From 7dd2079b063ea00adbfde8a5f97fc555e1f74348 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 12 Oct 2026 14:47:56 +0000
Subject: [PATCH] Hard-disable exec tools for every call in the full-track test

Why: only the deploy invocation carried RDM_DISABLE_EXEC_TOOLS; the
trailing restart ran without it and the serve died on keyless runners
under the bwrap fail-closed policy (run 3765).
Evidence: local suite green; the restart now inherits the hard-disable.
Impact: tests only.
---
 tests/test_svc_realcombo.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/test_svc_realcombo.py b/tests/test_svc_realcombo.py
index 52ecd5e0..9a15ae4d 100644
--- a/tests/test_svc_realcombo.py
+++ b/tests/test_svc_realcombo.py
@@ -174,8 +174,10 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
     def test_U3_real_rdm_full_deploy_track(self):
         """全轨：materialize（真实 make build）→ 候选身份门禁 → release 切换 →
         伴生工作台 200 → 裸重启稳定。"""
+        # 硬关须覆盖本测试全部调用（deploy/start/restart/stop 的 serve 都要），
+        # 不只 deploy 一处——CI 无 bwrap 时 fail-closed 拒启。
+        self.env["RDM_DISABLE_EXEC_TOOLS"] = "1"
         env = dict(self.env)
-        env["RDM_DISABLE_EXEC_TOOLS"] = "1"
         env.update(ci_git_env())
         env.update({"SVC_RDM_SRC_DIR": str(self.root / "rdmcache"),
                     "SVC_RDM_ORIGIN": RDM_ORIGIN})