decisions: 106, Q103 agreed, rootless daemon beside the rootful one (I1-2)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -2345,3 +2345,32 @@ which stay with him. Each item names who decided it and what happened.
     - For decision 96, I1's direction is ratified and M1 is approved
       (decision 104). I1-2 to I1-4 are open. When T3 Mos retires is
       still Jason's call, after M3.
+106. **Q103 agreed: a rootless daemon beside the rootful one, I1-2
+    (2026-10-12).** Jason, relayed by Mos (sage-0075, recorded in
+    jason-master-restart DECISIONS.md): "Q103: agreed. Give me the steps
+    and I'll do it." Jason installed the packages: rootlesskit 3.2.0,
+    slirp4netns 1.3.6, libslirp 4.9.5, docker-rootless-extras 29.9.0
+    (AUR). Mos did the user-level setup.
+    - Sage checked it at 14:46Z, read-only. The endpoint
+      unix:///run/user/1000/docker.sock answers with server 29.7.2 and
+      security options seccomp, rootless and cgroupns. It uses cgroup
+      driver systemd v2, storage overlayfs, and data root
+      /mnt/storage/docker-rootless/data (jwoltje, mode 710, which
+      dockerd sets itself). User unit docker.socket is enabled and
+      active, docker.service is active, and linger is on.
+      DOCKER_HOST is unset, the CLI context is `default`, and the
+      rootful daemon still runs its 20 containers.
+    - Only the Mosaic containerized install uses the rootless daemon.
+      Nothing existing moves to it. The pi worker path stays on the
+      rootful daemon until it migrates under the I1 brief.
+    - The I1 brief pins the endpoint explicitly, never through the
+      ambient context or DOCKER_HOST. Before any launch it refuses
+      unless `docker info` on that endpoint lists `name=rootless`.
+      Neither engine socket is mounted into any container.
+    - Not fixed by this: jwoltje stays in the `docker` group, so any
+      host process under his uid can still reach the rootful daemon's
+      socket, which is root-equivalent. That is the same class as
+      decision 95's host-side limit and is recorded, not closed.
+    - `execution.backend` stays `docker`, and no allowlist change is
+      needed. How the endpoint gets into config is the brief's design
+      item. A config schema change goes through review like any other.