From fd2861c0977837f1ca208a289fb6aa74108faaf4 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Fri, 30 Oct 2026 04:50:22 +0100
Subject: [PATCH] reset the failed container unit before stopping it in the
 link-refusal vm subtest

---
 nix/vm-tests/agent-ephemeral-rootfs.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nix/vm-tests/agent-ephemeral-rootfs.nix b/nix/vm-tests/agent-ephemeral-rootfs.nix
index bf021706..d16620a6 100644
--- a/nix/vm-tests/agent-ephemeral-rootfs.nix
+++ b/nix/vm-tests/agent-ephemeral-rootfs.nix
@@ -254,8 +254,10 @@ pkgs.testers.runNixOSTest {
         host.succeed(f"test -L {ROOT}/root")
 
         # Control: with the link gone the same unit starts.
-        host.succeed(f"systemctl stop container@{MACHINE}")
+        # The reset comes first: once the failed unit is stopped, systemd
+        # unloads it and reset-failed exits 1.
         host.succeed(f"systemctl reset-failed container@{MACHINE}")
+        host.succeed(f"systemctl stop container@{MACHINE}")
         host.succeed(f"rm {ROOT}/root && mkdir -m 0700 {ROOT}/root")
         boot()
   '';