[rennf93]

The decorator mixin family port (guard_core/decorators): the 25 config methods + the 9 base infra methods, the route-identity mechanism (the _guard_route_id equivalent), the shared revision cell, and the engine set_decorator_handler seam.

What lands

• src/Decorators/SecurityDecorator.php: the 25 config methods (requireIp, blockCountries, allowCountries, blockClouds, bypass, rateLimit, geoRateLimit, usageMonitor, returnMonitor, behaviorAnalysis, suspiciousFrequency, requireHttps, requireAuth, apiKeyAuth, requireAuthorizationHeader, requireHeaders, blockUserAgents, contentTypeFilter, maxRequestSize, requireReferrer, customValidation, detectionExclusion, timeWindow, suspiciousDetection, honeypotDetection) with reference semantics (uppercase country normalization, the block_clouds selector validity gate with the unknown-provider warning, the bypass union with decorator-time leniency, the auth/authorization-header mutual exclusion raising at application time, the ReDoS gate refusing unsafe user-agent patterns before decoration, the body-scan gate for body-reading return patterns, the parse_qs-shaped honeypot validator with Python truthiness). Plus the base infra: config, routeConfigRevision, getRouteConfig, routeConfigs, initializeBehaviorTracking, initializeAgent, and the five send_*_event emitters over the event bus (decorator_type inside the metadata, the agent_enable_events gate honored), and the getRouteDecoratorConfig static (the module-level helper).
• src/Decorators/RouteDecoration.php: the immutable decoration chain, the port of the decorator closures the mixin methods return; decorate() is the application step. Chaining never mutates the handler or a shared chain, so two factories built from one decorator never bleed into each other (the per-function guarantee).
• src/Decorators/DecoratedEndpoint.php: the stamped endpoint shell (invokable call-through; pattern shells throw LogicException).
• src/Decorators/RouteConfigRevision.php: the shared revision cell.
• Route identity (the _get_route_id port): the stamped id is reused only when this instance assigned it to this endpoint (stacked decorations share one config); otherwise the base id suffixes fix(unicode): table-driven NFKC with inert-subject fast path #2..#n. New routes seed enableSuspiciousDetection from enablePenetrationDetection like _ensure_route_config; every applied decoration bumps the shared cell.
• GuardEngine::setDecoratorHandler (the set_decorator_handler port): requests stamped with a route id resolve their RouteConfig through the handler's registry (the get_route_decorator_config flow), and decorator mutations rebuild the pipeline through the revision staleness seam.
• BehaviorRuleValidation::validateReturnPatternAgainstScanFlag: the single-pattern scan gate (the _validate_return_pattern_body_scan path), with the list validator refactored onto it.

Consumption

Decorated endpoints flow through the identical pipeline checks: adapters hand the registry (SecurityDecorator::routeConfigs()) to the existing path-pattern route maps, or stamp state->guardRouteId and let the engine resolve through the handler.

Tests

• bin/test_decorators.php (210 assertions) mirrors the reference decorator tests (test_base, test_mixins, test_route_id_per_function, the access-control country/cloud/bypass arms, the advanced honeypot matrix, the detection-exclusion arms) and joins the CI test steps, the coverage collect list and the Makefile runners. All four new files sit at 100% lines.
• The ip_ban initialization catch waiver moves with its shifted lines in .github/coverage-unreachable.php (same block, same proof).