# REPORT — the test record and its gate (night 2026-09-23, Part B)

`09-update-architecture.md` §3 decision 13, §6.4 part 4 and the catalog half of part 6. Night record:
`felhom.eu/documentation/audits/DRILL-night-2026-09-23.md`; evidence `…/night-2026-09-23/B*`.

## Not done, or changed
- The brief's "`check-image-resolvable.py` already resolves digests" is only half true: it asks `docker
  manifest inspect` whether a ref EXISTS and discards the digest. The digest comes from the new
  `image_digest.py`, whose answer equals Docker's `RepoDigests` on a box (positive control).
- The move gate uses the network in the hook — for moved refs only. Decided by CC unattended (it is the
  only way a push-time "digest matches the registry now" can be asked); operator may reverse.
- Backfilled digests are TODAY's registry answer, not a measurement of the image that was tested.
- Step definitions for intermediate steps (`steps/<to>.yml`, part 5) are not written — no app has two
  steps yet.

## What shipped
Format + spike, two gates (16 decoys, 3 red-proofs), the writer (5 tests), harness v3 (box fixtures on
the bench; files_may_change), `image_digest.py`, the backfill (21 proven).

## Gates
`catalog_gates.py --fast` all OK; `test_gate_decoys.py` 80 cases OK; `test_ladder_writer.py` OK;
`test_catalog_gates.py` OK after this commit (its shallow-clone case needs the new scripts committed).