# Q26 — Harden the prose-anchor convention: the two silent token classes die loudly

**Status: DONE — hardened prototype built, all five Q25 legs re-run green, two negative
test sets (7 malformed tokens, 5 outside-panel sentinels) each dying with its own
message, the `contributor.display_name` fifth slot measured without building it.**
Merlin, 2026-10-11 ~00:20–00:24 UTC. Scratch tree `/root/crucible/q26/`, every artifact
re-runnable from the scripts named in §9. **Nothing published, nothing applied to the
shared build tree; `blocks.json` was read-only throughout.**

---

## 0. Reading rule (unchanged from Q25, restated so the population is re-derivable)

- **Prose panels** = the fields `render_entry` emits as the archive's own prose and routes
  through `expand_prose`: `body` **where `body_kind == "summary"`**, `plain_summary.text`,
  `body_provenance`, `uncertainty`. The `body_kind == "quote"` branch renders `body`
  through `esc()` inside a blockquote — third-party quoted text, **not a panel**.
- **Token sentinel** = any occurrence of the literal `{{` or `}}` anywhere in an entry.
- **Malformed token** = a `{{x:...}}` in a panel that `TOKEN_RE`
  (`\{\{x:([A-Za-z0-9_]{1,15})\}\}`) does not match.
- **Cited handle (validator registry)** = every `contributor.handle` value plus the first
  path segment of any `https://x.com/…` or `https://twitter.com/…` URL anywhere in
  `blocks.json`, minus reserved account paths.

## 1. What was hardened, and why

Q25 left two classes failing silently, both reproduced in the control plane's 2026-10-10
verification of Q25:

1. **A malformed token passes the build and prints raw braces.** `expand_prose` returns
   `esc(text)` unless the text contains the literal `{{x:`, and the validator only ever
   inspects what `TOKEN_RE` matched. So `{{x:saylor}`, `{{x:}}`, `{{ x:saylor }}`,
   `{{y:saylor}}` and a 16+ character handle all emitted `Built 123 pages from 121
   entries`, exit 0, with the literal on the page.
2. **A token outside the four panels prints literally** — the quote branch (Q25's own
   limit 3), a `title`, an `excerpts[].text`, a `contributor` field, an index
   `coverage.gaps` string. Q25's validator could not see any of these.

The fix is a **pre-write scan**, `check_tokens(b, slug)` plus `check_gaps(data)`, run for
every entry **before a single byte is written** (the scan sits above the `OUT` cleanup in
`build()`, so a `die()` can never leave a half-emitted tree — the Q25 prototype's scan
point would have):

- any `{{` or `}}` in a field the panels do not render → `die`;
- any sentinel left in a panel after `TOKEN_RE.sub("", obj)` → `die`;
- the panel set is computed **per entry**: `body` is a panel only when
  `body_kind == "summary"`, so the quote branch is caught by construction rather than by
  a special case.

Two further changes ride along, both byte-neutral with no token present:

- `render_genesis` now routes `body_provenance` and `uncertainty` through `expand_prose`
  instead of `esc()`. The genesis page previously could not expand a token those panels
  carried even though `block-5`'s own page did — a third silent class, found while
  writing the positive control, not in Q25's list.
- `coverage.gaps` strings are checked (the index renders them through `esc()`).

## 2. The diff

`/root/crucible/q26/DIFF.txt` — `diff -u build_blocks_proto.py build_blocks_hard.py`:
**+70 / −6 lines, 5,817 B.** `DIFF-PRISTINE.txt` — against the shared tree's
`build_blocks.py` (sha256 `97fedb5dd5e85d2b10071e8e4904b3a9b1573072149e722fbece93eaf0774672`):
**+118 / −11 lines, 9,949 B.**

The hardened prototype is `build_blocks_hard.py`, **27,878 B / sha256
`d45cc28f7d69afcdab4eccb16e9e0cc264e4317e059e17f1ba53eb23f792cb60`** (this host,
2026-10-11T00:22Z). The Q25 prototype, copied unchanged into this tree, verified
byte-identical first: sha256 `5af80b78961b4f55ca1ac436c19074d275b9a255569de07156a527de39d8de35`.

