fix...

enroll/manifest.py

@@ -400,7 +400,7 @@ Unowned /etc config files not attributed to packages or services.
     state: started
   when:
     - _unit_probe is succeeded
-    - {{ var_prefix }}_start | bool
+    - {var_prefix}_start | bool
 """
         )
 

tests/test_manifest.py

@@ -96,7 +96,7 @@ def test_manifest_writes_roles_and_playbook_with_clean_when(tmp_path: Path):
 
     # Service role: conditional start must be a clean Ansible expression
     tasks = (out / "roles" / "foo" / "tasks" / "main.yml").read_text(encoding="utf-8")
-    assert "when:\n    - _unit_probe is succeeded\n    - { var_prefix }_start | bool\n" in tasks
+    assert "when:\n    - _unit_probe is succeeded\n    - foo_start | bool\n" in tasks
     # Ensure we didn't emit deprecated/broken '{{ }}' delimiters in when:
     for line in tasks.splitlines():
         if line.lstrip().startswith("when:"):