R-1110: the guard's census is 42 calls, not 41 (measured; comment and CHANGELOG)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -26,7 +26,7 @@ burndown 3 (felhom.eu `REPORT-burndown-3-2026-10-17.md`).
   byte-identical compose (no recreate per pass). Every box with sharing on recreates samba ONCE after this update (the
   label is new). `TestRenderSambaCompose_ConfigHashLabel`, `TestSambaReconcile_SamePathRenameChangesCompose`, red-proved.
 - **R-1110** — `TestNoBareDrivePathToPathHelpers`: the R-1017 guard for `RecoveryUnitPath`, `AppDataDir` and
-  `PrimaryBackupPath`, through both packages (41 calls). All passed a namespace root; two only by a comment —
+  `PrimaryBackupPath`, through both packages (42 calls). All passed a namespace root; two only by a comment —
   `GetStackBackupData`'s parameter renamed `nsRoot` (its caller passes `AppNamespaceRoot`), and the storage page's app
   size (`appDetailsForPath`) now goes through `appbackup.NamespaceRootFor` (same path on an enrolled drive). Loop
   variables in `removed_units.go`, `offbox_placement.go`, `offbox.go` renamed. Red-proved three ways.

controller/internal/appbackup/userdata_bare_drive_guard_test.go

@@ -80,7 +80,7 @@ func TestNoBareDrivePathToUserdataDir(t *testing.T) {
 // AppDataDir and PrimaryBackupPath take a NAMESPACE ROOT too (the NamespaceRootFor contract names all four), and
 // package backup re-exports them, so both packages' calls are read. Same acceptance rule as above.
 //
-// THE CENSUS on 2026-10-17 (41 calls): every one passed a namespace root, but two only by a comment —
+// THE CENSUS on 2026-10-17 (42 calls): every one passed a namespace root, but two only by a comment —
 // stacks/delete.go GetStackBackupData's parameter was named drivePath (its one caller passes AppNamespaceRoot),
 // and web/handlers.go appDetailsForPath passed a registered StoragePath, which is its namespace root only while
 // the system drive is never a StoragePath. The first was renamed nsRoot; the second now goes through
@@ -118,7 +118,7 @@ func TestNoBareDrivePathToPathHelpers(t *testing.T) {
 		}
 	}
 	if len(calls) < 30 {
-		t.Errorf("the census found %d calls; 41 on 2026-10-17 — a shrink this large is a scope bug, not a cleanup", len(calls))
+		t.Errorf("the census found %d calls; 42 on 2026-10-17 — a shrink this large is a scope bug, not a cleanup", len(calls))
 	}
 	for _, v := range violations {
 		t.Errorf("%s:%d (%s): %s — the first argument is not a namespace root by construction. "+