The deploy tool declared this repo's own heartbeat unit foreign — on every box
Discovered on the first real deploy.sh run after #45, in its own output:
SKIP live-sync.service (ExecStart '%h/.omp/scripts/live-sync.sh' absent on this host)
%h is a systemd specifier. The shell has never heard of it, so the literal string went to command -v, failed everywhere, and the unit was classified as belonging to another machine —
through the very code path whose job is to keep a foreign unit inert, and without a warning. /home/blank/.omp/scripts/live-sync.sh exists; %h is where this checkout lives, so the false
verdict was identical on every box that deployed this tier. Refs #44.
Nothing failed tonight only because of install state: live-sync.service is linked and its
timer drives it, so the heartbeat kept running while the deploy lied about it. A unit whose
only install route were this loop would never have been enabled anywhere, and nobody would have
seen a reason to look.
%h, %u, %U are expanded before resolution; anything else is left alone so it fails loudly
instead of being guessed at. The new test writes a %h/.local/bin/helper unit into the scratch
home — red before (SKIP), green after (already linked; not started) — so it also proves the #45 rule survived: resolving a unit is still not licence to start it.
Faithful probe, no privileges, writes nothing:
bin=$(sed -n 's/^ExecStart=\([^ ]*\).*/\1/p'\
~/.omp/dotfiles/systemd-user/.config/systemd/user/live-sync.service | head -1)command -v "${bin//%h/$HOME}"# resolves → the unit is this box's; the SKIP was the lie
Verification
bats tests/71/71, kb-lint.sh omp-docs 0, kb-coverage.py 0, bash -n clean. After
merge the next real deploy on blankpad should print ENABLE live-sync.service (already linked; not started …) instead of the SKIP line — that is the acceptance check.
# The deploy tool declared this repo's own heartbeat unit foreign — on every box
Discovered on the first real `deploy.sh` run after #45, in its own output:
SKIP live-sync.service (ExecStart '%h/.omp/scripts/live-sync.sh' absent on this host)
`%h` is a systemd specifier. The shell has never heard of it, so the literal string went to
`command -v`, failed everywhere, and the unit was classified as belonging to another machine —
through the very code path whose job is to keep a *foreign* unit inert, and without a warning.
`/home/blank/.omp/scripts/live-sync.sh` exists; `%h` is where this checkout lives, so the false
verdict was identical on every box that deployed this tier. Refs #44.
Nothing failed tonight only because of install state: `live-sync.service` is `linked` and its
timer drives it, so the heartbeat kept running while the deploy lied about it. A unit whose
only install route were this loop would never have been enabled anywhere, and nobody would have
seen a reason to look.
`%h`, `%u`, `%U` are expanded before resolution; anything else is left alone so it fails loudly
instead of being guessed at. The new test writes a `%h/.local/bin/helper` unit into the scratch
home — red before (`SKIP`), green after (`already linked; not started`) — so it also proves the
#45 rule survived: resolving a unit is still not licence to start it.
Faithful probe, no privileges, writes nothing:
```bash
bin=$(sed -n 's/^ExecStart=\([^ ]*\).*/\1/p' \
~/.omp/dotfiles/systemd-user/.config/systemd/user/live-sync.service | head -1)
command -v "${bin//%h/$HOME}" # resolves → the unit is this box's; the SKIP was the lie
```
## Verification
`bats tests/` **71/71**, `kb-lint.sh omp-docs` 0, `kb-coverage.py` 0, `bash -n` clean. After
merge the next real deploy on blankpad should print `ENABLE live-sync.service (already linked;
not started …)` instead of the `SKIP` line — that is the acceptance check.
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Build worktree: `~/.omp/wt/wt-unit-spec` off `origin/main`. Refs #44
The first real `deploy.sh` run on blankpad printed:
SKIP live-sync.service (ExecStart '%h/.omp/scripts/live-sync.sh' absent on this host)
while `/home/blank/.omp/scripts/live-sync.sh` sits right there. `%h` is expanded by systemd,
never by the shell, so the literal string was handed to `command -v`, failed, and the unit was
declared to belong to another machine — through the same code path whose whole purpose is to
keep a *foreign* unit inert, and silently. The victim was this repo's own heartbeat, and the
verdict was the same on every box that ever deployed it, because `%h` is exactly where the
checkout lives.
