check every container's root before its start, through the container@ template

nix/module-eval/core-toggle.nix

@@ -1497,6 +1497,37 @@ let
         && (sc.ProtectKernelLogs or false)
         && (sc.ProtectKernelModules or false);
     }
+    {
+      # Every `container@` instance starts through the template's drop-in, the
+      # agents' and the swarm services' alike, so a host with containers has it
+      # whether or not it runs a hive. A host with none has no `container@`
+      # unit and gets no drop-in. Only the rendered line is pinned: eval cannot
+      # show where systemd reads the file from. The misspelled name is the
+      # control that the lookup finds nothing when nothing is there.
+      name = "the container@ template drop-in runs the root check on every host with containers and on no other";
+      ok =
+        let
+          dropinText =
+            name: m:
+            let
+              hits = lib.filter (p: (p.name or "") == name) m.systemd.packages;
+            in
+            if builtins.length hits == 1 then (builtins.head hits).text else "";
+          runsCheck =
+            name: m:
+            let
+              want = "ExecStartPre=${m.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs %i";
+              lines = lib.splitString "\n" (dropinText name m);
+            in
+            lib.elem (builtins.unsafeDiscardStringContext want) (map builtins.unsafeDiscardStringContext lines);
+          check = "hyperhive-container-rootfs-check";
+        in
+        runsCheck check allLocal
+        && runsCheck check shared.servicesHere
+        && !(runsCheck "${check}-misspelled" allLocal)
+        && !(bare.systemd.units ? "container@.service")
+        && !(runsCheck check bare);
+    }
   ]
   # Starting a unit that stays `active (exited)` is a no-op, so a timer aimed
   # at one fires and fetches nothing.