gate: report a unit that is running code older than the code on disk

'how can i watch yesterday's build? Every new release should restart bro. that
was wasted time' — a pass lost to a midiviz restarted the night before, which
therefore contained none of that night's four commits. systemd said active
(running) the whole time, correctly: a unit holds whatever the interpreter read
at ExecStart, and from outside there is nothing to distinguish it from a unit
on current code.

Comparing the unit's ActiveEnterTimestamp to its ExecStart file's mtime is the
only honest test, and it is deliberately not a git comparison: the question is
'is the process executing what I can read', so an uncommitted edit counts.

ADVISE, never BLOCK — a stale lens is not a reason to refuse a launch. --fix
restarts only the inaudible login units; SuperDirt and the two painters are
reported and left alone, since gig-up's generation-aware chooser owns when
those cycle.

tools/check-gig.py

@@ -280,6 +280,19 @@ print(" ".join(str(p) for p in m.setlist_tracks()))')"""),
     # visuel anymore" the day before a gig. Generation-aware: an LCXL3 is
     # painted by lcxl3-driver, the original LCXL by lcxl-leds-watch. A v2-only
     # grep made this probe pass by accident.
+    # PLN, 2026-09-23, after a pass spent debugging a midiviz restarted the
+    # night before and therefore containing none of the night's work: "how can
+    # i watch yesterday's build? Every new release should restart bro. that was
+    # wasted time". A unit holds whatever the interpreter read at ExecStart, and
+    # from outside a unit on three-day-old code is indistinguishable from a
+    # healthy one -- same active (running), same journal. ADVISE, not BLOCK: a
+    # stale lens is a stale lens, never a reason to refuse a launch.
+    Probe("unit builds fresh", [PY, "tools/check-stale-units.py"],
+          fix="tools/check-stale-units.py --fix   # restarts the inaudible ones; "
+              "reports the rest, because gig-up owns when SuperDirt and the "
+              "painter cycle",
+          kind=ADVISE),
+
     # NOT gated on scsynth (it was until 2026-09-23, and that is how the board
     # sat unpainted through every cold run). The painter has nothing to do with
     # SuperDirt: it translates hands to CCs and lights LEDs. Gating it on the

tools/tests/test_check_stale_units.py

+"""A unit running yesterday's code looks exactly like a healthy one.
+
+2026-09-23, PLN: "how can i watch yesterday's build? Every new release should
+restart bro. that was wasted time :((" — he had spent a pass debugging a
+midiviz that had been restarted at 20:13 the previous evening and therefore
+contained none of that night's four commits. systemd reported `active
+(running)` throughout, because it was.
+"""
+from __future__ import annotations
+
+import importlib.util
+import pathlib
+import sys
+from datetime import datetime, timedelta
+
+import pytest
+
+TOOLS = pathlib.Path(__file__).resolve().parents[1]
+if str(TOOLS) not in sys.path:
+    sys.path.insert(0, str(TOOLS))
+
+
+def _load():
+    spec = importlib.util.spec_from_file_location("csu", TOOLS / "check-stale-units.py")
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+CSU = _load()
+
+
+def test_the_timestamp_parser_survives_systemds_format():
+    # "Wed 2026-09-23 09:41:26 CEST" — weekday and zone are both locale noise,
+    # and a parser that demands them breaks on a box in another locale.
+    CSU._prop = lambda unit, name: "Wed 2026-09-23 09:41:26 CEST"
+    assert CSU.started_at("anything") == datetime(2026, 9, 23, 9, 41, 26)
+
+
+def test_an_unstarted_unit_has_no_opinion():
+    CSU._prop = lambda unit, name: ""
+    assert CSU.started_at("never-ran") is None
+
+
+def test_a_garbled_timestamp_is_not_an_exception():
+    CSU._prop = lambda unit, name: "Wed ∞ CEST"
+    assert CSU.started_at("weird") is None
+
+
+def test_only_login_units_are_ever_auto_restarted():
+    """The three that must not cycle blind, and why, from rig_units' own table:
+    parvagues-sc is 15s of silence plus a preload warm, and the two painters
+    Conflicts= each other — a blind restart with the classic board plugged kills
+    the painter that was correctly lighting it."""
+    import rig_units
+    policies = {u: pol for u, _l, _p, pol, _w in rig_units.SERVICES}
+    for never in ("parvagues-sc", "lcxl3-driver", "lcxl-leds-watch"):
+        assert policies[never] not in CSU.SAFE_TO_RESTART, never
+    for always in ("midiviz", "gig-log", "parvagues-bridge"):
+        assert policies[always] in CSU.SAFE_TO_RESTART, always
+
+
+def test_exec_paths_reads_the_unit_not_the_units_name(tmp_path):
+    """perf-tray's unit lives outside the repo and several units exec a wrapper
+    that is not named after them, so guessing from the unit name would miss."""
+    script = tmp_path / "whatever.py"
+    script.write_text("#\n")
+    CSU._prop = lambda unit, name: f"/usr/bin/python3 {script} --relative --paint"
+    assert CSU.exec_paths("unit") == [script]
+
+
+def test_a_path_that_does_not_exist_is_not_reported(tmp_path):
+    CSU._prop = lambda unit, name: "/usr/bin/python3 /gone/missing.py"
+    assert CSU.exec_paths("unit") == []
+
+
+def test_apply_restarts_nothing_when_nothing_is_safe(capsys):
+    manual = [dict(unit="lcxl3-driver", label="LCXL3 driver", policy="manual",
+                   restartable=False, started="x", newest="y", edited="z",
+                   behind_s=1)]
+    assert CSU.apply(manual, dry=True) == 0
+    assert "need a human" in capsys.readouterr().out
+
+
+def test_dry_run_names_the_command_and_runs_none(capsys, monkeypatch):
+    called = []
+    monkeypatch.setattr(CSU, "_sh", lambda argv: called.append(argv) or (0, ""))
+    item = dict(unit="midiviz", label="midiviz", policy="login",
+                restartable=True, started="x", newest="y", edited="z", behind_s=1)
+    CSU.apply([item], dry=True)
+    assert "systemctl --user restart midiviz" in capsys.readouterr().out
+    assert called == [], "a dry run must not touch a single unit"
+
+
+def test_the_probe_is_advisory_and_asks_without_fix():
+    """A stale lens is never a reason to refuse a launch, and the gate must
+    never be the thing that restarts a unit mid-set."""
+    src = (TOOLS / "check-gig.py").read_text()
+    i = src.index('Probe("unit builds fresh"')
+    block = src[i:i + 500]
+    assert "kind=ADVISE" in block
+    assert "--fix" not in block.split("fix=")[0]
+
+
+@pytest.mark.parametrize("behind,expect", [(59, "0m"), (600, "10m"),
+                                           (7200, "2h"), (180000, "2d")])
+def test_the_age_reads_as_a_human_would_say_it(behind, expect, capsys):
+    CSU.report([dict(unit="u", label="L", policy="login", restartable=True,
+                     started="2026-09-22 20:12:55", newest="/x/y.py",
+                     edited="2026-09-23 09:58:36", behind_s=behind)])
+    assert expect in capsys.readouterr().out