feat(post-rebuild-check): let a machine declare which units it means to leave disabled

Check 2 treats "enabled" as a proxy for "will actually run", and the proxy is wrong for a unit nobody intends to enable on that box. velox has four: geoclue-agent is redundant because hyprland's exec-once starts the binary itself, emacs is started on demand by emacsclient, obs-record-watchdog only matters while recording, and obsbot-wb-guard needs an OBSBOT the laptop doesn't have. All four reported at every run.

Four permanent lines in front of every real finding teach me to skim the output, which is the argument check 4 already makes about CLAUDE.md. On velox this takes the run from 8 findings to 4.

The list is machine-local, read from $XDG_CONFIG_HOME/post-rebuild-check/units-expected-disabled. It can't live in the unit file, because obsbot-wb-guard is correctly enabled on ratio. One unit, a different right answer per machine.

An entry whose unit is enabled after all is reported too. The main loop can't catch that, since it skips any state that isn't disabled or linked, so the list gets its own pass. Without it a stale exemption sits there suppressing nothing, and the list becomes somewhere real findings go to die.

The exemption is tested last, so it never hides the dangling-symlink finding decided on the filesystem above it.

1 files changed, 68 insertions, 0 deletions

diff --git a/scripts/post-rebuild-check b/scripts/post-rebuild-check
index 14f2415..ee77a19 100755
--- a/scripts/post-rebuild-check
+++ b/scripts/post-rebuild-check
@@ -72,6 +72,15 @@
 #                         running, the special value MISSING = not installed
 #   PRC_REPO_REMOTES      newline list of "path origin-url"; an empty URL
 #                         means origin could not be read
+#   PRC_UNITS_EXPECTED_DISABLED
+#                         newline list of units whose not-enabled state is
+#                         deliberate here, replacing the file below
+#   PRC_UNITS_EXPECTED_DISABLED_FILE
+#                         path to that list (default:
+#                         $XDG_CONFIG_HOME/post-rebuild-check/units-expected-disabled).
+#                         One unit per line, # starts a comment. Machine-local
+#                         on purpose: the same unit is correctly enabled on one
+#                         box and not another
 #   PRC_SYSTEMCTL         path to the systemctl binary (a fake, under test)
 #   PRC_SYSTEMCTL_TIMEOUT seconds to allow each systemctl call (default 5)
 #
@@ -209,6 +218,39 @@ done < "$STAGE"
 report "check 1/8: failed units"
 
 # --- 2. user unit files present but not enabled ---------------------------
+#
+# Units nothing intends to enable here are read from a machine-local list.
+# "Enabled" is this check's proxy for "will actually run", and the proxy is
+# wrong for a unit nobody means to enable on this box. velox carries four, for
+# four different reasons: geoclue-agent is redundant because hyprland's
+# exec-once starts the binary directly, emacs is started on demand by
+# emacsclient, obs-record-watchdog only matters while recording, and
+# obsbot-wb-guard needs an OBSBOT the machine does not have. Left unexempted
+# they report at every run, and four permanent lines in front of every real one
+# teach you to skim the output -- the same argument check 4 makes about
+# CLAUDE.md.
+#
+# Machine-local rather than a marker in the shared unit file, because
+# obsbot-wb-guard is correctly ENABLED on ratio. One unit, a different right
+# answer per machine, so the shared file cannot hold the answer.
+#
+# An entry that turns out to be enabled after all is still a finding. Without
+# that the list rots into somewhere real findings go to die, which is worse
+# than the noise it removes.
+
+EXPECT_DISABLED_FILE="${PRC_UNITS_EXPECTED_DISABLED_FILE:-${XDG_CONFIG_HOME:-$HOME/.config}/post-rebuild-check/units-expected-disabled}"
+if [ -n "${PRC_UNITS_EXPECTED_DISABLED+set}" ]; then
+    expect_disabled=$PRC_UNITS_EXPECTED_DISABLED
+elif [ -f "$EXPECT_DISABLED_FILE" ]; then
+    expect_disabled=$(cat "$EXPECT_DISABLED_FILE" 2>/dev/null)
+else
+    expect_disabled=""
+fi
+# Strip comments and blanks once, here, so the membership test below is a
+# plain word match. The reason a unit is exempt is the most useful thing about
+# the entry, so the format has to carry one.
+expect_disabled=$(printf '%s\n' "$expect_disabled" \
+    | sed 's/#.*//' | awk 'NF {print $1}')
 
 if [ -n "${PRC_UNIT_STATES+set}" ]; then
     states=$PRC_UNIT_STATES
@@ -294,8 +336,34 @@ while read -r name state; do
             esac
             ;;
     esac
+    # Deliberately not enabled on this machine. Checked last, so it suppresses
+    # only this finding and never the dangling-link one decided above on the
+    # filesystem.
+    case "
+$expect_disabled
+" in
+        *"
+$name
+"*) continue ;;
+    esac
     finding "unit file present but not enabled: $name ($state)"
 done < "$STAGE"
+# The exemption list, checked in the other direction. An entry whose unit is
+# enabled after all suppresses nothing, and leaving it there is how the list
+# turns into a place real findings go to die. The loop above cannot catch this:
+# it skips any state that is not disabled or linked, so an enabled unit never
+# reaches it.
+printf '%s\n' "$expect_disabled" > "$WORK/expect" 2>/dev/null || {
+    echo "post-rebuild-check: cannot write $WORK/expect" >&2
+    echo "  nothing was checked; this is not a pass" >&2; exit 1; }
+while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    estate=$(awk -v u="$name" '$1 == u {print $2; exit}' "$WORK/states")
+    case "$estate" in
+        enabled|enabled-runtime)
+            finding "$name is listed as expected-disabled but is $estate — drop the stale exemption" ;;
+    esac
+done < "$WORK/expect"
 report "check 2/8: unit files"
 
 # --- 3. *.example files whose real sibling is missing ---------------------