v0.328.0 (unreleased): live finding on 9201 (rc.4) — roots resolved through their nearest existing ancestor; no symlink resolve for the placeholder check

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/privpolicy/privpolicy_test.go

@@ -417,3 +417,24 @@ func TestAdmit_HDDPathRootIsAppdataOnly(t *testing.T) {
 		}
 	}
 }
+
+// Found live on 9201 (rc.4): with Resolve set, roots that do not exist yet (a drive folder not created, or the
+// placeholder env) made every bind "outside". A root is resolved through its nearest existing ancestor too.
+func TestAdmit_RootsThatDoNotExistYet(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "mnt", "felhom-drives"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	resolve := func(s string) (string, error) {
+		r, err := filepath.EvalSymlinks(filepath.Join(root, s))
+		if err != nil {
+			return "", err
+		}
+		rel, _ := filepath.Rel(root, r)
+		return "/" + rel, nil
+	}
+	c := "services:\n  app:\n    image: x/y:1\n    volumes:\n      - ${USERDATA_PATH}/media:/m\n      - ${HDD_PATH}/appdata/app:/c\n"
+	if err := Admit("app", []byte(c), PlaceholderEnv(), Policy{Resolve: resolve}); err != nil {
+		t.Fatalf("binds under roots that do not exist yet were refused: %v", err)
+	}
+}