gatewayd: config, [approvals] users and socket

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

docs/runbook.md

@@ -423,13 +423,17 @@ file or a directory, then this entry.
 
 **Why.** `gatewayd` could not read or parse `gatewayd.toml`, or a value in it is not allowed: a
 `url` that is not `http://` or `https://` with a host and an optional port, an id that is not 26
-characters of `a-z0-9`, an empty `[allow] users`, or a secret with not exactly one of `credential`,
-`env` and `file`. Or it could not create `<home>/gateway/`. It will not guess at a configuration
-that decides who it answers.
+characters of `a-z0-9`, an empty `[allow] users`, an id in `[approvals] users` that is not also in
+`[allow] users`, or a secret with not exactly one of `credential`, `env` and `file`. Or it could
+not create `<home>/gateway/`, or could not listen on `gateway.sock` (its directory is made 0700
+and the socket 0600, as `brokerd`'s are; a path of 108 bytes or more cannot be a socket). It will
+not guess at a configuration that decides who it answers and who approves.
 
 **Confirm.** The line says which: `<config path>: …` for the file (unknown keys are errors; check
-it against `docs/specs/2026-09-23-m4a-gateway.md`, section 3), or `cannot prepare <dir>: …` for the
-directory (`ls -ld <dir> "$(dirname <dir>)"`).
+it against `docs/specs/2026-09-23-m4a-gateway.md`, section 3, and
+`docs/specs/2026-09-24-m4b-approvals.md`, section 3), `cannot prepare <dir>: …` for a directory
+(`ls -ld <dir> "$(dirname <dir>)"`), or `cannot listen on <socket>: …` for `gateway.sock`
+(`Address already in use` means another `gatewayd` runs: `pgrep -x gatewayd`).
 
 **Fix.** Correct the file or the directory's ownership. A user id is shown in Mattermost under the
 user's profile, or by `GET /api/v4/users/username/<name>`.