deferred: gate runs mount the host pi auth file (Webby N4 on the row 197 proof driver, traced by Herb)

docs/plans/DEFERRED.md

@@ -270,6 +270,20 @@ at every gate. Started 2026-09-12 during the control board MVP.
   (`:1538`, `:1689`, `:1691`). For a later row that edits
   `stack-release.sh`. Webby N1 on row 238 r1 (REVIEW-r1.md, 433a95292,
   #1744). (2026-10-21)
+- **Gate runs mount the host's pi auth file.** `compose.yaml:43` mounts
+  `${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}` read-only into
+  the agent container. No suite sets `PI_AUTH_FILE`, so the
+  `test-task.sh` cases that call `scripts/run-task.sh`, and
+  `test-release.sh` through `release.sh` `health_check` (`:41-54`), run
+  Compose with the host file. Row 197's lane `cleanEnv`
+  (`scripts/testing/gate-lane.mjs:109`) keeps the default too: it neither
+  sets nor passes `PI_AUTH_FILE`. The mount is read-only, and the legacy
+  gate already worked this way before row 197. `test-auth.sh` uses its
+  own fixtures but calls `auth.sh`, not Compose. The fix: a fixture
+  `PI_AUTH_FILE` for the Compose-reaching cases, set by the suites or by
+  the lane's `cleanEnv`, and a test that no gate step mounts the host
+  default. It needs its own row. Webby N4 on the row 197 proof driver
+  (bba870ee9), traced by Herb (herb-0051). (2026-10-21)
 
 ## Queue