Hmmmmm. Shouldn't *any* machine we provision for a specific unit *always* have constraints derived from that unit already? ie combining service/environmental constraints at the time of creation? I'm surprised to see that added here (although that's probably a bugfix, I'm just surprised by the bug); but please check how service/env constraints end up as machine constraints elsewhere, because I *think* the path is different.