Brad Anderson
18fa177049
Reported as a degraded host after a restart, and the status line named it exactly: ExecStart=/usr/local/bin/dejima-ci-allowlist, status=203/EXEC. The programs are installed to /usr/local/sbin. The unit had the path wrong since it was written. So the refresh timer has never worked on any host built by this. That is worse than a failing unit: the whole point of reading the allowlist from main is that merging a domain reaches the runners without anyone doing anything, and instead it only ever moved when someone ran the command by hand. The one visible sign was a service in the failed list, which reads as a fault in the thing it runs rather than as the file naming it. The cause is one this project keeps warning about and then committed itself: a path written down twice. The units carry @@BIN_DIR@@ now and install.sh substitutes what it is actually using, so there is one copy and it is the one that placed the file. It also checks. After writing each unit it resolves the ExecStart and refuses to finish if that program is not executable, because the alternative is finding out at the next timer tick - or, as here, at a restart weeks later. Three tests: no unit hard-codes a path, every ExecStart resolves to a program bin/ actually ships, and install.sh both substitutes the marker and keeps the check. Also ran install.sh end to end against stubs with BIN_DIR overridden and confirmed the installed units name that directory, that the programs there are executable, and that no marker survives. 87 ok, 0 failed.