berth updates

berth/ctrl/selftest.sh

@@ -231,7 +231,16 @@ check "a crash-looping container is flagged"   "1" "$(grep -c '! mongo .*restart
 check "an unbounded json log is flagged"       "1" "$(grep -c 'NO max-size' <<< "$hout")"
 check "reclaimable ≥ deficit → pruning is enough" "1" "$(grep -c 'Pruning is enough' <<< "$hout")"
 printf 'TYPE TOTAL ACTIVE SIZE RECLAIMABLE\nImages 3 3 5GB 0B (0%%)\n' > "$hfix/docker_df"
-check "reclaimable < deficit → pruning will NOT fix it" "1" \
+# Unknown is not zero. Without --admin, container logs are unsized, and they can
+# flip the verdict — 2026-09-16 printed "will NOT fix" on a 15 MB margin that
+# rested on counting them as 0. Unsized → undetermined, never a verdict.
+check "unsized logs + a shortfall → undetermined, not a verdict" "1 0" \
+    "$(o="$(bash ./host.sh check "$hfix" 2>&1)"; echo "$(grep -c Undetermined <<< "$o") $(grep -c 'will NOT fix' <<< "$o")")"
+printf '5000\t/var/lib/docker/containers/aaaaaaaaaaaa/aaaaaaaaaaaa-json.log\n' > "$hfix/admin_container_logs"
+check "sized logs map back to container names" "1" \
+    "$(bash ./host.sh check "$hfix" 2>&1 | grep -cE '^ +5000  mongo$')"
+: > "$hfix/admin_container_logs"
+check "measured and still short → pruning will NOT fix it" "1" \
     "$(bash ./host.sh check "$hfix" 2>&1 | grep -c 'Pruning will NOT fix')"
 rm -rf "$hfix"
 check "no snapshot is exit 1, not a silent pass" "1" \