From 7d2465ec898c3096012f2c10739a836ea08d09aa Mon Sep 17 00:00:00 2001
From: Sycun <165354365+Sycun@users.noreply.github.com>
Date: Fri, 13 Nov 2026 10:05:42 +0800
Subject: [PATCH] fix(update): reload after confirming the accepted update is
 running

(cherry picked from commit aa7a533497a6b524fbd4d7d330ca06b04414e2fb)
---
 cmd/server/main.go                       |   3 +-
 internal/app/app.go                      |   4 +-
 internal/app/update_restart_other.go     |   4 +-
 internal/app/update_restart_unix.go      |  19 ++-
 internal/app/update_restart_unix_test.go |   7 +-
 internal/handler/update.go               |  61 +++++---
 internal/handler/update_http_test.go     |   6 +-
 web/static/i18n/ar-SA.json               |   2 +
 web/static/i18n/en-US.json               |   2 +
 web/static/i18n/ru-RU.json               |   2 +
 web/static/i18n/zh-CN.json               |   2 +
 web/static/js/update-ui.test.cjs         |  72 +++++++--
 web/static/js/update.js                  | 177 +++++++++++++++--------
 web/templates/index.html                 |   2 +-
 14 files changed, 257 insertions(+), 106 deletions(-)

diff --git a/cmd/server/main.go b/cmd/server/main.go
index 1c4d2e4a..3c78bd75 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -22,6 +22,7 @@ import (
 )
 
 func main() {
+	updateActivation := app.TakeUpdateActivation()
 	updateSessions := app.TakeUpdateSessionHandoff()
 	var configPath = flag.String("config", "config.yaml", "Path to the configuration file")
 	var httpsBootstrap = flag.Bool("https", false, "Enable HTTPS for the main site; uses an in-memory self-signed certificate when no cert/key is configured")
@@ -157,7 +158,7 @@ func main() {
 	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
 
 	// 创建应用
-	application, err := app.New(cfg, log, cp)
+	application, err := app.New(cfg, log, cp, updateActivation)
 	if err != nil {
 		log.Fatal("应用初始化失败", "error", err)
 	}
diff --git a/internal/app/app.go b/internal/app/app.go
index 36de93a6..83aeae35 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -79,7 +79,7 @@ type App struct {
 }
 
 // New 创建新应用
-func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error) {
+func New(cfg *config.Config, log *logger.Logger, configPath, updateActivation string) (*App, error) {
 	toolGuard, err := toolguard.NewManager(cfg.EffectiveToolGuard())
 	if err != nil {
 		return nil, fmt.Errorf("初始化调用拦截规则: %w", err)
@@ -613,7 +613,7 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 	})
 
 	updateHandler := handler.NewUpdateHandler(configDir, log.Logger, auditSvc,
-		app.updateRestart(configDir), configHandler.UpdateSource, configHandler.SetUpdateSource)
+		app.updateRestart(configDir), updateActivation, configHandler.UpdateSource, configHandler.SetUpdateSource)
 
 	// 设置路由（使用 App 实例以便动态获取 handler）
 	setupRoutes(
diff --git a/internal/app/update_restart_other.go b/internal/app/update_restart_other.go
index dc621f5a..600285ed 100644
--- a/internal/app/update_restart_other.go
+++ b/internal/app/update_restart_other.go
@@ -6,4 +6,6 @@ import "os"
 
 func TakeUpdateSessionHandoff() *os.File { return nil }
 
-func (a *App) updateRestart(string) func() (func(), error) { return nil }
+func TakeUpdateActivation() string { return "" }
+
+func (a *App) updateRestart(string) func(string) (func(), error) { return nil }
diff --git a/internal/app/update_restart_unix.go b/internal/app/update_restart_unix.go
index 94b31add..21a39f03 100644
--- a/internal/app/update_restart_unix.go
+++ b/internal/app/update_restart_unix.go
@@ -18,6 +18,19 @@ import (
 )
 
 const updateSessionsEnv = "CYBERSTRIKE_UPDATE_SESSIONS_FD"
+const updateActivationEnv = "CYBERSTRIKE_UPDATE_ACTIVATION"
+
+// TakeUpdateActivation identifies the update that launched this process.
+// A fresh start by a supervisor has no activation ID.
+func TakeUpdateActivation() string {
+	value := os.Getenv(updateActivationEnv)
+	_ = os.Unsetenv(updateActivationEnv)
+	pid, id, ok := strings.Cut(value, ":")
+	if !ok || pid != strconv.Itoa(os.Getpid()) {
+		return ""
+	}
+	return id
+}
 
