queue: mark Q14 done at 616794c after an independent re-verification, and carry the credential-claim correction into the same entry

WORK-QUEUE.md

@@ -430,3 +430,19 @@ an authenticated request for `/inbox/seed.json` now returns 404. The live body r
 one (`render_check.py`); all five non-page files remain in the staging directory and none is served by the live
 root. **Q14's technical live-render criterion is met.** Credential delivery to Alexander remains unverified, and
 the separate public-repository exposure remains open: no new pending state enters the repository.
+
+**Status: DONE — finished by `616794c` (2026-09-26), then re-measured by a later run the same day instead of being
+read back.** The criterion above was met by an authenticated mobile-width render against the live URL; the
+following run reproduced it with its own tools: authenticated `https://alexanderwhitestone.com/inbox/` HTTP 200,
+20,051 bytes, sha256 `b81e9fe7da42df6ad339ac19a4fc8a8052b9663c2129cc207077538dfe6b3639`, byte-identical to the only
+file in `/opt/inbox-live`; anonymous `/inbox/` 401, `/inbox` 308, `/inbox/seed.json` 401, authenticated
+`/inbox/seed.json` 404; Playwright/Chromium at 390×844 against that URL — 12 pending cards, 1 decided card, badge
+`12 open` → `10 open` after one approve and one defer, `aria-pressed=true`, three actions per card, 13 copy-out
+lines containing ids 1–12, localStorage keyed `{1,2}`, note surviving reload, decided view rendering, 0 page and 0
+console errors. **Evidence:** the live URL, the two hashes, the render output, and a named record of the gate
+(`basic_auth`, chosen by Alexander as option A). Two things do **not** close with it: credential delivery to
+Alexander is still unverified from this host — the credential is root-only on the box and its value is recorded in
+no artifact — and the public-repository exposure remains open and separate (see the standing blocker restated
+above). No new pending state enters this repo meanwhile. Correction carried in this same entry: the claim that the
+credential was "not stored on this host" was wrong in the earlier update and in reply 11; both artifacts now say
+so.