From ea6c84bf9a5ee03c541e3a226555ced919859fe5 Mon Sep 17 00:00:00 2001
From: G <41178744+catomean@users.noreply.github.com>
Date: Sat, 29 Aug 2026 09:58:34 +0200
Subject: [PATCH] fix(ops): only flag units that are meant to be running
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The unit check asked "is it active?" and flagged aoz-demo, which is stopped AND
disabled with nothing routed to its port — deliberately retired. A check that
reports a decision as a fault is one people learn to ignore, and an ignored
check is worse than none.

"Is it supposed to be running?" is a different question from "is it running?".
Enabled-but-inactive is the fault; disabled-and-inactive is a choice.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvjGNAS9CMfEGNW26tUR4P
---
 scripts/ci/runtime-conformance-audit.sh | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/scripts/ci/runtime-conformance-audit.sh b/scripts/ci/runtime-conformance-audit.sh
index 79044a36..b197aba7 100755
--- a/scripts/ci/runtime-conformance-audit.sh
+++ b/scripts/ci/runtime-conformance-audit.sh
@@ -90,12 +90,21 @@ for dir in /opt/*/; do
   done
 done
 
-# ---- 5. every app unit that exists is actually serving ---------------------
+# ---- 5. every app unit MEANT to run is running -----------------------------
+# Enabled-but-not-active, not merely not-active. aoz-demo is stopped AND
+# disabled with nothing routed to its port — deliberately retired, and flagging
+# it as a fault is how a check earns the reputation that gets it ignored.
+# "Is it supposed to be running?" is a different question from "is it running?".
 for u in /etc/systemd/system/*-app.service; do
   [ -e "$u" ] || continue
   unit="$(basename "$u")"; app="${unit%-app.service}"
+  enabled="$(systemctl is-enabled "$unit" 2>/dev/null)"
+  case "$enabled" in
+    enabled|enabled-runtime|static) ;;
+    *) continue ;;
+  esac
   state="$(systemctl is-active "$unit" 2>/dev/null)"
-  [ "$state" = "active" ] || finding "$app" "unit is $state"
+  [ "$state" = "active" ] || finding "$app" "unit is enabled but $state"
 done
 
 note "checked $(ls -d /opt/*/ 2>/dev/null | wc -l) app dirs on node $BOX_NODE"