From e0d2350902ce69fb118e6e0e780ccba2ccb486e7 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 28 Oct 2026 23:52:37 +0100
Subject: [PATCH] ignore a failed warn-only root check: prefix its ExecStartPre
 with a dash

---
 .../lib/container-rootfs-check.nix            |  6 ++--
 nix/module-eval/core-toggle.nix               | 29 ++++++++++++++++++-
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/nix/host-modules/lib/container-rootfs-check.nix b/nix/host-modules/lib/container-rootfs-check.nix
index d8832d5e..5922c80a 100644
--- a/nix/host-modules/lib/container-rootfs-check.nix
+++ b/nix/host-modules/lib/container-rootfs-check.nix
@@ -6,7 +6,9 @@
 # `touch` and `cp` follow links the container planted there. `hive-priv
 # check-rootfs` looks at the paths the script touches (rules in
 # `hive-priv/src/prestart.rs`). With `--warn-only` it logs each violation at
-# warning level and lets the start go on; the agent containers run it strict
+# warning level and lets the start go on. The line carries systemd's `-`
+# prefix, so a crash or a failed exec of the check cannot fail the start either.
+# The agent containers run it strict
 # from their per-agent drop-in (hive-priv's `WriteResourceLimits`).
 #
 # Pure function, not a NixOS module. A container's module calls it with its
@@ -26,7 +28,7 @@
   # Attributes for `systemd.services."container@<name>"`.
   warnOnly = name: {
     serviceConfig.ExecStartPre = [
-      "${config.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}"
+      "-${config.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}"
     ];
   };
 }
diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix
index 668e41fa..cfe315c8 100644
--- a/nix/module-eval/core-toggle.nix
+++ b/nix/module-eval/core-toggle.nix
@@ -1526,7 +1526,7 @@ let
           carries =
             m: name:
             checks m name == [
-              (builtins.unsafeDiscardStringContext "${m.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}")
+              (builtins.unsafeDiscardStringContext "-${m.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}")
             ];
           names = lib.attrNames allLocal.containers;
         in
@@ -1552,6 +1552,33 @@ let
         # Control: a name with no unit finds nothing.
         && checks allLocal "swarm-nope" == [ ];
     }
+    {
+      # Advisory means the start goes on whatever the check does, a crash or a
+      # missing binary included: systemd ignores the failure of a command
+      # prefixed `-`. The agents' strict line is the opposite and has no
+      # prefix; hive-priv renders it at runtime, and its own test
+      # (`the_rootfs_check_leads_the_service_section_…`) pins the bare
+      # `ExecStartPre=` there.
+      name = "every hyperhive container's root check is ignored on failure, not left to fail the start";
+      ok =
+        let
+          hivePrivLines =
+            m: name:
+            builtins.filter (lib.hasInfix "hive-priv") (
+              map (p: builtins.unsafeDiscardStringContext (toString p)) (
+                m.systemd.services."container@${name}".serviceConfig.ExecStartPre or [ ]
+              )
+            );
+          allLines = m: lib.concatMap (hivePrivLines m) (lib.attrNames m.containers);
+          ignored = lib.hasPrefix "-/";
+        in
+        allLines allLocal != [ ]
+        && lib.length (allLines allLocal) == lib.length (lib.attrNames allLocal.containers)
+        && lib.all ignored (allLines allLocal)
+        && lib.all ignored (allLines withCi)
+        # Control: the test discriminates, a line without the prefix is not ignored.
+        && !(ignored "/nix/store/x-hyperhive/bin/hive-priv check-rootfs --warn-only x");
+    }
     {
       # The operator's other containers are not hyperhive's to touch: a
       # `containers.<name>` it declares gets no check, while the classifier