docs: close unguarded chmod/cp cluster task

1 files changed, 3 insertions, 1 deletions

diff --git a/todo.org b/todo.org
index d00c708..c5d06c0 100644
--- a/todo.org
+++ b/todo.org
@@ -1658,7 +1658,9 @@ CLOSED: [2026-07-20 Mon]
 Fixed in 8917f2f: extracted crontab_append_once (dedup guard), zfs_scrub_timer_units (one timer per pool, warn on none instead of @.timer), and enable_user_service (wants-symlink; gamemode now uses it and syncthing folds into the shared helper). TDD via tests/installer-steps/test_idempotency_cluster.py.
 Grading: Minor severity x rare edge case (re-run after a mid-step failure) = P4 = [#D]. Group of small non-idempotent / wrong-target spots.
 crontab log-cleanup line duplicates on resume (archsetup:1713 — guard on absence); zfs scrub timer picks an arbitrary pool via =head -1= and yields =@.timer= when empty (archsetup:1857); gamemode enabled via =systemctl --user= which the script itself documents fails at install time (archsetup:2419 — use the manual wants-symlink like syncthing). See findings doc (S2, S3).
-** TODO [#D] Installer unguarded chmod/cp after non-fatal ops :bug:solo:quick:
+** DONE [#D] Installer unguarded chmod/cp after non-fatal ops :bug:solo:quick:
+CLOSED: [2026-07-20 Mon]
+Fixed in dd41036: extracted install_executable (guarded cp + chmod +x) for the two zfs scripts; guarded the two hypr-live-update-guard chmods inline with error_warn. TDD via tests/installer-steps/test_install_executable.py.
 Grading: Minor severity x rare edge case (only when a preceding non-fatal cp/clone failed) = P4 = [#D].
 With set -e off, unguarded chmod/cp hit missing/partial files silently: hypr-live-update-guard chmods (archsetup:2108/2144), zfs-replicate cp (archsetup:1820) leaving a service with a dead ExecStart, zfs-pre-snapshot cp (archsetup:1943) leaving a broken pacman hook. Fix: wrap each in =(...) >> log 2>&1 || error_warn=. See findings doc (S2, S3).
 ** TODO [#D] normalize-notify-sounds temp/atomicity can corrupt tracked file :bug:solo:quick: