The decoy suite is a gate of the full run (R-1116); no code change

controller/scripts/test_gate_decoys.py is now controller_gates.py's `gate-decoys` row: blocking, full run only
(~22 s, 53 cases, and it edits real files in the tree for a moment, so never the hook). Declared in its own
COVERS; test_controller_gates.py pins it. Red-proved: debug-routes/comment flipped to expect accept ->
CONVICTED: gate-decoys; restored, green. gates.md's "--fast is all of them" corrected.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,14 @@
+## Unreleased (2026-10-17) — the decoy suite is a gate of the full run (R-1116); no code change
+
+- **`gate-decoys`** (`controller/scripts/test_gate_decoys.py`) is now a row of `controller_gates.py`: the full run,
+  blocking, NOT `--fast`. It was in no runner — the shape that let the catalog's R-1115 fail unseen for a night. Not
+  `--fast` because it takes ~22 s (measured: 53 cases) and edits real files in this tree for a moment (it swaps and
+  restores `handler_debug.go`, `update.go`, the locale bundles, and plants `.go` files under `internal/` and `cmd/`) —
+  in the pre-push hook that would race a session editing the same tree. It does not call the runner (no recursion).
+  Declared in its own `COVERS`. `test_controller_gates.py` pins it (registered once, full run only, blocking, named
+  by `--fast`'s SKIPPED line). Red-proved: the `debug-routes/comment` case flipped to expect `accept` turned the full
+  run red (`CONVICTED: gate-decoys`); restored, green. `.claude/rules/gates.md`'s „`--fast` is all of them" corrected.
+
 ## v0.325.0 — parallel password tries capped on two more doors; family sessions stored as fingerprints; samba renames apply; path guard widened; gates in a worktree (2026-10-17)
 
 **MinAgent: 0.158.1** — the floor's, carried. Nothing here calls the agent. No golden (`09` §3 decision 250). Task: