Confine asset-repair entry-point validation to fixture unit inventory

The complete installer package correctly stopped its old re-entry fixture at unavailable mask evidence. Admit exact unmasked fixture units and record the sole daemon-reload operation instead of depending on a real host manager. Exercise the actual CLI re-entry with both effective runtime masks as well; retain refusal and all assets unchanged.

Contract-Neutral: Confined test admission and CLI coverage only; no installer runtime or subsystem contract change.
Change-source: pulse-maintainer

scripts/installtests/root_install_sh_test.go

@@ -2256,6 +2256,28 @@ func TestRootInstallScriptRepairAutoUpdateUnitsEntryPoint(t *testing.T) {
 		[]byte("#!/usr/bin/env bash\necho repaired-helper\n"), 0755); err != nil {
 		t.Fatalf("write release helper: %v", err)
 	}
+	// This is an asset-rendering/re-entry fixture, not admission to the host
+	// service manager. Supply a successful exact unmasked inventory and record
+	// the only permitted manager operation. Whole-installer controls exercise
+	// failed reads and effective masks using real fixture-root inventories.
+	toolsDir := filepath.Join(tmpDir, "tools")
+	if err := os.MkdirAll(toolsDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	callsPath := filepath.Join(tmpDir, "systemctl-calls")
+	stub := `#!/usr/bin/env bash
+set -eu
+printf '%s\n' "$*" >> "` + callsPath + `"
+case "$*" in
+    'list-unit-files --no-legend --no-pager --full -- pulse-update.timer pulse-update.service')
+        printf 'pulse-update.timer disabled enabled\npulse-update.service disabled enabled\n' ;;
+    daemon-reload) : ;;
+    *) echo "Unexpected fixture manager operation: $*" >&2; exit 97 ;;
+esac
+`
+	if err := os.WriteFile(filepath.Join(toolsDir, "systemctl"), []byte(stub), 0755); err != nil {
+		t.Fatal(err)
+	}
 
 	installer, err := filepath.Abs(filepath.Join("..", "..", "install.sh"))
 	if err != nil {
@@ -2263,6 +2285,8 @@ func TestRootInstallScriptRepairAutoUpdateUnitsEntryPoint(t *testing.T) {
 	}
 	cmd := exec.Command("bash", installer, "--repair-auto-update-units")
 	cmd.Env = append(os.Environ(),
+		"PATH="+toolsDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+		"PULSE_SERVICE_NAME=pulse",
 		"PULSE_INSTALL_DIR="+installDir,
 		"PULSE_CONFIG_DIR="+configDir,
 		"PULSE_AUTO_UPDATE_DEST="+autoUpdateDest,
@@ -2274,6 +2298,10 @@ func TestRootInstallScriptRepairAutoUpdateUnitsEntryPoint(t *testing.T) {
 	if err != nil {
 		t.Fatalf("install.sh --repair-auto-update-units failed: %v\n%s", err, out)
 	}
+	calls, err := os.ReadFile(callsPath)
+	if err != nil || string(calls) != "list-unit-files --no-legend --no-pager --full -- pulse-update.timer pulse-update.service\ndaemon-reload\n" {
+		t.Fatalf("repair did not inspect both units before its only manager operation: %v\n%s", err, calls)
+	}
 
 	helper, err := os.ReadFile(autoUpdateDest)
 	if err != nil {

scripts/tests/test_server_update_timer.py

@@ -107,6 +107,7 @@ case "$FLOW" in
         exit 0 ;;
     refresh) refresh_auto_updates; exit 0 ;;
     setup) ENABLE_AUTO_UPDATES=true; setup_auto_updates; exit 0 ;;
+    repair-entry) exec bash "$INSTALLER" --repair-auto-update-units ;;
     assets)
         result=0
         install_auto_update_assets || result=$?
@@ -346,12 +347,12 @@ class ServerUpdateTimerTest(unittest.TestCase):
 
     @unittest.skipUnless(REAL_SYSTEMCTL, "systemctl filesystem inventory is unavailable")
     def test_asset_repair_and_explicit_setup_cannot_replace_effectively_masked_units(self):
-        for flow in ("assets", "setup"):
+        for flow in ("assets", "setup", "repair-entry"):
             for mask in ("timer", "service"):
                 with self.subTest(flow=flow, mask=mask):
                     e = self.exercise(flow=flow, state="disabled", mask=mask,
                                       mask_location="runtime", inventory="real", config_enabled=False)
-                    self.assert_preserved(e, status=1 if flow == "assets" else 0)
+                    self.assert_preserved(e, status=1 if flow in ("assets", "repair-entry") else 0)
                     self.assertIn("masked-runtime", e["result"].stdout)
 
     def test_failed_unknown_and_duplicate_effective_inventory_cannot_admit_writes(self):