decoy sweep: eight holes in this repo's gates, all measured, all fixed (R-421)

Every gate was DECOYED - the label constructed without the fact, the gate run, the verdict recorded.
No verdict here was reached by reading, because reading is exactly how the five prior instances hid.

SCOPE IS A FACT TOO, and it was the big one. Six gates decided what to look at with os.listdir - one
directory level. Every one was green AND CORRECT, because no template subdirectory exists today; every
one would have gone blind the moment anyone added templates/partials/, which is an ordinary act. A
single planted file carrying an emoji, a native confirm(), hand-rolled row markup, a dangling JS id
reference, a templated secret and an unregistered retrieval promise passed all six.

THE CONTROL IS WHAT MAKES THAT A MEASUREMENT: mojibake and docker-v already used os.walk, saw the
identical planted file, and convicted. So the cause was the listing, not the decoy.

COMMENTS ARE NOT CODE, AND COMMENTS ARE NOT CONTROLS. debug-routes matched `case subpath == "x"` in
raw text, so a case left in a commented-out block counted as a live handler - which is R-400's
original defect (seven dead controls on the page an operator opens when something is already wrong)
reached through the one door its own gate could not see. app-row-dedup's MUST_USE check had the same
shape: a commented-out {{template "app_list_row"}} satisfied it.

Stripping is deliberately crude in debug_route_gate, and that is correct there: its own docstring
insists on ten lines that cannot rot. A // inside a string literal truncates that line, which can
only ever HIDE a reference, never invent one - it fails in the safe direction.

NOT FIXED, and left open with its decoy rather than quietly patched: R-425, offbox-rename scans a
fixed three-entry FILES list, so banned NAS branding in a NEW offbox template passes. The scope was
correct when written and silently narrows every time the feature grows a file.

test_gate_decoys.py holds 10 decoys and declares COVERS, which felhom.eu's new decoy-coverage gate
AST-parses - a substring search for coverage would be the very shape this sweep exists to find.

No Go code. No version bump. No image. No golden owed.
Survey: felhom.eu/documentation/audits/AUDIT-gate-decoys-2026-09-01.md

controller/scripts/debug_route_gate.py

@@ -31,6 +31,30 @@ REF_RE = re.compile(r"/api/debug/([A-Za-z0-9/_-]+)")
 CASE_RE = re.compile(r'subpath\s*==\s*"([A-Za-z0-9/_-]+)"')
 
 
+# R-421 (2026-09-01) — COMMENTS ARE NOT CODE, AND COMMENTS ARE NOT CONTROLS.
+#
+# Both sides of this gate were plain regexes over raw file text, so a `case subpath == "x":` left
+# behind in a commented-out block counted as a live handler, and a `/api/debug/x` inside an HTML
+# comment counted as a live control. Measured 2026-09-01: commenting out one dispatcher case while
+# adding the matching button made this gate report OK on a control that does nothing — which is
+# R-400's original defect, reachable again through the one door the gate could not see.
+#
+# Stripping is deliberately crude and that is correct here: this gate's own docstring insists on ten
+# lines of logic that cannot rot. A `//` inside a string literal (a URL, say) would truncate that
+# line — which can only ever HIDE a reference, never invent one, so it fails in the safe direction.
+GO_COMMENT_RE = re.compile(r"//[^\n]*")
+GO_BLOCK_RE = re.compile(r"/\*.*?\*/", re.S)
+HTML_COMMENT_RE = re.compile(r"<!--.*?-->", re.S)
+
+
+def strip_go_comments(src):
+    return GO_COMMENT_RE.sub("", GO_BLOCK_RE.sub("", src))
+
+
+def strip_html_comments(src):
+    return HTML_COMMENT_RE.sub("", src)
+
+
 def read(path):
     if not os.path.exists(path):
         print("DEBUG ROUTE GATE INCONCLUSIVE: %s not found (run from controller/)" % path)
@@ -40,8 +64,8 @@ def read(path):
 
 def main():
     # Sets, not lists: the same address referenced by two controls is satisfied by one case (§8).
-    refs = set(REF_RE.findall(read(TEMPLATE)))
-    cases = set(CASE_RE.findall(read(DISPATCH)))
+    refs = set(REF_RE.findall(strip_html_comments(read(TEMPLATE))))
+    cases = set(CASE_RE.findall(strip_go_comments(read(DISPATCH))))
 
     dead = sorted(refs - cases)
     unreached = sorted(cases - refs)