feat: restart to apply update, privileged helper, rollback

api/dependecyInjection.go

@@ -60,6 +60,8 @@ type UseCases struct {
 	GetUpdateStatusUseCase      *useCases.GetUpdateStatusUseCase
 	CheckForUpdateUseCase       *useCases.CheckForUpdateUseCase
 	StartUpdateDownloadUseCase  *useCases.StartUpdateDownloadUseCase
+	RequestRestartUseCase       *useCases.RequestRestartUseCase
+	RecordRunningInfoUseCase    *useCases.RecordRunningInfoUseCase
 }
 
 type Repositories struct {
@@ -76,6 +78,9 @@ type Repositories struct {
 	SignatureVerifier domainUpdate.SignatureVerifier
 	StagedRunner      domainUpdate.StagedBinaryRunner
 	DatabaseBackup    domainUpdate.DatabaseBackup
+	UpdateResults     domainUpdate.ResultStore
+	RestartRequests   domainUpdate.RestartRequestStore
+	RunningInfo       domainUpdate.RunningInfoStore
 }
 
 const (
@@ -139,6 +144,9 @@ func getRepositories(db *gorm.DB, settings config.Settings) *Repositories {
 		SignatureVerifier: update.NewEd25519SignatureVerifier(releasePublicKey()),
 		StagedRunner:      update.NewExecStagedBinaryRunner(),
 		DatabaseBackup:    update.NewSQLiteDatabaseBackup(db, filepath.Join(dataDir, backupsDirName), time.Now),
+		UpdateResults:     update.NewJSONResultStore(filepath.Join(dataDir, domainUpdate.ResultFileName)),
+		RestartRequests:   update.NewJSONRestartRequestStore(filepath.Join(dataDir, domainUpdate.RestartRequestFileName)),
+		RunningInfo:       update.NewJSONRunningInfoStore(filepath.Join(dataDir, domainUpdate.RunningInfoFileName)),
 	}
 }
 
@@ -175,9 +183,11 @@ func getUseCases(repos *Repositories, settings config.Settings) *UseCases {
 		MergeMediaUseCase:           useCases.NewMergeMediaUseCase(repos.ImageRepo, repos.ArticleRepo),
 		GetMediaUsageUseCase:        useCases.NewGetMediaUsageUseCase(repos.ImageRepo, repos.ArticleRepo),
 		GetSettingsUseCase:          useCases.NewGetSettingsUseCase(settings.Version),
-		GetUpdateStatusUseCase:      useCases.NewGetUpdateStatusUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, settings.Version),
+		GetUpdateStatusUseCase:      useCases.NewGetUpdateStatusUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, time.Now),
 		CheckForUpdateUseCase:       useCases.NewCheckForUpdateUseCase(repos.ReleaseFeed, repos.UpdateStore, settings.Version, time.Now),
 		StartUpdateDownloadUseCase:  startUpdateDownloadUseCase(repos, settings),
+		RequestRestartUseCase:       useCases.NewRequestRestartUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, time.Now),
+		RecordRunningInfoUseCase:    useCases.NewRecordRunningInfoUseCase(repos.RunningInfo, settings.Version, os.Getpid(), time.Now),
 	}
 }
 
@@ -186,6 +196,8 @@ func startUpdateDownloadUseCase(repos *Repositories, settings config.Settings) *
 		Store:          repos.UpdateStore,
 		Jobs:           repos.UpdateJobs,
 		Helper:         repos.UpdateHelper,
+		Results:        repos.UpdateResults,
+		Requests:       repos.RestartRequests,
 		Fetcher:        repos.AssetFetcher,
 		Verifier:       repos.SignatureVerifier,
 		Runner:         repos.StagedRunner,
@@ -214,3 +226,42 @@ func closeDb(db *gorm.DB) func() error {
 		return sqlDb.Close()
 	}
 }
+
+type BrowserUpdateCommands struct {
+	Enable  *useCases.EnableBrowserUpdatesUseCase
+	Disable *useCases.DisableBrowserUpdatesUseCase
+}
+
+func InitBrowserUpdateCommands() *BrowserUpdateCommands {
+	units := update.NewSystemdUnits()
+	dependencies := useCases.ManageBrowserUpdatesDependencies{
+		Probe:   update.NewSystemMachineProbe(),
+		Locator: units,
+		Units:   units,
+		Manager: update.NewSystemctlControl(domainUpdate.ServiceUnitName),
+		Status:  update.NewJSONHelperStatusWriter(),
+		Now:     time.Now,
+	}
+	return &BrowserUpdateCommands{
+		Enable:  useCases.NewEnableBrowserUpdatesUseCase(dependencies),
+		Disable: useCases.NewDisableBrowserUpdatesUseCase(dependencies),
+	}
+}
+
+func InitApplyUpdateCommand(options domainUpdate.InstallOptions) *useCases.ApplyRestartRequestUseCase {
+	layout := domainUpdate.HelperLayout{DataDir: options.DataDir, BinaryPath: options.Binary}
+	files := update.NewNoFollowFilesystem()
+	return useCases.NewApplyRestartRequestUseCase(useCases.ApplyRestartRequestDependencies{
+		Requests: update.NewFSRestartRequestStore(files, layout.RestartRequestPath()),
+		Results:  update.NewFSResultStore(files, layout.ResultPath()),
+		Running:  update.NewJSONRunningInfoStore(filepath.Join(options.DataDir, domainUpdate.RunningInfoFileName)),
+		Files:    files,
+		Service:  update.NewSystemctlControl(options.Service),
+		Health:   update.NewHTTPHealthChecker(options.Port),
+		Verifier: update.NewEd25519SignatureVerifier(releasePublicKey()),
+		Clock:    update.NewSystemClock(),
+		Logger:   log.Default(),
+		Layout:   layout,
+		Platform: domainUpdate.Platform{OS: runtime.GOOS, Arch: runtime.GOARCH},
+	})
+}

api/handlers/update/updateHandler.go

@@ -3,26 +3,37 @@ package update
 import (
 	"RenewCMS/api/pkg/apperr"
 	"RenewCMS/api/pkg/claims"
+	validator "RenewCMS/api/pkg/validator"
 	domain "RenewCMS/internal/domain/update"
 	"RenewCMS/internal/domain/user"
 	"RenewCMS/internal/infrastructure/useCases"
 	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
+	"strings"
 )
 
+const restartBodyLimitBytes = 1024
+
 type Handler struct {
 	GetUpdateStatusUseCase     *useCases.GetUpdateStatusUseCase
 	CheckForUpdateUseCase      *useCases.CheckForUpdateUseCase
 	StartUpdateDownloadUseCase *useCases.StartUpdateDownloadUseCase
+	RequestRestartUseCase      *useCases.RequestRestartUseCase
 	GetUserUseCase             *useCases.GetUserUseCase
 }
 
-func NewHandler(getStatus *useCases.GetUpdateStatusUseCase, checkForUpdate *useCases.CheckForUpdateUseCase, startDownload *useCases.StartUpdateDownloadUseCase, getUser *useCases.GetUserUseCase) *Handler {
+type restartRequest struct {
+	Kind *string `json:"kind" validate:"omitempty,oneof=update restart"`
+}
+
+func NewHandler(getStatus *useCases.GetUpdateStatusUseCase, checkForUpdate *useCases.CheckForUpdateUseCase, startDownload *useCases.StartUpdateDownloadUseCase, requestRestart *useCases.RequestRestartUseCase, getUser *useCases.GetUserUseCase) *Handler {
 	return &Handler{
 		GetUpdateStatusUseCase:     getStatus,
 		CheckForUpdateUseCase:      checkForUpdate,
 		StartUpdateDownloadUseCase: startDownload,
+		RequestRestartUseCase:      requestRestart,
 		GetUserUseCase:             getUser,
 	}
 }
@@ -56,6 +67,44 @@ func (h *Handler) Download(w http.ResponseWriter, _ *http.Request) {
 	writeStatus(w, http.StatusAccepted, status)
 }
 
