docs(ops): document volatility triage path dedup

[cursor]

Description

collect_plugin_volatility_metadata now keys plugin paths by resolved path plus default section (#1868, already on main). These notes record that contract so operators can read scan_manifest_*.yaml → plugin_metadata.volatility_triage without guessing.

Same file, same default section, two spellings (relative and absolute) produce one triage row. The first spelling stays in source_file. patterns_plugin_file plus a legacy key on that same path stays two reads, because the default sections differ. A bare YAML list under patterns_plugin_file is read as regex_patterns, so the same bytes on regex_overrides_* repeat those rows. Detector merge and finding rows follow docs/SENSITIVITY_DETECTION.md.

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / maintenance
• Other (describe):

Issue linking (required)

No issue closed: #1868 is already closed in code; this PR only documents the shipped collector.

• This PR links the issue with Closes #NNNN or documents No issue closed: above

Docs added/updated

• docs/TECH_GUIDE.md and docs/TECH_GUIDE.pt_BR.md — path-spelling rules for volatility_triage
• docs/PLUGIN_AUTHOR_GUIDE.md and docs/PLUGIN_AUTHOR_GUIDE.pt_BR.md — author-facing pitfall
• docs/primers/FORENSICS_AND_EVIDENCE_PRIMER.md and .pt_BR.md — pointer from the forensics primer
• CHANGELOG.md — 1.8.0-rc bullet

Codepaths

• config/plugin_validator.py (_plugin_path_entries_from_config, collect_plugin_volatility_metadata)
• report/scan_evidence.py (writes plugin_metadata.volatility_triage)
• Tests already on main: tests/test_plugin_schema.py

Knowledge gap

Relative and absolute spellings of one plugin file no longer duplicate triage rows when the keys share a default section. Listing the same file on patterns_plugin_file and a legacy key still does.

🧱 Checklist de Integridade

• Python: uv run pytest e uv run ruff check . sem erros. (Docs guards passed: locale, markdown lint, external plan-link. Full ./scripts/check-all.sh exited 1 on this image: Pester Maestro-GateReadiness needs a DataBoar/maestro clone that this token cannot read. Unrelated to this diff.)
• Rust Core: cargo clippy --locked passou no motor nativo. (cargo fmt --check, cargo check, and cargo test passed with rustc 1.99.0. Clippy was not run.)
• Performance: Validei que o benchmark não caiu abaixo de 0.574x.
• Drift Doc: O README.pt_BR.md reflete as mudanças atuais (LCM nível 1). (No README change; the contract lives in TECH_GUIDE / plugin author guide.)
• Léxico: Verifiquei se não há "anglicismos sintáticos" ou traduções artificiais.

  

---

Note

Low Risk
Markdown and changelog updates only; no runtime or API behavior changes in this diff.

Overview
Documentation-only follow-up for behavior already shipped in #1868: how plugin_metadata.volatility_triage in scan_manifest_*.yaml treats duplicate config path spellings.

Adds EN/pt-BR contract text in TECH_GUIDE, PLUGIN_AUTHOR_GUIDE, and the forensics primer: collect_plugin_volatility_metadata keys paths by resolved path + default section; relative and absolute paths to the same file collapse to one triage row when keys share a section (e.g. regex_overrides_file vs regex_overrides_files), with the first spelling kept in source_file. patterns_plugin_file plus a legacy key on the same file stays two reads (different default sections); bare lists under unified file vs regex_overrides_* can still duplicate rows. Detector merge is explicitly unchanged.

CHANGELOG gets a 1.8.0-rc bullet for the above. TESTING (EN/pt-BR) documents pytest -W error after Starlette 1.7.0 removed the BlockingPortal filterwarnings workaround (#1915).

^{Reviewed by Cursor Bugbot for commit 5e20efc. Bugbot is set up for automated code reviews on this repo. Configure here.}