A helper that would have deployed a channel nobody named

The channel is declared twice: in lembas.env, which this process reads and the
page prints, and baked into the systemd unit, which is what the helper actually
deploys. install.sh writes both together so they agree by construction -- and
the moment somebody edits one by hand they diverge, with the page naming one
channel down every card and the button deploying the other. Nothing anywhere
would have said so.

It cannot be collapsed to one place. Reading it from lembas.env at deploy time
would mean the service account decides what gets deployed, since it owns that
file -- and "the request carries no channel" is the property the whole design
rests on. So the two stay, and the marker file the page already reads to know
the helper exists now carries the channel it was installed with. A disagreement
is an alert.

Display only, deliberately: the service account can write that marker, so a
compromised process could lie about what the helper will do -- but not change
it, because the helper's own channel lives in /etc where that account cannot
reach. Lying about the channel is a much smaller thing than choosing it.

An empty marker -- every host installed before this -- reads as unknown rather
than as a mismatch. Claiming one would put a red alert on every existing host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/admin/updates.html

@@ -181,6 +181,25 @@
   </form>
 
   {% elif state.helper %}
+  {% if state.channel_mismatch %}
+  {#
+    The two declarations have drifted. Worth its own alert rather than a note:
+    the button would deploy something other than what this page has been naming
+    all the way down, and nothing else anywhere would say so.
+  #}
+  <div class="alert alert--error">
+    {{ icon("warning", "icon--sm") }}
+    <span>
+      This page follows <strong>{{ state.channel }}</strong> but the update
+      helper on this host was installed for
+      <strong>{{ state.helper_channel }}</strong> — so the button would deploy
+      the second, not the first. They are set in two places
+      (<code>lembas.env</code> and the systemd unit); re-run the installer with
+      <code>INSTALL_UPDATE_HELPER=1</code> and the channel you want, which
+      writes both.
+    </span>
+  </div>
+  {% endif %}
   <p class="card__lede">
     This host has the update helper installed, so the button below writes a
     request that a systemd unit picks up and runs as root. It always deploys the