+func (h *Handler) Restart(w http.ResponseWriter, r *http.Request) {
+	kind, ok := decodeRestartKind(w, r)
+	if !ok {
+		return
+	}
+	userId, ok := claims.UserId(r)
+	if !ok {
+		http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized)
+		return
+	}
+	status, err := h.RequestRestartUseCase.Request(userId, kind)
+	if err != nil {
+		writeRestartError(w, err)
+		return
+	}
+	writeStatus(w, http.StatusAccepted, status)
+}
+
+func decodeRestartKind(w http.ResponseWriter, r *http.Request) (string, bool) {
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, restartBodyLimitBytes))
+	if err != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return "", false
+	}
+	if strings.TrimSpace(string(body)) == "" {
+		return "", true
+	}
+	var request restartRequest
+	if err := json.Unmarshal(body, &request); err != nil || validator.Validate.Struct(request) != nil {
+		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
+		return "", false
+	}
+	if request.Kind == nil {
+		return "", true
+	}
+	return *request.Kind, true
+}
+
 func (h *Handler) isOwner(w http.ResponseWriter, r *http.Request) (bool, bool) {
 	userId, ok := claims.UserId(r)
 	if !ok {
@@ -78,7 +127,7 @@ func writeDownloadError(w http.ResponseWriter, err error) {
 	switch {
 	case errors.Is(err, domain.ErrNotPrepared):
 		http.Error(w, apperr.UpdateNotPreparedErrorMessage, http.StatusConflict)
-	case errors.Is(err, domain.ErrJobInProgress):
+	case errors.Is(err, domain.ErrJobInProgress), errors.Is(err, domain.ErrRestartPending):
 		http.Error(w, apperr.UpdateAlreadyRunningErrorMessage, http.StatusConflict)
 	case errors.Is(err, domain.ErrNothingToUpdate):
 		http.Error(w, apperr.NothingToUpdateErrorMessage, http.StatusBadRequest)
@@ -89,6 +138,19 @@ func writeDownloadError(w http.ResponseWriter, err error) {
 	}
 }
 
+func writeRestartError(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, domain.ErrNotPrepared):
+		http.Error(w, apperr.UpdateNotPreparedErrorMessage, http.StatusConflict)
+	case errors.Is(err, domain.ErrJobInProgress), errors.Is(err, domain.ErrRestartPending):
+		http.Error(w, apperr.UpdateAlreadyRunningErrorMessage, http.StatusConflict)
+	case errors.Is(err, domain.ErrRestartKindMismatch):
+		http.Error(w, apperr.UpdateRestartMismatchErrorMessage, http.StatusConflict)
+	default:
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+	}
+}
+
 func writeStatus(w http.ResponseWriter, code int, status domain.UpdateStatus) {
 	body, err := json.Marshal(status)
 	if err != nil {

api/pkg/apperr/messages.go

@@ -33,3 +33,4 @@ const UpdateNotPreparedErrorMessage = "This server cannot update itself yet."
 const UpdateAlreadyRunningErrorMessage = "An update is already running or waiting to be installed."
 const NothingToUpdateErrorMessage = "There is nothing to update."
 const UpdateRefusedErrorMessage = "This update cannot be downloaded."
+const UpdateRestartMismatchErrorMessage = "The update state changed. Reload the page and try again."

api/router.go

@@ -141,7 +141,7 @@ const (
 func NewSystemRouter(container *UseCases) http.Handler {
 	r := chi.NewRouter()
 
-	updateHandler := update.NewHandler(container.GetUpdateStatusUseCase, container.CheckForUpdateUseCase, container.StartUpdateDownloadUseCase, container.GetUserUseCase)
+	updateHandler := update.NewHandler(container.GetUpdateStatusUseCase, container.CheckForUpdateUseCase, container.StartUpdateDownloadUseCase, container.RequestRestartUseCase, container.GetUserUseCase)
 
 	r.Use(jwtauth.Verifier(container.Token))
 	r.Use(jwtauth.Authenticator(container.Token))
@@ -158,6 +158,10 @@ func NewSystemRouter(container *UseCases) http.Handler {
 		r.Use(middleware.NewUserRateLimiter(updateDownloadMaxAttempts, updateDownloadWindow))
 		r.Post("/update/download", updateHandler.Download)
 	})
+	r.Group(func(r chi.Router) {
+		r.Use(middleware.RequireOwner(container.GetUserUseCase))
+		r.Post("/update/restart", updateHandler.Restart)
+	})
 	return r
 }
 

cmd/server/commands.go

@@ -0,0 +1,90 @@
+package main
+
+import (
+	"RenewCMS/api"
+	"RenewCMS/internal/domain/update"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+)
+
+const (
+	enableCommand  = "enable-browser-updates"
+	disableCommand = "disable-browser-updates"
+	applyCommand   = "apply-update"
+
+	exitOK    = 0
+	exitError = 1
+	exitUsage = 2
+
+	usageText = "usage: renewcms [--version]\n" +
+		"       renewcms enable-browser-updates [--service NAME] [--binary PATH] [--data-dir DIR] [--port PORT]\n" +
+		"       renewcms disable-browser-updates [--service NAME] [--data-dir DIR]\n" +
+		"       renewcms apply-update --binary PATH --data-dir DIR [--service NAME] [--port PORT]"
+
+	applyNeedsFlagsMessage = "apply-update needs --binary and --data-dir."
+)
+
+func runCommand(args []string, stdout io.Writer, stderr io.Writer) int {
+	name, rest := args[0], args[1:]
+	switch name {
+	case enableCommand:
+		return withOptions(name, rest, stderr, func(options update.InstallOptions) int {
+			message, err := api.InitBrowserUpdateCommands().Enable.Enable(options)
+			return printOutcome(stdout, stderr, message, err)
+		})
+	case disableCommand:
+		return withOptions(name, rest, stderr, func(options update.InstallOptions) int {
+			message, err := api.InitBrowserUpdateCommands().Disable.Disable(options)
+			return printOutcome(stdout, stderr, message, err)
+		})
+	case applyCommand:
+		return withOptions(name, rest, stderr, func(options update.InstallOptions) int {
+			return apply(options, stderr)
+		})
+	}
+	fmt.Fprintln(stderr, usageText)
+	return exitUsage
+}
+
+func withOptions(name string, args []string, stderr io.Writer, run func(update.InstallOptions) int) int {
+	flags := flag.NewFlagSet(name, flag.ContinueOnError)
+	flags.SetOutput(stderr)
+	var options update.InstallOptions
+	flags.StringVar(&options.Service, "service", "", "systemd service name of RenewCMS")
+	flags.StringVar(&options.Binary, "binary", "", "path of the RenewCMS binary")
+	flags.StringVar(&options.DataDir, "data-dir", "", "directory that holds DB_FILE")
+	flags.StringVar(&options.Port, "port", "", "port RenewCMS listens on")
+	if err := flags.Parse(args); err != nil {
+		return exitUsage
+	}
+	return run(options)
+}
+
+func printOutcome(stdout io.Writer, stderr io.Writer, message string, err error) int {
+	if err != nil {
+		fmt.Fprintln(stderr, err)
+		return exitError
+	}
+	fmt.Fprintln(stdout, message)
+	return exitOK
+}
+
+func apply(options update.InstallOptions, stderr io.Writer) int {
+	if options.Binary == "" || options.DataDir == "" {
+		fmt.Fprintln(stderr, applyNeedsFlagsMessage)
+		return exitUsage
+	}
+	if options.Service == "" {
+		options.Service = update.DefaultService
+	}
+	if options.Port == "" {
+		options.Port = update.DefaultPort
+	}
+	if err := api.InitApplyUpdateCommand(options).Apply(); err != nil {
+		log.Printf("apply-update failed: %v", err)
+		return exitError
+	}
+	return exitOK
+}

cmd/server/main.go

@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -57,6 +58,9 @@ func main() {
 		fmt.Println(version)
 		return
 	}
+	if len(os.Args) > 1 {
+		os.Exit(runCommand(os.Args[1:], os.Stdout, os.Stderr))
+	}
 	if err := run(); err != nil {
 		log.Fatal(err)
 	}
@@ -76,7 +80,7 @@ func run() error {
 	validator.InitValidator()
 
 	server := newServer(api.InitRoutes(container, settings), settings)
-	return serveUntilStopped(server, settings)
+	return serveUntilStopped(server, settings, container.RecordRunningInfoUseCase.Record)
 }
 
 func initEnvVariables() {
@@ -127,12 +131,12 @@ func newServer(handler http.Handler, settings config.Settings) *http.Server {
 	}
 }
 
-func serveUntilStopped(server *http.Server, settings config.Settings) error {
+func serveUntilStopped(server *http.Server, settings config.Settings, recordRunning func() error) error {
 	stopSignal, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 
 	serverErr := make(chan error, 1)
-	go listen(server, serverErr, settings)
+	go listen(server, serverErr, settings, recordRunning)
 
 	select {
 	case err := <-serverErr:
@@ -142,9 +146,17 @@ func serveUntilStopped(server *http.Server, settings config.Settings) error {
 	}
 }
 
-func listen(server *http.Server, serverErr chan<- error, settings config.Settings) {
+func listen(server *http.Server, serverErr chan<- error, settings config.Settings, recordRunning func() error) {
+	listener, err := net.Listen("tcp", server.Addr)
+	if err != nil {
+		serverErr <- err
+		return
+	}
+	if err := recordRunning(); err != nil {
+		log.Printf("WARNING: could not write the running-version file: %v", err)
+	}
 	log.Printf("RenewCMS %s (%s) listening on %s, public URL %s", version, settings.Environment, server.Addr, settings.PublicURL)
-	err := server.ListenAndServe()
+	err = server.Serve(listener)
 	if errors.Is(err, http.ErrServerClosed) {
 		err = nil
 	}

docs/deployment.md

@@ -33,11 +33,57 @@ To check a download by hand: `go run ./cmd/releasesign verify checksums.txt`, wi
 
 ### Update checks
 
-The owner's Settings page asks the release feed for the newest release (see `UPDATE_FEED_URL` in [configuration.md](configuration.md)) and keeps the last result in `update-status.json`, next to `DB_FILE`. Back it up with the rest of the data directory if you like; it is rebuilt by the next check when missing. The Settings page only reports a newer version for now: the site does not update itself.
+The owner's Settings page asks the release feed for the newest release (see `UPDATE_FEED_URL` in [configuration.md](configuration.md)) and keeps the last result in `update-status.json`, next to `DB_FILE`. Back it up with the rest of the data directory if you like; it is rebuilt by the next check when missing. The Settings page reports a newer version. To install it from the browser, set up [Browser updates](#browser-updates) once on the server.
 
