diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md
index e18813c4..168d3c29 100644
--- a/hub/CHANGELOG.md
+++ b/hub/CHANGELOG.md
@@ -1,5 +1,6 @@
 ## unreleased
 
+- hub: R-444 — the System page shows each box's 'Last disk trim' (from the agent's guest_disk_trim stanza): last successful trim and the GiB freed; amber when the newest attempt failed (its error shown) or the last success is older than 14 days; '—' when the agent sends none. wire_contract_gate checks guest_disk_trim field by field both ways against hub sysfacts.DiskTrim (SUBTREE_MIRRORS), with decoys (decision 139).
 - **Fixed without a row (R-872 night watch):** the 05:00 deadline check's down-box judgement returned early in silence for a box never bound or first seen under 48 h ago, so the log read only „1 skipped (down)" and a night watch could not tell „too young to judge" from „judged, nothing missed". Each early return now logs why. `TestR872_DownButTooYoungIsLogged`; red-proved (without the line: the test fails).
 
 ## v0.138.0 — secrets sealed at rest, a cookie no sibling can plant, the box's own claim state, agent-binary drift (burn-down night: R-879, R-136, R-283, R-349, R-276) (2026-10-05)
diff --git a/scripts/CHANGELOG.md b/scripts/CHANGELOG.md
index 7a6bf347..b9e90ffe 100644
--- a/scripts/CHANGELOG.md
+++ b/scripts/CHANGELOG.md
@@ -1,3 +1,7 @@
+## gates — the ISO first-boot test is a gate, full runs only (R-502, `09` §3 decision 147) (2026-10-06)
+
+- scripts: R-502 — new gate `iso-bootstrap` (scripts/iso_bootstrap_gate.py) runs the ISO first-boot harness in felhom-iso-assistant:trixie on FULL runs only (fast=False: never the pre-push hook, never CI); no docker/no image/docker error = exit 2 'not checked', never a pass; every green run is followed by a built-in decoy (a pairing banner that never paints) the harness must fail. Docker-free decoys in scripts/test_iso_bootstrap_gate.py, covered in test_gate_decoys.py (decision 147).
+
 ## gates — decoy coverage: the exemption list is EMPTY (controller decoys landed; R-426 closed) (2026-10-06)
 
 - `decoy_coverage_gate.py` EXEMPT: the four felhom-controller entries are gone (`controller/scripts/test_gate_decoys.py` COVERS docker-v, reuse-refs, instructions, observations).