4773809334
Found on the demo-felhom deploy leg: ensuring only <sysNS>/userdata/import left its parent at 755 root:root, because EnsureUserdataDir MkdirAll's intermediates at plain 0755 and chmods only the leaf. That made the system drive's userdata root the one on the box outside the 2775/gid-1000 convention.