[phroi]

Three commented lines in each tracked unit and one README paragraph.

A unit alone on its checkout that uncomments them runs git pull --ff-only and pnpm install --frozen-lockfile as ExecStartPre before every turn. The update lands between turns, so it costs no ready window, and it needs no timer that would have to stop a running turn. What reaches the bot is exactly what passed the gate and the merge rules, so the repository's merge protection is the update policy; the two-account rule, when it lands, hardens both at once.

The - prefix lets the turn run when the pull fails; the install line has none, so a turn never runs new source on old node_modules and waits until the install completes, which an offline no-op install never blocks. git and pnpm are native binaries, so the updater never depends on the Node it replaces: an install interrupted mid Node bump, which removes the checkout's only Node, is finished by the next turn's install instead of looping forever. timeout caps a fetch against an unreachable GitHub at a minute; TimeoutStartSec gives a cold install the time a new Node needs.

The tracked examples keep the lines commented: a development checkout must not move under whoever works in it, and two actors on one host get one clone each. The mainnet VM is the first host meant to opt in. Also here: the README's host install names the Node-free pnpm binary, since pnpm is what fetches Node.

Rejected: a timer unit; an updater written in TypeScript, which two reviews showed cannot recover from the interrupted install it exists to survive; signed release tags verified on the host, a second key that belongs only to a setup where GitHub no longer holds the first.