 // TakeUpdateSessionHandoff claims the descriptor left by an in-place exec.
 // Do this before startup runs any subprocesses.
@@ -61,7 +74,7 @@ func writeUpdateSessionHandoff(payload []byte) (*os.File, error) {
 // updateRestart only replaces the executable this instance was started from.
 // For example, go run and installs with a separate config directory must not
 // start a different executable just because the updater wrote one there.
-func (a *App) updateRestart(root string) func() (func(), error) {
+func (a *App) updateRestart(root string) func(string) (func(), error) {
 	dir, err := filepath.Abs(root)
 	if err != nil {
 		return nil
@@ -79,7 +92,7 @@ func (a *App) updateRestart(root string) func() (func(), error) {
 	if err != nil || self != path {
 		return nil
 	}
-	return func() (func(), error) {
+	return func(activationID string) (func(), error) {
 		info, err := os.Lstat(path)
 		if err != nil {
 			return nil, err
@@ -95,7 +108,7 @@ func (a *App) updateRestart(root string) func() (func(), error) {
 			// Keep the same PID, arguments, environment and working directory.
 			// This works both in a terminal and under an existing supervisor.
 			exec := func(payload []byte) error {
-				env := os.Environ()
+				env := append(os.Environ(), fmt.Sprintf("%s=%d:%s", updateActivationEnv, os.Getpid(), activationID))
 				if len(payload) != 0 {
 					f, err := writeUpdateSessionHandoff(payload)
 					if err == nil {
diff --git a/internal/app/update_restart_unix_test.go b/internal/app/update_restart_unix_test.go
index 1dbcdf55..62a307d7 100644
--- a/internal/app/update_restart_unix_test.go
+++ b/internal/app/update_restart_unix_test.go
@@ -105,6 +105,9 @@ func TestUpdateSessionHandoffChild(t *testing.T) {
 		t.Fatal(err)
 	}
 	if token := os.Getenv("CSAI_RESTART_TEST_TOKEN"); token != "" {
+		if got := TakeUpdateActivation(); got != "upd-session-test" || os.Getenv(updateActivationEnv) != "" {
+			t.Fatalf("replacement did not consume the update activation: %q", got)
+		}
 		if handoff == nil || os.Getenv(updateSessionsEnv) != "" {
 			t.Fatal("replacement did not claim the private handoff")
 		}
@@ -142,7 +145,7 @@ func TestUpdateSessionHandoffChild(t *testing.T) {
 	if err := os.Rename("next", update.Binary); err != nil {
 		t.Fatal(err)
 	}
-	restart, err := prepare()
+	restart, err := prepare("upd-session-test")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -162,7 +165,7 @@ func TestUpdateRestartChild(t *testing.T) {
 	if err := os.Rename("next", update.Binary); err != nil {
 		t.Fatal(err)
 	}
-	restart, err := prepare()
+	restart, err := prepare("upd-standalone-test")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/handler/update.go b/internal/handler/update.go
index 657be816..4e15f8e5 100644
--- a/internal/handler/update.go
+++ b/internal/handler/update.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"runtime/debug"
 	"strings"
 	"sync"
 	"time"
@@ -34,8 +35,10 @@ type UpdateHandler struct {
 	logger *zap.Logger
 	audit  *audit.Service
 	// prepareRestart validates the replacement before the running service shuts down.
-	prepareRestart func() (func(), error)
+	prepareRestart func(activationID string) (func(), error)
 	bootID         string
+	activationID   string
+	buildRevision  string
 	// source reports the configured update source (config.yaml update.repo) as the
 	// operator last saved it; an empty string means "not configured" and the official
 	// repository is used. A function rather than a value because the config can change
@@ -82,14 +85,25 @@ func (j *updateJob) view() *updateJob {
 // NewUpdateHandler takes the audit service as a constructor argument rather than through
 // a SetAudit the assembly has to remember: forgetting here is a compile error instead of
 // a privileged endpoint that writes no audit records at all.
-func NewUpdateHandler(root string, logger *zap.Logger, auditSvc *audit.Service, prepareRestart func() (func(), error),
+func NewUpdateHandler(root string, logger *zap.Logger, auditSvc *audit.Service, prepareRestart func(string) (func(), error), activationID string,
 	source func() string, saveSource func(repo string) error) *UpdateHandler {
+	var revision string
+	if info, ok := debug.ReadBuildInfo(); ok {
+		for _, setting := range info.Settings {
+			if setting.Key == "vcs.revision" {
+				revision = setting.Value
+				break
+			}
+		}
+	}
 	return &UpdateHandler{
 		root:           root,
 		logger:         logger,
 		audit:          auditSvc,
 		prepareRestart: prepareRestart,
 		bootID:         uuid.NewString(),
+		activationID:   activationID,
+		buildRevision:  revision,
 		source:         source,
 		saveSource:     saveSource,
 		baseline:       update.StampBinary(root, update.Options{Root: root}),
@@ -145,6 +159,7 @@ func (h *UpdateHandler) sourceView() gin.H {
 // GetStatus answers GET /api/system/update: the install tree as it is on disk, without a
 // network round trip, so opening the page is never gated on GitHub being reachable.
 func (h *UpdateHandler) GetStatus(c *gin.Context) {
+	c.Header("Cache-Control", "no-store")
 	snap, err := update.Status(c.Request.Context(), h.options())
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -152,15 +167,17 @@ func (h *UpdateHandler) GetStatus(c *gin.Context) {
 	}
 	needsRestart, binaryBuiltAt := h.restartPending()
 	c.JSON(http.StatusOK, gin.H{
-		"status":        snap,
-		"job":           h.latest(),
-		"canRestart":    h.prepareRestart != nil,
-		"autoRestart":   h.prepareRestart != nil,
-		"bootID":        h.bootID,
-		"supervised":    restartSupervised(),
-		"needsRestart":  needsRestart,
-		"binaryBuiltAt": binaryBuiltAt,
-		"source":        h.sourceView(),
+		"status":             snap,
+		"job":                h.latest(),
+		"canRestart":         h.prepareRestart != nil,
+		"autoRestart":        h.prepareRestart != nil,
+		"bootID":             h.bootID,
+		"buildRevision":      h.buildRevision,
+		"activationTracking": true,
+		"supervised":         restartSupervised(),
+		"needsRestart":       needsRestart,
+		"binaryBuiltAt":      binaryBuiltAt,
+		"source":             h.sourceView(),
 	})
 }
 
@@ -168,6 +185,12 @@ func (h *UpdateHandler) GetStatus(c *gin.Context) {
 // a new boot from a revoked or expired session on the current boot.
 func (h *UpdateHandler) SetBootHeader(c *gin.Context) {
 	c.Header("X-CyberStrike-Boot-ID", h.bootID)
+	c.Header("X-CyberStrike-Build-Revision", h.buildRevision)
+	activationID := h.activationID
+	if activationID == "" {
+		activationID = "-"
+	}
+	c.Header("X-CyberStrike-Activation-ID", activationID)
 	c.Header("Cache-Control", "no-store")
 }
 
