test record: an image move must carry its proof (09 decision 13, part 4)

update_ladder: in .felhom.yml, one JSON entry per line (spiked live on
controller v0.266.0 and v0.267.0 first). Two gates: check-test-record.py
(static, CI too) and check-test-record-move.py (history + registry for
moved refs only). 16 decoys, 3 red-proofs. The ONLY writer is
upgrade-test.py --write-ladder (bench AND box proven, digests resolved).
Harness v3: box fixtures on the bench, files_may_change.
Backfill: the 21 moves of 2026-09-22, 21 proven from their records.
No image: line moved.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/catalog_gates.py

@@ -19,6 +19,10 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
   7. probe-matches-compose  static, instant, whole repo — the .felhom.yml health probe dials the
                          port/path the app's own compose healthcheck dials (R-618). Runs in the
                          hook: a wrong probe stops a WORKING app at the end of a successful update.
+  8. test-record         static, instant, whole repo — every update_ladder is well-formed, continuous,
+                         and its newest step IS the compose's images (runs in CI too)
+  9. test-record-move    git history + the registry for MOVED refs only — an image move adds a PROVEN
+                         ladder entry whose digests the registry still serves (hook; skipped on CI)
   4. engine-major        static, needs GIT HISTORY — no database engine pin crosses a MAJOR version
                          (operator ruling 2026-09-13; expires when Slice 4 / R-448 ships). Runs in the
                          pre-push hook, which has the full clone; on a SHALLOW clone (CI fetches at
@@ -93,6 +97,13 @@ GATES = [
     # defect it catches does not merely mis-colour a badge, it makes a SUCCESSFUL update stop a
     # working app (the `verifying` phase waits on this probe), so it must bite at push time.
     ("probe-matches-compose", "check-probe-matches-compose.py", True, True, False),
+    # 2026-09-23 (`09` §3 decision 13, §6.4 part 4): THE TEST RECORD. The static half needs no
+    # history and no network, so it bites in CI too: a ladder must be well-formed and its newest step
+    # must BE the compose's images. The move half needs history (skipped out loud on CI's shallow
+    # clone, like engine-major) and asks the registry ONLY for refs that moved in the range: an image
+    # move must add a PROVEN entry whose digests the registry still serves.
+    ("test-record",        "check-test-record.py",        True,  True,  False),
+    ("test-record-move",   "check-test-record-move.py",   False, True,  True),
 ]
 
 VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"}