From 7b558acaeffae89ed95d200abe49da2c5fc21460 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 15 Oct 2026 12:38:37 +0900
Subject: [PATCH] Count root-reserved blocks for the coverage image apt fetch.

apt rejects the 339 MB archive fetch when Sandbox::User is set because that check uses f_bavail. An empty sandbox user makes the same root build count f_bfree, and the layer still drops the archive cache after install.
---
 .../workflows/opencode-review-dispatch.yml    |  6 ++-
 tests/test_opencode_coverage_apt_disk.py      | 39 +++++++++++++++++++
 ...t_pr_review_autofix_nvidia_nim_contract.py |  2 +-
 3 files changed, 44 insertions(+), 3 deletions(-)
 create mode 100644 tests/test_opencode_coverage_apt_disk.py

diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml
index cb3f10e0f6..7e7790eeb3 100644
--- a/.github/workflows/opencode-review-dispatch.yml
+++ b/.github/workflows/opencode-review-dispatch.yml
@@ -953,7 +953,8 @@ jobs:
             cat >"$coverage_build_dir/Dockerfile" <<'DOCKERFILE'
           FROM docker.io/library/python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1
           ENV DEBIAN_FRONTEND=noninteractive
-          RUN apt-get update \
+          RUN printf '%s\n' 'APT::Sandbox::User "";' 'APT::Keep-Downloaded-Packages "false";' > /etc/apt/apt.conf.d/99-opencode-coverage-apt-disk \
+            && apt-get update \
             && apt-get install --no-install-recommends -y \
               ca-certificates \
               cargo \
@@ -974,7 +975,8 @@ jobs:
               util-linux \
               vulkan-tools \
               xz-utils \
-            && rm -rf /var/lib/apt/lists/*
+            && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* \
+            && rm -f /etc/apt/apt.conf.d/99-opencode-coverage-apt-disk
           COPY coverage-cargo-fixtures /tmp/coverage-cargo-fixtures
           RUN CARGO_HOME=/opt/coverage-cargo-home cargo fetch --locked \
                 --manifest-path /tmp/coverage-cargo-fixtures/Cargo.toml \
diff --git a/tests/test_opencode_coverage_apt_disk.py b/tests/test_opencode_coverage_apt_disk.py
new file mode 100644
index 0000000000..7f0086aad5
--- /dev/null
+++ b/tests/test_opencode_coverage_apt_disk.py
@@ -0,0 +1,39 @@
+"""The coverage tool image must count root-reserved blocks for apt archives."""
+
+from pathlib import Path
+
+import yaml
+
+
+def test_coverage_tool_image_apt_uses_root_reserved_space() -> None:
+    """apt must not reject the coverage image fetch using only f_bavail."""
+
+    workflow = yaml.safe_load(
+        Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8")
+    )
+    steps = workflow["jobs"]["coverage-evidence"]["steps"]
+    script = next(
+        step["run"]
+        for step in steps
+        if step.get("name") == "Measure test and docstring evidence"
+    )
+    dockerfile = script.split("cat >\"$coverage_build_dir/Dockerfile\" <<'DOCKERFILE'\n", 1)[1]
+    dockerfile = dockerfile.split("\n          DOCKERFILE\n", 1)[0]
+    apt_layer = dockerfile.split("COPY coverage-cargo-fixtures", 1)[0]
+    sandbox = apt_layer.index('APT::Sandbox::User "";')
+    install = apt_layer.index("apt-get install --no-install-recommends -y")
+    assert sandbox < install
+    assert 'APT::Keep-Downloaded-Packages "false";' in apt_layer
+    assert "rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*" in apt_layer
+    assert "rm -f /etc/apt/apt.conf.d/99-opencode-coverage-apt-disk" in apt_layer
+    for package_name in (
+        "ca-certificates",
+        "cargo",
+        "llvm-19",
+        "r-base",
+        "r-cran-covr",
+        "r-cran-testthat",
+        "rustc",
+        "xz-utils",
+    ):
+        assert f"    {package_name} \\" in apt_layer
diff --git a/tests/test_pr_review_autofix_nvidia_nim_contract.py b/tests/test_pr_review_autofix_nvidia_nim_contract.py
index da69740c25..7a75c7bff2 100644
--- a/tests/test_pr_review_autofix_nvidia_nim_contract.py
+++ b/tests/test_pr_review_autofix_nvidia_nim_contract.py
@@ -17,7 +17,7 @@
 DOCTORING_RECORD = Path("docs/doctoring/hourly-nvidia-nim-autofix.md")
 CHANGELOG = Path("CHANGELOG.md")
 REVIEW_DISPATCH_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml")
-REVIEW_DISPATCH_BLOB_SHA = "cb3f10e0f616e0ae443206a22d379173fe5056b1"
+REVIEW_DISPATCH_BLOB_SHA = "7e7790eeb306dae9031ecbaf2eeee35caa3e6749"
 
 
 def _workflow_text(path: Path) -> str: