No idea why everything was executable, lol.
I had to disable initrd's systemd stuff. I just /couldn't/ get a rollback service working; believe me, not for a lack of effort! I've been working on this on-and-off for a month or two now.