post_install() {
    cat <<'EOF'

Roundhouse is installed read-only and binds 127.0.0.1 only. Nothing runs
until you enable it, and nothing is reachable from another machine until a
reverse proxy fronts it.

  Start it (per user, read-only — senses the fleet, changes nothing):
    systemctl --user enable --now roundhouse.service
    loginctl enable-linger "$USER"      # only if it should return at boot
  Then: http://127.0.0.1:8090 on that host only — loopback is the whole point.
  For access from another machine, front it with TLS (caddy pattern in
  /usr/share/doc/roundhouse/docs/PEERS.md); to change the port, drop in
  ~/.config/systemd/user/roundhouse.service.d/port.conf with an ExecStart
  override rather than editing the packaged unit.

  To allow rollouts / switches / boot-strategy toggles, edit
  ~/.config/systemd/user/roundhouse.service (copy it from
  /usr/lib/systemd/user/) and add --actuate to ExecStart. The first armed
  launch refuses until the unit directory is a git repository and prints the
  exact commands to make it one — it never runs `git init` for you. A bearer
  token is generated at ~/.config/roundhouse/token (mode 600).

  Agents: /usr/bin/roundhouse-mcp is an MCP server (stdio) over the same
  gated API. Registration example and the tool catalog:
    /usr/share/doc/roundhouse/docs/MCP.md
  Wiring a proxy to the generated routing config:
    /usr/share/doc/roundhouse/docs/ROUTING.md

EOF
}

post_upgrade() {
    cat <<'EOF'

Roundhouse upgraded. If it is running, restart it to pick up the new version:

    systemctl --user restart roundhouse.service

CHANGED IN 0.7.0: the packaged unit now binds 127.0.0.1 ONLY. If you were
reaching this host's Roundhouse over the LAN, it will stop answering there
after the restart. Put a reverse proxy in front of 127.0.0.1:<port> (caddy
pattern in /usr/share/doc/roundhouse/docs/PEERS.md), or override ExecStart in
your own ~/.config/systemd/user/roundhouse.service copy.

Units are parsed once at startup — a restart is also how a newly added
'# roundhouse: on-demand' marker becomes visible.

EOF
}
