Fix stuff

docs/TODO.md

@@ -157,6 +157,11 @@ boot LAN.
     `nvme connect-all` until the namespace appears. The dracut module installs
     the unit + script and enables it via an `initrd-root-device.target.wants`
     symlink; `diskless.pkr.hcl` hard-asserts the unit is in the initramfs.
+    Gotcha: `$systemdsystemunitdir` is **empty** in this dracut's module-setup
+    context — `inst_simple` then silently drops the unit (empty dest dir). Use a
+    `${systemdsystemunitdir:-/usr/lib/systemd/system}` fallback and `return 1`
+    if the unit didn't land, so the build fails loudly instead of shipping a UKI
+    that can't connect its root.
     **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire