Correct spec after final review: drop unworkable Windows 8 fallback, fix stale branch/key-destination wording

Co-Authored-By: Claude Sonnet 5 <[email protected]>

docs/superpowers/specs/2026-09-17-sshinstall-design.md

@@ -15,10 +15,10 @@ passwordless. Follows the exact usage convention already established by `apps.sh
 `apps.ps1` in this same repo (see `README.md`):
 
 ```bash
-curl -s https://git.edemilov.ru/edemilov/scripts/raw/branch/main/sshinstall.sh | sudo bash
+curl -s https://git.edemilov.ru/edemilov/scripts/raw/branch/master/sshinstall.sh | sudo bash
 ```
 ```powershell
-irm https://git.edemilov.ru/edemilov/scripts/raw/branch/main/sshinstall.ps1 | iex
+irm https://git.edemilov.ru/edemilov/scripts/raw/branch/master/sshinstall.ps1 | iex
 ```
 
 ## Key deployed
@@ -54,15 +54,17 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH/hWD8YgjVzA/9V364W4w2HiEpuPjKMQ/Id3SRlyriM
 3. **Install the SSH server, if not already present.**
    - Linux: `openssh-server` via the detected package manager (idempotent — package
      managers already no-op on an installed package).
-   - Windows: try `Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0` first
-     (native path, works on Windows 10 1809+ and 11, gets Windows-Update-maintained
-     binaries). If that cmdlet doesn't exist or the capability install fails (this is the
-     path that covers **Windows 8**, which has no such capability at all), fall back to
-     downloading the portable Win32-OpenSSH release zip, extracting it to
-     `C:\Program Files\OpenSSH`, and registering `sshd`/`ssh-agent` as services via
-     the bundled `install-sshd.ps1` (the same mechanism Windows 10/11 use internally,
-     just done by hand). One fallback path covers the edge case rather than a
-     Windows-8-specific branch.
+   - Windows: `Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0` (native
+     path, Windows 10 1809+ and 11, Windows-Update-maintained binaries).
+
+   **Revised 2026-09-17, after final review**: the original design also planned a
+   portable Win32-OpenSSH-zip fallback for Windows 8 (no `Add-WindowsCapability` at
+   all). Dropped — it depended on `Expand-Archive` (PowerShell 5.0+) and TLS 1.2
+   support neither of which exist on stock Windows 8's PowerShell 3.0/4.0, so the one
+   path that existed specifically for Windows 8 was guaranteed to fail on Windows 8. If
+   the capability isn't available, the script now just fails with one clear
+   unsupported-OS message instead of attempting a fallback that can't work. **Windows
+   support is 10/11 only**, not 8/10/11 as originally scoped.
 4. **Enable and start the service, if not already running.**
    - Linux: `systemctl enable --now sshd` (or `ssh` — service name varies by distro;
      check both).
@@ -78,7 +80,9 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH/hWD8YgjVzA/9V364W4w2HiEpuPjKMQ/Id3SRlyriM
      for port 22 doesn't already exist (the native capability install actually creates
      this automatically — the manual/portable fallback path needs to do it explicitly).
 6. **Deploy the embedded public key, idempotently.**
-   - Linux: append to the invoking (root) user's `~/.ssh/authorized_keys`, creating
+   - Linux: append to the invoking real user's `~/.ssh/authorized_keys` (the user who
+     ran `sudo`, resolved via `$SUDO_USER` — not literally `/root/`, unless the script
+     is run as root directly with no `sudo`), creating
      `~/.ssh` (mode `700`) and the file (mode `600`) if missing. Skip the append if the
      exact key line is already present (idempotent re-run).
    - Windows: **must** go into `%ProgramData%\ssh\administrators_authorized_keys`, not
@@ -133,7 +137,8 @@ approach — real-machine verification only). Plan:
    `administrators_authorized_keys` with correct ACLs (verify via `icacls`), and
    `ssh <target>` from a machine holding the laptop's private key connects with no
    password prompt.
-4. If a Windows 8 machine/VM is available, confirm the portable-binary fallback path
-   is actually triggered (not silently skipped) and produces the same end state.
+4. On a machine without the OpenSSH capability available (or an older Windows build),
+   confirm the script fails with the clear unsupported-OS message rather than
+   attempting an install.
 5. Confirm a non-elevated run on both platforms fails fast with the one-line error and
    makes no changes.