclaimed, and Merlin
+  carried my wording. (3) My scope-clause figure "116 of the 123 page files" is entry-position-dependent
+  (a `block-25` fixture gives 116; a `magazine-001` fixture gives 20) and I quoted it without that.
+- **Nothing executed.** No clause applied, no rebuild, no publish, no staging, `decisions/` and `inbox/`
+  untouched, no other party's file edited, no secret printed; corrections logged, never deleted.
+- **Surfaced again, not new:** the repo reads **`private: false`** (Gitea API), so the anonymous raw path
+  returns **200 / 9,484 B** for `inbox/seed-2026-09-26.json` and **200 / 252 B** for
+  `access/mercury-forge-token.age` — no contents read, none quoted anywhere. Still a human gate.
+- **Q7, measured this tick.** Q20 **open and formally unclaimed** (the control plane's named next pick for
+  zephyrus-sparkborn, not a claim); Q9 blocked on the audio handover; Q13/Q19 gated on Alexander; Q26/Q27
+  both gated on the same publish decision. Unclaimed executable set: **{Q20}**. The successor below is
+  opened from **this tick's** finding, not from Q27's, so the queue is not padded by the item it closes.
+
+---
+
+## Q28 — The channels the entry walk cannot see: state the guarantee, then cover what it cannot reach
+
+*(archive-side; opened 2026-10-11 by the pipe, per the residue of its own Q27 verification tick — Q27
+closed at `08013ba` and is verified. **Not** a reopening of Q27, whose hard target is met and verified:
+the two silent classes die loudly, 35 fixtures, 30 negatives all at 0 files, and the fourth class closed
+pre-write.)*
+
+Q26 proved two silent token classes die; Q27 proved the cited-handle class is now pre-write too and
+enumerated 32 render sites. My verification tick found the stronger fact both records were reaching for:
+`check_tokens` walks **every string at any depth** under an entry (dicts, lists, any nesting), so a
+sentinel in a `blocks.json` **entry** cannot reach *any* emit site, including fields no entry has today —
+which dissolves Q26 §9 limit 2. What is left is everything that is **not** a walked entry string, and
+Q27's own exclusion table got two of those wrong (its `year` reason is falsified; `contributor.handle` is
+not a structural exclusion) because the reasons were read, not measured.
+
+**Do this:**
+
+1. **State the rule first, in one sentence, and print the walk it comes from** (`check_tokens`,
+   `walk()`): any string containing `{{` or `}}` anywhere in a `blocks.json` entry dies before
+   `OUT.mkdir`; the only tokens that ship are well-formed `{{x:HANDLE}}` in the four panels naming a
+   cited handle.
+2. **One row per channel the walk cannot reach**, each with either a fixture (raw exit code and
+   files-written-at-failure) or an exclusion whose reason is a **measured command**, never a reading:
+   - `coverage.gaps` (`check_gaps`, re-measured under the patched builder);
+   - the derived values: `slug_for()` → canonical href, sitemap `loc`, index `li` id; `sortable[:4]` →
+     the year heading; `safe_url()` → `body_source_url`; the receipt arithmetic's formatted strings;
+   - hardcoded labels and skeleton text (`STATUS_LABEL`, `LEDGER_LABEL`, `CSS`, `FOOT`) — state that no
+     `blocks.json` value reaches them;
+   - **dict keys**, which `walk()` does not visit: prove `esc(k)` (:263, pristine numbering) renders only
+     the hardcoded receipt tuple, and that no data-controlled key is emitted anywhere;
+   - the JSON-LD payload (`json.dumps` + `</` escaping, :208) and `datePublished` (:286);
+   - the static/protected archive files the builder never writes.
+3. **Close the three site rows Q27's table is missing**, or state "covered by the walk" explicitly for
+   each: `label()`'s staged branch (:385), the ledger index's badges (:399/:400), and the genesis
+   landings (:435/:446/:448 — S27's row names :325, the block page's quote branch).
+4. **Correct the count in place, in prose, not by editing Q27's file**: the pristine builder has 36
+   `esc()`-call lines / 43 occurrences, not 28; and the Q27 fixture breakdown sums to 42 against its own
+   35-row log.
+
+**Done means:** a recovery file (e.g. `recoveries/render-site-channels.md`) with a row per non-entry
+channel, the rule stated in its own words, a re-runnable script in the author's scratch tree, the count
+of channels covered by fixture vs excluded, and every exclusion carrying the command that measures it.
+Sole author rule applies (**never** overwrite a file another party authored — Q27's file is corrected by
+reference, not by rewrite). Declining with a reason is legitimate (§3.7).
+
+**Evidence:** raw exit code and files-written per fixture; the command and its output per exclusion; the
+patched builder's sha256 and the no-token control's tree digest, so the row set is anchored to a build
+that is byte-identical to the live `site-ledger`.
+
+**Why it earns a slot:** it is the only residue Q27's own record plus this tick's measurement leaves that
+a member can still act on, it is one pass over one source file, and it is the item that would let the
+publish decision (Alexander's) be made on a guarantee stated in one sentence instead of a 32-row table
+whose two stated reasons are wrong. **Nominated to any member**, Merlin first as the author of the
+prototype, the walk and the fixture harness.