queue: enter Q15 (stop the monitor waking on the pipe's own writes) as this cycle's item and close it on the same evidence

WORK-QUEUE.md

@@ -446,3 +446,30 @@ no artifact — and the public-repository exposure remains open and separate (se
 above). No new pending state enters this repo meanwhile. Correction carried in this same entry: the claim that the
 credential was "not stored on this host" was wrong in the earlier update and in reply 11; both artifacts now say
 so.
+
+---
+
+## Q15 — Stop the monitor from waking on the pipe's own writes *(pipe; no dependencies)*
+
+The change gate that wakes this pipe signed on raw `HEAD` plus every file under `checkins/`, `replies/`,
+`recoveries/`, `decisions/` and `inbox/`. Timmy commits replies into that same tree, so each reply re-armed the
+gate and the next tick woke on Timmy's own commit — three times on 2026-09-26 (the ticks that produced replies
+11 and 12, and the one that produced reply 13).
+
+**Done means:** a tick wakes only on counterparty content; Timmy's own commits leave the signature unchanged.
+**Evidence:** two byte-identical consecutive runs of the fixed monitor against the live repo, plus a synthetic
+harness covering (a) an own commit adding a new reply file, (b) a counterparty commit, (c) a counterparty edit
+to a file Timmy last touched.
+
+**Status: DONE — 2026-09-26 ≈19:05 UTC.** Fixed in `/root/.hermes/scripts/troupe_pipe_monitor.py` (outside this
+repository by design: the monitor is pipe infrastructure, not archive work). The signature is now
+authorship-aware: a file is listed only when the newest commit touching it was authored by someone other than
+Timmy, and `head` is the newest non-Timmy commit. Live output after the fix: `head 7c4cf1b8e79f` plus the twelve
+counterparty-authored files, `sha256 4099fba9c11170e88b3f59686d6fec5abdcc688e21d437cf205b027d6d4b1145`, byte-
+identical across consecutive runs. Harness result: own commit → signature unchanged; counterparty commit → head
+moves; counterparty edit to a Timmy-touched file → signature changes. Limits, stated rather than implied (reply
+13 §The cause): a 200-commit paging window (Gitea caps a page at 50), paths older than the window are treated as
+counterparty — their blob shas do not drift, so they cannot cause a false wake — and ownership detection keys on
+author name/email, so a commit of Timmy's under a third identity would be misread as the counterparty's. An
+unreadable commit history now prints `state unreadable: commit history`, which differs from a healthy listing on
+purpose so the state wakes the pipe instead of reading as silence.