fix: a wrong-shaped answer no longer 500s the gallery and the marks page

Pre-existing, measured at 42ea67f, so it predates U3. `_hydrate` checked only
that `answer` was a dict and never that `answer["answers"]` was one, so
`marks_for` and `hold_read` both reported the mark healthy with no read error
-- and `_ask_inline.html` then asked a list for `.get`. The v0.2.2 lesson was
half-implemented: that outage was a file that could not be PARSED and the
reader was made lenient, while this one parses perfectly and breaks one layer
further in, at render, where no leniency existed.

Closed at the hydration boundary rather than by a third copy of the guard --
one predicate, one place, every surface inherits it. Only the multi case is
checked, because only the multi case indexes; requiring `answers`
unconditionally would break every single-question pick, and that direction has
its own test. Measured before and after: gallery and marks pages 500 -> 200,
the error visible on the page, the booth's other healthy pick untouched.

The placement was the one open operator question of the session. It was
surfaced three times without a ruling, so it is taken under a stated assumption
and is cheap to move: the whole fix is one condition in one function.

Two things fell out of it worth more than the fix.

`_safe_fragments` no longer has a reachable natural trigger. Probed every wrong
answer shape a .marks.json can carry: `answers` as a list, a string or null all
become hydration errors now, and a wrong-typed value INSIDE `answers` renders
without raising, because Jinja absorbs attribute access on a non-mapping. U3's
guard is a pure backstop, and its test now says so and trips it synthetically
through the shared macro module rather than asserting a path nothing reaches.
A guard tested by an unreachable input is an untested guard.

And that guard's handler could not survive the failure it was handling: it
caught a raising `_pick_fragments` and rebuilt the broken-ask box through the
SAME macro module that had just raised, so whenever `whole` was the broken
thing it re-raised and took the whole report. Found by accident while building
the falsifier. Fixed, with its own test.

Both new falsifiers were verified RED against their defeating change rather
than assumed.

607 -> 611 tests.

persistent-memory.md

@@ -36,12 +36,15 @@ _As of 2026-09-22:_
   is `miranda-is` at 92 items. Two of 19 booths have subfolders and both are
   reports. Sections buy close to nothing; the rail, filters and grid keyboard
   are the unit.
-- ⚠ **ONE DEFECT IS OPEN, AND THE OPERATOR HAS NOW BEEN ASKED TWICE.** A
-  `.marks.json` that is well-formed JSON with a wrong-shaped `answer` 500s **the
-  gallery page and the marks page**. Predates U3 (measured at `42ea67f`). No
-  issue, no tracking surface — untracked by operator choice. Session
-  recommendation is `_hydrate` (one predicate, one place, every surface
-  inherits it). Read
+- **THE LAST OPEN DEFECT IS CLOSED.** The wrong-shaped `answer` that 500'd the
+  gallery and marks pages (pre-existing, measured at `42ea67f`) is fixed at
+  `_hydrate` — the placement the session recommended three times and the
+  operator never ruled on, **taken under a stated assumption and cheap to move**
+  (one condition in one function) if he disagrees. Measured before/after: both
+  pages 500 → 200, error visible, the booth's other pick untouched. Two things
+  fell out of it that matter more than the fix — U3's `_safe_fragments` lost its
+  natural trigger and is now a synthetically-falsified backstop, and that guard's
+  own handler could not survive the failure it was handling. Read
   `persistent-memory.d/2026-09-22-a-wrong-shaped-answer-500s-the-gallery.md`
   before touching marks rendering anywhere.
 - ⚠ **TWO OPERATOR DECISIONS ARE OUTSTANDING AND BOTH ARE DELIBERATELY NOT
@@ -75,6 +78,7 @@ _As of 2026-09-22:_
 
 ## Recent decisions
 
+- `[2026-09-22]` **The last open defect closed, and building its falsifier found another** — the wrong-shaped answer fixed at `_hydrate`; `_safe_fragments` lost its natural trigger and its handler could not survive the failure it handled → `persistent-memory.d/2026-09-22-a-wrong-shaped-answer-500s-the-gallery.md`
 - `[2026-09-22]` **U6 released as `v0.6.0` — benches, and the number that was two defects** — six of seven v1 units landed, NOT PUSHED → `persistent-memory.d/2026-09-22-u6-benches-released.md`
 - `[2026-09-22]` **Three cold panels on one unit, and what each lens could only see alone** — READ BEFORE DECIDING TO SKIP A GATE; all five passes found something the others structurally could not → `persistent-memory.d/2026-09-22-three-cold-panels-on-one-unit.md`
 - `[2026-09-22]` **U6 landed — three surfaces, three jobs, one predicate** — the seam review caught three real contract defects incl. a per-row `resolve_booth` that would have 404'd the board → `persistent-memory.d/2026-09-22-u6-benches-landed.md`