R-426: decoy-coverage names stale exemptions; dead offbox-rename entry removed

controller/offbox-rename kept its EXEMPT entry after R-425 gave it decoys, so
the debt list read longer than the debt. The gate now prints a STALE EXEMPTION
line for any exempt gate that has a decoy (named, not convicted: the decoy lands
in a sibling repo, and failing this repo's push for it would couple the two).
A check in test_gate_decoys.py plants a stale entry and asserts it is named;
seen to fail with the notice removed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/decoy_coverage_gate.py

@@ -37,9 +37,6 @@ EXEMPT = {
     ("felhom-controller", "docker-v"):
         "COVERED IN THE SWEEP, not yet in a suite: an unallowlisted `-v` host path in a new Go file "
         "was REJECTED (it uses os.walk). R-426 tracks moving it in.",
-    ("felhom-controller", "offbox-rename"):
-        "R-425 — the FILES list is fixed, so banned branding in a NEW offbox file is unscanned. The "
-        "decoy passes today.",
     ("felhom-controller", "reuse-refs"):
         "shared script; its decoy lives in felhom.eu/scripts/test_gate_decoys.py.",
     ("felhom-controller", "instructions"):
@@ -134,6 +131,7 @@ def main(argv):
     roots = argv[1:] or ["."]
     problems, inconclusive, lines = [], [], []
     total = covered = exempt = 0
+    stale = []
 
     for root in roots:
         root = os.path.abspath(root)
@@ -168,6 +166,12 @@ def main(argv):
             if label in covers:
                 covered += 1
                 lines.append("  COVERED   %-22s %-20s %s" % (name, label, covers[label][:60]))
+                # R-426 (2026-10-06): an exemption for a gate that HAS a decoy is a dead entry that keeps
+                # the debt list longer than the debt (controller/offbox-rename sat here after R-425 gave it
+                # decoys). Named, not convicted: the decoy lands in a sibling repo, and failing THIS repo's
+                # push for another repo's good news would couple the two for no safety gain.
+                if (name, label) in EXEMPT:
+                    stale.append((name, label))
             elif (name, label) in EXEMPT:
                 exempt += 1
                 lines.append("  exempt    %-22s %-20s %s" % (name, label, EXEMPT[(name, label)][:60]))
@@ -179,6 +183,11 @@ def main(argv):
     for l in sorted(lines):
         print(l)
 
+    if stale:
+        print()
+        for repo, label in stale:
+            print("  STALE EXEMPTION: %s / %s has a decoy now — delete its EXEMPT entry (R-426)" % (repo, label))
+
     if inconclusive:
         print()
         for i in inconclusive: