read the running rev and the hyperhive flake from /etc files, not the unit

nix/host-modules/swarm-controller.nix

@@ -286,12 +286,18 @@ let
       # helper answers only `https` for the forge.
       git_base = "https://${forgeCfg.domain}";
       github_disabled = !swarmCfg.github.enable;
-      # The rev this controller runs, which `internal/meta` pins hyperhive
-      # to once it descends from the committed pin; null on a dirty tree.
-      hyperhive_rev = config.services.hyperhive.deploy.hive-controller.hyperhiveRev;
     };
   };
 
+  # The rev this controller runs, which `internal/meta` pins hyperhive to once
+  # it descends from the committed pin; null on a dirty tree. It is a file the
+  # daemon re-reads on every meta update, not part of the unit: the rev differs
+  # on every commit, and a changed unit restarts the controller and drops its
+  # job graph.
+  runningRevFile = builtins.toJSON {
+    hyperhive_rev = deployCfg.hive-controller.hyperhiveRev;
+  };
+
   # The swarm's own display name, for `GET /api/swarm` (swarm-ui's chrome).
   # Gated on the option resolving, not defaulted to an empty string: an
   # operator who never named the swarm gets `name: null` from the
@@ -692,6 +698,9 @@ in
       serviceConfig.SupplementaryGroups = [ clientsGroup ];
     };
 
+    # Read by `meta_flake::running_rev`.
+    environment.etc."hyperhive/swarm-controller.json".text = runningRevFile;
+
     # Installed host-wide, not into the daemon's unit: `swarmctl` is run
     # by a human on this box and acts as root, so the daemon's sandbox is
     # exactly what it must not inherit.