docs: close chpasswd guard task

1 files changed, 3 insertions, 1 deletions

diff --git a/todo.org b/todo.org
index 4cd0055..25db464 100644
--- a/todo.org
+++ b/todo.org
@@ -1461,7 +1461,9 @@ Parent spec: [[file:docs/specs/2026-07-09-audio-doctor-spec.org][docs/specs/2026
 
 ** TODO [#C] WireGuard import is now config-less — decide feature fate :feature:network:
 scripts/import-wireguard-configs.sh reads assets/wireguard-config/*.conf, but no configs ship in the repo anymore (removed as a public-leak fix; .gitignore blocks plaintext). Decide: remove the import feature entirely, or keep it and document dropping plaintext configs into the dir out-of-band at install time (they stay gitignored). If kept, confirm the script no-ops gracefully when the dir has no *.conf.
-** TODO [#C] Installer chpasswd unguarded — unloggable primary user :bug:solo:quick:
+** DONE [#C] Installer chpasswd unguarded — unloggable primary user :bug:solo:quick:
+CLOSED: [2026-07-20 Mon]
+Fixed (fa3135a): extracted set_user_password, which guards the chpasswd with error_fatal so a failure aborts loudly instead of silently leaving no password. Fake-chpasswd test pins the guard fires on failure and stays quiet on success.
 Grading: Major severity (fresh system's primary user can't log in) x rare edge case (chpasswd seldom fails) = P3 = [#C].
 archsetup:1168 runs =echo "$user:$pass" | chpasswd= with no guard, then unsets the password next line; set -e is off (line 21), so a silent failure leaves no password and no log entry. Fix: guard with error_fatal (report + "set it by hand: passwd $user") before unsetting. See findings doc (S2).
 ** TODO [#C] Installer nvme early module never built into initramfs :bug:solo: