albok-dev's host ask under Prime's goal "land all of u6". A 20 GiB LUKS2 file
with ext4, keyed only from the vault (piped over ssh, never on the host's
disk). The mountpoint is immutable while unmounted, and the mounted root is
1500:1513 0750 with .albok-wing. The parent is bound into the container with
rslave propagation: a lock then unlock with the service running showed through
without a restart. The wing is not in albok.yaml yet (albok-dev's release).
Runbook and backup posture are in the README.
vh
767b3af409