D53 built + live-proven (08 §10 [DESIGN — built]); R-1297 decoys: register-shape decoys assert the script's exit

- 08 §10: built (controller 5bd03ad, hub 7e57e824, commit only); putback_pending as on the wire; as-built notes
- audits/d53-held-apps-2026-10-26: live proof on 9202 against a test hub (3-min grace), red-proofs, teardown
- R-1291 BUILT (not released); R-1298 filed (9202's orphan holds + PrivateBin leftover)
- test_gate_decoys.py: the register-shape cases also run the script and assert its exit code — R-1297's decoy 2
  showed an inert main() passed every case (9 cases red with it now)
- audits/r1297-ci-trim-2026-10-26: runners, times, decoys

scripts/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 2026-10-26 (evening) — CI: heavy suites by path, no second full gate run, a nightly run (R-1297 A); a decoy hole closed
+
+- **`script_tests_gate.py` `PATH_FILTERED`:** on a CI branch push with a known file list, `test_gate_decoys.py`,
+  `test_due_checks_gate.py` and `dooplex-offsite/test_dooplex_offsite.py` run only when one of their paths changed; no
+  list (a tag, the nightly run, a dispatch, the pre-push hook), an empty or unreadable list = every suite (`ecd82aba`).
+- **`.gitea/workflows/gates.yml`:** a nightly schedule 03:20 UTC; `FELHOM_CHANGED_FILES` only for `push:refs/heads/*`; a
+  trimmed commits array is an unknown list. Pinned by `test_script_tests_gate.py` (filter cases + workflow pins).
+- **`test_repo_gates.py` and `test_due_checks_gate.py` group G** drive the real runner with `GATES` narrowed by label —
+  the wiring, not the whole gate set a second time (~130 s each in CI).
+- **`test_gate_decoys.py` register-shape cases assert the SCRIPT's exit code too.** Found by R-1297's decoy: an inert
+  `main()` passed every case because the cases called `check()` only; red-proved with that inert `main()` (9 cases red).
+- Numbers and decoys: `documentation/audits/r1297-ci-trim-2026-10-26/`.
+
 ## 2026-10-26 — felhom-tenantsync v1.4.0: the self-check waits out the PBS permission cache (R-1295) — INSTALLED on ep0 2026-10-26 13:09Z on the operator's yes (sha256 `751b3c26…` = the repository's; v1.3.0 kept as `.v1.3.0`; `fingerprint` and `usage` ok)
 
 - **`felhom-tenantsync.sh` v1.4.0:** the new token is re-checked every 0.5 s for up to 15 s (a log line per try) before

scripts/test_gate_decoys.py

@@ -882,7 +882,15 @@ def _rsg_case(name, text, must_convict, expect_rule=None):
             fh.write(text)
         rows, ids, bad = _rsg.check(fp)
         convicted = bool(bad)
-        if convicted != must_convict:
+        # 2026-10-26 (R-1297 A's decoy): the RUNNER calls the script, not check(). An inert main() (convicting
+        # nothing) passed every case here while check() still worked — so the script's own exit code is
+        # asserted too, on every case.
+        _p = subprocess.run([sys.executable, os.path.join(ROOT, "scripts", "register_shape_gate.py"), fp],
+                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        if _p.returncode != (1 if must_convict else 0):
+            fails.append("register-shape [%s]: the SCRIPT exited %d, want %d — check() and the entry point disagree"
+                         % (name, _p.returncode, 1 if must_convict else 0))
+        elif convicted != must_convict:
             fails.append("register-shape [%s]: expected %s, got %s (%s)"
                          % (name, "CONVICT" if must_convict else "PASS",
                             "CONVICT" if convicted else "PASS",