## 3. The five Q25 legs, re-run on the hardened prototype (`Q26-VERIFY.txt`)

**Leg 1 — no-token build is byte-identical.** Unmodified `blocks.json` (278,459 B /
sha256 `63c9cee6103a6824c90c71440fa983d2f5592e380f9c3fb40f7ad366ae41723d`, unchanged from
Q25's record):

```
$ python3 build_blocks_hard.py
Built 123 pages from 121 entries (121 cleared, 0 research-only)
tree digest: 91ecf6bf939a2a499983066a2331bb953eab8a4ca85c66a8a19f42cb1b28f7a8
baseline   : 91ecf6bf939a2a499983066a2331bb953eab8a4ca85c66a8a19f42cb1b28f7a8
125 files; BYTE-IDENTICAL to baseline
$ diff -rq <scratch>/site-ledger /root/stackchain-legends-build/site-ledger
(no output — live tree identical)
```

**Leg 2 — the registry is unchanged: 8 handles.**
`@anthonydessauer @arizonanhodl @guiamadogomes @happyclowntime @rockachopa @satskeeper_
@saylor @yoshishisatoshi` (`REGISTRY.txt`, identical to Q25's).

**Leg 3 — the uncited-handle negative test still fails closed**, same message:

```
$ cd negtest && python3 build_blocks_hard.py     # {{x:NotACitedHandle}} in uncertainty
exit 1
BUILD FAILED: block-25:uncertainty: prose-anchor token names handle @NotACitedHandle which no entry cites
```

**Leg 4 — the token demo is unchanged: 6 deltas (H1–H4 as tokens) → 3 of 125 emitted
files.**

```
$ cd tokentest && python3 build_blocks_hard.py
exit 0  Built 123 pages from 121 entries (121 cleared, 0 research-only)
emitted files: 125 -> 125; changed: 3
  event-2022-07-18-the-5-invitation-becomes-a-chain/index.html
  magazine-002/index.html
  magazine-005/index.html
emitted: event-2022-07-18…  https://x.com/AriZonanHODL  @AriZonanHODL   (x2: body + plain English)
emitted: event-2022-07-18…  https://x.com/satskeeper_  @satskeeper_    (x2)
emitted: magazine-002       https://x.com/AriZonanHODL  @AriZonanHODL
emitted: magazine-005       https://x.com/AriZonanHODL  @AriZonanHODL
```

**Leg 5 — the diff itself** (§2). All five legs: **green**.

## 4. The malformed-token set — 7 fixtures, each in its own tree, each `exit 1`

Each fixture appends one token to `block-25`'s `uncertainty` (a panel rendered on every
entry). Raw stderr in `MALFORMED.txt`:

| fixture | token | exit | first stderr line |
|---|---|---|---|
| open brace | `{{x:saylor}` | 1 | `BUILD FAILED: block-25:uncertainty: malformed prose-anchor token — sentinel {{ left after token expansion; tokens must read exactly {{x:HANDLE}} with a 1-15 character handle` |
| empty handle | `{{x:}}` | 1 | same, sentinel `{{` |
| whitespace padded | `{{ x:saylor }}` | 1 | same, sentinel `{{` |
| wrong namespace | `{{y:saylor}}` | 1 | same, sentinel `{{` |
| handle over 15 chars | `{{x:abcdefghijklmnopq}}` | 1 | same, sentinel `{{` |
| lone close brace | `}}` | 1 | same, sentinel `}}` |
| close then open | `}}{{x:saylor}}` | 1 | same, sentinel `}}` |

All seven now die. Under the Q25 prototype all seven built and shipped the literal.

## 5. The outside-panel sentinel set — 5 fixtures, each `exit 1`

Each places a **valid** `{{x:saylor}}` where no panel renders it (`OUTSIDE-PANEL.txt`):

| fixture | field | exit | message |
|---|---|---|---|
| quote branch | `block-6:body` (`body_kind: quote`) | 1 | `token sentinel {{ in a field that is not a prose panel (panels: body_provenance, plain_summary.text, uncertainty)` |
| title | `magazine-001:title` | 1 | `… (panels: body, body_provenance, plain_summary.text, uncertainty)` |
| excerpt text | `magazine-001:excerpts[0].text` | 1 | same |
| contributor display_name | `magazine-035:contributor.display_name` | 1 | same |
| index coverage gap | `coverage.gaps[4]` | 1 | same |

Note the quote-branch message prints the panel set **without `body`** — the per-entry
`body_kind` rule, visible in the error itself. This fixture is the one Q25's limit 3
named; it was the only silent class that survived the first pass of the hardening and
the reason the panel set is computed per entry.

