docs: document Linux service requirement

README.md

@@ -178,6 +178,8 @@ curl -fsSL https://git.example.com/awaioi/ERP/raw/branch/main/install.sh \
 
 命令行只做环境准备：优先使用已有的 Java 17+，缺少时通过当前系统的 `apt-get`、`dnf`、`yum`、`zypper` 或 Homebrew 安装 Java、curl、tar、Python 3 和 OpenSSL 3，然后下载并启动独立安装器。数据库信息不在命令行输入。
 
+Linux 生产服务要求主机使用 systemd；没有 systemd 的容器、WSL 或精简系统只能显式使用 `--no-service` 做开发验收，在线更新也会保持关闭。
+
 安装器启动后会输出带一次性令牌的局域网地址，例如：
 
 ```text

docs/online-install-and-update.md

@@ -44,6 +44,8 @@ curl -fsSL https://git.example.com/awaioi/ERP/raw/branch/main/install.sh \
 
 命令行只检查并安装 Java 17+、curl、tar、Python 3 和 OpenSSL 3，然后启动独立安装器并输出带一次性 token 的网页地址。数据库、管理员和密码全部在首次网页向导填写；安装器会真实测试 PostgreSQL 15+ 和 `pg_trgm`，迁移完成并确认正式服务健康后才写 `install.lock`，随后物理删除安装器目录。
 
+Linux 生产服务要求主机使用 systemd；没有 systemd 的容器、WSL 或精简系统只能显式使用 `--no-service` 做开发验收，在线更新也会保持关闭。
+
 当前 `http://38.76.196.225:10099` 仅用于开发测试，必须同时传入 `--allow-insecure`。HTTP 会暴露安装脚本、Release 元数据和 Gitea token，不应作为生产部署方式。
 
 ## 在线更新

install.sh

@@ -64,6 +64,14 @@ detect_platform() {
   fi
 }
 
+validate_service_manager() {
+  [[ "$PLATFORM" != "linux" || "$NO_SERVICE" == "1" ]] && return 0
+  command -v systemctl >/dev/null 2>&1 \
+    || fail 'systemd is required for a production Linux install; use --no-service only for development'
+  [[ -d /run/systemd/system ]] \
+    || fail 'systemd is not running on this Linux host; use --no-service only for development'
+}
+
 java_major() {
   local java_bin="${1:-java}"
   "$java_bin" -version 2>&1 | awk -F'[".]' '/version/ {print $2; exit}'
@@ -294,10 +302,11 @@ shell_setting() {
 prepare_layout() {
   if [[ "$PLATFORM" == "linux" ]]; then
     ERP_USER="${ERP_SERVICE_USER:-kaidi-erp}"
-    ERP_GROUP="$ERP_USER"
     [[ "$ERP_USER" =~ ^[a-z_][a-z0-9_-]*[$]?$ ]] || fail 'invalid Linux service user name'
     id "$ERP_USER" >/dev/null 2>&1 \
       || useradd --system --home-dir "$INSTALL_ROOT" --shell /usr/sbin/nologin "$ERP_USER"
+    ERP_GROUP="$(id -gn "$ERP_USER" 2>/dev/null)" \
+      || fail "unable to resolve the primary group for Linux service user: $ERP_USER"
     CONFIG_ROOT="${ERP_CONFIG_ROOT:-/etc/kaidi-erp}"
     STATE_ROOT="${ERP_STATE_ROOT:-/var/lib/kaidi-erp}"
     LOG_ROOT="${ERP_LOG_ROOT:-/var/log/kaidi-erp}"
@@ -506,6 +515,7 @@ detect_lan_address() {
 
 main() {
   detect_platform
+  validate_service_manager
   if [[ -z "$INSTALL_ROOT" ]]; then
     if [[ "$PLATFORM" == "linux" ]]; then
       INSTALL_ROOT=/opt/kaidi-erp

tests/release-scripts.test.sh

@@ -187,7 +187,7 @@ class Handler(BaseHTTPRequestHandler):
                 "prerelease": False,
                 "assets": [
                     {"name": archive, "browser_download_url": base + "/" + archive},
-                    {"name": f"kaidi-erp-installer-{version}.jar", "browser_download_url": base + f"/assets/kaidi-erp-installer-{version}.jar"},
+                    {"name": f"kaidi-erp-installer-{version}.jar", "browser_download_url": base + f"/kaidi-erp-installer-{version}.jar"},
                     {"name": "SHA256SUMS", "browser_download_url": base + "/SHA256SUMS"},
                     {"name": "SHA256SUMS.sig", "browser_download_url": base + "/SHA256SUMS.sig"},
                 ],
@@ -456,6 +456,19 @@ test_installer_requires_explicit_gitea_url() (
   [[ "$status" -ne 0 && "$output" == *'Gitea URL is required'* ]]
 )
 
+test_linux_service_preflight_requires_systemd() (
+  local tmp output status=0
+  tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-systemd-test.XXXXXX")" || return 1
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/bin"
+  source "$PROJECT_ROOT/install.sh"
+  PLATFORM=linux
+  NO_SERVICE=0
+  output="$(PATH="$tmp/bin" validate_service_manager 2>&1)" || status=$?
+  [[ "$status" -ne 0 && "$output" == *'systemd'* ]] || return 1
+  NO_SERVICE=1 PATH="$tmp/bin" validate_service_manager
+)
+
 test_no_service_install_disables_online_update() (
   local tmp
   tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-no-service-test.XXXXXX")" || return 1
@@ -506,6 +519,7 @@ run_test 'update helper rolls back an unhealthy release end to end' test_update_
 run_test 'update helper rejects a concurrent process' test_update_lock_rejects_concurrent_process
 run_test 'installer moves database setup to the web wizard' test_installer_moves_database_setup_to_web_wizard
 run_test 'installer requires an explicit Gitea URL' test_installer_requires_explicit_gitea_url
+run_test 'Linux production install requires systemd' test_linux_service_preflight_requires_systemd
 run_test 'no-service install disables online update' test_no_service_install_disables_online_update
 run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token
 run_test 'installer starts correctly when piped to bash' test_installer_runs_when_piped_to_bash