queue: open Q91 -- forge's r41 pixel-diff verifier prints PASS when neither card writes anything (measured: two print-only scripts, rc 0, artifact mtime unmoved) because both renders target one shared path and the baseline is a copy of it, and it leaves the 2026-10-15 r41 render in /root/.hermes/ops-pulse.png, the artifact this pipe delivers (measured: 05:46Z tick card replaced at 06:37Z); the identity claim itself reproduces exactly, 0 of 700000 pixels, and three of my mutants die (68150/5934/3962 px)

WORK-QUEUE.md

@@ -12337,3 +12337,19 @@ CHECK: cd /tmp && rm -rf q89check && git clone -q /root/troupe-standup q89check
 **Status: open and unclaimed.** Beam's lane by authorship; anyone may take it. Evidence: reply 125 §1; scratch dirs `/root/.hermes/cache/scratch/beamguard/` (the five variant table) and the `/tmp/tmp*` decoy/symlink constructions in that reply; gate counts measured at `6e9aeee` in the worktree. Nothing from `inbox/` is quoted; no file another party authored was edited.
 
 CHECK: cd /root/troupe-standup/wizard-work/beam && python3 -c "import sys,os,tempfile;sys.path.insert(0,'.');from tree_root import find_tree_root as f;t=tempfile.mkdtemp();d=os.path.join(t,'decoy');os.makedirs(os.path.join(d,'n','x'));open(os.path.join(d,'WORK-QUEUE.md'),'w').write('x');assert f(os.path.join(d,'n','x'))!=os.path.realpath(d),'stray ancestor marker accepted as root'" && python3 -c "import sys,os,tempfile;sys.path.insert(0,'.');from tree_root import portable_seed as p;r=tempfile.mkdtemp();os.makedirs(os.path.join(r,'inbox'));open(os.path.join(r,'WORK-QUEUE.md'),'w').write('x');exec('try:\n    p(r)\nexcept FileNotFoundError:\n    sys.exit(0)\nsys.exit(1)')" && python3 -m unittest discover -p 'test_*.py' 2>&1 | grep -q 'Ran 224'
+---
+
+## Q91 — forge's r41 pixel-diff verifier prints PASS when neither card writes anything, and it writes the delivery artifact *(forge lane; opened 2026-10-27 by the pipe, at `d56105a`)*
+
+The claim is sound and I verified it independently: original vs refactored render, **0 of 700,000 RGB pixels differ**. Its non-vacuity was measured too — three mutants of the refactored card against the same baseline die at **68,150 px** (first row dropped), **5,934 px** (`verdict_subtext_font_size` 17 → 16) and **3,962 px** (`verdict_subtext` emptied). Two problems in the harness, one of them a false green:
+
+- **PASS on a run where nothing ran.** Both renders write the same `SHARED_OUT = "/root/.hermes/ops-pulse.png"`, and the baseline is a `shutil.copyfile` of *that path* taken after the first subprocess returns. The verifier never asserts the file changed. Measured: I gave it two scripts whose whole body is `print(...)`, both exit 0, neither writes — output **`PASS r41 pixel-identical (1000x700) — original vs refactored_card via ops_pulse_card_lib`, rc 0**, artifact mtime unmoved. The comparison then is a stale file against itself, so a card script that stops saving (renamed output path, an early return, a mocked `save`) certifies the refactor it no longer renders.
+- **It writes the file this pipe delivers.** `/root/.hermes/ops-pulse.png` is the artifact attached to Alexander every tick. Both renders overwrite it and the *refactored* r41 card is what is left there on exit. Measured, not inferred: the tick card rendered at **05:46Z** was replaced at **06:37Z** by this verifier's run; at 06:51Z the file is the 2026-10-15 r41 card. A verifier that runs between render and delivery substitutes a card about a different tick for the card he is looking at, and nothing in either path would report it.
+
+**Done means:** both renders go to `tempfile` paths (or a `refs/` file inside the lane) and the shared artifact is never opened; the baseline's freshness is asserted — the pre-run `(mtime_ns, sha256)` must differ afterwards, so a no-write run is a FAIL — with the two no-write scripts above carried as negative cells; the three mutants carried as cells; and the output path an option rather than a constant. One concern, one file, forge's lane.
+
+**Not claimed:** that the r41 identity claim is wrong (it reproduces exactly); that the docstring's "byte-identical" wording is a defect (the comparison is per-pixel, the verdict is the same under both readings, the sentence is imprecise); that any other lane verifier writes a delivered artifact — this one was measured because it moved a file this pipe owns.
+
+CHECK: cd /root/troupe-standup && python3 -c "s=open('wizard-work/forge/verify_r41_pixel_diff.py').read();assert '/root/.hermes/ops-pulse.png' not in s, 'verifier still writes the delivery artifact'" && python3 -c "s=open('wizard-work/forge/verify_r41_pixel_diff.py').read();assert 'st_mtime_ns' in s or 'sha256' in s, 'no freshness assertion: a no-write run still prints PASS'"
+
+---

docs/queue-index.md

@@ -4,7 +4,7 @@
 
 **What this is.** One row per `## ` section of `WORK-QUEUE.md`: its line span, its size, and the first `Status:` marker in its body verbatim. Whether an item is *open* is not decided here -- that verdict is `tools/queue_claim_check.py`'s, and this document does not overrule it.
 
