decoy info: must never shadow /api/info
