Say when the systemd unit has moved on

update.sh pulls the code and restarts, and says nothing about the unit --
so a host can run a new release under the old confinement and fail in a
way that points nowhere. Dropping ProtectKernelTunables is exactly such a
change: without it applied, an agent chat cannot start a sandbox at all.

It compares the *template* against the one last applied here rather than
against the installed file. An installed unit grows host-specific lines --
an ordering dependency on whatever serves the models, a note about how the
prefix is mounted -- and diffing the files would warn about those forever.
A warning that always fires is one nobody reads.

Reinstalling automatically would clobber those same lines, so it only says
so and leaves the merge to a person.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/install.sh

@@ -110,6 +110,10 @@ sudo install -d -o "$SERVICE_USER" -g "$SERVICE_USER" -m 750 "$PREFIX/data"
 echo "== systemd unit =="
 sed -e "s|__PREFIX__|$PREFIX|g" -e "s|__SERVICE_USER__|$SERVICE_USER|g" \
     "$HERE/lembas.service" | sudo tee /etc/systemd/system/lembas.service >/dev/null
+# Which version of the template this host is running. update.sh compares
+# against it and says so when the template moves on, because the installed
+# unit usually grows host-specific lines and cannot simply be overwritten.
+sha256sum "$HERE/lembas.service" | cut -d' ' -f1 | sudo tee "$PREFIX/.unit-applied" >/dev/null
 sudo systemctl daemon-reload
 
 echo "== self-signed cert for $SITE_HOST =="

deploy/update.sh

@@ -43,6 +43,37 @@ fi
 echo "== dependencies =="
 sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[search]"
 
+# The unit is NOT reinstalled automatically. An installed unit usually carries
+# host-specific lines the template cannot know about -- an ordering dependency
+# on whatever serves the models, a note about how the prefix is mounted -- and
+# overwriting those on every update would be a worse surprise than drifting.
+#
+# So this compares the *template* against the one last applied here, not the
+# template against the installed file. Comparing the files would warn forever
+# about the local lines, and a warning that always fires is one nobody reads.
+#
+# The drift is worth catching: a change in the unit can be what makes a release
+# work at all. Dropping ProtectKernelTunables is why an agent chat can start a
+# sandbox, and a host that pulled the code without it would run the new version
+# under the old confinement and fail confusingly.
+STAMP="$PREFIX/.unit-applied"
+current=$(sha256sum "$APP/deploy/lembas.service" | cut -d' ' -f1)
+if [[ -f "$STAMP" && "$(cat "$STAMP")" != "$current" ]]; then
+  echo "== systemd unit ==" >&2
+  echo "   deploy/lembas.service has changed since it was last applied here." >&2
+  echo "   Review it and merge by hand, keeping this host's own lines:" >&2
+  echo "     diff /etc/systemd/system/lembas.service <(sed \\" >&2
+  echo "       -e 's|__PREFIX__|$PREFIX|g' -e 's|__SERVICE_USER__|$SERVICE_USER|g' \\" >&2
+  echo "       $APP/deploy/lembas.service)" >&2
+  echo "   Then: sudo systemctl daemon-reload && sudo systemctl restart lembas" >&2
+  echo "   And record it as applied: echo $current | sudo tee $STAMP" >&2
+elif [[ ! -f "$STAMP" ]]; then
+  # First run after this check was added. Assume what is installed is current;
+  # there is nothing to compare against and crying wolf on every host once is
+  # not worth it.
+  echo "$current" | sudo tee "$STAMP" >/dev/null
+fi
+
 echo "== restart =="
 sudo systemctl restart lembas
 sleep 2