decoy coverage: 8 exemptions removed (agent + catalog suites, R-426; 4 left, controller)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,7 @@
+## gates — decoy coverage: 8 exemptions removed (agent + catalog suites exist now; R-426) (2026-10-06)
+
+- `decoy_coverage_gate.py` EXEMPT: the five felhom-agent and three app-catalog entries are gone — each repo's `scripts/test_gate_decoys.py` COVERS them. 4 left, all felhom-controller.
+
 ## gates — R-426: the felhom.eu exemptions get decoys, and three gates that could be fooled are fixed (burn-down night, 2026-10-06)
 
 - R-426: hostinstall gate — the R-185 grant count now counts only real path-qualified invocations (the dry-run echo had stood in for a deleted grant) and the age-install check ignores commented-out lines; four decoys in test_gate_decoys.py, `felhom.eu/hostinstall` leaves the decoy-coverage EXEMPT list.

scripts/decoy_coverage_gate.py

@@ -43,24 +43,7 @@ EXEMPT = {
         "shared script; see felhom.eu. R-426.",
     ("felhom-controller", "observations"):
         "shared script; its decoy (R-419) lives in felhom.eu/scripts/test_gate_decoys.py.",
-    # felhom-agent — no decoy suite yet
-    ("felhom-agent", "reuse-refs"): "shared script; decoy in felhom.eu. R-426.",
-    ("felhom-agent", "instructions"): "shared script; decoy in felhom.eu. R-426.",
-    ("felhom-agent", "observations"): "shared script; decoy in felhom.eu. R-426.",
-    ("felhom-agent", "published"):
-        "R-426 — a network gate; a decoy needs a fake registry, which this sweep did not build.",
-    ("felhom-agent", "release-complete"):
-        "R-426 — the sweep's decoy (a non-version heading on top of CHANGELOG.md) was WITHDRAWN: "
-        "HEAD_RE.search scans the whole file, so the real release is still found and named. The "
-        "gate looked sound; no legitimate decoy has been constructed yet.",
-    # app-catalog
-    ("app-catalog-felhom.eu", "image-pins"):
-        "COVERED IN THE SWEEP: a real untagged `image:` line was REJECTED, and the `x-image:` decoy "
-        "was WITHDRAWN as illegitimate (x- fields are inert in Compose). R-426 tracks a suite.",
-    ("app-catalog-felhom.eu", "image-resolvable"):
-        "R-426 — needs a container runtime and the network; not a --fast gate.",
-    ("app-catalog-felhom.eu", "volume-persistence"):
-        "R-426 — 877 lines that actually run containers and diff them; not a --fast gate.",
+    # felhom-agent and app-catalog: covered by their own scripts/test_gate_decoys.py since 2026-10-06 (R-426)
 }
 
 RUNNERS = {