Nothing broke tonight only by luck of install state: `live-sync.service` is `linked`, driven
by its timer, so the heartbeat kept running while the deploy lied about it. A unit whose only
install route was this loop would simply never have been enabled anywhere.
`%h`, `%u` and `%U` are now expanded before resolution; an unrecognised specifier is left
alone so it fails loudly rather than being guessed at. Pinned by a test that writes a
`%h/.local/bin/helper` unit into the scratch home — red before (`SKIP`), green after
(`already linked; not started`), which also keeps the #45 rule intact: resolving a unit is not
licence to start it. Refs #44.
Verification: `bats tests/` 71/71, `kb-lint.sh omp-docs` 0 violations, `kb-coverage.py` 0
issues, `bash -n` clean.
dank
merged commit 3809e1ed22 into main2026-10-20 17:22:52 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The deploy tool declared this repo's own heartbeat unit foreign — on every box
Discovered on the first real
deploy.shrun after #45, in its own output:%his a systemd specifier. The shell has never heard of it, so the literal string went tocommand -v, failed everywhere, and the unit was classified as belonging to another machine —through the very code path whose job is to keep a foreign unit inert, and without a warning.
/home/blank/.omp/scripts/live-sync.shexists;%his where this checkout lives, so the falseverdict was identical on every box that deployed this tier. Refs #44.
Nothing failed tonight only because of install state:
live-sync.serviceislinkedand itstimer drives it, so the heartbeat kept running while the deploy lied about it. A unit whose
only install route were this loop would never have been enabled anywhere, and nobody would have
seen a reason to look.
%h,%u,%Uare expanded before resolution; anything else is left alone so it fails loudlyinstead of being guessed at. The new test writes a
%h/.local/bin/helperunit into the scratchhome — red before (
SKIP), green after (already linked; not started) — so it also proves the#45 rule survived: resolving a unit is still not licence to start it.
Faithful probe, no privileges, writes nothing:
Verification
bats tests/71/71,kb-lint.sh omp-docs0,kb-coverage.py0,bash -nclean. Aftermerge the next real deploy on blankpad should print
ENABLE live-sync.service (already linked; not started …)instead of theSKIPline — that is the acceptance check.cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Build worktree:
~/.omp/wt/wt-unit-specofforigin/main. Refs #44The first real `deploy.sh` run on blankpad printed: SKIP live-sync.service (ExecStart '%h/.omp/scripts/live-sync.sh' absent on this host) while `/home/blank/.omp/scripts/live-sync.sh` sits right there. `%h` is expanded by systemd, never by the shell, so the literal string was handed to `command -v`, failed, and the unit was declared to belong to another machine — through the same code path whose whole purpose is to keep a *foreign* unit inert, and silently. The victim was this repo's own heartbeat, and the verdict was the same on every box that ever deployed it, because `%h` is exactly where the checkout lives. Nothing broke tonight only by luck of install state: `live-sync.service` is `linked`, driven by its timer, so the heartbeat kept running while the deploy lied about it. A unit whose only install route was this loop would simply never have been enabled anywhere. `%h`, `%u` and `%U` are now expanded before resolution; an unrecognised specifier is left alone so it fails loudly rather than being guessed at. Pinned by a test that writes a `%h/.local/bin/helper` unit into the scratch home — red before (`SKIP`), green after (`already linked; not started`), which also keeps the #45 rule intact: resolving a unit is not licence to start it. Refs #44. Verification: `bats tests/` 71/71, `kb-lint.sh omp-docs` 0 violations, `kb-coverage.py` 0 issues, `bash -n` clean.dank referenced this pull request2026-10-20 17:23:49 -07:00