docs(R-7b): finding (f) now points at ROADMAP R-29, with the dating and diagnosis

The gate landed v0.125.0 (2026-07-13), realVolumeSize landed v0.129.0 (2026-07-14)
-> red for 16 releases unnoticed. Records that the flagged mount is a NAMED VOLUME
(the safe shape) so the fix is an allowlist entry, not a rewrite of correct code.
This commit is contained in:
2026-07-18 15:17:12 +02:00
parent cc50918244
commit 57be785bad
+16 -3
View File
@@ -93,9 +93,22 @@ for the live leg — six green red-proofs did not catch it.
raw stack name in Hungarian prose, but the shares source is a sibling and never flows through the
capture-set helpers, so `_shares` cannot reach them. Verified rather than assumed; no edit made.
**(f) Pre-existing gate failure, untouched.** `scripts/docker_run_volume_path_gate.py` fails on
`internal/appexport/estimate.go:179`. It fails identically on the unmodified tree (verified by
stashing), predates this work, and is out of scope. All six other gates pass.
**(f) Pre-existing gate failure, untouched → now tracked as ROADMAP R-29.**
`scripts/docker_run_volume_path_gate.py` fails on `internal/appexport/estimate.go:179`. It fails
identically on the unmodified tree (verified by stashing), predates this work, and was out of scope.
All six other gates pass. Dated afterwards for the roadmap entry: the gate landed 2026-07-13
(v0.125.0) and `realVolumeSize` landed 2026-07-14 (v0.129.0, the CAMPAIGN-4 F-A fix), so **the gate
has been red continuously for 16 releases** without anyone noticing — the second instance of the
"gate silently red" class after the v0.123.0 Windows read-only-fsync note.
The finding itself is benign: the flagged call mounts a **named volume**
(`-v <volumeName>:/vol:ro`), which is daemon-side with no host path — the *safe* shape, and the same
pattern as three entries already on the gate's allowlist. It is not the path-strand class the gate
exists to catch; the v0.129.0 author avoided that class deliberately (the function's comment says so)
and merely never added the allowlist entry. **The correct fix is an allowlist addition with its WHY,
not a docker-cp rewrite** — R-29 records that explicitly so nobody "fixes" it by rewriting a call that
is already correct. The systemic half of R-29 is the one that matters: the gates run only when a human
remembers to, so a red gate can survive 16 releases of REPORTs claiming green.
## 5. Tests