test record: an image move must carry its proof (09 decision 13, part 4)

update_ladder: in .felhom.yml, one JSON entry per line (spiked live on
controller v0.266.0 and v0.267.0 first). Two gates: check-test-record.py
(static, CI too) and check-test-record-move.py (history + registry for
moved refs only). 16 decoys, 3 red-proofs. The ONLY writer is
upgrade-test.py --write-ladder (bench AND box proven, digests resolved).
Harness v3: box fixtures on the bench, files_may_change.
Backfill: the 21 moves of 2026-09-22, 21 proven from their records.
No image: line moved.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/romm/.felhom.yml

@@ -234,3 +234,9 @@ i18n:
           - env_var: MOBYGAMES_API_KEY
             label: "MobyGames API Key"
             help_text: 'Sign up on MobyGames, then ask for a key on the API page. It gives detailed game information and credits.'
+
+# update_ladder — the test record: one tested step per line, oldest first (JSON flow mappings,
+# `09-update-architecture.md` §6.4 part 4). WRITTEN BY scripts/upgrade-test.py, never by hand;
+# gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
+update_ladder:
+  - {"from": {"romm": "rommapp/romm:5.0.0", "romm-db": "mariadb:11.4", "romm-redis": "redis:7-alpine"}, "to": {"romm": "rommapp/romm:5.3.0", "romm-db": "mariadb:11.4", "romm-redis": "redis:7-alpine"}, "digest": {"romm": "sha256:dc586cb3a2c7316fcffb3dc273171b1964523f0f409e989295d26d2199df1d4e", "romm-db": "sha256:70cc072b29b4a89ae07abb2d4da2c64678a7f2dfe092751bb51c87d67dc1338b", "romm-redis": "sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499"}, "verdict": "proven", "tested_at": "2026-09-21T19:27:03.627376+00:00", "harness_version": 1, "evidence": "felhom.eu/documentation/audits/update-night-2026-09-21/apps/romm/verdict.json", "memory_peak_pct": 80.9, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": true}, "backfilled": "2026-09-23", "note": "backfilled from catalog commit 15f9ebf; box walk only (harness v1, no memory watch); digest = what the registry served on 2026-09-23, not a measurement of the tested image; memory watch from felhom.eu/documentation/audits/update-rulings-2026-09-23/harness/evidence/M1/verdict.json (bench, harness v2): peak 80.9%"}