@@ -260,11 +283,11 @@ func (h *UpdateHandler) Adopt(c *gin.Context) {
 	}
 	job, started := h.startJob("adopt", body.Restart)
 	if !started {
-		c.JSON(http.StatusConflict, gin.H{"error": "已有一次更新在进行中", "job": job})
+		c.JSON(http.StatusConflict, gin.H{"error": "已有一次更新在进行中", "job": job, "bootID": h.bootID})
 		return
 	}
 	h.record(c, "update.adopt", "started", "开始把目录接入更新源", map[string]interface{}{"job": job.ID, "restart": body.Restart})
-	c.JSON(http.StatusAccepted, gin.H{"job_id": job.ID, "state": job.State})
+	c.JSON(http.StatusAccepted, gin.H{"job_id": job.ID, "state": job.State, "bootID": h.bootID})
 }
 
 // Apply answers POST /api/system/update/apply. It starts one job and returns immediately;
@@ -287,12 +310,12 @@ func (h *UpdateHandler) Apply(c *gin.Context) {
 
 	job, started := h.startJob("apply", body.Restart)
 	if !started {
-		c.JSON(http.StatusConflict, gin.H{"error": "已有一次更新在进行中", "job": job})
+		c.JSON(http.StatusConflict, gin.H{"error": "已有一次更新在进行中", "job": job, "bootID": h.bootID})
 		return
 	}
 	h.record(c, "update.apply", "started", "开始一键更新源码并重编译", map[string]interface{}{"job": job.ID, "restart": body.Restart})
 
-	c.JSON(http.StatusAccepted, gin.H{"job_id": job.ID, "state": job.State})
+	c.JSON(http.StatusAccepted, gin.H{"job_id": job.ID, "state": job.State, "bootID": h.bootID})
 }
 
 // Restart answers POST /api/system/update/restart: replace this process so the binary
@@ -327,14 +350,15 @@ func (h *UpdateHandler) Restart(c *gin.Context) {
 		c.JSON(http.StatusConflict, gin.H{"error": "磁盘上的二进制不存在，无法重启", "reason": "no_binary"})
 		return
 	}
-	restart, err := h.prepareRestart()
+	activationID := uuid.NewString()
+	restart, err := h.prepareRestart(activationID)
 	if err != nil {
 		failure := &update.Error{Reason: "restart_unavailable", Message: "无法启动磁盘上的二进制：" + err.Error()}
 		c.JSON(statusForError(failure), errorBody(failure))
 		return
 	}
 	h.record(c, "update.restart", "started", "重启安装以运行磁盘上的新二进制", nil)
-	c.JSON(http.StatusAccepted, gin.H{"restarting": true})
+	c.JSON(http.StatusAccepted, gin.H{"restarting": true, "activation_id": activationID, "bootID": h.bootID})
 	scheduled = true
 	time.AfterFunc(updateRestartDelay, func() { defer release(); restart() })
 }
@@ -342,6 +366,7 @@ func (h *UpdateHandler) Restart(c *gin.Context) {
 // Job answers GET /api/system/update/job: the running job, or the most recent one, with
 // every progress line so far.
 func (h *UpdateHandler) Job(c *gin.Context) {
+	c.Header("Cache-Control", "no-store")
 	c.JSON(http.StatusOK, gin.H{"job": h.latest()})
 }
 
