[Unit]
Description=BGF reinstant / full system alias (BGS+BGF · TX/RX · all of it)
Documentation=file:///home/default/Desktop/x/Build/cover.sh
After=local-fs.target

[Service]
Type=oneshot
User=default
Group=default
WorkingDirectory=/home/default/Desktop/x
Environment=HOME=/home/default
Environment=PATH=/usr/local/bin:/usr/bin:/bin
# cover.sh uses SUDO_PASS for drop_caches only · local desk
Environment=SUDO_PASS=mememe
Nice=10
# full cook · thrash + drop_caches + peel + wire
TimeoutStartSec=900
# same path as bgs-bgf-full · prefer timer bgs-bgf-full.timer for repeat
ExecStart=/home/default/Desktop/x/Build/cover.sh full
SyslogIdentifier=bgf-reinstant

# lite sandbox · needs home + /proc + sudo for drop_caches
NoNewPrivileges=false
PrivateTmp=true
ProtectSystem=full
ProtectHome=false
ReadWritePaths=/home/default/Desktop/x/out /home/default/.local/state
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK

[Install]
WantedBy=multi-user.target