 ### Update downloads
 
-Once the restart helper is installed (it writes `update-helper.json` next to `DB_FILE`), the owner's Update button downloads the new binary, `checksums.txt` and `checksums.txt.sig` from the release feed host over https only, checks the ed25519 signature and the SHA-256, runs the staged binary with `--version`, copies the database into `backups/` (the last 3 copies are kept) and stages everything under `updates/<tag>/`, all next to `DB_FILE`. The job record is `update-job.json`. Nothing running is replaced and the site is not restarted. `renewcms --version` prints the build version and exits.
+Once the restart helper is installed (it writes `update-helper.json` next to `DB_FILE`), the owner's Update button downloads the new binary, `checksums.txt` and `checksums.txt.sig` from the release feed host over https only, checks the ed25519 signature and the SHA-256, runs the staged binary with `--version`, copies the database into `backups/` (the last 3 copies are kept) and stages everything under `updates/<tag>/`, all next to `DB_FILE`. The job record is `update-job.json`. Nothing running is replaced and the site is not restarted by the download: the owner's Restart button does that, as described in [Browser updates](#browser-updates). `renewcms --version` prints the build version and exits.
+
+### Browser updates
+
+The owner's Restart button installs a downloaded update, or just restarts the site, without touching the server by hand. The app itself stays unprivileged: the systemd unit below keeps `ProtectSystem=strict` and only the data directory (the directory that holds `DB_FILE`) is writable. The only privileged code is a small helper, the same binary started as `renewcms apply-update` by a systemd service that runs as root.
+
+Enable it once, on the server, as root:
+
+```sh
+sudo renewcms enable-browser-updates
+```
+
+The command reads the service name, the binary path and the data directory from your `renewcms.service` unit. Pass `--service`, `--binary`, `--data-dir` and `--port` to override them or when there is no such unit. The port, used by the helper to poll `/healthz`, comes from `--port`, else from `PORT` in the unit's `EnvironmentFile`, else 8080. It then:
+
+- writes `renewcms-update.path` and `renewcms-update.service` next to your other units in `/etc/systemd/system` (no secret and no environment value goes into them);
+- runs `systemctl daemon-reload` and enables and starts the path unit;
+- writes `update-helper.json` in the data directory last, so the Settings page only offers Update and Restart once everything else worked.
+
+Running it again rewrites the units and the status file to the current values. If a step fails, the units it wrote are removed again and `update-helper.json` is not written.
+
+To undo it:
+
+```sh
+sudo renewcms disable-browser-updates
+```
+
+This stops and disables the path unit, removes both unit files and `update-helper.json`, and runs `systemctl daemon-reload`. The restart request, the result, the staged files and the backups stay where they are, and the Settings page goes back to "Not prepared".
+
+How it works: pressing Restart makes the app write `update-restart-request.json` in the data directory. The path unit notices it and starts the helper, which deletes the request, checks the staged files again, installs the update, restarts the service and waits up to 60 seconds for the site to answer `/healthz` and for the new process to write `update-running.json`. The helper writes its outcome to `update-result.json`; the Settings page reads it. The technical reason of a failure goes to the journal only (`journalctl -u renewcms-update`).
+
+Files in the data directory:
+
+| File | Written by | What |
+|------|------------|------|
+| `update-restart-request.json` | the app | The request: `kind` (`update` or `restart`), `tag` (updates only), `requested_at`, `requested_by`. The helper deletes it first. |
+| `update-result.json` | the helper | The outcome: `running`, `succeeded`, `rolled_back` or `failed`, with `kind`, `tag`, `from_version`, `started_at`, `finished_at`. It stays until the next download or restart. |
+| `update-helper.json` | `enable-browser-updates` | Marks browser updates as set up (`version`, `service`, `binary`, `data_dir`, `installed_at`). |
+| `update-running.json` | the server, at every start | `version`, `pid` and `started_at` of the running process. The helper uses it to tell a new process from an old one. |
+
+What is supported and what is not:
+
+- Linux with systemd only. Not Windows, macOS, Docker or other init systems: there the command refuses with a clear message and the Settings page keeps showing "Not prepared".
+- Before the swap the helper copies the staged files into a private temp directory, checks the signature and the SHA-256 on that copy and installs the copy. It refuses symbolic links under `updates/` and on the request file.
+- The previous binary is kept as `<name>.previous` next to the binary, and the update download keeps a database backup in `backups/`.
+- If the new version does not come up within 60 seconds, the helper puts `<name>.previous` back, restarts the service and records `rolled_back`. If even that fails the result is `failed` and the journal says so loudly.
+- A plain restart (no update waiting) restarts the service the same way and records `succeeded` or `failed`; no binary is replaced.
+- Only the owner can press Restart. The site is unavailable for about 10 seconds.
 