@@ -429,7 +454,7 @@ func (h *UpdateHandler) startJob(kind string, restart bool) (*updateJob, bool) {
 		if job.Restart && finish == "succeeded" && res != nil && res.BinaryBuilt && h.prepareRestart != nil {
 			release, lockErr := update.LockInstall(opts)
 			if lockErr == nil {
-				restart, prepareErr := h.prepareRestart()
+				restart, prepareErr := h.prepareRestart(job.ID)
 				if prepareErr == nil {
 					h.mu.Unlock()
 					// Keep both CLI and HTTP writers out until the old executable is replaced.
diff --git a/internal/handler/update_http_test.go b/internal/handler/update_http_test.go
index 4a164be6..478ff765 100644
--- a/internal/handler/update_http_test.go
+++ b/internal/handler/update_http_test.go
@@ -36,11 +36,11 @@ func newUpdateRouter(root string, restart func()) (*gin.Engine, *UpdateHandler)
 func newUpdateRouterWithSource(root string, restart func(),
 	source func() string, save func(string) error) (*gin.Engine, *UpdateHandler) {
 	gin.SetMode(gin.TestMode)
-	var prepare func() (func(), error)
+	var prepare func(string) (func(), error)
 	if restart != nil {
-		prepare = func() (func(), error) { return restart, nil }
+		prepare = func(string) (func(), error) { return restart, nil }
 	}
-	h := NewUpdateHandler(root, nil, nil, prepare, source, save)
+	h := NewUpdateHandler(root, nil, nil, prepare, "", source, save)
 	router := gin.New()
 	router.GET("/api/system/update", h.GetStatus)
 	router.GET("/api/system/update/job", h.Job)
diff --git a/web/static/i18n/ar-SA.json b/web/static/i18n/ar-SA.json
index 6f87e584..53d2ee59 100644
--- a/web/static/i18n/ar-SA.json
+++ b/web/static/i18n/ar-SA.json
@@ -112,6 +112,7 @@
     "rollbackTitle": "التراجع",
     "root": "دليل التثبيت",
     "branch": "الفرع المحلّي",
+    "runningBuild": "البنية قيد التشغيل",
     "commit": "الإيداع الحالي",
     "committedAt": "أُودِع في",
     "subject": "موضوع الإيداع",
@@ -180,6 +181,7 @@
     "restartOverlayBody": "ستُعاد الصفحة تلقائيًا عندما يصبح الإصدار الجديد جاهزًا.",
     "restartOverlaySlowRunning": "لا تزال الخدمة تستجيب بوصفها العملية القديمة - يبدو أنّ إعادة التشغيل لم تحدث. استخدم الزرّ أدناه لمعاينة الحالة الحالية.",
     "restartOverlaySlowDown": "لم تعد الخدمة بعد. ستواصل الصفحة المحاولة. راجع سجلّات الخدمة إذا استمر الانقطاع.",
+    "restartOverlayUnexpected": "عادت الخدمة، لكن لم يُؤكّد تثبيت الإصدار المستهدف. ستستمر الصفحة في التحقق، ويمكنك تحديثها لمعرفة الإصدار الحالي.",
     "restartOverlayRefresh": "تحديث هذه الصفحة",
     "failureNoMessage": "لم يقدّم الخادم أيّ رسالة فشل",
     "resultTitle": "نتيجة التحديث",
diff --git a/web/static/i18n/en-US.json b/web/static/i18n/en-US.json
index d225707f..651c1ad4 100644
--- a/web/static/i18n/en-US.json
+++ b/web/static/i18n/en-US.json
@@ -112,6 +112,7 @@
     "rollbackTitle": "Rollback",
     "root": "Install directory",
     "branch": "Local branch",
+    "runningBuild": "Running build",
     "commit": "Current commit",
     "committedAt": "Committed at",
     "subject": "Commit subject",
@@ -180,6 +181,7 @@
     "restartOverlayBody": "This page will reload automatically when the new version is ready.",
     "restartOverlaySlowRunning": "The service is still answering as the old process - the restart does not seem to have happened. Use the button below to look at the current state.",
     "restartOverlaySlowDown": "The service is taking longer to come back. This page will keep trying. Check the service logs if it remains unavailable.",
+    "restartOverlayUnexpected": "The service is back, but this update has not been confirmed. This page will keep checking. You can also refresh to see the current version.",
     "restartOverlayRefresh": "Refresh this page",
     "failureNoMessage": "The server gave no failure message",
     "resultTitle": "Update result",
diff --git a/web/static/i18n/ru-RU.json b/web/static/i18n/ru-RU.json
index eb2fe9a1..cdfb2523 100644
--- a/web/static/i18n/ru-RU.json
+++ b/web/static/i18n/ru-RU.json
@@ -112,6 +112,7 @@
     "rollbackTitle": "Откат",
     "root": "Каталог установки",
     "branch": "Локальная ветка",
+    "runningBuild": "Запущенная сборка",
     "commit": "Текущий коммит",
     "committedAt": "Дата коммита",
     "subject": "Заголовок коммита",
@@ -180,6 +181,7 @@
     "restartOverlayBody": "Когда новая версия будет готова, страница обновится автоматически.",
     "restartOverlaySlowRunning": "Служба по-прежнему отвечает старым процессом — перезапуск, похоже, не произошёл. Нажмите кнопку ниже, чтобы увидеть текущее состояние.",
     "restartOverlaySlowDown": "Служба пока недоступна. Страница продолжит попытки. Если служба долго не отвечает, проверьте её журналы.",
+    "restartOverlayUnexpected": "Служба снова доступна, но установка нужной сборки не подтверждена. Проверка продолжится. Текущую версию можно увидеть, обновив страницу.",
     "restartOverlayRefresh": "Обновить страницу",
     "failureNoMessage": "Сервер не передал сообщение об ошибке",
     "resultTitle": "Результат обновления",
diff --git a/web/static/i18n/zh-CN.json b/web/static/i18n/zh-CN.json
index 7f55a325..05374ddf 100644
--- a/web/static/i18n/zh-CN.json
+++ b/web/static/i18n/zh-CN.json
@@ -112,6 +112,7 @@
     "rollbackTitle": "回滚",
     "root": "安装目录",
     "branch": "本机分支",
+    "runningBuild": "运行中的构建",
     "commit": "当前提交",
     "committedAt": "提交时间",
     "subject": "提交说明",
@@ -180,6 +181,7 @@
     "restartOverlayBody": "切换完成后，页面会自动恢复。",
     "restartOverlaySlowRunning": "服务仍在以旧进程应答——重启似乎没有发生。可点下方按钮刷新页面查看当前状态。",
     "restartOverlaySlowDown": "服务仍未恢复，页面会继续重试。如果长时间无法连接，请检查服务日志。",
+    "restartOverlayUnexpected": "服务已恢复，但未能确认本次更新的目标构建已生效。页面会继续检查，也可以刷新查看当前版本。",
     "restartOverlayRefresh": "立即刷新页面",
     "failureNoMessage": "服务端没有给出失败说明",
     "resultTitle": "更新结果",
diff --git a/web/static/js/update-ui.test.cjs b/web/static/js/update-ui.test.cjs
index 4c885bd3..2d90d74a 100644
--- a/web/static/js/update-ui.test.cjs
+++ b/web/static/js/update-ui.test.cjs
@@ -96,6 +96,7 @@ function envelope(status, job, canRestart, source, flags) {
         supervised: !!(flags && flags.supervised),
         autoRestart: flags?.autoRestart,
         bootID: flags?.bootID,
+        activationTracking: flags?.activationTracking,
         needsRestart: !!(flags && flags.needsRestart),
         binaryBuiltAt: (flags && flags.binaryBuiltAt) || '',
         source: source || emptySource,
@@ -316,7 +317,11 @@ function harness(options) {
             if (typeof answer === 'object') {
                 return Promise.resolve({
                     status: answer.status,
-                    headers: { get: name => name === 'X-CyberStrike-Boot-ID' ? answer.bootID : null },
+                    headers: { get: name => ({
+                        'X-CyberStrike-Boot-ID': answer.bootID,
+                        'X-CyberStrike-Activation-ID': answer.activationID,
+                        'X-CyberStrike-Build-Revision': answer.revision,
+                    })[name] },
                     json: () => Promise.resolve(answer.body || {}),
                 });
             }
@@ -407,8 +412,8 @@ function harness(options) {
         },
         setConfirm(v) { confirmAnswer = v; },
         liveTimers() { return timers.filter(t => !t.cleared && !t.deferred); },
-        tick() {
-            const live = h.liveTimers();
+        tick(ms) {
+            const live = h.liveTimers().filter(t => ms === undefined || t.ms === ms);
             if (!live.length) throw new Error('no poll timer is armed');
             return live[live.length - 1].fn();
         },
@@ -439,7 +444,7 @@ test('the console lives inside the settings page as its own section', () => {
         'settings-section-update must live inside page-settings');
     assert.match(template, /id="settings-section-update"[\s\S]{0,700}?id="update-console"/);
     assert.match(template, /id="update-console"/);
-    assert.match(template, /<script src="\/static\/js\/update\.js\?v=\{\{\.Version\}\}-auto-switch"><\/script>/);
+    assert.match(template, /<script src="\/static\/js\/update\.js\?v=\{\{\.Version\}\}-activation"><\/script>/);
     assert.match(template, /<div class="settings-section-header update-section-head">/);
     assert.match(template, /<h3 data-i18n="update\.title">/);
 
