deploy/files/usr/local/lib/systemd/system/left4me-server@.service

@@ -33,13 +33,7 @@ WorkingDirectory=-/var/lib/left4me/runtime/%i/merged/left4dead2
 # anyway. ExecStopPost (not ExecStop) so unmount runs after the cgroup is
 # cleared; ExecStop runs while srcds is still alive and would EBUSY.
 ExecStartPre=+/usr/local/libexec/left4me/left4me-overlay mount %i
-# Run from the merged overlay, NOT installation/. srcds_run is a shell
-# script that `cd`s to its own dirname before exec'ing srcds_linux, so the
-# binary's path determines where the engine reads gameinfo.txt and addons
-# from — WorkingDirectory has no effect. Invoking installation/srcds_run
-# would resolve everything against the lower layer and never see overlay-
-# provided plugins (Metamod/SourceMod) or cfgs (zonemod, confogl).
-ExecStart=/var/lib/left4me/runtime/%i/merged/srcds_run -game left4dead2 +hostport ${L4D2_PORT} $L4D2_ARGS
+ExecStart=/var/lib/left4me/installation/srcds_run -game left4dead2 +hostport ${L4D2_PORT} $L4D2_ARGS
 ExecStopPost=+/usr/local/libexec/left4me/left4me-overlay umount %i
 Restart=on-failure
 RestartSec=5

deploy/tests/test_deploy_artifacts.py

@@ -67,11 +67,7 @@ def test_server_unit_contains_required_runtime_contract():
     # mount helper before the merged dir exists. ExecStart re-applies and
     # finds the dir once the mount has landed.
     assert "WorkingDirectory=-/var/lib/left4me/runtime/%i/merged/left4dead2" in unit
-    # ExecStart must invoke srcds_run from the *merged* overlay tree, not
-    # from installation/. srcds_run cds to its own dirname; if we point at
-    # installation/, the engine reads gameinfo.txt and addons from the lower
-    # layer and never sees overlay plugins (Metamod/SourceMod) or cfgs.
-    assert "ExecStart=/var/lib/left4me/runtime/%i/merged/srcds_run" in unit
+    assert "ExecStart=/var/lib/left4me/installation/srcds_run" in unit
     assert "$L4D2_ARGS" in unit
     assert "${L4D2_ARGS}" not in unit
     assert "NoNewPrivileges=true" in unit
@@ -427,14 +423,8 @@ def test_deploy_script_has_safe_defaults_and_preserves_state() -> None:
     assert "for attempt in" in script
     assert "/opt/left4me/.venv" in script
     assert "visudo -cf /etc/sudoers.d/left4me" in script
-    # Note: assertions about web.env's lifecycle (create-only-if-missing /
-    # never-sourced-from-deploy) used to live here. They became stale in
-    # commit caa8b83, which switched to "rewrite web.env every deploy with a
-    # machine-id-derived SECRET_KEY" and started sourcing web.env in the
-    # alembic + seed helper subprocesses. Removed entirely; current behavior
-    # is covered by `install -m 0640 ... /etc/left4me/web.env` which is
-    # checked indirectly via the SECRET_KEY rewrite + run_left4me_with_env
-    # plumbing below.
+    assert "if [ ! -f /etc/left4me/web.env ]" in script
+    assert ". /etc/left4me/web.env\n" not in script
     assert "run_left4me_with_env" in script
     assert "LEFT4ME_ADMIN_USERNAME" in script
     assert "LEFT4ME_ADMIN_PASSWORD" in script