say that the backend env leaf and file are agent-writable, and why that is accepted

nix/agent-modules/agent-service.nix

@@ -192,7 +192,10 @@ in
       read-write for recovery — see `docs/agent-lifecycle/persistence.md`'s "Cross-agent access to
       state"), so this credential is reachable by nothing but this agent
       and the host. Permissions should be `0600`, owned by the agent's
-      unix user. Loaded with a leading `-` (optional `EnvironmentFile`),
+      unix user. Whatever owner it was installed with, the file becomes
+      agent-owned at the container's next boot, so the agent can rewrite it;
+      it is no boundary the agent can't cross until the swarm secret store
+      replaces the file. Loaded with a leading `-` (optional `EnvironmentFile`),
       so a path that doesn't exist yet — an operator setting this option
       before creating the file, or a fresh host rebuild before state is
       restored — makes systemd skip it rather than refuse to start the

nix/agent-modules/backend-env.nix

@@ -18,6 +18,12 @@
 # systemd lets a later file override an earlier one, so the store's value wins
 # when there is one, and the file carries the agent when the store is down.
 #
+# The leaf's create grant cannot constrain content, so while the leaf is empty
+# the agent's own process can also create it with any text, and the store's
+# value then wins over the file. That is no wider than the file the agent
+# already owns: `./user.nix`'s `heal_own_dir` chowns the harness dir to the
+# agent at every activation, a gap the issue tracker has an open bug for.
+#
 # The unit runs as root because the file is root-owned `0600` where an operator
 # placed it. Root can still read the agent's `0400` store identity.
 {