pivot to a systemd unit for the online hook

docs/TODO.md

@@ -146,11 +146,18 @@ boot LAN.
     `/dev/nvme-fabrics` exists; only the connect trigger is missing. A job
     placed on the *main* initqueue from a settled hook gets registered but is
     **never re-executed** once the loop blocks on udev events (verified: job
-    present, manual `connect-all` works, namespace stays absent). **Fixed:** a
-    dedicated `initqueue/online` hook (`nvmf-connect.sh`, installed via
-    `inst_hook initqueue/online 90`) runs `nvme connect-all` when network-legacy
-    sources online hooks on DHCP-bound — the event-driven trigger the nvmf
-    module omits. **⚠ The secure path has the same dependency on the
+    present, manual `connect-all` works, namespace stays absent). An
+    `initqueue/online` hook also does NOT work: this initramfs is **systemd-
+    driven** ("A start job is running for /dev/mapper/root") and never sources
+    dracut online hooks on link-up (verified: hook installs as
+    `90-nvmf-connect.sh` but never fires — no log, no stamp). **Fixed:** the
+    connect is now a **systemd unit** (`nvmf-connect.service`,
+    `ConditionKernelCommandLine=rd.dot1x=0`, `Before=initrd-root-device.target`)
+    whose ExecStart (`/usr/sbin/nvmf-connect`) polls for the network then runs
+    `nvme connect-all` until the namespace appears. The dracut module installs
+    the unit + script and enables it via an `initrd-root-device.target.wants`
+    symlink; `diskless.pkr.hcl` hard-asserts the unit is in the initramfs.
+    **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire
     a working autoconnect). Currently only the test path is fixed.