An SELinux file context restore fixes the target path while a transient tmpfiles rule recreates it at boot with the wrong type again during a staged decommission

Manual recovery works and the next boot silently undoes it. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.