@@ -825,8 +830,7 @@ test('applying reads the job every 1.5 seconds', async () => {
     assert.ok(apply, 'no apply was posted: ' + h.calls.map(c => c.method + ' ' + c.url));
     assert.deepEqual(JSON.parse(apply.body), { restart: true },
         'the body is one object carrying a restart boolean, not a positional bag');
-    assert.equal(h.liveTimers().length, 1, 'exactly one poller: ' + JSON.stringify(h.timers.map(t => t.ms)));
-    assert.equal(h.liveTimers()[0].ms, 1500, 'progress must be read every 1.5 seconds');
+    assert.deepEqual(h.liveTimers().map(t => t.ms).sort(), [1500, 2000]);
 
     // In the browser the poller runs off the timer; here the test drives the armed callback so the
     // whole progress path is exercised without waiting on wall-clock time.
@@ -836,7 +840,7 @@ test('applying reads the job every 1.5 seconds', async () => {
     assert.deepEqual(h.calls.map(c => c.method + ' ' + c.url), ['GET /api/system/update/job']);
     assert.match(h.html(), /开始拉取更新源/, 'each step line must be rendered as it arrives');
     assert.match(h.html(), /进行中/);
-    assert.equal(h.liveTimers().length, 1);
+    assert.equal(h.liveTimers().filter(t => t.ms === 1500).length, 1);
 
     h.calls.length = 0;
     await h.tick();
@@ -1011,11 +1015,11 @@ test('a 202 that carries an error is not mistaken for success', async () => {
         'a half-finished rollback must not be followed by a victory lap through the status endpoint');
 });
 
-test('leaving the page kills the poller, and reopening arms exactly one', async () => {
+test('leaving the page pauses both timers and returning resumes the accepted update', async () => {
     const h = await harness();
     h.fire('startUpdateApply');
     await h.flush();
-    assert.equal(h.liveTimers().length, 1);
+    assert.equal(h.liveTimers().length, 2);
 
     h.calls.length = 0;
     h.setActive(false);
@@ -1027,7 +1031,7 @@ test('leaving the page kills the poller, and reopening arms exactly one', async
 
     h.setActive(true);
     await h.api.loadUpdateConsole();
-    assert.equal(h.liveTimers().length, 0, 'a clean open arms nothing');
+    assert.deepEqual(h.liveTimers().map(t => t.ms).sort(), [1500, 2000]);
 
     const busy = await harness({ job: { id: 'upd-3', state: 'running', started: 'x', steps: [] } });
     assert.equal(busy.liveTimers().length, 1, 'opening onto a running job arms the poller');
@@ -1453,11 +1457,57 @@ test('a job poll that dies while the restart is in flight is not a failure', asy
     assert.match(h.html(), /正在重启服务/, 'a dead poll while a restart is requested means the restart is in flight');
     assert.deepEqual(h.toasts.filter(t => t.type === 'error'), [], 'and it must not be toasted as a failure');
 
-    await h.tick();
+    await h.tick(2000);
     await h.flush();
     assert.equal(h.location.replaced.length, 1);
 });
 
