docs: one canonical handoff, rewritten in place; F-035

Handoff documents were additive. HANDOFF-2026-08-19 opened by saying the
18 AUG document still applied in full and added to it. After ten sessions
a new assistant would face ten documents to read in date order and diff
mentally to work out what is currently true. That cost grows every
session and none of it is necessary.

docs/HANDOFF.md is now the only handoff, rewritten in place each session.
It is state, not a log. The dated ones move to docs/archive/ and stop
being required reading. It is standalone: everything still true from both
is carried forward.

Section 1 is invocation, stated as facts rather than demonstrated in
examples. That is the other half of the problem. runuser appeared only
inside example commands, so it could be learned by pattern matching but
not by reading, which fails exactly when an assistant composes a command
from scratch. That is what happened, and it is F-035: su cannot run as a
nologin service user, both commands returned the same message before
touching anything, and the output read as a broken repository when the
tree was clean and the suite passed. The F-027 class again.

Also stated as facts: bash tools/ not ./tools/, all repository operations
as mechcomp, Gitea SSH on 42022, pct push then chown, explicit timeouts,
journalctl not /var/log, systemd-run for long jobs, and assert the guest
is running before interpreting any pct exec result.

Not done: the same facts should be cross referenced from PROCESS.md. I no
longer had that file in view and would not patch a document I cannot see.

docs/FAILURES.md

@@ -836,6 +836,53 @@ decision.
 
 ---
 
+### F-035 — `su` cannot run as a `nologin` service user
+CT 100. Session handover.
+
+**Observed:** a new assistant opened a session with
+
+```
+pct exec 100 -- su - mechcomp -c 'cd /var/www/mechcomp && git log --oneline -1'
+pct exec 100 -- su - mechcomp -c 'cd /var/www/mechcomp && make test'
+```
+
+Both returned `This account is currently not available` and nothing else. With
+the same message for the repository check and the test run, the output reads as
+a broken clone or a broken container. Neither was true — the tree was clean and
+the suite passed.
+
+**Cause:** **Proven.** `mechcomp` is a service account:
+
+```
+mechcomp:x:999:996::/var/www/mechcomp:/usr/sbin/nologin
+```
+
+`su` starts the account's login shell, which is `nologin`, whose entire function
+is to print that message and exit. The account is fine. `runuser -u mechcomp --`
+executes the command directly without a login shell and works, which is what
+every command in the porting sessions used.
+
+**Correction:** use `runuser -u mechcomp -- <cmd>`. Never `su`. Recorded as an
+explicit fact in `HANDOFF.md` §1 rather than left to be inferred from examples.
+
+**Consequence:** Two things.
+
+**This is the F-027 class again — a tool failure reading as a condition
+failure.** Both commands failed identically and before touching anything, so the
+message describes the invocation, not the state. When every command in a group
+fails the same way, suspect the invocation before concluding anything about the
+system.
+
+**Operational facts must be stated, not demonstrated.** `runuser` appeared
+throughout the previous sessions only inside example commands, so it could be
+learned by pattern-matching but not by reading. That fails exactly when an
+assistant composes a command from scratch, which is what happened here. The same
+applies to `bash tools/...` over `./tools/...`, to Gitea's port 42022, and to
+running every repository operation as `mechcomp`. All are now stated as facts in
+`HANDOFF.md` §1.
+
+---
+
 ## Open, not closed
 
 | # | Status |
@@ -857,5 +904,6 @@ decision.
 | F-032 | **Closed** 2026-08-18. No correction required; encoded in `ct-baseline.sh`. |
 | F-033 | **Corrected** 2026-08-19. Restore path unreachable under `set -e`. |
 | F-034 | **Open** 2026-08-19. Reproduced unguarded; affects an unknown number of oracle cases. |
+| F-035 | **Corrected** 2026-08-19. Use `runuser`, never `su`; `mechcomp` is `nologin`. |
 
 Everything else is closed with a proven cause and a proven correction.