 ## 2. Lay out the server
 

features/updates_restart_helper.feature

@@ -0,0 +1,508 @@
+Feature: Updates part 3: Restart, the privileged helper and rollback
+
+  As the owner of a RenewCMS site
+  I want one Restart button that installs the staged release, or just restarts the site, and puts the old version back if the new one does not come up
+  So that I can update from the browser while the app itself stays unprivileged and sandboxed
+
+  Background:
+    Given slices 1 to 3 of Updates ship in one release
+    And the app never gains privileges: the documented systemd unit keeps ProtectSystem=strict and only the data directory writable
+    And only the helper runs as root; it is the same binary, started as "renewcms apply-update" by a oneshot systemd service
+    And the data directory is the directory that holds DB_FILE; no new env var is added
+    And the files in the data directory are:
+      update-restart-request.json (marker, written by the app):
+        {"kind":"update"|"restart","tag" (update only),"requested_at" RFC3339 UTC,"requested_by" user_id};
+      update-result.json (written by the helper):
+        {"outcome":"running"|"succeeded"|"rolled_back"|"failed","kind","tag","from_version","started_at","finished_at"};
+      update-helper.json (status file, written by enable-browser-updates):
+        {"version":1,"service","binary","data_dir","installed_at"};
+      update-running.json (written by the server at every startup):
+        {"version","pid","started_at"}
+    And the marker is written atomically (temp file in the data directory, then rename) and deleted by the helper after reading it
+    And the technical reason of a failure goes to the log or journal only, never into a file the app serves or a response
+    And the domain package internal/domain/update (stdlib only) gains these interfaces, each faked in tests:
+      RestartRequestStore (write, read, delete the marker),
+      ResultStore (read, write and delete the result),
+      RunningInfoStore (the server writes update-running.json; the helper reads it),
+      HelperFilesystem (lstat, open with no-follow, read, create-exclusive, copy, rename, remove, chmod, make a fresh private
+        temp directory, all of them symlink-aware),
+      ServiceControl (restart and status of the systemd service),
+      HealthChecker (GET http://127.0.0.1:<port>/healthz, true on 200),
+      Clock
+    And the helper logic depends only on those interfaces and on update.SignatureVerifier from slice 2 with the embedded release.pub
+    And O_NOFOLLOW and lstat behaviour sit behind HelperFilesystem so the logic is tested on any OS; the real adapter is Linux-only
+      (build-tagged) and is covered by the manual systemd checklist
+    And RequestRestartUseCase and the extended GetUpdateStatusUseCase depend only on domain interfaces; handlers in
+      api/handlers/update receive them through NewHandler; only api/dependecyInjection.go builds the adapters
+    And POST /v1/system/update/restart is mounted in NewSystemRouter behind jwtauth.Verifier, jwtauth.Authenticator,
+      RequireCurrentToken, RequireVerifiedUser and RequireOwner; there is no limiter
+    And its optional JSON body is {"kind":"update"|"restart"}, bound to a request struct with
+      validate:"omitempty,oneof=update restart" and checked by validator.Validate.Struct; an empty body is allowed
+    And the checks on POST run in this order: no cookie or stale token (401), unverified (403), not owner (403),
+      malformed body or invalid kind (400), can_apply false (409), job downloading or verifying (409), a restart already pending
+      or running (409), kind that does not match the state (409), marker write error (500), then 202
+    And with no body the server picks by state: job "ready" gives kind "update", anything else kind "restart"
+    And the kind given must match: "update" needs a job "ready"; "restart" needs no job "ready"; otherwise 409 and nothing is written
+    And POST download and POST restart delete update-result.json before they start a new job or write a marker
+    And the 202 body is the status JSON with state "restarting" and started_at equal to the marker's requested_at (server clock)
+    And errors are plain text from http.Error and carry no path or technical detail
+    And GET /v1/system/update has no side effects; it keeps the 12 keys of slice 1 and gains exactly one key, "finished_at":
+      the result's finished_at (RFC3339 UTC) whenever a result file exists, otherwise null, whatever the state
+    And state is one of idle, downloading, verifying, ready, restarting, succeeded, failed, derived from the files by one rule:
+      marker present, or result "running" younger than 5 minutes: "restarting";
+      result "running" older than 5 minutes and no marker: "failed", error "install";
+      result "succeeded", kind "update", tag equal to the running version: "succeeded";
+      result "succeeded" for kind "restart", or kind "update" whose tag is no longer the running version: "idle";
+      result "rolled_back": "failed", error "rolled_back";
+      result "failed": "failed", error "install";
+      otherwise the slice 2 job state; a missing or corrupt result file counts as no result
+    And a result persists and is read the same on every GET until POST download or POST restart deletes it
+    And error is null, "download", "verification", "rolled_back" or "install"
+    And GET /healthz is unchanged: body "ok", no version header
+    And the server writes update-running.json at every startup, after the listener is bound and before it serves, atomically; a write error
+      is logged and is not fatal
+    And the helper judges a restart by two things: GET /healthz answers 200 AND update-running.json holds the expected version AND it is
+      NEW: its pid differs from the pid read before the restart, or its started_at is later than the instant the restart command
+      was issued; a stale file with the old pid or started_at never counts
+    And main gains a minimal dispatcher before the normal start: the subcommands enable-browser-updates, disable-browser-updates and
+      apply-update run their own code and never read .env, open the database or listen; "--version" and the normal start are unchanged
+    And the new subcommands never write a secret value or an env value into a unit file
+
+  Scenario: Request an update restart, happy path
+    Given the owner, can_apply true and a job "ready" for "v2.3.0-beta"
+    When the owner sends POST /v1/system/update/restart with no body, or with {"kind":"update"}
+    Then the status is 202 and the body is the status JSON with state "restarting"
+    And the marker holds kind "update", tag "v2.3.0-beta", requested_by the owner's user_id and requested_at
+    And update-result.json was deleted first
+    And the running binary, the staged files and the database are unchanged by the app
+    And GET reports state "restarting" for any verified user
+
+  Scenario: Request a plain restart
+    Given the owner, can_apply true and no job "ready"
+    When the owner sends POST /v1/system/update/restart with no body, or with {"kind":"restart"}
+    Then the status is 202, the marker holds kind "restart" and no tag, and GET reports state "restarting"
+
+  Scenario Outline: The kind must match the state
+    Given the owner, can_apply true and <state>
+    When the owner sends POST /v1/system/update/restart with {"kind":"<kind>"}
+    Then the status is 409, no marker is written, the result file and the job are untouched
+
+    Examples:
+      | state                       | kind    |
+      | no job "ready" (idle)       | update  |
+      | a job "failed"              | update  |
+      | a job "ready"               | restart |
+
+  Scenario: Restart site never installs an update another owner just made ready
+    Given owner A opened the Plain restart dialog while the job was idle
+    And owner B then made a job "ready"
+    When owner A confirms and the SPA sends {"kind":"restart"}
+    Then the status is 409, nothing is installed and the staged files are untouched
+    And the SPA reloads the card and shows "Ready to install"
+
+  Scenario Outline: A bad body is a 400
+    Given the owner and can_apply true
+    When the owner sends POST /v1/system/update/restart with <body>
+    Then the status is 400 with a plain text body and no marker is written
+
+    Examples:
+      | body                         |
+      | {"kind":"upgrade"}           |
+      | {"kind":""}                  |
+      | {"kind":7}                   |
+      | {"kind":"update"             |
+      | not json                     |
+
+  Scenario Outline: POST is guarded like the other system routes
+    When <caller> sends POST /v1/system/update/restart
+    Then the status is <status> and no marker is written and no result is deleted
+
+    Examples:
+      | caller                | status | body                             |
+      | no jwt cookie         | 401    | the existing 401 text            |
+      | a stale token version | 401    | the existing 401 text            |
+      | an unverified owner   | 403    | the existing unverified text     |
+      | an admin              | 403    | apperr.OwnerRequiredErrorMessage |
+
+  Scenario Outline: Restart is refused with 409
+    Given the owner and <condition>
+    When the owner sends POST /v1/system/update/restart
+    Then the status is 409, the existing marker, result and job are untouched and no new marker is written
+
+    Examples:
+      | condition                                        |
+      | can_apply is false (no update-helper.json)       |
+      | the job state is downloading                     |
+      | the job state is verifying                       |
+      | a marker is already pending                      |
+      | the result file reads "running" (helper at work) |
+
+  Scenario: Two restarts at once write one marker
+    When two owners send POST /v1/system/update/restart concurrently
+    Then exactly one answers 202 and the other 409 and one marker exists
+
+  Scenario: The marker cannot be written
+    Given the data directory is not writable, or a directory sits where the marker file goes
+    When the owner sends POST /v1/system/update/restart
+    Then the status is 500 with a plain text body without paths, no marker exists and the job record is untouched
+
+  Scenario Outline: GET derives the state from the files and never changes them
+    Given <files>
+    When any verified user sends GET /v1/system/update twice
+    Then both answers are identical, state is <state>, error is <error> and finished_at is <finished>
+    And no file in the data directory changed
+
+    Examples:
+      | files                                                              | state      | error         | finished  |
+      | a marker is present                                                | restarting | null          | null      |
+      | result "running" written 30 s ago                                  | restarting | null          | null      |
+      | result "running" written 6 minutes ago, no marker                  | failed     | "install"     | its value |
+      | result "succeeded", kind "update", tag equal to the running version | succeeded  | null          | its value |
+      | result "succeeded", kind "update", tag older than the running one  | idle       | null          | its value |
+      | result "succeeded", kind "restart"                                 | idle       | null          | its value |
+      | result "rolled_back"                                               | failed     | "rolled_back" | its value |
+      | result "failed"                                                    | failed     | "install"     | its value |
+      | no marker, no result                                               | idle       | null          | null      |
+      | a corrupt result file                                              | idle       | null          | null      |
+
+  Scenario: The result lives until the next job
