[Service]
# Stage 3A.2: preserve ProtectSystem=strict; carve out only the canary status directory
# and the network-backed SHiRE Academy evidence tree. No backup-root or practice-state writes.
ReadWritePaths=/home/shire3d/ARMOR/apps/shire-academy/runtime
ReadWritePaths=/mnt/shirevault-network/SHiREVault/SHiREAcademy