The decoy suite is a gate of the full run (R-1116); no code change

controller/scripts/test_gate_decoys.py is now controller_gates.py's `gate-decoys` row: blocking, full run only
(~22 s, 53 cases, and it edits real files in the tree for a moment, so never the hook). Declared in its own
COVERS; test_controller_gates.py pins it. Red-proved: debug-routes/comment flipped to expect accept ->
CONVICTED: gate-decoys; restored, green. gates.md's "--fast is all of them" corrected.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/scripts/controller_gates.py

@@ -18,6 +18,9 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
   8. debug-routes       every debug-page control resolves to a handler, and back (R-400)
   9. reuse-refs         every path cited by this repo's REUSE.md still resolves
   …  gofmt              every Go file is gofmt-clean (R-454)
+  …  gate-decoys        the decoy suite (test_gate_decoys.py): every gate above still convicts its
+                        decoys (R-1116). ~22 s and it edits real files in this tree for a moment, so
+                        the full run only, never --fast (never the hook, never CI)
 
 WHY THIS FILE EXISTS (2026-08-02, closing R-29 leg (a) and half of leg (b)).
 
@@ -104,6 +107,13 @@ GATES = [
     ("gofmt",           os.path.join(SCRIPTS, "gofmt_gate.py"),                [],       True, True),
     # R-404 — ADVISORY. Reports the golden debt where it is created; never refuses.
     ("golden-notice", GOLDEN_NOTICE, [REPO], True, False),
+    # R-1116 (2026-10-17) — the gates' OWN decoy suite: every gate above, red-proved against its decoys. It was
+    # in no runner, the shape that let the catalog's R-1115 fail unseen for a night. NOT --fast, for two
+    # reasons: it takes ~22 s (measured, 53 cases), and it EDITS REAL FILES in this tree and restores them
+    # (handler_debug.go, update.go, the locale bundles; plants .go files under internal/ and cmd/) — in the
+    # pre-push hook that would race any session editing the same tree. Run the full run in a quiet tree.
+    # It does not call this runner, so there is no recursion.
+    ("gate-decoys",     os.path.join(SCRIPTS, "test_gate_decoys.py"),          [],       False, True),
 ]
 
 VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"}