Index: deploy/MULTI-INSTANCE.md
===================================================================
--- deploy/MULTI-INSTANCE.md	(revision 5462bab0a30abfb9338812cb154a11cebda17b67)
+++ deploy/MULTI-INSTANCE.md	(revision f43429431106c0c5b44ac4e91a6f294622a26fed)
@@ -84,7 +84,11 @@
 because the port comes from the same `.env`.
 
-**Rolling back.** The old `klonkt.service` is disabled but not deleted. To go
-back, move the data into `/opt/klonkt/storage`, restore the relative paths in
-`.env`, and run `systemctl enable --now klonkt`.
+**Rolling back.** The old `klonkt.service` is disabled and masked, not deleted.
+Masked because `disable` alone does not stop `systemctl restart klonkt` from
+starting it again, and a resurrected unit no longer finds its `.env` (that moved
+with the data): it would fall back to the defaults and write a fresh empty
+database into the checkout. To go back, move the data into `/opt/klonkt/storage`,
+restore the relative paths in `.env`, then `systemctl unmask klonkt` and
+`systemctl enable --now klonkt`.
 
 ## Adding an instance
Index: scripts/klonkt-migrate-data.sh
===================================================================
--- scripts/klonkt-migrate-data.sh	(revision 5462bab0a30abfb9338812cb154a11cebda17b67)
+++ scripts/klonkt-migrate-data.sh	(revision f43429431106c0c5b44ac4e91a6f294622a26fed)
@@ -129,7 +129,14 @@
 
 step "Switching to klonkt@$SLUG"
-if systemctl is-enabled --quiet "$OLD_UNIT" 2>/dev/null; then
+if systemctl list-unit-files "$OLD_UNIT" >/dev/null 2>&1; then
   run "systemctl disable --now $OLD_UNIT"
-  say "disabled $OLD_UNIT (file kept, so you can roll back)"
+  # Disable only removes the autostart link: `systemctl restart klonkt` would
+  # still START it. That is not theoretical — an updater generated before the
+  # split does exactly that, and the resurrected unit finds no .env (it moved
+  # with the data), falls back to the built-in defaults and creates a FRESH
+  # EMPTY database in the checkout. Masking makes any such call fail loudly.
+  # Reversible: systemctl unmask klonkt.
+  run "systemctl mask $OLD_UNIT"
+  say "disabled and masked $OLD_UNIT (unmask to roll back)"
 fi
 run "systemctl enable --now 'klonkt@$SLUG'"
Index: scripts/klonkt-refresh-updater.sh
===================================================================
--- scripts/klonkt-refresh-updater.sh	(revision 5462bab0a30abfb9338812cb154a11cebda17b67)
+++ scripts/klonkt-refresh-updater.sh	(revision f43429431106c0c5b44ac4e91a6f294622a26fed)
@@ -58,2 +58,29 @@
 chmod +x /usr/local/bin/klonkt-update
 echo "klonkt-update rewritten: branch ${BRANCH}, code ${KLONKT_DIR}, instances under ${DATA_ROOT}"
+
+# On a split install the old single unit must not be startable. `disable` alone
+# does not stop `systemctl restart klonkt` from starting it, and a resurrected
+# klonkt.service has no .env (it moved with the data): it falls back to the
+# defaults and writes a fresh empty database into the checkout.
+SPLIT=0
+for d in "${DATA_ROOT}"/*/; do [ -f "$d/.env" ] && SPLIT=1 && break; done
+if [ "$SPLIT" = 1 ] && systemctl list-unit-files klonkt.service >/dev/null 2>&1; then
+  if ! systemctl is-enabled klonkt.service 2>/dev/null | grep -q masked; then
+    systemctl stop klonkt.service 2>/dev/null || true
+    systemctl disable klonkt.service 2>/dev/null || true
+    systemctl mask klonkt.service
+    echo "retired klonkt.service: stopped, disabled and masked (unmask to roll back)"
+  fi
+fi
+
+# A leftover storage/ in the checkout means something ran without the instance
+# config. Report it; never delete it unattended — only its owner can tell
+# whether it holds anything.
+if [ "$SPLIT" = 1 ] && [ -e "${KLONKT_DIR}/storage" ]; then
+  echo
+  echo "WARNING: ${KLONKT_DIR}/storage exists while instance data lives in ${DATA_ROOT}."
+  echo "         Something ran without the instance .env and wrote here. Check with:"
+  echo "             sqlite3 ${KLONKT_DIR}/storage/database.sqlite 'select count(*) from posts;'"
+  echo "         If it is empty, it is a stray from a resurrected klonkt.service and"
+  echo "         can be removed. If it is NOT empty, do not delete it: ask first."
+fi