+test('the accepted update reloads even when its final progress response is missed', async () => {
+    const h = await harness({
+        flags: { bootID: 'old', activationTracking: true },
+        responses: {
+            'GET /api/system/update/job': [
+                { body: { job: { ...runningJob, restartRequested: true } } },
+                { body: { job: null } },
+            ],
+        },
+        probes: [
+            { status: 200, bootID: 'old', activationID: '-' },
+            'down',
+            { status: 200, bootID: 'unrelated', activationID: '-' },
+            { status: 200, bootID: 'new', activationID: 'upd-1' },
+        ],
+    });
+    await h.api.startUpdateApply();
+    assert.match(h.html(), /开始拉取更新源/);
+    await h.tick(2000);
+    await h.tick(2000);
+    await h.tick(1500);
+    await h.tick(2000);
+    assert.equal(h.location.replaced.length, 0);
+
+    await h.tick(2000);
+    assert.equal(h.location.replaced.length, 1);
+    assert.match(h.location.replaced[0], /#system-update$/);
+    assert.equal(h.liveTimers().length, 0);
+});
+
+test('a confirmed target commit must match the running build before reloading', async () => {
+    const h = await harness({
+        flags: { bootID: 'old', activationTracking: true },
+        responses: { 'GET /api/system/update/job': [{ body: { job: succeededJob } }] },
+        probes: [
+            { status: 200, bootID: 'new', activationID: 'upd-1', revision: 'a1b2c3d' },
+            { status: 200, bootID: 'new', activationID: 'upd-1', revision: 'f9e8d7c000000' },
+        ],
+    });
+    await h.api.startUpdateApply();
+    await h.tick(2000);
+    assert.equal(h.location.replaced.length, 0);
+    await h.tick(2000);
+    assert.equal(h.location.replaced.length, 1);
+});
+
 test('an update that did not build a binary stays on the progress page', async () => {
     const h = await harness({
         flags: { autoRestart: true },
diff --git a/web/static/js/update.js b/web/static/js/update.js
index 1a2dfcc8..8208e0e5 100644
--- a/web/static/js/update.js
+++ b/web/static/js/update.js
@@ -26,11 +26,11 @@ let updateBusy = false;          // 页面自己发着的动作请求（检查 /
 let updateChecking = false;      // 只影响「检查更新」按钮的措辞
 let updatePollTimer = null;
 let updatePollInFlight = null;
-let updateRestartExpected = false;  // 更新结束后预计重启，构建阶段仍照常读进度
+let updateActivation = null;        // 已接受的切换请求，独立于任务进度
 let updateRestartPending = false;   // 正在等待服务恢复
 let updateWatchdogTimer = null;     // 重启守侧自己的定时器，跟任务进度轮询互不干扰
 let updateWatchdogDeadline = 0;
-let updateWatchdogSlow = null;      // null=还没超时；'running'=仍由旧进程应答；'down'=服务没回来
+let updateWatchdogSlow = null;      // 超时后说明服务未恢复、仍在旧进程或启动了非目标构建
 let updateAutoCheckDone = false; // 每个会话只自动查一次远端，不每次重绘都去打扰
 let updateSourceDraft = null;    // 编辑中的更新源仓库地址；null=还贴着服务端保存的值
 let updateSourceError = '';      // 最近一次保存/接入失败的原因，画在区块里
@@ -75,7 +75,7 @@ function scheduleUpdateAutoCheck() {
     if (!status || !status.installed || isUpdateJobRunning()) return false;
     updateAutoCheckDone = true;
     setTimeout(() => {
-        if (!isUpdateConsoleActive() || isUpdateJobRunning() || updateRestartPending) return;
+        if (!isUpdateConsoleActive() || isUpdateJobRunning() || updateActivation) return;
         checkForUpdates({ quiet: true });
     }, 1200);
     return true;
@@ -160,6 +160,8 @@ async function fetchUpdateStatus() {
         job: r.data.job || null,
         canRestart: !!r.data.canRestart,
         bootID: r.data.bootID || '',
+        buildRevision: r.data.buildRevision || '',
+        activationTracking: !!r.data.activationTracking,
         needsRestart: !!r.data.needsRestart,
         binaryBuiltAt: r.data.binaryBuiltAt || '',
         source: r.data.source || { repo: '', configured: false, defaultRepo: '' },
@@ -212,9 +214,11 @@ async function withUpdateBusy(fn, label) {
 
 async function loadUpdateConsole() {
     stopUpdatePolling();
-    // 重启已经发起：控制台让位给自恢复视图，不再去读一个正在退出的服务。
-    if (updateRestartPending) {
+    // Returning to this section must keep comparing against the original process.
+    if (updateActivation) {
         startUpdateWatchdog();
+        if (updateRestartPending) renderUpdateWatchdog();
+        if (!updateActivation.scheduled) startUpdatePolling();
         return;
     }
     resetUpdateCheck();
@@ -231,10 +235,12 @@ async function loadUpdateConsole() {
     }
     renderUpdateConsole();
     const job = updateJobOf();
-    updateRestartExpected = !!(job && job.restartRequested && job.state === 'running');
-    if (job && job.state === 'succeeded' && job.restartRequested && job.result?.binaryBuilt) {
-        startUpdateWatchdog();
-        return;
+    if (job?.restartRequested) {
+        watchUpdateActivation(job.id);
+        if (job.state === 'succeeded' && job.result?.binaryBuilt) {
+            waitForUpdateRestart(job.result.toCommit);
+            return;
+        }
     }
     if (isUpdateJobRunning()) startUpdatePolling();
     scheduleUpdateAutoCheck();
@@ -255,63 +261,92 @@ function stopUpdatePolling() {
 // 重启守侧：请求重启之后，盯着"新进程是否已经接客"，接上了就整页刷新
 // ---------------------------------------------------------------------------
 
-// 服务启动标记变了才刷新。会话过期和代理的错误页都不代表换版。
-// 离开控制台就静默停表：不把已经走开的用户从别的页面拽回更新页。
-let updateWatchdogProbing = false;
+// Watch from acceptance so a missed job response cannot prevent the reload.
+let updateWatchdogInFlight = null;
+
+function watchUpdateActivation(id, bootID = updateConsoleState?.bootID) {
+    updateActivation = {
+        id,
+        bootID,
+        tracked: !!(id && updateConsoleState?.activationTracking),
+        scheduled: false,
+        targetCommit: '',
+    };
+    updateWatchdogSlow = null;
+    updateWatchdogDeadline = Date.now() + UPDATE_WATCHDOG_TIMEOUT_MS;
+    startUpdateWatchdog();
+}
+
+function waitForUpdateRestart(targetCommit = '') {
+    stopUpdatePolling();
+    updateActivation.scheduled = true;
+    updateActivation.targetCommit = targetCommit;
+    updateWatchdogSlow = null;
+    updateWatchdogDeadline = Date.now() + UPDATE_WATCHDOG_TIMEOUT_MS;
+    updateRestartPending = true;
+    renderUpdateWatchdog();
+}
 
