docs: v0.125.0 path-strand fix — CHANGELOG + REPORT (probe transcript, red-proofs, round-trip evidence, Tier-1/2 mechanism) + CONTEXT + REUSE + README flows; hollow-bundle asymmetry recorded (containerized ≤0.124.0 exports suspect — re-export); floor note for the next train

Claude-Session: https://claude.ai/code/session_01GzammAMzsJTgpQHqxwM2bC

CHANGELOG.md

@@ -1,5 +1,44 @@
 ## Changelog
 
+### v0.125.0 — .fab volume export/import: containerized path-strand data loss FIXED (IA finding 1, HIGH) (2026-07-13) — MinAgent: 0.81.0
+
+Both .fab volume legs streamed via `docker run -v <controller-temp-path>` host mounts — correct
+on bare metal, silently wrong under the golden containerized deployment (the daemon resolves the
+`-v` host side against the GUEST filesystem): the export's tar stranded host-side while the
+bundle shipped an EMPTY `data/volumes` and reported SUCCESS; the import then wiped the app's
+volumes and populated them from host-side emptiness. Live-hit on demo ActualBudget (v0.124.0
+validation). No .fab format change — but note the ASYMMETRY: **any bundle exported by a
+containerized controller ≤0.124.0 is suspect (hollow volume data) — re-export**; the new
+import-side guard refuses such bundles loudly instead of destroying the app.
+
+- **`docker cp` tar-streaming both legs** (`appexport/export.go` + `restore.go`, new `dockerExec`
+  seam): a stopped helper container pins the volume (`docker create -v <vol>:/vol alpine true`),
+  the tar streams over the docker API (`docker cp <cid>:/vol/. -` out; `docker cp - <cid>:/vol`
+  in) — ZERO shared paths, correct in both deployment shapes. §3 live probe proved content,
+  subdirs, symlinks, empty files and uid/gid round-trip. Helpers are ALWAYS force-removed, error
+  paths included (test-asserted); 10-min/volume timeouts + truncated stderr preserved.
+- **Export can no longer lie** (scenario B): a failed volume export is FATAL (was WARN+continue);
+  `assertBundleDataComplete` refuses to package any bundle whose manifest claims a tar that is
+  missing/empty (volumes AND HDD subdirs — the HDD leg also stopped pre-claiming subdirs before
+  the tar succeeds). Live-proven: an engine-invalid volume name failed the export naming the
+  volume, no bundle staged.
+- **Import validates BEFORE it destroys** (scenario C): `validateBundleData` refuses a
+  claimed-but-absent/empty data tar in step 0 — before the app is stopped and before any volume
+  is removed (the pre-fix order wiped first and discovered later); the refusal names the hollow
+  ≤0.124.0-exporter cause and states the app is untouched. `restoreVolumeData`/`restoreHDDData`
+  missing-tar soft-skips became hard errors (defense in depth).
+- **The class is extinct** (scenario D): `scripts/docker_run_volume_path_gate.py` — every `"-v"`
+  argument in non-test Go code must be allowlisted with its WHY; the Tier-1/2 volume dump/restore
+  entries are documented host-visible (registered-drive namespace paths under the golden
+  deployment's identical `/mnt` + `/opt/docker` binds), the rest are named-volume/flag usages.
+- Red-proofs: assertion removed → hollow-success test fails; pre-flight disabled → the
+  zero-destruction assertions fail (`removedVolumes=1`); a violating `-v` line → gate exits 1.
+- **Live §13**: supervised repeat of the exact failed leg on demo — export → download (bundle
+  now carries the 66048-byte volume tar) → drive placement → import → **volume fingerprint
+  byte-identical** (`ec8ea6cb…` before == after), app healthy, zero leaked helpers.
+- **NOTE for the next publish train:** the golden floor must not advance past 0.124.0 without
+  this fix; floor may advance to 0.125.0 now that it validates.
+
 ### v0.124.0 — backups IA restructure: four sub-pages, Felhom-offsite status card, .fab browser download (2026-07-13) — MinAgent: 0.81.0
 
 The nine-section backups page split into four sub-pages (operator review: customers got lost);