+    Given a result "rolled_back"
+    When the owner sends POST /v1/system/update/download and the job reaches "ready"
+    Then the result file was deleted by the POST, GET reports state "ready", error null and finished_at null
+    And GET /v1/system/update still has exactly the 12 keys of slice 1 plus finished_at
+
+  Scenario: After a successful update the status is consistent
+    Given a result "succeeded" for "v2.3.0-beta" and the running version "v2.3.0-beta"
+    Then GET reports state "succeeded", available false, current "v2.3.0-beta" and finished_at set
+
+  Scenario: The server writes update-running.json at startup
+    When the server starts with version "v2.3.0-beta"
+    Then update-running.json holds {"version":"v2.3.0-beta","pid":<its pid>,"started_at":<now>} written atomically
+    And it is written after the listener is bound and before requests are served
+    And a write error is logged and the server still starts
+    And a second start replaces the file with the new pid and started_at
+    And the file is not served by any route
+
+  Scenario: Healthz is unchanged
+    When a client sends GET /healthz
+    Then the status is 200, the body is "ok" and there is no version header, and the route stays public
+
+  Scenario Outline: The command dispatcher
+    When the binary is run with "<args>" and an empty environment
+    Then <outcome>
+
+    Examples:
+      | args                    | outcome                                                                  |
+      | --version               | it prints the version, exits 0 (unchanged from slice 2)                  |
+      | enable-browser-updates  | it runs the installer, never reads .env or opens the database            |
+      | disable-browser-updates | it runs the uninstaller, never reads .env or opens the database          |
+      | apply-update            | it runs the helper, never reads .env or opens the database               |
+      | no arguments            | the normal server start                                                  |
+      | an unknown subcommand   | a usage message on stderr and a non-zero exit, the server is not started |
+
+  Scenario Outline: enable-browser-updates refuses when it cannot work
+    Given <situation>
+    When "renewcms enable-browser-updates" runs
+    Then it exits non-zero with the clear message "<message>" and writes nothing
+
+    Examples:
+      | situation                                      | message                                                                       |
+      | the OS is not Linux                            | Browser updates need Linux with systemd.                                      |
+      | Linux without systemd (no /run/systemd/system) | Browser updates need systemd, which this machine is not running.              |
+      | not run as root                                | Run this command as root, for example with sudo.                              |
+      | no unit for the service and no flags           | Could not find the RenewCMS service. Pass --service, --binary and --data-dir. |
+      | the data directory cannot be resolved          | Could not find the data directory. Pass --data-dir.                           |
+
+  Scenario: enable-browser-updates installs the units
+    Given systemd on Linux, root, and an existing renewcms.service with ExecStart=/opt/renewcms/renewcms and ReadWritePaths=/var/lib/renewcms
+    When "renewcms enable-browser-updates" runs
+    Then it reads the service name, binary path and data directory from the unit, with --service, --binary and --data-dir overriding them
+    And it writes renewcms-update.path (PathExists= the marker) and renewcms-update.service (Type=oneshot, User=root,
+      ExecStart=<binary> apply-update with the service, binary, data directory and port as flags)
+    And the port comes from --port, else from PORT in the service's environment file, else 8080
+    And it runs daemon-reload and enables and starts the path unit
+    And it writes update-helper.json last, so can_apply becomes true only when everything else worked
+    And no secret and no environment value is written into either unit
+    And it prints what it installed and how to undo it
+
+  Scenario: enable-browser-updates is idempotent
+    Given it ran once
+    When it runs again, including after the binary path or service name changed
+    Then the units and the status file are rewritten to the current values, no duplicate unit exists and the exit is 0
+
+  Scenario: enable-browser-updates undoes its own partial work
+    Given writing the second unit, daemon-reload or enable fails
+    Then the first unit is removed, update-helper.json is not written and the exit is non-zero with the reason
+
+  Scenario: disable-browser-updates
+    Given browser updates are enabled
+    When "renewcms disable-browser-updates" runs
+    Then the path unit is stopped and disabled, both unit files and update-helper.json are removed, daemon-reload runs
+    And the marker and result files, the staged files and backups are left in place
+    And running it again, or where it was never enabled, exits 0 with a message
+    And can_apply reads false afterwards
+
+  Scenario: apply-update, a plain restart
+    Given a marker of kind "restart" and update-running.json with pid 100 and started_at T0
+    When the helper runs
+    Then it reads the marker without following symlinks, deletes it, and writes the result "running" with started_at
+    And it records the current update-running.json, restarts the service once and polls until /healthz answers 200
+      and update-running.json is new (pid differs from 100, or started_at is later than the restart instant)
+    And it then writes "succeeded" with kind "restart" and finished_at
+    And the binary and the staged files are untouched
+
+  Scenario Outline: A stale running file never counts as success
+    Given a marker and update-running.json that <staleness> while /healthz answers 200
+    When the helper polls
+    Then it keeps polling and it is not declared succeeded or rolled back until a new file appears or 60 s pass
+
+    Examples:
+      | staleness                                                         |
+      | still holds the old pid and old started_at                        |
+      | holds the target version but the old pid and an old started_at    |
+      | is missing                                                        |
+      | is corrupt                                                        |
+      | holds the old version with a new pid (for an update)              |
+
+  Scenario: apply-update, an update, happy path
+    Given a marker of kind "update" for "v2.3.0-beta" and a staged binary, checksums.txt and checksums.txt.sig under updates/v2.3.0-beta/
+    When the helper runs
+    Then it creates a fresh root-owned temp directory with mode 0700 and copies the staged files into it, opening each original with no-follow
+    And it verifies the signature of the COPIED checksums.txt with the embedded public key
+    And it verifies the SHA-256 of the COPIED binary against its checksums.txt line, ignoring the earlier job record
+    And it copies the current binary to <name>.previous, replacing an older .previous
+    And it writes the verified copy to a temp file in the binary's directory (mode 0755), checks that it still hashes to the verified value,
+      and installs it with an atomic rename; the original staged path is never installed
+    And it restarts the service and polls /healthz and update-running.json for up to 60 s
+    And when /healthz answers 200 and update-running.json is new and holds "v2.3.0-beta" it writes "succeeded", success being declared on the
+      first matching poll
+    And it removes the temp directory and updates/v2.3.0-beta/
+    And the marker was deleted before any other step ran
+
+  Scenario Outline: apply-update refuses an untrusted staged binary
+    Given a marker of kind "update" and <fault>
+    When the helper runs
+    Then the current binary is not touched, no .previous is written and the service is not restarted
+    And it writes "failed", logs the technical reason only, and removes the temp directory and updates/<tag>/
+
+    Examples:
+      | fault                                                     |
+      | the binary was changed after the job verified it          |
+      | checksums.txt was changed                                 |
+      | the signature is from a different key or is missing       |
+      | checksums.txt has no line for the asset                   |
+      | the staged binary is missing                              |
+
+  Scenario Outline: apply-update refuses symlinks
+    Given a marker of kind "update" and <symlink>
+    When the helper runs
+    Then it never reads through the link, the current binary is untouched, there is no .previous and no restart
+    And it writes "failed" and logs which path was a symlink
+    And whatever the link pointed to is not read, copied, written or removed
+
+    Examples:
+      | symlink                                                           |
+      | the marker itself is a symlink                                    |
+      | <data>/updates is a symlink to another directory                  |
+      | <data>/updates/<tag> is a symlink to another directory            |
+      | the staged binary is a symlink to /usr/bin/something              |
+      | checksums.txt is a symlink                                        |
+      | checksums.txt.sig is a symlink                                    |
+      | a symlink is placed at the result path or at a temp file name     |
+
+  Scenario: A symlinked marker is removed, not followed
+    Given the marker is a symlink to a file outside the data directory
+    When the helper runs
+    Then the link itself is unlinked, the target is untouched, and the result is "failed"
+
+  Scenario: A file swapped after verification is not installed
+    Given the staged binary is verified and a fake attacker replaces the original staged path with other bytes right after the copy step
+    When the helper installs
+    Then the installed bytes equal the verified copy's bytes and not the swapped bytes
+    And the same holds for a swap during the .previous copy and the final rename
+    And a swap of the temp file in the binary's directory before the rename is caught by the re-hash and ends as "failed" with the binary untouched
+
+  Scenario: Result and temp files are written without following links
+    Given the service user placed a symlink at update-result.json or at a predictable temp name in the data directory
+    When the helper writes its result
+    Then it creates a temp file with create-exclusive and no-follow, then renames it over the result, and the link target is untouched
+
+  Scenario Outline: apply-update distrusts the marker
+    Given a marker whose tag is <tag>
+    When the helper runs
+    Then it writes "failed", the binary is untouched, the service is not restarted and nothing outside <data>/updates is read
+
+    Examples:
+      | tag                                                 |
+      | ../../etc/passwd                                    |
+      | v2.3.0-beta/../../x                                 |
+      | an empty string                                     |
+      | v2.1.0-beta (older than the running version)        |
+      | not-a-version                                       |
+
+  Scenario Outline: apply-update rolls back when the new version does not come up
+    Given an update marker and <fault> after the new binary was installed and the service restarted
+    When the helper runs
+    Then within the 60 s window it restores <name>.previous over the binary atomically and restarts the service again
+    And it polls until /healthz answers 200 and a NEW update-running.json holds the old version
+    And it writes "rolled_back" with from_version and tag and removes the temp directory and the staged files
+
+    Examples:
+      | fault                                                                 |
