4bf5db6875
scripts/test_gate_decoys.py (new; COVERS "published"): an http.server on 127.0.0.1 stands in for Gitea through the gate's existing GITEA_BASE seam, proxies stripped, so no case reaches the real registry. Facts convicted: a tag whose package 404s, a tag tree without the configs, a package one patch past the newest tag (never tagged), a patch-gap orphan, a missing package that lexical sorting would drop out of the retention window. Inconclusive, never a pass: tags api 500, a non-JSON 200, Gitea unreachable. Passed: a clean registry, a non-semver tag, a version older than the retention window (BY DESIGN). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS