Under HOME=/root the home-literal clause of standsAsAccountName (internal/adapter/scanner/identity.go) hard-fails every absolute path whose last segment is named root: /sys/fs/cgroup/root, an overlay filesystem's .../root, macOS root's own /var/root. The clause accepts the generic login wherever it closes the home literal, so that a blob-shaped ...0/root/deck.key that home_path_self's leading anchor declines is still caught; but a /root that is a deeper segment of an absolute path is a directory named root, not the caller's home, and the rule refuses the write or the launch on it. It blocks rather than leaks, so it is a nitpick; it came in with the generic floor on this lane (review item 7).

Under HOME=/root the home-literal clause of standsAsAccountName (internal/adapter/scanner/identity.go) hard-fails every absolute path whose last segment is named root: /sys/fs/cgroup/root, an overlay filesystem's .../root, macOS root's own /var/root. The clause accepts the generic login wherever it closes the home literal, so that a blob-shaped ...0/root/deck.key that home_path_self's leading anchor declines is still caught; but a /root that is a deeper segment of an absolute path is a directory named root, not the caller's home, and the rule refuses the write or the launch on it. It blocks rather than leaks, so it is a nitpick; it came in with the generic floor on this lane (review item 7).

Grounds

• pursued: under a single-segment home a same-named deeper segment of an absolute path is not reported, while the blob-shaped literal still is; /sys/fs/cgroup/root flagged under HOME=/root, or tEXtCreator0/root/deck.key unflagged, would show it wrong.