+      | /healthz never answers within 60 s                                    |
+      | /healthz answers but update-running.json stays old                    |
+      | update-running.json holds another version                             |
+      | the service restart command fails                                     |
+
+  Scenario Outline: apply-update failures around the swap
+    Given an update marker and <fault>
+    Then <outcome>
+
+    Examples:
+      | fault                                         | outcome                                                                                |
+      | copying to .previous fails                    | the binary is untouched, the service not restarted, result "failed"                    |
+      | the atomic install fails                      | .previous and the old binary are intact, no restart, result "failed"                   |
+      | the rollback restore itself fails             | result "failed", logged loudly, exit non-zero                                          |
+      | the old version never returns after rollback  | result "failed" (not "rolled_back"), exit non-zero                                     |
+
+  Scenario: The result is always written
+    Given any marker and any outcome, including a panic in the helper
+    Then update-result.json holds outcome, kind, tag, from_version, started_at and finished_at, written atomically
+    And a "running" record exists from the moment the marker was read until the outcome replaces it
+
+  Scenario: Only the helper runs with privilege
+    Then the app has no code that execs systemctl, writes outside the data directory or reads the units
+    And the oneshot service and path unit contain no environment secrets
+
+  Scenario: Settings, owner, Restart buttons (route /settings)
+    Given the owner and can_apply true
+    Then with state "ready" the Restart button (power, primary) is enabled and opens the Install dialog
+    And with state "idle" (Up to date or Check failed) the Restart button (power, secondary) is enabled and opens the Plain restart dialog
+    And with state "downloading", "verifying" or "restarting" Restart is disabled or absent as the card draws it
+    And with can_apply false (Not prepared) or the admin view no Restart is rendered
+    And the slice 2 disabled Restart in Ready to install is now enabled and has a handler
+    And the SPA sends {"kind":"update"} from the Install dialog and {"kind":"restart"} from the Plain restart dialog, always
+
+  Scenario: Settings, Restart: confirm (Install dialog)
+    When the owner presses Restart in Ready to install
+    Then a dialog titled "Restart to finish the update?" shows "RenewCMS will install version 2.3.0-beta and restart. Your site will be unavailable for about 10 seconds. This page reloads on its own when the site is back. Save anything you're editing first."
+    And its buttons are "Restart later" and "Restart now", the confirm is neutral, not red
+    And focus moves to the first button, Escape and "Restart later" close it and focus returns to Restart
+    And no request is sent until "Restart now"
+
+  Scenario: Settings, Plain restart: confirm
+    When the owner presses Restart with no update waiting
+    Then a dialog titled "Restart the site?" shows "Your site will be unavailable for about 10 seconds. This page reloads on its own when the site is back. Save anything you're editing first."
+    And its buttons are "Cancel" and "Restart site", with the same focus and Escape behaviour
+
+  Scenario: Settings, Restart: request failed
+    Given the confirm button is pressed and POST /v1/system/update/restart answers 500 or never reaches the server
+    Then the dialog stays open (install or plain) with the error "Couldn't start the restart. Nothing was changed and your site is still running. Try again in a moment."
+    And the confirm button is enabled again, no overlay shows and nothing is stored in sessionStorage
+
+  Scenario: Settings, this tab remembers that it started the restart
+    Given POST /v1/system/update/restart answers 202 with started_at "S"
+    Then sessionStorage holds one entry with the kind and "S" (the server's started_at), and no other storage is written
+    And the overlay shows
+
+  Scenario: Settings, Restarting to install
+    Given POST /v1/system/update/restart answers 202 for an update
+    Then a full-page region with role "status" shows, titled "Installing version 2.3.0-beta" with
+      "Your site is restarting with the new version. This takes about 10 seconds. This page reloads on its own when the site is back." and a moving bar
+    And it is announced once as "Installing version 2.3.0-beta. Your site is restarting."
+    And the overlay survives failing requests and the Offline banner state is ignored while it shows
+    And it polls GET /healthz and GET /v1/system/update every second, tolerating network errors and non-200 answers
+
+  Scenario: Settings, Plain restart: restarting
+    Given POST /v1/system/update/restart answers 202 for a plain restart
+    Then the overlay shows "Restarting your site" / "This takes about 10 seconds. This page reloads on its own when the site is back."
+    And it polls the same way
+
+  Scenario: Settings, Restarting, taking longer
+    Given 60 seconds pass with no answer from /healthz or from GET /v1/system/update
+    Then the overlay shows "Still restarting" / "This is taking longer than usual. Keep this page open. It reloads on its own when the site is back, or you can reload it now." and a "Reload page" button
+    And the meta reads "Started at 09:51 · 1 minute ago" (clock-sensitive)
+    And "Reload page" reloads the page, the overlay stays until the site answers, and the polling continues
+
+  Scenario: Settings, the overlay ends when the site answers
+    Given the overlay shows and /healthz answers and GET /v1/system/update answers with a state other than "restarting"
+      and finished_at later than the stored started_at
+    Then the page reloads once
+    And a GET answering "restarting", a GET whose finished_at is null or not later than the stored started_at, a /healthz answer without a GET
+      answer, and a rejected GET all keep the overlay and do not reload
+
+  Scenario: Settings, Update done (the tab that started it)
+    Given the page reloaded, sessionStorage holds {kind "update", started_at "S"} and GET answers state "succeeded" with finished_at later than "S"
+    Then the entry is cleared, focus lands on the "Updates" heading (id="updates-h") with the ring shown
+    And a success toast "Update installed" / "RenewCMS is now on version 2.3.0-beta." is announced
+    And the Version card shows the new running version and the card reads "You're on version 2.3.0-beta" /
+      "The update is installed and your site is running again." / "Updated today at 09:52" with a "Read the release notes" link (arrow-up-right)
+
+  Scenario: Settings, Update failed, rolled back (the tab that started it)
+    Given the page reloaded, sessionStorage holds {kind "update", started_at "S"} and GET answers state "failed", error "rolled_back", finished_at later than "S", running "v2.2.0-beta"
+    Then the entry is cleared and focus lands on "Updates"
+    And an error toast (stays until dismissed) with icon circle-x "The update didn't install" / "Your site is back on v2.2.0-beta." shows
+    And the card shows icon triangle-alert (warning) "The update didn't install" /
+      "RenewCMS put the previous version back, so your site is running as before. Nothing was lost." /
+      "What to do next: try again in a few minutes. If it fails again, ask whoever manages your server to check the update." and a "Try again" button that sends POST /v1/system/update/download
+    And error "install" renders the same card and toast
+
+  Scenario: Settings, Plain restart: done (the tab that started it)
+    Given the page reloaded, sessionStorage holds {kind "restart", started_at "S"} and GET answers state "idle" with finished_at later than "S"
+    Then the entry is cleared, focus lands on "Updates" and a success toast "Site restarted" / "Your site is running again." is announced
+    And the card is the normal Up to date card
+
+  Scenario Outline: A later visit shows the card with no toast and no focus move
+    Given sessionStorage has no entry, or an entry whose started_at is not earlier than finished_at, and GET answers <result>
+    Then the card renders for that state, no toast shows and focus does not move to "Updates"
+    And nothing is written to sessionStorage
+
+    Examples:
+      | result                                            |
+      | state "succeeded", finished_at set                |
+      | state "failed", error "rolled_back"               |
+      | state "failed", error "install"                   |
+      | state "idle", finished_at set (plain restart)     |
+
+  Scenario: Settings, another owner's tab never takes the toast
+    Given owner B has /settings open, with no sessionStorage entry, while GET answers "restarting" and later "succeeded"
+    Then owner B's page shows the overlay while "restarting" and the card afterwards, with no toast and no focus move
+    And owner A's tab, which holds the entry, still gets the toast and the focus
+    And an admin sees the admin view and no overlay
+
+  Scenario: Settings, a stale sessionStorage entry
+    Given an entry left behind by a restart that never finished in this tab (the tab was closed and reopened by hand)
+    When the page loads and GET answers a finished_at that is not later than the entry's started_at, or null
+    Then no toast shows, focus does not move, the entry stays until a later finished_at consumes it, and a new restart overwrites it
+
+  Scenario: Settings, 409 on Restart
+    Given POST /v1/system/update/restart answers 409
+    Then the dialog closes, nothing is stored in sessionStorage and the card reloads
+    And when the reload shows downloading, verifying or restarting an info toast "An update is already running" / "Another owner started it. Progress shows here." shows and the card or overlay switches to that run
+    And when the reload shows can_apply false the card shows "Not prepared" and no toast
+    And when the reload shows a different "Ready to install" or "idle" (the kind did not match) the card shows that state and no toast
+
+  Scenario: Settings, 400 on Restart
+    Given POST /v1/system/update/restart answers 400
+    Then the dialog shows the "Couldn't start the restart" text and nothing is stored in sessionStorage
+
+  Scenario: Settings, 403 role changed on Restart
+    Given POST /v1/system/update/restart answers 403
+    Then the dialog closes, an error toast "Only the owner can do this" / "Ask the owner of this site to update RenewCMS." shows and the card reloads in the admin view
+
+  Scenario: Settings, 401 on Restart
+    Given POST /v1/system/update/restart answers 401
+    Then the global handler goes to /login?redirect=/settings&reason=expired and no local copy shows
+
+  Scenario: Home banner while restarting
+    Given state "restarting"
+    Then Home shows no update banner and does not poll
+
+  Scenario: The docs gain a "Browser updates" section
+    Then docs/deployment.md has "Browser updates" with the one-time command "sudo renewcms enable-browser-updates", what it installs
+      (two units, update-helper.json), how to undo it ("sudo renewcms disable-browser-updates"), and what is and is not supported
+    And it lists: Linux with systemd only; not Windows, macOS, Docker or other init systems; the previous binary is kept as <name>.previous
+      and a database backup in backups/; an update whose new version does not come up within 60 s is rolled back automatically
+    And it names the files update-restart-request.json, update-result.json, update-helper.json and update-running.json
+    And the "How to update" link of the Not prepared card points at that section
+    And the sentence "the site does not update itself" in the "Update checks" section is replaced

