R-650 sweep 2026-09-23 — every docker exec a test reached, BEFORE the per-package stubs (trace of the guard's refusals, count × package × command):
     67 web	docker compose version
     46 backup	docker ps --format {{.ID}}	{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Image}} --filter status=running
     19 web	docker ps --format {{.ID}}	{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Image}} --filter status=running
     19 web	docker info --format {{.MemTotal}}
     11 stacks	docker compose ps -a --format json
     10 web	docker inspect --format {{.State.Running}} felhom-samba
      7 appexport	docker ps --format {{.ID}}	{{.Names}}	{{.Label "com.docker.compose.project"}}	{{.Image}} --filter status=runni
      6 web	docker ps -a --format {{.Names}}	{{.Image}}	{{.State}}	{{.Status}}	{{.Label "com.docker.compose.project"}} --no-trun
      4 stacks	docker-compose ps -a --format table {{.Name}}	{{.Image}}	{{.State}}	{{.Status}}
      4 stacks	docker ps -a --format {{.Names}}	{{.Image}}	{{.State}}	{{.Status}}	{{.Label "com.docker.compose.project"}} --no-t
      1 web	docker info --format {{.ServerVersion}}
      1 web	docker exec felhom-samba ip -4 route show default
      1 web	docker exec felhom-samba ip -4 -o addr show eth0
      1 system	docker info --format {{.MemTotal}}
      1 stacks	docker-compose down
      1 dockerexec	docker-compose volume create r650-decoy
      1 dockerexec	docker-compose ps -a
      1 dockerexec	docker volume create r650-decoy
      1 dockerexec	docker ps -a
      1 dockerexec	/usr/bin/docker volume create r650-decoy
      1 dockerexec	/usr/bin/docker ps -a

Resolution: api, stacks, web -> TestMain + dockerexec.RunWithStub (silent stub on PATH). backup, appexport, system -> no change needed: their tests pass with the refusal (they only read docker ps/info and tolerate an error); before tonight they read DooPlex's production container list. dockerexec -> its own decoys.

Full suite after: go build/vet rc=0; go test -count=1 ./... rc=0, 31 ok packages