 async function watchdogProbe() {
     if (!isUpdateConsoleActive()) {
         stopUpdateWatchdog();
         return;
     }
-    if (updateWatchdogProbing) return;
-    updateWatchdogProbing = true;
+    const timer = updateWatchdogTimer;
+    if (!timer || updateWatchdogInFlight === timer) return;
+    const activation = updateActivation;
+    updateWatchdogInFlight = timer;
     let status = 0;
     let bootID = '';
+    let activationID = '';
+    let revision = '';
     let legacyUnauthorized = false;
-    const previousBoot = updateConsoleState && updateConsoleState.bootID;
     try {
         const resp = await fetchDuringUpdate('/api/auth/validate');
         status = resp.status;
         bootID = resp.headers?.get('X-CyberStrike-Boot-ID') || '';
-        if (status === 401 && !bootID) {
-            // A downgrade may return to a build that predates the boot header.
+        activationID = resp.headers?.get('X-CyberStrike-Activation-ID') || '';
+        revision = resp.headers?.get('X-CyberStrike-Build-Revision') || '';
+        if ((!activation.tracked || activation.scheduled) && status === 401 && !bootID && !activationID) {
             const data = await resp.json().catch(() => null);
             legacyUnauthorized = data?.error === '未授权访问，请先登录';
         }
-    } catch (err) {
+    } catch {
         status = 0;
     } finally {
-        updateWatchdogProbing = false;
+        if (updateWatchdogInFlight === timer) updateWatchdogInFlight = null;
     }
-    if (!isUpdateConsoleActive() || !updateWatchdogTimer) return;
-    if ((bootID && bootID !== previousBoot && (status === 200 || status === 401)) || legacyUnauthorized) {
+    if (!isUpdateConsoleActive() || timer !== updateWatchdogTimer || activation !== updateActivation) return;
+
+    const answering = status === 200 || status === 401;
+    const newBoot = answering && bootID && bootID !== activation.bootID;
+    // Apply results may use the short SHA. The activation ID also covers rebuilds
+    // of the same commit and builds without VCS metadata.
+    const targetMatches = !activation.targetCommit || !revision || revision.startsWith(activation.targetCommit);
+    // A confirmed handoff may boot an older binary, e.g. after rolling back.
+    const matchesActivation = !activation.tracked || activationID === activation.id ||
+        (activation.scheduled && !activationID);
+    if ((newBoot && targetMatches && matchesActivation) || legacyUnauthorized) {
+        stopUpdatePolling();
         stopUpdateWatchdog();
         const params = new URLSearchParams(location.search);
         params.set('restarted', Date.now());
         location.replace(location.pathname + '?' + params + '#system-update');
         return;
     }
-    if (updateRestartExpected && previousBoot && bootID === previousBoot && status === 200) {
-        // The progress request may have hit a transient network error during the build.
-        stopUpdateWatchdog();
-        updateRestartPending = false;
-        renderUpdateConsole();
-        startUpdatePolling();
-        return;
+    const timedOut = Date.now() > updateWatchdogDeadline;
+    if (!updateRestartPending && (newBoot || timedOut)) {
+        updateRestartPending = true;
+        renderUpdateWatchdog();
     }
-    if (updateWatchdogSlow === null && Date.now() > updateWatchdogDeadline) {
-        updateWatchdogSlow = bootID || status === 200 ? 'running' : 'down';
+    if (updateRestartPending && updateWatchdogSlow === null && timedOut) {
+        updateWatchdogSlow = newBoot ? 'unexpected' : bootID || status === 200 ? 'running' : 'down';
         renderUpdateWatchdog();
     }
 }
 
 function startUpdateWatchdog() {
-    if (updateWatchdogTimer) return;
-    updateRestartPending = true;
-    updateWatchdogSlow = null;
-    updateWatchdogDeadline = Date.now() + UPDATE_WATCHDOG_TIMEOUT_MS;
-    renderUpdateWatchdog();
+    if (updateWatchdogTimer || !isUpdateConsoleActive()) return;
     updateWatchdogTimer = setInterval(watchdogProbe, UPDATE_WATCHDOG_INTERVAL_MS);
 }
 
@@ -325,17 +360,17 @@ async function pollUpdateJob() {
         // 页面已经切走了。router.js 只在进入时调 initPage，离开时没人喊，
         // 所以这里自己停，不留野定时器。
         stopUpdatePolling();
+        stopUpdateWatchdog();
         return;
     }
     const timer = updatePollTimer;
     if (!timer || updatePollInFlight === timer) return;
     updatePollInFlight = timer;
-    // 传输层死亡（连接被拒、进程已经退出）是 reject 而不是带状态码的回应：两者在这里
-    // 归一——重启进行中它就是"进程退了"，否则才是要播报的读取失败。
+    // Handle socket errors and HTTP failures in the same progress path.
     let r;
     try {
         r = await runUpdateRequest('GET', '/api/system/update/job', undefined,
-            updateRestartExpected ? fetchDuringUpdate : apiFetch);
+            updateActivation ? fetchDuringUpdate : apiFetch);
     } catch (err) {
         r = { ok: false, error: err && err.message ? err.message : String(err) };
     } finally {
@@ -343,34 +378,47 @@ async function pollUpdateJob() {
     }
     if (timer !== updatePollTimer || !isUpdateConsoleActive()) return;
     if (!r.ok) {
-        stopUpdatePolling();
-        if (updateRestartExpected) {
-            // The page may have missed the last progress response before handoff.
-            startUpdateWatchdog();
+        // Keep both timers alive. If this was a brief network failure, the next
+        // progress response restores the build view.
+        if (updateActivation) {
+            if (!updateRestartPending) {
+                updateRestartPending = true;
+                updateWatchdogDeadline = Date.now() + UPDATE_WATCHDOG_TIMEOUT_MS;
+                renderUpdateWatchdog();
+            }
             return;
         }
+        stopUpdatePolling();
         notify(updateT('jobPollFailed', { reason: r.error }), 'error');
         return;
     }
-    const job = r.data && r.data.job ? r.data.job : null;
-    if (updateConsoleState) updateConsoleState.job = job;
-    renderUpdateConsole();
-    if (job && job.state === 'running') updateRestartExpected = !!job.restartRequested;
-    if (!job && updateRestartExpected) {
-        stopUpdatePolling();
-        startUpdateWatchdog();
+
+    const job = r.data?.job;
+    if (updateActivation?.tracked && job?.id !== updateActivation.id) return;
+    if (!job) {
+        if (!updateActivation) stopUpdatePolling();
         return;
     }
-    if (job && job.state !== 'running') {
-        stopUpdatePolling();
-        updateRestartExpected = false;
-        if (job.state === 'succeeded' && job.restartRequested && job.result?.binaryBuilt) {
-            startUpdateWatchdog();
-            return;
-        }
+    if (updateConsoleState) updateConsoleState.job = job;
+    if (job.state === 'running') {
         updateRestartPending = false;
-        reportFinishedJob(job);
+        updateWatchdogSlow = null;
+        updateWatchdogDeadline = Date.now() + UPDATE_WATCHDOG_TIMEOUT_MS;
+        renderUpdateConsole();
+        return;
     }
+
+    if (job.state === 'succeeded' && job.restartRequested && job.result?.binaryBuilt) {
+        if (!updateActivation) watchUpdateActivation(job.id);
+        waitForUpdateRestart(job.result.toCommit);
+        return;
+    }
+    stopUpdatePolling();
+    stopUpdateWatchdog();
+    updateActivation = null;
+    updateRestartPending = false;
+    renderUpdateConsole();
+    reportFinishedJob(job);
 }
 
