An update you can ask for, and a boundary that stays where it was

The button cannot do the work, and that is the whole design. The service runs as
an unprivileged account, cannot restart itself, and should not be able to: a web
application that can restart its own service is one whose worst day is much
worse. So /admin/updates writes a file, and an opt-in systemd .path unit runs
deploy/update.sh as root.

Three properties hold it up, and each is a thing that could have been got wrong.
The request file carries nothing that reaches a command line -- no branch, no
ref, no arguments -- because the branch is baked into the unit at install time,
so pressing the button is always "deploy the branch this host was configured
with" and can never be "deploy something else". It is off unless somebody passes
INSTALL_UPDATE_HELPER=1, and re-running the installer without it removes both
units and the marker. And without the helper the page says so and prints the
manual command rather than writing a file nothing is watching, which would be a
button that reports success and does nothing.

The card that says all of this is rendered whether or not there is anything to
apply. It was inside the "there is an update" branch first, so an administrator
could not discover the helper was missing until the day they needed it, which is
the worst possible moment.

Opening the page makes no network request; Check is the one thing that fetches.
And it shows the log between, not a count: "3 behind" is a number somebody has to
go and look up, while the subjects are what decides whether this is worth
restarting for right now.

Docker is one stage, because there is nothing to build -- no Node, no compiled
assets. It bakes no secret key (one in an image is one every copy shares, and
rotating it makes stored API keys unreadable), no data, and no .git, so
/admin/updates inside a container correctly reports that it was not installed
from a checkout. Compose publishes on loopback and refuses to start without a
key. TLS in front is a constraint rather than a recommendation: the service
worker and the microphone both require HTTPS or localhost.

The image was built and run before this was committed, which is how the missing
COPY of LICENSE was found -- pyproject declares it and the build backend reads
it, so the failure reads like a packaging problem and is one line.

deploy/lxc-install.sh creates an unprivileged Debian container and runs the
existing installer inside it. A wrapper, not a second install path: a parallel
installer is two things to keep correct and one of them rots.

/healthz opens the database rather than only proving the socket is listening -- a
process that is up with a database it cannot open answers every page with a 500
-- and says nothing about what is here, being reachable without signing in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PLAN.md

@@ -9,7 +9,7 @@ reasoning, tool calling with web search, custom HTTP tools and MCP servers,
 agent chats that work on a machine over SSH, a knowledge library, notes, memory
 and skills, speech in and out, image generation over ComfyUI, users and groups,
 model administration, installable as an app, reports, messages, and scheduled
-work that runs on its own. 2062 tests, `ruff` clean.
+work that runs on its own. 2081 tests, `ruff` clean.
 
 What remains before the first stable release is written out below, in phases,
 under [The road to 1.0.0](#the-road-to-100).
@@ -544,11 +544,22 @@ seen working.
       `library.share` on by default. Sharing stays read-only
 
 ### Phase 7 — packaging and updating (`0.9.7`)
-- [ ] **Docker**, with the data on a volume and a TLS proxy expected in front
-- [ ] **An LXC bootstrap** that runs the existing installer in a container
-- [ ] **Updating without a shell** — a page that says what is running, what is
-      available and what changed, and a button answered by an opt-in systemd
-      helper, because the service user cannot restart itself and should not
+- [x] **Docker**, one stage, non-root, data on a volume — and baking neither a
+      secret key nor a database nor `.git`, so a container correctly reports
+      that it was not installed from a checkout. TLS in front is a constraint
+      rather than a recommendation: the service worker and the microphone both
+      require HTTPS or localhost
+- [x] **An LXC bootstrap** that creates an unprivileged container and runs the
+      existing installer inside it — a wrapper, not a second install path
+- [x] **Updating without a shell** — what is running, what is on the branch, and
+      the log between. Checking reaches the remote; opening the page does not
+- [x] **The button writes a file and an opt-in systemd unit does the work.** The
+      service runs unprivileged and cannot restart itself, and the request
+      carries no branch and no ref — so pressing it is always "deploy the branch
+      this host was configured with" and never "deploy something else". Without
+      the helper the page says so and prints the manual command
+- [x] `/healthz`, which opens the database rather than only proving the socket
+      is listening, and says nothing about what is here
 
 ### Phase 8 — audit and finalization (`0.9.8` … `0.9.9`)
 - [ ] Security review over the whole accumulated diff