## 6. Positive control — a cited token expands on the entry page *and* the genesis page

`{{x:AriZonanHODL}}` appended to `block-5`'s `body_provenance` (`positive/`):

```
$ cd positive && python3 build_blocks_hard.py
exit 0  Built 123 pages from 121 entries (121 cleared, 0 research-only)
block-5 page anchors: https://x.com/AriZonanHODL -> @AriZonanHODL  (x2: panel + contributor slot)
genesis page anchors: https://x.com/AriZonanHODL -> @AriZonanHODL
changed files: 2  [block-5/index.html, genesis/index.html]
```

The genesis-page anchor is the §1 wiring change proven: without it the same token would
have expanded on `block-5` and printed raw braces on `genesis/`. A negative test with no
positive control proves nothing, so both are recorded.

## 7. The `contributor.display_name` fifth slot, measured without building it

Measured from `blocks.json` and from this run's scratch build (byte-identical to the live
`site-ledger`), per entry, with Q24's staged delta applied in its own scratch tree
(`DISPLAY-NAME-MEASURE.txt`):

| entry | Q24 clause | `display_name` today | `handle` today | live page today | after Q24's delta | named accounts in registry |
|---|---|---|---|---|---|---|
| magazine-035 | G1 | `@BTC_Freeborn and @AnthonyDessauer` | `null` | `@BTC_Freeborn and @AnthonyDessauer` — anchors: NONE | `BTC_Freeborn and Anthony Dessauer (@BTC_Freeborn)` — anchor `x.com/BTC_Freeborn`; sha256 `871638b8…` → `565e6f68…` | `@BTC_Freeborn` no; `@AnthonyDessauer` **yes** |
| magazine-056 | G2 | `Red Tail Hawk (@RedTailHawk1923)` | `null` | text only — anchors: NONE | `Red Tail Hawk (@RedTailHawk1923)` — anchor `x.com/RedTailHawk1923`; sha256 `33b55f8f…` → `8094e862…` | `@RedTailHawk1923` no |
| magazine-070 | I2 | `@MidyReyes` | `null` | text only — anchors: NONE | `MidyReyes (@MidyReyes)` — anchor `x.com/MidyReyes`; sha256 `6227e199…` → `c994e055…` | `@MidyReyes` no |

All three live-page digests reproduce Q24's fix-pack figures to the nibble
(`871638b8abb5…`, `33b55f8f61fe…`, `6227e199522f…`), so the live tree is still the tree
Q24 measured. **Recommendation, per entry:**

- **magazine-056 (G2), magazine-070 (I2): the handle-only fix is the right instrument
  and it is complete.** One account named, one `handle` slot; the build already anchors
  `contributor.handle` (line 310), and the delta is what admits the handle into the
  registry. The convention cannot help — `display_name` is not a panel, and §5 proves a
  token there now dies at build time.
- **magazine-035 (G1): handle-only anchors `@BTC_Freeborn` and leaves
  `@AnthonyDessauer` unanchored**, because `contributor` has exactly one `handle` slot
  while the byline names two accounts — and `@AnthonyDessauer` *is* in the registry, so
  a token for it would be admitted today. A wording-only fix (strip both `@`s, as
  Q24 stages) loses the link on both. **The only instrument that anchors both is
  `display_name` as a fifth panel** carrying `{{x:AnthonyDessauer}}` beside the handle
  slot — a build change, which is Alexander's, not a wizard's.

**Which of Q24's deltas the hardened convention can carry as links: H1–H4 only — 4 of
the 31.** The hardening changes no clause's carrier; it makes the four token carriers
safe to publish. Everything else is a structured field the build already anchors, a note
where the handle is uncited or dead, or a wording call.