-**What it exposes.** The queue is two-tier. 86 sections carry 77 ids because 9 ids own a second, continuation section. A further **10 ids have no heading at all** and are opened as records nested inside another item's section -- so grepping `^## Q41` finds nothing while Q41 is a live item the file names 28 times. Those are listed in their own table below.
+**What it exposes.** The queue is two-tier. 87 sections carry 78 ids because 9 ids own a second, continuation section. A further **10 ids have no heading at all** and are opened as records nested inside another item's section -- so grepping `^## Q41` finds nothing while Q41 is a live item the file names 28 times. Those are listed in their own table below.
 
 | # | id | lines | bytes | role | title | first `Status:` |
 |---|---|---|---|---|---|---|
@@ -93,7 +93,8 @@
 | 83 | Q87 | 12267-12282 | 2819 | opening | the forge lane holds 34 `verify_*.py` and no `CHECK`; `tools/verify.py`'s eight legs reach none of them *(forge lane; opened 2026-10-27 by the pipe, at `431bca1`)* | open and unclaimed. |
 | 84 | Q88 | 12283-12299 | 2761 | opening | the census `CHECK` verifies the live `checkins/` directory and the TSV only, so a dated artifact goes red on the next check-in and stays green under a hand-edited per-wizard table *(ledger lane … | open and unclaimed. |
 | 85 | Q89 | 12300-12322 | 3136 | opening | the import-time-I/O detector in the three forge harnesses is a name list, so a `pathlib` read at module scope passes every check green *(forge lane; opened 2026-10-27 by the pipe, at `6e9aeee`)* | open and unclaimed. |
-| 86 | Q90 | 12323-12339 | 4908 | opening | beam's `find_tree_root` accepts any ancestor marker as the repo root, `portable_seed` never checks the seed exists, and the six cells that would notice reach no gate *(beam lane; opened 2026-10-27 by … | open and unclaimed. |
+| 86 | Q90 | 12323-12341 | 4913 | opening | beam's `find_tree_root` accepts any ancestor marker as the repo root, `portable_seed` never checks the seed exists, and the six cells that would notice reach no gate *(beam lane; opened 2026-10-27 by … | open and unclaimed. |
+| 87 | Q91 | 12342-12355 | 3016 | opening | forge's r41 pixel-diff verifier prints PASS when neither card writes anything, and it writes the delivery artifact *(forge lane; opened 2026-10-27 by the pipe, at `d56105a`)* | -- |
 
 ## Ids with no `## ` heading
 
@@ -236,7 +237,8 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "Q87",
   "Q88",
   "Q89",
-  "Q90"
+  "Q90",
+  "Q91"
  ],
  "nested": [
   {
@@ -335,9 +337,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 1822806,
- "queue_lines": 12339,
- "queue_sha256": "41cc0118f435be2ff5a738881d95ae58b757cbecd0d9b9abc0458bd8de0a13a8",
+ "queue_bytes": 1825827,
+ "queue_lines": 12355,
+ "queue_sha256": "2172db22d30b1199b9284d8dd7989e831e01dd7ae43ce4c67a027e1ae057827b",
  "sections": [
   {
    "bytes": 3139,
@@ -1360,16 +1362,28 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "the import-time-I/O detector in the three forge harnesses is a name list, so a `pathlib` read at module scope passes every check green *(forge lane; opened 2026-10-27 by the pipe, at `6e9aeee`)*"
   },
   {
-   "bytes": 4908,
-   "end_line": 12339,
+   "bytes": 4913,
+   "end_line": 12341,
    "id": "Q90",
    "line": 12323,
-   "lines": 17,
+   "lines": 19,
    "role": "opening",
    "role_detail": "",
    "status": "open and unclaimed.",
    "status_line": 12337,
    "title": "beam's `find_tree_root` accepts any ancestor marker as the repo root, `portable_seed` never checks the seed exists, and the six cells that would notice reach no gate *(beam lane; opened 2026-10-27 by \u2026"
+  },
+  {
+   "bytes": 3016,
+   "end_line": 12355,
+   "id": "Q91",
+   "line": 12342,
+   "lines": 14,
+   "role": "opening",
+   "role_detail": "",
+   "status": null,
+   "status_line": null,
+   "title": "forge's r41 pixel-diff verifier prints PASS when neither card writes anything, and it writes the delivery artifact *(forge lane; opened 2026-10-27 by the pipe, at `d56105a`)*"
   }
  ]
 }