From 598ab639e9cf4df36f34ed9765c9731cf081a2e8 Mon Sep 17 00:00:00 2001
From: Miguel Jacq <mig@mig5.net>
Date: Sat, 27 Dec 2025 20:55:18 -0600
Subject: [PATCH] Add Technical_Decomp_Systemd

---
 Technical_Decomp_Systemd.md | 66 +++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 Technical_Decomp_Systemd.md

diff --git a/Technical_Decomp_Systemd.md b/Technical_Decomp_Systemd.md
new file mode 100644
index 0000000..bb92750
--- /dev/null
+++ b/Technical_Decomp_Systemd.md
@@ -0,0 +1,66 @@
+## enroll/systemd.py
+
+### UnitInfo (dataclass)
+
+#### Purpose: parsed subset of systemctl show <unit> for services.
+
+#### Fields:
+
+- name: unit name
+- fragment_path: main unit file path
+- dropin_paths: list of drop-in config files
+- env_files: resolved EnvironmentFiles entries (minus leading -)
+- exec_paths: parsed executable paths from ExecStart
+- active_state, sub_state, unit_file_state, condition_result
+
+#### Lifecycle / where it’s used:
+
+- Returned by get_unit_info().
+- harvest.harvest() uses it to:
+    - infer packages (dpkg_owner on fragment + exec binaries)
+    - add /etc/... candidates from dropins/env files
+
+__________________
+
+### UnitQueryError (exception class)
+
+#### Purpose: a structured error when systemctl show fails for a unit.
+
+#### Fields set in __init__:
+
+- unit: unit name that failed
+- stderr: trimmed stderr text
+
+#### Message:
+
+systemctl show failed for <unit>: <stderr>
+
+#### Lifecycle / where it’s used:
+
+Raised by get_unit_info() if systemctl returns nonzero.
+
+harvest.harvest() catches it and records a ServiceSnapshot with empty packages/files and a note containing the error string.
+
+____________________
+
+### TimerInfo (dataclass)
+
+#### Purpose: parsed subset of systemctl show <unit> for timers.
+
+#### Fields:
+
+- name
+- fragment_path
+- dropin_paths
+- env_files
+- trigger_unit: parsed from Unit= field (what the timer triggers)
+- active_state, sub_state, unit_file_state, condition_result
+
+#### Lifecycle / where it’s used:
+
+Returned by get_timer_info().
+
+harvest.harvest() uses timers to attribute timer override files under /etc to:
+- the triggered service role (preferred), else
+- a package role, else
+- let it fall through and potentially get captured by etc_custom.
\ No newline at end of file