Count root-reserved space for the OpenCode coverage image apt fetch

.github/workflows/opencode-review-dispatch.yml

@@ -953,7 +953,8 @@ jobs:
             cat >"$coverage_build_dir/Dockerfile" <<'DOCKERFILE'
           FROM docker.io/library/python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1
           ENV DEBIAN_FRONTEND=noninteractive
-          RUN apt-get update \
+          RUN printf '%s\n' 'APT::Sandbox::User "";' 'APT::Keep-Downloaded-Packages "false";' > /etc/apt/apt.conf.d/99-opencode-coverage-apt-disk \
+            && apt-get update \
             && apt-get install --no-install-recommends -y \
               ca-certificates \
               cargo \
@@ -974,7 +975,8 @@ jobs:
               util-linux \
               vulkan-tools \
               xz-utils \
-            && rm -rf /var/lib/apt/lists/*
+            && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* \
+            && rm -f /etc/apt/apt.conf.d/99-opencode-coverage-apt-disk
           COPY coverage-cargo-fixtures /tmp/coverage-cargo-fixtures
           RUN CARGO_HOME=/opt/coverage-cargo-home cargo fetch --locked \
                 --manifest-path /tmp/coverage-cargo-fixtures/Cargo.toml \

tests/test_opencode_coverage_apt_disk.py

@@ -0,0 +1,39 @@
+"""The coverage tool image must count root-reserved blocks for apt archives."""
+
+from pathlib import Path
+
+import yaml
+
+
+def test_coverage_tool_image_apt_uses_root_reserved_space() -> None:
+    """apt must not reject the coverage image fetch using only f_bavail."""
+
+    workflow = yaml.safe_load(
+        Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8")
+    )
+    steps = workflow["jobs"]["coverage-evidence"]["steps"]
+    script = next(
+        step["run"]
+        for step in steps
+        if step.get("name") == "Measure test and docstring evidence"
+    )
+    dockerfile = script.split("cat >\"$coverage_build_dir/Dockerfile\" <<'DOCKERFILE'\n", 1)[1]
+    dockerfile = dockerfile.split("\n          DOCKERFILE\n", 1)[0]
+    apt_layer = dockerfile.split("COPY coverage-cargo-fixtures", 1)[0]
+    sandbox = apt_layer.index('APT::Sandbox::User "";')
+    install = apt_layer.index("apt-get install --no-install-recommends -y")
+    assert sandbox < install
+    assert 'APT::Keep-Downloaded-Packages "false";' in apt_layer
+    assert "rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*" in apt_layer
+    assert "rm -f /etc/apt/apt.conf.d/99-opencode-coverage-apt-disk" in apt_layer
+    for package_name in (
+        "ca-certificates",
+        "cargo",
+        "llvm-19",
+        "r-base",
+        "r-cran-covr",
+        "r-cran-testthat",
+        "rustc",
+        "xz-utils",
+    ):
+        assert f"    {package_name} \\" in apt_layer

tests/test_pr_review_autofix_nvidia_nim_contract.py

@@ -17,7 +17,7 @@
 DOCTORING_RECORD = Path("docs/doctoring/hourly-nvidia-nim-autofix.md")
 CHANGELOG = Path("CHANGELOG.md")
 REVIEW_DISPATCH_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml")
-REVIEW_DISPATCH_BLOB_SHA = "cb3f10e0f616e0ae443206a22d379173fe5056b1"
+REVIEW_DISPATCH_BLOB_SHA = "7e7790eeb306dae9031ecbaf2eeee35caa3e6749"
 
 
 def _workflow_text(path: Path) -> str: