Sample env carries a version marker; install appends settings missing since the writing version

internal/service/service_linux.go

@@ -140,7 +140,7 @@ func copyFile(src, dst string, mode os.FileMode) error {
 // *directory*, and granting the sandboxed service user write access to a
 // shared system directory would let a compromised service overwrite other
 // binaries. /var/lib/gpu-turnstile is exclusively ours.
-func Install(configPath string, copyBin bool) error {
+func Install(configPath string, copyBin bool, version string) error {
 	exe, err := os.Executable()
 	if err != nil {
 		return err
@@ -172,14 +172,23 @@ func Install(configPath string, copyBin bool) error {
 			}
 		}
 		exe = installedExe
-		if _, err := os.Stat(etcConfig); os.IsNotExist(err) {
+		data, readErr := os.ReadFile(etcConfig)
+		switch {
+		case os.IsNotExist(readErr):
 			if configPath != "" {
 				copyFile(configPath, etcConfig, 0o644) //nolint:errcheck // best effort
-			} else {
-				// No config at all: install a fully commented sample
-				// covering every setting. LOG_FILE stays commented —
-				// stderr goes to the journal on Linux.
-				if err := os.WriteFile(etcConfig, []byte(config.SampleEnv("")), 0o644); err != nil {
+			} else if err := os.WriteFile(etcConfig, []byte(config.SampleEnv(version, "")), 0o644); err != nil {
+				// Fully commented sample covering every setting; LOG_FILE
+				// stays commented — stderr goes to the journal on Linux.
+				return fmt.Errorf("write %s: %w", etcConfig, err)
+			}
+		case readErr != nil:
+			return fmt.Errorf("read %s: %w", etcConfig, readErr)
+		default:
+			// An installer-written config from an older version gets any
+			// new settings appended; hand-written files stay untouched.
+			if synced, changed := config.SyncSample(string(data), version, ""); changed {
+				if err := os.WriteFile(etcConfig, []byte(synced), 0o644); err != nil {
 					return fmt.Errorf("write %s: %w", etcConfig, err)
 				}
 			}