# The protected view of the agent's per-role log sockets (isolated-exec
# design §3.2, §6.4): /run/carlos/.logs bound onto /run/carlos/logs with
# nosymfollow. This directory is bound into NO instance namespace; the
# mount option is for the transition release, in which unisolated flat
# tenants still share the agent's uid and could otherwise turn a log
# socket path into a symlink that PID 1 opens as root for some unit's
# stdout (codex R3-1). See data-instances.mount for the ordering.
[Unit]
Description=carlos instance log sockets (bind, nosymfollow)
DefaultDependencies=no
After=systemd-tmpfiles-setup.service
Before=carlos-edge.service carlos-instance-control.service
Conflicts=umount.target
Before=umount.target

[Mount]
What=/run/carlos/.logs
Where=/run/carlos/logs
Type=none
Options=bind,nosymfollow,nosuid,nodev,noexec

[Install]
WantedBy=multi-user.target