sponsord role: follow-ups from PR #82 (check mode, low-water warning, test gaps) #83

What are you trying to do?

PR #82 adds the sponsord role. Review left a few lower-priority items out of scope. None blocks the role, but each closes a gap where a mistake could pass a green deploy or a green test run.

What would help?

Role

• Warn when sponsord_pool_low_water_micro_usdc is 0. It passes validation ("zero allowed"), but upstream tops up only while remaining < low_water, so 0 silently turns the keeper off. Emit a debug warning, or require an explicit acknowledgement.
• Hash unit drop-ins in the restart-inputs record. .inputs.sha256 covers the credentials, both env files, the unit and the binary. It does not cover /etc/systemd/system/sponsord.service.d/*.conf, so a drop-in edited out of band never triggers a reload or restart.

Tests

• A molecule check (dry-run) step in molecule/sponsord, once on a fresh host and once after converge. make check-sponsord ships, and the role has several ansible_check_mode branches, but no scenario runs --check. If molecule's test_sequence won't take check, use a check_sequence plus a CI call.
• A validation case for an explicit sponsord_target that doesn't match the host architecture, in release mode. Copy decdn_node's arch-mismatch case. Neither "Require a supported target triple" nor "Require the target triple to match the host architecture" has a case.
• Pin how playbooks/group_vars/all.yml derives the Alloy toggles. Use ansible -i <toy inventory> --playbook-dir ansible/playbooks all -m debug over four hosts: node-only, sponsord-only, both, and one with an inventory group_vars/<group>.yml override. That pins the booleans and the documented precedence. No Docker is needed, so it fits make test-scripts.
• Tie the Alloy level-harness sample lines to upstream's real output. The plain-text samples in tests/alloy-config/validate.sh are hand-written. Capture one real line from the upstream binary as a fixture, so a change in its subscriber format (timestamps off, JSON) fails lint-alloy instead of silently turning every line info.

Deploy path

Ansible