The decoy suite is a gate of the full run (R-1116); scripts only, no release

scripts/test_gate_decoys.py is now agent_gates.py's `gate-decoys` row: the full run (which CI runs on every
push), not --fast (~20 s in the workspace, 30 cases). Declared in its own COVERS; test_agent_gates.py pins it.
Red-proved: a reuse-refs FACT case flipped to expect rc 0 -> CONVICTED: gate-decoys; restored, green.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/agent_gates.py

@@ -15,6 +15,9 @@ Gates (all must pass; **non-zero exit on any failure**):
                      or because someone is offline on a train. CI runs the FULL set for exactly this
                      reason: it is the machine that can afford a network check, and it is the half
                      that emails when something is wrong.
+  …  gate-decoys     the decoy suite (test_gate_decoys.py): every gate here still convicts its decoys
+                     (R-1116). ~20 s in the workspace, so the full run only: not the hook, but CI
+                     runs the full set on every push. Scratch clones and a local fake Gitea only.
 
 WHY THIS FILE EXISTS, WITH ONE GATE (2026-08-02, R-29 leg (b)).
 
@@ -58,6 +61,12 @@ GATES = [
     ("release-complete", os.path.join(ROOT, "scripts", "check-release-complete.py"), [], True),
     # R-389 — a REPORT.md observation with no register row behind it. Fast: stdlib file reads.
     ("observations", SHARED_OBSERVATIONS, [ROOT], True),
+    # R-1116 (2026-10-17) — the gates' OWN decoy suite. It was in no runner, the shape that let the catalog's
+    # R-1115 fail unseen for a night. Full run only: ~20 s in the workspace (measured, 30 cases; ~5 s in a
+    # CI-shaped clone, where the shared gates have fewer siblings to search), too slow for the hook — and CI
+    # runs the FULL set, so every push is still judged by it. It plants only in scratch clones and asks a fake
+    # Gitea on 127.0.0.1 (never the network, never the real tree); it does not call this runner (no recursion).
+    ("gate-decoys", os.path.join(ROOT, "scripts", "test_gate_decoys.py"), [], False),
 ]
 
 VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"}

scripts/test_agent_gates.py

@@ -57,6 +57,20 @@ class AgentGatesTest(unittest.TestCase):
         finally:
             shutil.rmtree(tmp, ignore_errors=True)
 
+    def test_decoy_suite_is_a_full_run_gate(self):
+        """R-1116: the decoy suite is a gate of the FULL run (which CI runs on every push), and --fast
+        names it as skipped (~20 s, too slow for the hook)."""
+        sys.dont_write_bytecode = True  # no __pycache__ left in scripts/ (not gitignored here)
+        sys.path.insert(0, os.path.join(ROOT, "scripts"))
+        import agent_gates as mod
+        rows = [g for g in mod.GATES if g[0] == "gate-decoys"]
+        self.assertEqual(len(rows), 1, "gate-decoys is not registered exactly once")
+        self.assertEqual(os.path.basename(rows[0][1]), "test_gate_decoys.py")
+        self.assertFalse(rows[0][3], "gate-decoys must not be --fast")
+        self.assertEqual([g[0] for g in mod.GATES if not g[3]], ["published", "gate-decoys"])
+        self.assertIn("--fast SKIPPED (deliberate periodic runs, never in a hook): published, gate-decoys",
+                      self.out)
+
     def test_unknown_argument_is_rejected(self):
         p = subprocess.run([sys.executable, ENTRY, "--nope"], cwd=ROOT,
                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT)

scripts/test_gate_decoys.py

@@ -66,6 +66,9 @@ COVERS = {
                     "inside an HTML comment (R-426)",
     "observations": "R-419 in THIS repo's REPORT.md: an Observations note SAYING it carries no marker - vs the "
                     "two genuine markers (R-426)",
+    "gate-decoys": "this suite, run as a gate of agent_gates.py's full run, which CI runs on every push (R-1116): "
+                   "every case above is a decoy of its own gate, and ONE case that stops convicting turns the run "
+                   "red - red-proved 2026-10-17 by flipping a reuse-refs FACT case to expect rc 0",
 }
 
 fails = []