features/updates_restart_helper.qa.md

@@ -0,0 +1,187 @@
+# QA: Updates part 3 (restart, helper, rollback)
+
+## Automated Go (`task test`, package `test`, black-box, no live systemd, no real SMTP, no network)
+
+Files: `test/update_restart_http_test.go` (HTTP), `test/update_restart_usecase_test.go` (request and status use cases),
+`test/update_helper_test.go` (helper logic over fakes, including rollback and hardening), `test/update_helper_install_test.go`
+(enable and disable over fakes), `test/update_helper_files_test.go` (real file adapters in `t.TempDir()`),
+`test/update_dispatch_test.go` (built binary).
+
+Fakes with unique names: `fakeRestartRequestStore`, `fakeResultStore`, `fakeRunningInfoStore` (scripted per poll: absent, corrupt, stale,
+new), `fakeHelperFS`, `fakeServiceControl` (records restart calls with the clock instant; can fail), `fakeHealthChecker` (scripted per poll),
+`fakeClock` (advances without sleeping), `fakeUnitWriter` (records unit contents, can fail the Nth write). Reuse `fakeJobStore`,
+`fakeHelperDetector`, `fakeUpdateStore`, `mockUserRepo` and the throwaway ed25519 signer from slices 1 and 2. Never read the committed `release.pub`.
+
+`fakeHelperFS`: an in-memory tree of files, directories and symlinks with owners and modes; `lstat`, no-follow open, create-exclusive, copy,
+rename, remove and a fresh private temp directory are the only operations; every call is recorded in order with its path; an operation that
+would traverse a symlink without the no-follow flag follows it (so a test fails if the code forgets to refuse); it can fail the Nth
+call of an operation, and it has a hook `after(op, n, mutate)` that mutates the tree after a chosen call (used to swap the original
+staged file after the copy step). Tests assert the paths the helper touched stay inside the data directory, the binary directory and
+its own temp directory.
+
+HTTP setup: `validator.InitValidator()`; `jwtauth.New("HS256", []byte("test-secret"), nil)`; a fresh `chi.NewRouter()` at `/v1/system`
+mirroring `NewSystemRouter` (Verifier, Authenticator, RequireCurrentToken, RequireVerifiedUser; the restart route also RequireOwner);
+cookies as in `test/stale_token_invalidation_http_test.go`. Marker, result and job files go in `t.TempDir()` through the real JSON adapters,
+plus the fakes where noted. Helper time is driven by `fakeClock`: no `time.Sleep`, so the 60 s window runs instantly.
+
+### Tests the coder must update (they exist from slices 1 and 2 and will break)
+- Slice 1 tests that assert GET /v1/system/update has exactly 12 keys: now 13, with `finished_at` (null when no result file).
+- Slice 2 tests and Vitest specs that assert the Restart button in "Ready to install" is disabled and has no handler, that no restart
+  endpoint, dialog or overlay exists, and that plain Restart is not rendered: replace them with the enabled behaviour below.
+- Slice 2 "Pending states for slice 3" visual entries: they become real setups.
+- Any slice 2 test that builds the status use case with a result store must accept the new `ResultStore` dependency.
+
+### HTTP and use case (Go-testable)
+1. Restart, update: ready job, can_apply on. POST with no body and POST `{"kind":"update"}` give 202 with state "restarting" and
+   `started_at` equal to the marker's `requested_at`; the marker has kind "update", the tag, requested_by equal to the owner id; the result file
+   was deleted first; no other file changed; GET as an admin also reads "restarting".
+2. Plain restart: idle job. No body and `{"kind":"restart"}` give 202, marker kind "restart", empty tag. Also after a failed job and after a
+   rolled-back result.
+3. Kind mismatch: `{"kind":"update"}` with no ready job (idle, failed) and `{"kind":"restart"}` with a ready job give 409; no marker, result and job untouched.
+   "Restart site never installs": owner A's body `{"kind":"restart"}` after the fake job store turned "ready" gives 409, no marker, staged files untouched.
+4. Bad body: `{"kind":"upgrade"}`, `{"kind":""}`, `{"kind":7}`, truncated JSON, `not json` give 400 plain text, no marker. The struct uses
+   `validate:"omitempty,oneof=update restart"` and goes through `validator.Validate.Struct`; an empty body and `{}` are accepted.
+5. Guards: admin 403 with `apperr.OwnerRequiredErrorMessage+"\n"`; no cookie 401; stale token 401; unverified 403; none writes a marker or deletes the result.
+   Order: an admin with a bad body gets 403, an owner with a bad body and can_apply off gets 400, can_apply off and a kind mismatch gives 409.
+6. 409 table: can_apply off, downloading, verifying, marker pending, result "running": no second marker, existing files untouched.
+7. Concurrency (`-race`): two simultaneous POSTs give one 202, one 409, one marker.
+8. 500: a directory where the marker goes, and a read-only temp directory (`t.Skip` that one on Windows): 500, plain text without the path, no marker,
+   job record unchanged.
+9. State derivation, one subtest per row of the feature table. Each row calls GET twice: the two bodies are byte-identical, `state`, `error` and
+   `finished_at` match, and a snapshot of every file in the data directory (names, bytes, mtimes) is unchanged by the GETs (GET has no side effects).
+   The 5-minute boundary uses `fakeClock`. Assert exactly the 12 slice 1 keys plus `finished_at`.
+10. The result lives until the next job: a "rolled_back" result, then POST download and a job reaching "ready": the result is gone,
+    state "ready", error null, `finished_at` null. POST restart also deletes it before writing the marker.
+11. After success: result "succeeded" for the running tag gives `available` false, `current` the new version, `finished_at` set.
+12. Server startup file: with the real running-info adapter in `t.TempDir()` write twice; the file has `version`, `pid` and `started_at`, the second
+    write replaces the first, it is written by a temp file plus rename, and a write into a missing directory returns an error that the startup code logs
+    (use case or startup function returns it; it does not panic). The built binary (item 15) writes it before it answers `/healthz`.
+13. `/healthz` is unchanged: body "ok", no `X-RenewCMS-Version` header, public.
+14. A new download after "rolled_back" gives 202 and later a "ready" with error null.
+15. Dispatcher: build with `go build -tags nofrontend -ldflags "-X main.version=v9.9.9" ./cmd/server` into `t.TempDir()`; with an empty environment
+    `--version` prints `v9.9.9`; an unknown subcommand exits non-zero with usage and does not listen; `apply-update` and `enable-browser-updates`
+    run without `.env` and create no `data/` (on a non-Linux machine the latter exits non-zero with the Linux/systemd message, which covers the Windows refusal).
+
+### Helper logic over fakes (Go-testable, no systemd)
+Fixture: fake FS with the binary `/opt/renewcms/renewcms` ("old"), staged `updates/v2.3.0-beta/` binary, `checksums.txt` and `checksums.txt.sig`
+signed with a throwaway key injected through the verifier constructor, a marker, running version v2.2.0-beta, `update-running.json` with pid 100 and
+started_at T0.
+
+16. Plain restart: the marker is opened no-follow and deleted first, result "running" then "succeeded", one service restart, no write to the binary.
+    Success needs `/healthz` 200 AND a running file that is NEW.
+17. Stale running info, one subtest per row: old pid and old started_at; target version but old pid and old started_at; absent; corrupt; old version with a new pid
+    (for an update). Health answers 200 throughout. The helper keeps polling and is not declared succeeded or rolled back until the file turns new or the
+    fake clock passes 60 s. Also: a file whose started_at is later than the restart instant counts as new even with the same pid.
+18. Update happy path, asserting the ORDER of fake calls: no-follow read and delete of the marker, "running", fresh 0700 temp directory, no-follow copy of the
+    three staged files into it, signature check on the copy, SHA-256 of the copied binary, copy of the current binary to `.previous`, temp file in the
+    binary's directory written from the verified copy, re-hash of that temp file, atomic rename, mode 0755, record running info, restart, polls,
+    "succeeded", removal of the temp directory and `updates/<tag>/`. Final FS: binary equals the new bytes, `.previous` equals the old bytes.
+    Success is declared on the first matching poll, not at 60 s.
+19. Re-verification, one subtest each: tampered binary, tampered checksums.txt, other-key signature, missing signature, no line for the asset, missing
+    binary. Each: binary unchanged, no `.previous`, zero restarts, result "failed", staged dir and temp dir removed, reason in the injected logger only.
+20. Symlinks, one subtest each: marker; `updates`; `updates/<tag>`; the binary; checksums.txt; checksums.txt.sig; a link at the result path; a link at a
+    predictable temp file name. Each: the FS records no read, write, copy or removal through the link (the targets, placed outside the allowed
+    directories with sentinel bytes, are unchanged), binary untouched, no `.previous`, zero restarts, result "failed", the log names the link path.
+    The symlinked marker case: the link itself is unlinked and the target is intact.
+21. TOCTOU: with the `after` hook, replace the original staged binary with other bytes immediately after the copy step; the installed bytes equal the
+    verified copy's bytes. Repeat with the swap after the signature check, after the hash check, and after the `.previous` copy. A swap of the temp file
+    in the binary's directory between write and rename is caught by the re-hash: result "failed", binary untouched.
