gosalyn: Case 2 C2-13 brief cites stack-copy.sh's copy id rule

docs/plans/2026-10-20_case2-rows.md

@@ -750,8 +750,9 @@ precheck take `--profile factory|library`, default `library`:
 - It renders the unit from the checkout's template, with the user, the home and the copy id as inputs.
 - It refuses unless `User=`, `Group=`, `ExecStart=` and the hardening lines match fixed values. The
   copy id is the one part of `ExecStart=` that varies, so a re-pin to a new copy can re-render the
-  unit (row 195). It must be exactly 40 lowercase hex characters naming an existing directory directly
-  under `<home>`'s copies dir. Anything else refuses before the render.
+  unit (row 195). It must be exactly 40 lowercase hex characters naming a copy that holds `scripts/mosaic`,
+  directly under `<home>/.local/share/mosaic-stack/copies`. That is the rule `copy_root` uses
+  (`scripts/stack-copy.sh:6`, `:20`). Anything else refuses before the render.
 - It refuses any `PermissionsStartOnly=`, and any `Exec*=` value whose leading run of prefix
   characters (`@`, `-`, `:`, `+`, `!`) holds a `+` or `!`. systemd takes those prefixes in any order,
   so `-+/srv/mosaic/x` runs as root even with `User=mosaic`. The named-line check doesn't read these