Constant EXIT_PERMANENT 

pub const EXIT_PERMANENT: i32 = 2;

Exit code for a failure retrying cannot fix: no usable GPU, a spec that does not parse, a directory that cannot be created, a missing binary. Distinct from 1 (a transient failure, one-shot) so a fleet can act on the difference without parsing stderr:

# /etc/systemd/system/flodl-join.service
Restart=always
RestartPreventExitStatus=2   # stop hot-looping a misprovisioned box
FailureAction=poweroff       # ... and self-deprovision it

fdl deliberately does not power a box off itself: the decision belongs to whatever owns the instance’s lifecycle, and 2 is how it hears about it.