docs(rig): move the verify queue out of tree to $AC_HOME

.agents/qa.md

@@ -269,7 +269,7 @@ justification — do not downgrade to `request-changes` to express it, because
 that send the PR back to a developer who cannot take the measurement either.
 
 Where the measurement is one the rig role would take, say which block of
-`rig/rig-verify-queue.md` it belong to, or that it needs a new one. The
+`$AC_HOME/rig-verify-queue.md` it belong to, or that it needs a new one. The
 rig role produce the measurement record; you do not run the session and you do
 not act on a result that does not exist yet.
 

.agents/rig.md

@@ -23,7 +23,7 @@ issue label, invoked directly for a rig session. Read-only with respect to
 the codebase — no PRs, no source edits, no issue transitions. Output is a
 measurement record file, nothing else. A defect the session finds becomes a
 new GitHub issue (or a note against the relevant block in
-`rig/rig-verify-queue.md`), not a fix written in-session.
+`$AC_HOME/rig-verify-queue.md`), not a fix written in-session.
 
 ## repo context
 
@@ -41,10 +41,19 @@ survived contact with this rig and what didn't:
 - `work/rig/rig-session-2-results.md`, `rig-session-3-results.md`,
   `rig-session-results.md`, `rig-verify-125-results.md` — completed
   sessions, historical.
-- `rig/rig-verify-queue.md` — the live queue of what still needs the
+- `$AC_HOME/rig-verify-queue.md` — the live queue of what still needs the
   rig; read the "rig's own defects" section at its top before anything
   else, and the "rig state left behind" section for what condition the
-  hardware was in after the last session.
+  hardware was in after the last session. **Out of tree**, alongside
+  `handoff/` and `session/`, so it is one file rather than one per branch
+  — a queue that lived in the repo was twice overwritten by a branch
+  syncing its docs from main, losing the entries that were the only
+  record of how to close an open QA finding. `$AC_HOME` is its own git
+  repo, so an overwrite is recoverable (`git -C "$AC_HOME" log -p --
+  rig-verify-queue.md`), but only up to the last commit there — commit at
+  the end of a session, not the start of the next one. Mark blocks
+  executed rather than deleting them regardless: the queue is the record
+  of what was asked, not just of what is left.
 
 ## what you must do
 
@@ -75,7 +84,7 @@ survived contact with this rig and what didn't:
   measurement, by output/input index, not by what a handoff document says it should be. Let operator know what is your idea of the outputs/inputs today.
 - Stop the daemon before installing a build over it. `install -m 755` over a
   running `ac-daemon` may fail `Text file busy`, or may succeed and leave an
-  ambiguous state — see `rig/rig-verify-queue.md` for whether this has
+  ambiguous state — see `$AC_HOME/rig-verify-queue.md` for whether this has
   been settled on the current build. Stop first regardless of the answer.
 
 ### step 2 — obtain emission consent

CLAUDE.md

@@ -4,7 +4,7 @@ Agent specs in `.agents/`. Read spec for your role before anything. Active role
 
 Repo: ac-rs/ (cargo workspace, five crates) — stddocs/ docs/ tests/
 
-Documents: root holds entry points only (this file, README, ARCHITECTURE, TESTING). `docs/` = durable reference — `docs/design/` design notes + briefs, `docs/superseded/` dead-but-kept plans. `work/` = in-flight, expiring — `work/rig/`, `work/planning/`. Handoffs are out of tree in `$AC_HOME/handoff`; read one only when a task names it.
+Documents: root holds entry points only (this file, README, ARCHITECTURE, TESTING). `docs/` = durable reference — `docs/design/` design notes + briefs, `docs/superseded/` dead-but-kept plans. `work/` = in-flight, expiring — `work/rig/`, `work/planning/`. Out of tree in `$AC_HOME`: handoffs (`handoff/`), session records (`session/`), and the live rig queue (`rig-verify-queue.md`) — one copy each, never per-branch. Read a handoff only when a task names it. `$AC_HOME` is its own git repo (markdown only; worktrees, cargo targets and logs are ignored) — commit edits there, nothing does it automatically.
 
 | crate | binary | role |
 |-------|--------|------|

TESTING.md

@@ -41,7 +41,7 @@ answered.
 
 It is also the expensive direction. A false green hides a defect; a false red
 sends someone hunting a regression that does not exist — the same shape as the
-stale `ac-view` snapshots in `rig/rig-verify-queue.md`, where the first
+stale `ac-view` snapshots in `$AC_HOME/rig-verify-queue.md`, where the first
 pixel-diff failure is a real defect the tests could not see and reads as one
 they introduced.
 

audit/rig-session-3/negative-lag-rule.md

@@ -1,6 +1,6 @@
 # The negative-lag floor does not separate. Block 2, answered offline.
 
-`rig/rig-verify-queue.md` block 2 asked one question of session 3's
+`$AC_HOME/rig-verify-queue.md` block 2 asked one question of session 3's
 captures, and said a capture set that answers "no" is as valuable as one that
 answers "yes":