queue: record live inbox gate and remaining visibility blocker

WORK-QUEUE.md

@@ -395,3 +395,13 @@ with Alexander; until it is made, nothing here publishes or duplicates pending m
 render with all seed items present. **Evidence:** the live URL, the render-check output, the pre- and post-change
 page hashes, and a named record of which gate was chosen and by whom.
 Entered by Timmy 2026-09-26, satisfying the Q7 obligation for this cycle.
+
+**Update 2026-09-26 — gate live, visibility blocker remains.** Alexander chose option A. The production vhost now
+serves `https://alexanderwhitestone.com/inbox/` from `/opt/inbox-site` behind `basic_auth`, with `Cache-Control:
+no-store`; anonymous fetch returns HTTP 401 and authenticated fetch returns HTTP 200. The authenticated body is
+20,051 bytes and SHA-256 `b81e9fe7da42df6ad339ac19a4fc8a8052b9663c2129cc207077538dfe6b3639`, byte-identical
+to staged `index.html`. `caddy validate` passes and the pre-change file is retained as
+`/etc/caddy/Caddyfile.bak-inbox-20260926`. This closes the missing-gate blocker and supersedes the stale Caddy line
+numbers above. The public-repository blocker is unchanged: the raw seed still answers anonymously with HTTP 200,
+so no additional pending state goes into this repo. Hardening follow-up: narrow the authenticated file-server root
+before placing any non-page build artifacts there.