diff --git a/controller/scripts/docker_run_volume_path_gate.py b/controller/scripts/docker_run_volume_path_gate.py
index 02a6a48..9ca77f0 100644
--- a/controller/scripts/docker_run_volume_path_gate.py
+++ b/controller/scripts/docker_run_volume_path_gate.py
@@ -16,6 +16,10 @@ ROOTS = ["internal", "cmd"]
 ALLOWLIST = [
     ("internal/appbackup/dbdump.go", '"psql", "-v"',
      "psql's own -v flag (ON_ERROR_STOP) — not a docker mount at all"),
+    ("internal/appexport/estimate.go", '"-v", volumeName+":/vol:ro"',
+     "realVolumeSize's container-view `du`: named-volume source (no host path) mounted read-only "
+     "into a throwaway alpine — docker resolves the volume name daemon-side, exactly the class of "
+     "the internal/backup/backup.go entry below. Reviewed 2026-08-02 (R-29 leg a)"),
     ("internal/appexport/export.go", '"create", "-v", volName+":/vol"',
      "named-volume mount (no host path): docker resolves volume names daemon-side; the tar "
      "itself streams via docker cp (v0.125.0)"),