R-902 search: contact-mailer source NOT FOUND (DooPlex disks, web editor + history, 10 Gitea repos, build cache); binary kept in git; replacement plan; decoy suite takes a lock (two sessions' runs left a decoy planted)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

scripts/CHANGELOG.md

@@ -1,3 +1,9 @@
+## gates — the decoy suite runs one at a time (2026-10-08, fixed without a row)
+
+- `test_gate_decoys.py` takes an exclusive `fcntl.flock` on `.git/decoy-suite.lock` before planting anything. Two runs at
+  once in the shared worktree (two sessions running the gates together) had left a decoy planted for good
+  (`website/en/apps.html` without its Radicale logo, local only, restored). A second run now waits for the first.
+
 ## gates — the language globe (site_gates.py gates 3 and 13; 2026-10-08)
 
 - One language list, `LANGS = [("hu", "Magyar"), ("en", "English")]`, with `GLOBE_LABEL`. Gate 3 normalises the

scripts/test_gate_decoys.py

@@ -34,6 +34,14 @@ import sys
 
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 
+# ONE RUN AT A TIME (2026-10-08). The decoys mutate REAL files and restore them from a backup taken at plant time. Two
+# runs at once in the shared worktree (two sessions running the gates together) let run B back up a file run A had
+# already mutated, and B's "restore" then wrote A's decoy back for good: website/en/apps.html was left without its
+# Radicale logo, one step from a push. An exclusive lock makes a second run WAIT for the first.
+import fcntl
+_LOCK = open(os.path.join(ROOT, ".git", "decoy-suite.lock"), "w")
+fcntl.flock(_LOCK, fcntl.LOCK_EX)
+
 # ── WHAT THIS FILE COVERS ────────────────────────────────────────────────────────────────────────
 # Read by scripts/decoy_coverage_gate.py, which AST-parses this literal rather than grepping for
 # gate names — a substring search for coverage would be the very shape this sweep exists to find.