A tmpfiles.d rule recreates a directory at boot with permissive ownership, undoing the tighter mode that the service requires after every restart

Permissions look correct after manual fixes, yet the next reboot reopens the security hole because tmpfiles policy rebuilds the directory differently from the service's expectation.