An installer that moved a channel nobody asked it to

The channel lives in two places -- lembas.env, which the page reads, and
the systemd unit, which the button obeys -- and a re-run keeps the env
file while rewriting the unit. Defaulting to stable therefore meant a
re-run for some unrelated reason silently moved one half and not the
other, leaving a host whose page named edge and whose button deployed
stable.

That mismatch already had an alert. An installer that causes the thing it
detects is the wrong end to be detecting it from, so it defaults to what
the host already follows. Parsed rather than sourced: that file holds the
secret key.

Found by running it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_updates.py

@@ -483,3 +483,27 @@ def test_the_container_runs_as_a_real_account():
 
     assert "USER lembas" in dockerfile
     assert dockerfile.index("USER lembas") > dockerfile.index("COPY . .")
+
+
+def test_a_reinstall_does_not_move_the_channel_by_itself():
+    """The channel lives in two places -- `lembas.env`, which the page reads,
+    and the systemd unit, which the button obeys -- and a re-run keeps the env
+    file while rewriting the unit. Defaulting to `stable` therefore meant a
+    re-run for some unrelated reason silently moved one half and not the other,
+    leaving a host whose page named one channel and whose button deployed
+    another.
+
+    That mismatch has an alert of its own, and an installer that *causes* the
+    thing it detects is the wrong end to be detecting it from.
+    """
+    from pathlib import Path
+
+    import lembas
+
+    root = Path(lembas.__file__).resolve().parents[2]
+    install = (root / "deploy/install.sh").read_text()
+
+    assert "LEMBAS_UPDATE_CHANNEL=" in install, "it has to read the installed value"
+    assert 'CHANNEL="${LEMBAS_CHANNEL:-${_installed_channel:-stable}}"' in install
+    # Parsed rather than sourced: that file holds the secret key.
+    assert ". $PREFIX/lembas.env" not in install