The v1 generator on this host skips a unit whose [Container] section holds an unknown key, so the deploy-time regeneration dropped hermes.service entirely while the container kept running unmanaged. Network=host generates --network host verbatim (v1 passes extension-less values through).