 // 完成时的这一句只念服务端写下来的结论，但补编译与普通更新是两种完成：commits=0 却换了
@@ -484,13 +532,13 @@ async function startUpdateApply() {
         if (r.status === 409 && r.data.job) {
             // 另一次更新真的在跑：把它的进度接下来并接着看，这才是"当前状态"。
             if (updateConsoleState) updateConsoleState.job = r.data.job;
-            updateRestartExpected = !!r.data.job.restartRequested;
+            if (r.data.job.restartRequested) watchUpdateActivation(r.data.job.id, r.data.bootID);
             renderUpdateConsole();
             startUpdatePolling();
         }
         if (!r.ok) throw new Error(r.error);
         resetUpdateCheck();
-        updateRestartExpected = restart;
+        if (restart) watchUpdateActivation(r.data.job_id, r.data.bootID);
         startUpdatePolling();
         await pollUpdateJob();
     }, 'apply');
@@ -506,9 +554,9 @@ async function startRestartNow() {
         const r = await runUpdateRequest('POST', '/api/system/update/restart');
         if (!r.ok) throw new Error(r.error);
         stopUpdatePolling();
-        updateRestartExpected = false;
+        watchUpdateActivation(r.data.activation_id, r.data.bootID);
         notify(updateT('restartRequestedToast'), 'info');
-        startUpdateWatchdog();
+        waitForUpdateRestart();
     }, 'restart');
 }
 
@@ -533,7 +581,6 @@ async function rollbackUpdate() {
         }
         const to = (r.data.result && r.data.result.toCommit) || status.rollbackTo || '-';
         resetUpdateCheck();
-        updateRestartChoice = false;
         await fetchUpdateStatus();
         renderUpdateConsole();
         notify(updateT('rollbackDone', { commit: to }), 'success');
@@ -598,7 +645,7 @@ async function confirmAdoptSource() {
         if (!r.ok) throw new Error(r.error);
         updateAdoptPlan = null;
         resetUpdateCheck();
-        updateRestartExpected = restart;
+        if (restart) watchUpdateActivation(r.data.job_id, r.data.bootID);
         startUpdatePolling();
         notify(updateT('adoptAccepted', { id: r.data.job_id || '-' }), 'success');
         await pollUpdateJob();
@@ -689,10 +736,12 @@ function renderAdoptBody() {
 }
 
 function renderUpdateInstallBody(status) {
+    const revision = updateConsoleState?.buildRevision;
     const facts = [
         updateFact(updateT('root'), status.root),
         updateFact(updateT('branch'), status.branch),
         updateFact(updateT('commit'), status.commit),
+        revision ? updateFact(updateT('runningBuild'), revision.slice(0, 12)) : '',
         updateFact(updateT('committedAt'), status.committedAt),
         updateFact(updateT('subject'), status.subject),
     ].join('');
@@ -967,7 +1016,7 @@ function renderUpdateWatchdog() {
         '<div class="update-overlay-body">' + escapeHtml(updateT('restartOverlayBody')) + '</div>'];
     if (updateWatchdogSlow) {
         parts.push('<div class="update-overlay-slow">' + escapeHtml(updateT(
-            updateWatchdogSlow === 'running' ? 'restartOverlaySlowRunning' : 'restartOverlaySlowDown')) + '</div>');
+            { running: 'restartOverlaySlowRunning', down: 'restartOverlaySlowDown', unexpected: 'restartOverlayUnexpected' }[updateWatchdogSlow])) + '</div>');
         parts.push('<div class="update-overlay-actions">' +
             '<button class="btn-secondary" type="button" onclick="refreshUpdatePage()">' +
             escapeHtml(updateT('restartOverlayRefresh')) + '</button></div>');
diff --git a/web/templates/index.html b/web/templates/index.html
index 1571baf6..46330da2 100644
--- a/web/templates/index.html
+++ b/web/templates/index.html
@@ -7078,7 +7078,7 @@
     <script src="/static/js/tasks.js?v=20261027-pagination-custom-select"></script>
     <script src="/static/js/workflow-package-client.js"></script>
     <script src="/static/js/workflows.js"></script>
-    <script src="/static/js/update.js?v={{.Version}}-auto-switch"></script>
+    <script src="/static/js/update.js?v={{.Version}}-activation"></script>
     <script src="/static/js/roles.js?v=20261027-pagination-custom-select"></script>
     <script src="/static/js/rbac.js"></script>
     <script src="/static/js/c2.js?v=20261027-pagination-custom-select"></script>