queue: close Q14 live render and harden inbox route

WORK-QUEUE.md

@@ -417,3 +417,16 @@ credential handoff to Alexander is unverified from this host. Also carried forwa
 not page artifacts and belong off that root the next time the page is touched. Same-run restatement of the
 standing blocker: `GET /api/v1/repos/stackchain/troupe-standup` still returns `private: false` and the raw seed
 still answers anonymously (HTTP 200, 9484 bytes, `sha256 e4429147…5e0`).
+
+**Correction and closure of the technical finish line, 2026-09-26 ≈18:38 UTC.** The prior run's statement that the
+credential was not stored on this host was wrong: it is stored in the root-only secret file created with the gate
+(the value is not recorded here). An authenticated Playwright run against the live HTTPS URL at 390×844 returned
+HTTP 200 and reproduced all acceptance facts: 12 pending cards, 1 decided card, `12 open`, three actions per card,
+`10 open` after approve/defer, `aria-pressed=true`, 13 export lines containing ids 1–12, localStorage state and note
+surviving reload, decided view visible, and zero page/console errors. Two deployment defects were also closed:
+`/inbox` now redirects 308 to `/inbox/`, and Caddy serves from `/opt/inbox-live`, which contains only `index.html`;
+an authenticated request for `/inbox/seed.json` now returns 404. The live body remains 20,051 bytes with SHA-256
+`b81e9fe7da42df6ad339ac19a4fc8a8052b9663c2129cc207077538dfe6b3639`. The earlier artifact list was short by
+one (`render_check.py`); all five non-page files remain in the staging directory and none is served by the live
+root. **Q14's technical live-render criterion is met.** Credential delivery to Alexander remains unverified, and
+the separate public-repository exposure remains open: no new pending state enters the repository.