Function runner_root_refusals 

pub fn runner_root_refusals(
    paths: &AppPaths,
) -> Result<Vec<RunnerRootRefusal>, ServiceError>

Every policy whose runner root refused it and has not since succeeded.

Ordered by policy, so two runs of service status on an unchanged host print the same thing in the same order.

Errors

ServiceError::Record when the file exists and cannot be read or parsed. Reported rather than treated as absence, for the reason last_github_contact gives: absence means “every policy is placing runners”, and answering a parse failure with that would be a wrong answer.