Followup: I think the issue may be an old profile sitting in enforce mode during dist-upgrade that didn't get handled properly.
I was able to load the profile from scratch properly on a clean heron install on another machine.
tldr "nevermind i fixed it"
Followup:
I think the issue may be an old profile sitting in enforce mode during dist-upgrade that didn't get handled properly.
I was able to load the profile from scratch properly on a clean heron install on another machine.
tldr "nevermind i fixed it"