Reload the guard for a changed table and restart it only for a changed unit, as the controller declares it (hq ADR 0103)

internal/bootstrap/adopted.go

@@ -87,8 +87,11 @@ func guardResources(ports []int) []map[string]any {
 	return []map[string]any{
 		{"id": guardID, "type": "file", "path": guardPath, "content": AsGuard(ports), "mode": "0644"},
 		{"id": guardUnitID, "type": "file", "path": guardUnitPath, "content": guardUnitText(), "mode": "0644"},
+		// A changed table is reloaded — the unit's ExecReload loads it in one transaction, so the
+		// ports are never unguarded — and only a changed unit restarts it. As the controller
+		// declares it, so the first push finds nothing different.
 		{"id": guardRunningID, "type": "service", "unit": guardUnit, "state": "running",
-			"boot": "enabled", "restart-on": []any{guardID, guardUnitID}},
+			"boot": "enabled", "reload-on": []any{guardID}, "restart-on": []any{guardUnitID}},
 	}
 }