Auto create data folder

README.md

@@ -207,26 +207,20 @@ poll_interval_seconds = 300
 retention_days = 30
 ```
 
-The service uses the existing `www-data` account. If replacing an existing service,
-stop it before changing data ownership:
+The service uses the existing `www-data` account. Deployment creates `data/archive`
+as the `www-data` runner before restarting the service. For a manual installation,
+create the directory as that account before starting the service:
 
 ```bash
-sudo systemctl stop solar-relay
-```
-
-Create the writable data directory once. The ownership change includes
-any existing archive files and leaves their contents intact:
-
-```bash
-sudo install -d -o www-data -g www-data -m 0700 \
+sudo -u www-data install -d -m 0700 \
   /var/www/html/solar-relay/data /var/www/html/solar-relay/data/archive
-sudo chown -R www-data:www-data /var/www/html/solar-relay/data
 ```
 
 The unit keeps the checkout read-only with `ProtectSystem=strict` and allows writes
 to `/var/www/html/solar-relay/data` through `ReadWritePaths`. The data directory must
-exist before starting the service. Do not run archive-writing CLI commands as another
-user; use `sudo -u www-data` to preserve ownership.
+exist before starting the service; otherwise systemd exits with `226/NAMESPACE`
+before Python can create it. Existing data must be writable by `www-data`. Use
+`sudo -u www-data` for archive-writing CLI commands to preserve ownership.
 
 Set `[upload].url` to the main website's `https://your-solar-host/index.php?a=relay`.
 Put `SOLAR_RELAY_TOKEN=your-shared-token` in `/etc/solar-relay/solar-relay.env` with
@@ -304,7 +298,8 @@ www-data ALL=(root) NOPASSWD: /usr/bin/systemctl restart solar-relay
 
 The workflow installs dependencies and runs tests in `.venv-ci`, checks the installed
 unit, serializes deployment with `flock`, syncs source, installs runtime dependencies
-inside `.venv`, restarts and checks the service, then probes the public HTTPS health
+inside `.venv`, creates the archive directory if needed, restarts and checks the
+service, then probes the public HTTPS health
 endpoint with certificate verification. Runtime venv/configuration, `data/` and
 Parquet files are preserved. The archive under `data/archive` is protected by the
 `/data/` rsync exclusion, and the credential environment file under `/etc` is outside