Update apply does not create /data/relay nor start a newly enabled unit on existing boxes open
Seen taking the relay live on Carloku (2026-09-07, platform dcf0cad, IE box annie-welding).
carlos system update rolled the fleet onto a build whose enabledUnits includes carlos-relay.service, and the box had /etc/carlos/relay-masters staged. After the apply:
- the unit was not started (apply restarts units it already knows; it never starts a unit that is new to the box), and
- once started by hand it failed with
Failed to set up mount namespacing: /data/relay: No such file or directory, because/data/relayis created only by fresh bootstrap (internal/host/bootstrap.go), never by an update.
Workaround used: install -d -m 0750 -o carlos -g carlos /data/relay; systemctl reset-failed carlos-relay; systemctl start carlos-relay.
Fix: systemapply should create the directories a unit's ReadWritePaths needs (or bootstrap's directory step should run idempotently on every apply), and should start any enabled unit that is not active after an apply, gated on its ConditionPathExists the same way systemd is. Without this every future region needs a hand step the docs do not mention.