## 8. Findings

1. **The first hardening pass missed the quote branch, and the error message now shows
   why it had to.** A path-based panel set ("`body` is a panel") admits a token in a
   quote-kind entry's `body`, where `render_entry` renders it through `esc()`. The panel
   set is per entry and depends on `body_kind`; the quote-branch error prints the
   reduced set, so the rule is visible in the failure.
2. **The genesis page was a third silent class, not in Q25's list.** `render_genesis`
   routed `body_provenance` and `uncertainty` through `esc()`, so a token those panels
   carry would expand on the entry's own page and print literally on `genesis/`.
   Routing them through `expand_prose` is byte-neutral with no token present (proved by
   §3 leg 1) and closes the class.
3. **The scan must run before the output tree is touched.** A `die()` inside the write
   loop leaves a half-emitted `site-ledger` behind, which on a shared tree is exactly
   the state a reader cannot distinguish from a partial publish. The checks now sit
   above the `OUT` cleanup.
4. **A negative test without a positive control proves nothing** — Q25's own incident
   note. Leg 6 carries both: a cited token builds, expands, and moves exactly the two
   files it should.
5. **The registry is the binding constraint, unchanged.** 8 handles of the 23 the census
   found printed in prose; the hardening widens nothing, it only makes the four
   carriers safe.
6. **`{{`/`}}` still collide with nothing in `blocks.json`** (0 occurrences), so the
   sentinel scan is silent on today's data — the no-token build proves it.

## 9. Limits

1. **Prototype only.** `build_blocks_hard.py` lives at `/root/crucible/q26/` and was
   never copied into the shared build tree. Verified at close: the shared tree's
   `build_blocks.py` is still sha256
   `97fedb5dd5e85d2b10071e8e4904b3a9b1573072149e722fbece93eaf0774672`, its
   `site-ledger` byte-identical to this run's scratch build (125 files each,
   `diff -rq` silent), and `find /root/stackchain-legends-build -newermt 2026-10-10
   18:00 -type f` returns nothing. The live archive is unchanged: index
   `https://alexanderwhitestone.com/stackchain/blocks/` **200 / 34,488 B / sha256
   `4f764ef4dfb9c08b2654ff0783550d20ad1bb7a31cb0c32070974a5fe451557e`** at
   2026-10-11T00:23:25Z. Publishing a build change is Alexander's, as Q13 states.
2. **7 + 5 fixtures are the test set, not a census of typos.** The malformed set is the
   item's own list plus a lone `}}` and a close-then-open; the outside-panel set is one
   fixture per field class. A sentinel in a field no entry has today cannot be
   enumerated from today's data.
3. **`display_name` was measured, not built.** No fifth panel was implemented; the
   recommendation is a decision input, not a staged change.
4. **Nothing re-tests Q25's census.** The 46-row population, the 25 X fetches and their
   liveness verdicts are Q25's, cited not re-run.
5. **X byte sizes are dated readings** (per-request CSP nonce); none is load-bearing
   here — no X page was fetched this run.

## 10. Scripts (all re-runnable, `/root/crucible/q26/`)

`verify26.py` (all eight legs) · `display_name.py` (the fifth-slot measurement) ·
`clean.py` (scratch reset) · `build_blocks_hard.py` (the hardened prototype) ·
`build_blocks_proto.py`, `build_blocks.py`, `blocks.json` (inputs, unmodified).

Artifacts: `DIFF.txt` (+70/−6 vs the Q25 prototype) · `DIFF-PRISTINE.txt` (+118/−11 vs
the shared build script) · `NOTOKEN-BUILD.txt` (digest `91ecf6bf…`, 125 files, live-tree
diff silent) · `REGISTRY.txt` (8) · `NEGTEST.txt` (exit 1) · `TOKEN-DIFF.txt`,
`TOKEN-PAGES.txt` (3 of 125 files, 6 emitted anchors) · `MALFORMED.txt` (7 fixtures) ·
`OUTSIDE-PANEL.txt` (5 fixtures) · `POSITIVE.txt` (2 changed files) ·
`DISPLAY-NAME-MEASURE.txt` · `Q26-VERIFY.txt` / `Q26-VERIFY-run.txt` (full run log) ·
scratch trees `negtest/`, `tokentest/`, `positive/`, `mal-*/`, `out-*/`, `dn-*/`.