declare the root-check link on hosts without a controller too

nix/host-modules/hive-priv.nix

@@ -12,16 +12,23 @@ let
   rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
 in
 {
+  # The platform containers run their warn-only root check by this path
+  # (`lib/container-rootfs-check.nix`), so their units carry no store path.
+  # Declared outside the controller toggle below: a host that runs platform
+  # containers but no hive carries the check too.
+  imports = [
+    {
+      systemd.tmpfiles.rules = [
+        "L+ ${rootfsCheck.hivePriv} - - - - ${controllerCfg.package}/bin/hive-priv"
+      ];
+    }
+  ];
+
   config = lib.mkIf config.services.hyperhive.deploy.hive-controller.enable {
     # The parent of every agent socket dir. hive-priv is its only writer
     # (`EnsureAgentSocketDir`), and its unit lists it in `ReadWritePaths`,
     # which fails the unit when the path is missing.
-    systemd.tmpfiles.rules = [
+    systemd.tmpfiles.rules = [ "d /run/hive-agent 0755 root root - -" ];
-      "d /run/hive-agent 0755 root root - -"
-      # The platform containers run their warn-only root check by this path
-      # (`lib/container-rootfs-check.nix`), so their units carry no store path.
-      "L+ ${rootfsCheck.hivePriv} - - - - ${controllerCfg.package}/bin/hive-priv"
-    ];
 
     # Socket unit for hive-priv — the narrow root helper that executes
     # privileged operations on behalf of hive-c0re. Systemd creates and

nix/module-eval/swarm-services-switch.nix

@@ -616,7 +616,16 @@ let
         && (s.hive-c0re.wantedBy or [ ]) == [ ]
         && !(swarmServicesOnly.systemd.sockets ? hive-c0re)
         && !(swarmServicesOnly.systemd.sockets ? hive-priv)
-        && !(s ? swarm-bao-queue-agent);
+        && !(s ? swarm-bao-queue-agent)
+        # The root check the platform containers carry runs through a link
+        # this host still declares, since no controller module does. Presence
+        # control: the unit and the rule are both found.
+        && lib.any (
+          r: lib.hasPrefix "L+ /run/hive-rootfs-check " r
+        ) swarmServicesOnly.systemd.tmpfiles.rules
+        && lib.any (
+          p: lib.hasPrefix "-/run/hive-rootfs-check check-rootfs --warn-only " (toString p)
+        ) s."container@swarm-bao".serviceConfig.ExecStartPre;
     }
     {
       # On a controller that runs none of them, so the link cannot come from