A helper that would have deployed a channel nobody named

The channel is declared twice: in lembas.env, which this process reads and the
page prints, and baked into the systemd unit, which is what the helper actually
deploys. install.sh writes both together so they agree by construction -- and
the moment somebody edits one by hand they diverge, with the page naming one
channel down every card and the button deploying the other. Nothing anywhere
would have said so.

It cannot be collapsed to one place. Reading it from lembas.env at deploy time
would mean the service account decides what gets deployed, since it owns that
file -- and "the request carries no channel" is the property the whole design
rests on. So the two stay, and the marker file the page already reads to know
the helper exists now carries the channel it was installed with. A disagreement
is an alert.

Display only, deliberately: the service account can write that marker, so a
compromised process could lie about what the helper will do -- but not change
it, because the helper's own channel lives in /etc where that account cannot
reach. Lying about the channel is a much smaller thing than choosing it.

An empty marker -- every host installed before this -- reads as unknown rather
than as a mismatch. Claiming one would put a red alert on every existing host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_updates.py

@@ -45,8 +45,8 @@ def clean():
     updates.clear_request()
 
 
-def _install_helper():
-    (settings.data_dir / updates.MARKER_NAME).touch()
+def _install_helper(channel: str = ""):
+    (settings.data_dir / updates.MARKER_NAME).write_text(channel)
 
 
 # --- Reading the state ----------------------------------------------------------
@@ -265,6 +265,33 @@ def test_an_unknown_channel_falls_back_to_stable(db, monkeypatch):
     assert updates.channel_name() == updates.CHANNEL_STABLE
 
 
+def test_a_helper_installed_for_another_channel_is_named(db, client, registered):
+    """The channel is declared in two places -- lembas.env and the systemd unit --
+    and only the installer writes both. Edit one by hand and the button deploys
+    something other than what the page has been naming all the way down."""
+    _install_helper("stable" if updates.channel_name() == "edge" else "edge")
+
+    state = updates.read()
+    assert state.channel_mismatch is True
+    assert "would deploy" in client.get("/admin/updates").text
+
+
+def test_a_helper_that_did_not_say_claims_no_disagreement(db):
+    """Every host installed before the marker carried a channel. Unknown is not
+    a mismatch, and claiming one would be a red alert on every existing host."""
+    _install_helper("")
+
+    assert updates.helper_channel() == ""
+    assert updates.read().channel_mismatch is False
+
+
+def test_a_matching_helper_says_nothing(db, client, registered):
+    _install_helper(updates.channel_name())
+
+    assert updates.read().channel_mismatch is False
+    assert "would deploy" not in client.get("/admin/updates").text
+
+
 # --- The page ---------------------------------------------------------------------
 def test_the_page_offers_nothing_without_the_helper(db, client, registered):
     page = client.get("/admin/updates").text