Host state requires a deploy account that can write /var/lib/onebox

[vishr]

Problem

Since #206, host state (owner record, host lock, host journal, proxy) always lives at /var/lib/onebox/_host, whatever basePath says. That is what keeps a host to one application, but it means a deploy account that owns its basePath and cannot write /var/lib can no longer bootstrap: acquireHostLock fails on mkdir -p /var/lib/onebox/_host.

Before #206, _host sat under basePath, so a non-root account with basePath: /home/deploy/onebox worked.

Preflight now reports it (host state check), but no project setting fixes it. The only override, ONEBOX_TEST_HOST_STATE_DIR, is test-only by design.

Options

• Document that the deploy account must be able to create /var/lib/onebox/_host, and have ob bootstrap say how to pre-create it with the right owner.
• Or add a host-level (not project-level) setting for the host state directory, so it cannot differ per application on one host.