diff --git a/docs/plans/2026-10-20_case2-rows.md b/docs/plans/2026-10-20_case2-rows.md index 8ccb98ed5..a126f1fd0 100644 --- a/docs/plans/2026-10-20_case2-rows.md +++ b/docs/plans/2026-10-20_case2-rows.md @@ -750,8 +750,9 @@ precheck take `--profile factory|library`, default `library`: - It renders the unit from the checkout's template, with the user, the home and the copy id as inputs. - It refuses unless `User=`, `Group=`, `ExecStart=` and the hardening lines match fixed values. The copy id is the one part of `ExecStart=` that varies, so a re-pin to a new copy can re-render the - unit (row 195). It must be exactly 40 lowercase hex characters naming an existing directory directly - under ``'s copies dir. Anything else refuses before the render. + unit (row 195). It must be exactly 40 lowercase hex characters naming a copy that holds `scripts/mosaic`, + directly under `/.local/share/mosaic-stack/copies`. That is the rule `copy_root` uses + (`scripts/stack-copy.sh:6`, `:20`). Anything else refuses before the render. - It refuses any `PermissionsStartOnly=`, and any `Exec*=` value whose leading run of prefix characters (`@`, `-`, `:`, `+`, `!`) holds a `+` or `!`. systemd takes those prefixes in any order, so `-+/srv/mosaic/x` runs as root even with `User=mosaic`. The named-line check doesn't read these