R-389: key the operator cooldown per app for app_start_failed; gate 11 makes an unfiled observation refuse the push

The cooldown key was customerID:eventType plus the tier and run suffixes, and
none of them names an app, so every app going down inside the same hour
collapsed onto one key and only the first was mailed. Measured on demo-hp:
bookstack sent 09:27:51, privatebin suppressed 09:31:51 under
key=demo-hp:app_start_failed.

cooldownStackSuffix is the third sibling of cooldownTierSuffix and
cooldownRunSuffix, and separate for the reason the second one's docstring
already gives: the existing two keep byte-identical semantics for every type
that uses them.

It is ALLOW-LISTED to app_start_failed and takes the event type as well as the
details, unlike its siblings, and that asymmetry is the safety property. The
backup family's cooldown is coarse ON PURPOSE (R-97a, R-182) so one full disk
sends one digest rather than one mail per app - and crossdrive_failed is
severity error, reaches the operator leg, and carries stack_name through a
DIFFERENT struct, so a payload-shape rule would have split it silently. The
hour itself does not change.

Gate 11 refuses a push whose REPORT.md carries an observation with neither
`FILED: R-NNN` nor `NOT-A-FINDING: <reason>`. It deliberately does NOT accept a
passing mention of some other R-number: the lost item cited R-182 as an analogy,
so "cites a register row" would have passed the very item the gate exists to
catch. That discrepancy with the spec is recorded in the gate's docstring.

Registered here and in the controller and agent runners. NOT in the catalog
runner - it has no shared-gate mechanism and appends --all to every gate;
filed as R-391 rather than left as a sentence, which is this session's lesson.

PROMPT-TEMPLATE.md §15.9 corrected: "documented, NOT acted on" was the wording
that invited the gap, and it now names the markers and points at the gate.

R-390 filed for the golden-bake runbook's missing `pveam update`.
Hub tests 709 -> 716.

scripts/repo_gates.py

@@ -18,6 +18,19 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
   8. wire-contract   every emitted field is decodable by its receiver (G-1)
   9. hub-copy        the hub's customer-facing words, against the retired-name list (R-324)
  10. due-checks      a dated check in OPEN-ITEMS.md that has come due (R-341)
+ 11. observations    a REPORT.md observation with no register row behind it (R-389)
+
+WHY 11 IS HERE (2026-08-24, R-389). On 2026-08-23 a session measured on live hardware that only the
+FIRST broken app per hour reaches the operator — the notification cooldown keys on the event type,
+not on the app. It was real, reproducible, and written under `## Observations` in `REPORT.md`. It was
+written NOWHERE ELSE. `REPORT.md` is overwritten every session by this project's own convention, so
+the finding had a lifetime of exactly one session and had to be re-derived the next day. That is
+gate 10's shape one surface over — a commitment recorded in prose that nothing enforces — and the
+instruction invited it: PROMPT-TEMPLATE.md §15 asked for observations "documented, not acted on", and
+"documented" was satisfied by the paragraph. The template was corrected in the same session; **this
+gate is the mechanism that correction points at.** It REFUSES rather than warns, for gate 10's
+reason. It PASSES quietly when there is no observations section, deliberately — a gate that taxes
+every push is one that gets disabled within a week. `--fast` (stdlib file reads only).
 
 WHY 10 IS HERE (2026-08-18, R-341). R-341 booked two dated measurements — +24 h and +7 d —
 as a sentence inside a register row. Nothing read those dates, and nothing would have said a word
@@ -93,6 +106,9 @@ GATES = [
     # finding sat in ROADMAP.md for 25 days invisible to every "grep the register" rule and was
     # rediscovered by an overnight drill. Fast: two file reads.
     ("one-register",    os.path.join(SCRIPTS, "one_register_gate.py"),    [],      True),
+    # R-389 — a live finding lived in a REPORT.md observations paragraph and nowhere else, and
+    # REPORT.md is overwritten every session. Fast: stdlib file reads.
+    ("observations",    os.path.join(SCRIPTS, "observations_gate.py"),    [ROOT],  True),
 ]
 
 VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"}