plans: installer I1/I3 brief, the stack user's stack-release.sh runs from its own clone of the release bundle (darkwing question, sage-1561)

docs/plans/2026-10-20_installer-rows.md

@@ -84,6 +84,15 @@ shared helper moves, and the `docs/TOOLS.md` and `packages/cli/README.md` lines
 - `stack-copy.sh wrapper ID --create`. It writes the first wrapper only when none exists at the wrapper
   path, and refuses when one does. Without `--create`, today's refusal on a missing wrapper stays.
 
+Where the stack user's `stack-release.sh` runs (darkwing on sage-1558, ruled sage-1561): from the stack
+user's own clone of the release bundle under its home, as in r6 step 2b. Each upgrade fetches the new bundle
+into that clone's `refs/heads/refactor` and `refs/remotes/origin/refactor`. So `check_target`'s reachability
+(`scripts/stack-release.sh:226`, `:258`), the plan's commit list (`:929-938`) and status drift (`:1220`)
+work unchanged under `external`, and I1 changes no reachability rule. "A VM has no such checkout" above
+means no canonical development checkout. The stack user never runs from root's checkout, and nothing adds
+`safe.directory`. `copy --bundle` still ships, for the first copy before the clone exists and as the
+release identity.
+
 The installer driver that calls these verbs as root is I3, and the install is I2. I1 has no root step and
 calls no `sudo`.
 
@@ -172,7 +181,8 @@ I3 says so and Gosalyn adds it to I2.
   `/srv/mosaic/.local/bin` (D :124), per C2-13a's `--claude` rule.
 - bubblewrap, the AppArmor profile, `dpkg-statoverride`, the no-new-privs test, the pins, `hostcheck`, the
   apt hook and the boot unit (r6). These are for any host that runs bwrap, so .54 gets them too.
-- The release transport: the bundle file, and root's checkout made from it.
+- The release transport: the bundle file, root's checkout made from it, and the stack user's own clone of
+  the bundle under its home (I1). Upgrade fetches each new bundle into both.
 - The machine-grant enrollment step, once per host (Gizmoduck's design r1 f6b6a04b6 section 3, as changed
   by its review and mos-1120). Mos sent Q-O1 to ops-01 (mos-1121). Until that design is approved, this
   item names the design and its open question and has no commands.