Restart psi-secrets after refresh so serve reloads fresh cache

psi/unitgen.py

@@ -160,9 +160,15 @@ def generate_provider_refresh_service(provider: str) -> str:
 
     This wrapper is a plain oneshot with no ``RemainAfterExit``, so its
     ``ActiveEnterTimestamp`` updates every run. The timer uses
-    ``OnUnitActiveSec`` against the wrapper and re-arms correctly. Each run
-    calls ``systemctl restart`` on the setup unit, which DOES re-run the
-    ExecStart even when it was ``active (exited)``.
+    ``OnUnitActiveSec`` against the wrapper and re-arms correctly. Each run:
+
+    1. ``systemctl restart psi-{provider}-setup.service`` — re-runs setup,
+       which re-registers secrets with fresh hex IDs and writes the updated
+       cache file to disk.
+    2. ``systemctl try-restart psi-secrets.service`` — restarts serve so it
+       reloads the fresh cache from disk. Without this, serve's in-memory
+       cache keeps the old hex IDs after each refresh and every subsequent
+       lookup misses the cache until the next operator-triggered restart.
     """
     return (
         "[Unit]\n"
@@ -172,6 +178,7 @@ def generate_provider_refresh_service(provider: str) -> str:
         "[Service]\n"
         "Type=oneshot\n"
         f"ExecStart=/usr/bin/systemctl restart psi-{provider}-setup.service\n"
+        "ExecStart=/usr/bin/systemctl try-restart psi-secrets.service\n"
     )
 
 

tests/test_unitgen.py

@@ -478,6 +478,14 @@ def test_orders_after_setup_unit(self) -> None:
         content = generate_provider_refresh_service("infisical")
         assert "After=psi-infisical-setup.service" in content
 
+    def test_restarts_psi_secrets_so_serve_reloads_the_fresh_cache(self) -> None:
+        """After setup writes a fresh cache with new hex IDs, psi-secrets must
+        restart to reload it — otherwise serve keeps the old IDs in memory and
+        every subsequent lookup misses the cache.
+        """
+        content = generate_provider_refresh_service("infisical")
+        assert "ExecStart=/usr/bin/systemctl try-restart psi-secrets.service" in content
+
 
 class TestProviderRefreshTimer:
     def test_targets_the_refresh_wrapper_not_the_setup_unit(self) -> None: