anchor.diff:                  ++ optional c.recursive "-r"
                   ++ optionals (c.sshKey != null) [ "--sshkey" c.sshKey ]
                   ++ c.extraArgs
  -                ++ [ "--sendoptions" c.sendOptions
  -                     "--recvoptions" c.recvOptions
  -                     "--no-privilege-elevation"
  -                     c.source c.target
  -                   ]);
  +                ++ [
  +                "--sendoptions"
  +                c.sendOptions
  +                "--recvoptions"
  +                c.recvOptions
  +                "--no-privilege-elevation"
  +                c.source
  +                c.target
  +              ]);
                 User = cfg.user;
                 Group = cfg.group;
                 StateDirectory = [ "syncoid" ];
  
positive.code:               BindPaths = [ "/dev/zfs" ];
                BindReadOnlyPaths = [ builtins.storeDir "/etc" "/run" "/bin/sh" ];
                # Avoid useless mounting of RootDirectory= in the own RootDirectory= of ExecStart='s mount namespace.
                InaccessiblePaths = ["-+/run/syncoid/${escapeUnitName name}"];
                MountAPIVFS = true;
                # Create RootDirectory= in the host's mount namespace.
                RuntimeDirectory = [ "syncoid/${escapeUnitName name}" ];
  
negative.code:                 # perf stat -x, 2>perf.log -e 'syscalls:sys_enter_*' syncoid …
                  # awk >perf.syscalls -F "," '$1 > 0 {sub("syscalls:sys_enter_","",$3); print $3}' perf.log
                  # systemd-analyze syscall-filter | grep -v -e '#' | sed -e ':loop; /^[^ ]/N; s/\n //; t loop' | grep $(printf ' -e \\<%s\\>' $(cat perf.syscalls)) | cut -f 1 -d ' '
                  "~@aio"
                  "~@chown"
                  "~@keyring"
                  "~@memlock"
                  "~@privileged"
                  "~@resources"
                  "~@setuid"
                  "~@sync"
                  "~@timer"
                ];
                SystemCallArchitectures = "native";
                # This is for BindPaths= and BindReadOnlyPaths=
  