+22. Result and temp writes: create-exclusive and no-follow, then rename; a pre-planted symlink at the result path or a temp name leaves the target intact.
+23. Hostile marker tags (traversal, traversal with valid prefix, empty, older version, malformed): result "failed", zero restarts, every touched path
+    under the allowed directories.
+24. Rollback table: health never answers (60 s of fake clock, about 60 polls at 1 s), healthy but running file stays old, other version in the running file,
+    restart error. Each: binary restored to "old" through an atomic rename, second restart issued, polled until a NEW running file holds the old version,
+    result "rolled_back" with from_version and tag, temp directory and staged dir removed.
+25. Swap failures: `.previous` copy fails (binary untouched, no restart, "failed"); atomic install fails (old binary and `.previous` intact, "failed");
+    restore fails ("failed", error returned, loud log); old version never returns after rollback ("failed", not "rolled_back").
+26. Result always written: a panic in the fake service control still leaves outcome "failed" with `finished_at`; the "running" record exists before the
+    first service call; writes are atomic.
+27. Timestamps come from `fakeClock`; finished is not before started.
+28. Enable, over fake FS, unit writer and service control: refuses non-Linux, no systemd, not root, no unit and no flags, no data directory (exact
+    messages); on success writes both units containing the service, binary and data directory from the parsed unit, the `PathExists=` marker line and
+    the port flag (`--port` over `PORT` from the env file over 8080); the units never contain `JWT_SECRET` or any value from the env file (seed the
+    fixture env file with `JWT_SECRET=sentinel-secret` and search both units); flags override the unit; the status file is written LAST; running it
+    twice gives identical files and one unit pair; each failing step leaves no status file and removes the first unit.
+29. Disable: removes units and the status file, keeps marker, result, staged files and backups; idempotent; a no-op where it was never enabled;
+    `can_apply` reads false afterwards through the real file detector.
+30. Real adapters on `t.TempDir()`: the JSON marker, result, status and running-info stores round trip; the atomic write replaces an existing file.
+    The Linux-only no-follow adapter has a test file with `//go:build linux` (it runs on Linux CI machines and the user's WSL2, and is skipped on Windows).
+31. Review items, not Go tests: the app (handlers, use cases, `api/`) execs no `systemctl` and writes only inside the data directory;
+    `internal/domain/update` imports only the stdlib; use cases import no `os/exec`, `net/http`, `gorm` or adapter; the handler imports no adapter;
+    the real filesystem adapter is the only code that calls `syscall.O_NOFOLLOW`; no secret in the repo; no new env var; `go vet -tags nofrontend`
+    and `gofmt` clean; no comments.
+
+## Automated SPA (Vitest + Vue Test Utils, `task test:web`)
+
+Mock `useApi.request` for `GET /v1/system/update`, `POST .../restart` and `POST .../download`; mock `fetch` for `GET /healthz`. Fake timers drive the
+1 s polls and the 60 s switch. Stub `window.location.reload` and use a fresh `sessionStorage` per test. No test freezes the system date and none asserts a
+relative date or "09:51". Sample data: running `v2.2.0-beta`, latest `v2.3.0-beta`, `started_at` and `finished_at` as plain strings.
+
+One test per state:
+1. Restart button: ready gives primary enabled; idle gives secondary enabled; downloading, verifying, restarting give disabled; can_apply false and admin give none.
+2. Install dialog: exact title, text, buttons; focus on the first button; Escape and "Restart later" close it; focus returns to Restart; no request until
+   "Restart now"; the confirm is neutral; the request body is `{"kind":"update"}`.
+3. Plain restart dialog: exact copy, "Cancel" / "Restart site", same behaviour; the request body is `{"kind":"restart"}`.
+4. Restart request failed: 500 and `NetworkError`, in both dialogs: dialog stays, the exact error text, confirm enabled again, no overlay, nothing in sessionStorage. A 400 gives the same.
+5. After 202, sessionStorage holds one entry with the kind and the response's `started_at`; no localStorage write.
+6. Restarting to install: overlay `role="status"`, title and text, announced once; stays mounted when `fetch` rejects; the offline banner state is ignored; polls
+   /healthz and GET every second.
+7. Plain restart: restarting: "Restarting your site" copy.
+8. Taking longer: at 60 s "Still restarting", the text, "Reload page" present; pressing it calls reload; the overlay stays.
+9. Overlay end: reload once when /healthz is ok and GET gives a non-"restarting" state with `finished_at` later than the stored `started_at`; no reload on
+   "restarting", on `finished_at` null, on `finished_at` not later, on a rejected GET, or without a GET answer; reload is not called twice.
+10. Update done (entry present, state "succeeded", later `finished_at`): entry cleared, focus on `#updates-h`, success toast "Update installed" / "RenewCMS is now on version 2.3.0-beta.", card text and the "Read the release notes" link.
+11. Rolled back (error "rolled_back" and "install"): entry cleared, focus on `#updates-h`, sticky error toast, card copy, "Try again" posts download.
+12. Plain restart done (state "idle", later `finished_at`, kind "restart"): toast "Site restarted" / "Your site is running again.", focus, Up to date card, entry cleared.
+13. No entry, or an entry not earlier than `finished_at`: for each of succeeded, rolled_back, install and plain-restart-idle results the card renders with no toast, no
+    focus move and no sessionStorage write.
+14. Another owner's tab: no entry, GET "restarting" then "succeeded": overlay then card, no toast, no focus move. An owner tab with an entry still gets the toast. An admin sees the
+    admin view, no overlay and no poll.
+15. Stale entry: `finished_at` null or earlier than the entry's `started_at` gives no toast and keeps the entry; a new restart overwrites it.
+16. 409: reload downloading gives the info toast and progress; reload restarting gives the toast and overlay; reload can_apply false gives Not prepared and no toast; reload "ready"
+    or "idle" after a kind mismatch gives that card, no toast, nothing in sessionStorage.
+17. 403: error toast and the admin view; 401 shows no local copy (the global handler is mocked).
+18. Home: no banner or poll while "restarting".
+19. Regression: slice 2's disabled-Restart assertions are replaced; Not prepared and the admin view still have no Restart.
+
+## Visual (`task visual:check -- settings`; desktop and mobile, light and dark; every capture within 10 %)
+
+`web/visual/states.ts` setups are added later by the coder, with the board's sample data (v2.2.0-beta, v2.3.0-beta). Exact values come from
+`docs/design/source/AppFrame.dc.html` and the "Settings" group of the Screens board; describe layout as drawn (open the frame markup for the dialog, the overlay card
+and its 440 px width before judging).
+- [ ] Restart: confirm (install dialog)
+- [ ] Plain restart: confirm
+- [ ] Restart: request failed
+- [ ] Restarting to install
+- [ ] Plain restart: restarting
+- [ ] Update failed, rolled back (the toast only if the frame draws it)
+- [ ] `skip: 'clock-sensitive'`: Update done and Plain restart: done (meta "Updated today at 09:52"), Restarting, taking longer (meta "Started at 09:51 · 1 minute ago"); their copy is covered by Vitest
+- [ ] Slice 2 pending states are now real: re-run the other Settings states and confirm Ready to install with an enabled Restart is within budget
+- [ ] If a capture exceeds 10 %, stop and report; do not widen the budget or add an exception without the user's approval
+- [ ] Not covered by screenshots: keyboard and focus order in both dialogs, the ring on `#updates-h` after the result states, the one-time overlay announcement, the motion of the bar, the Offline banner being ignored
+
+## Manual only (real systemd Linux: WSL2 with systemd enabled, or a VPS): CANNOT be verified automatically
+The user will run these. The helper's decision logic, ordering, symlink refusal, TOCTOU defence and rollback are unit-tested over fakes (items 16 to 27), but none of the following is covered:
+- [ ] On Windows or macOS `renewcms enable-browser-updates` refuses with the clear message.
+- [ ] On a VPS following docs/deployment.md (service user `renewcms`, `ProtectSystem=strict`, only `/var/lib/renewcms` writable): `sudo renewcms enable-browser-updates` reads the real unit, writes
+      `renewcms-update.path` and `renewcms-update.service`, enables the path unit (`systemctl status` active) and writes `update-helper.json`; a second run changes nothing.
+- [ ] The Settings page shows the Update button (can_apply true) after a reload.
+- [ ] The path unit fires when the sandboxed app writes the marker, and the app (as `renewcms`) can write the marker and cannot write the binary, the units or anything outside the data directory.
+- [ ] The server writes `update-running.json` at startup (`cat` it: version, pid, started_at) and a restart replaces it.
+- [ ] Real update from a real signed release (real `release.pub` committed, `task release` signing): Update, Ready, Restart, overlay, reload on the new version, toast on the tab that started it,
+      `.previous` next to the binary, `renewcms --version` equals the new tag, `journalctl -u renewcms-update` shows the helper log.
+- [ ] Real rollback: stage a signed release whose binary prints the right `--version` but crashes at boot; the old binary is restored within about 60 s, the card reads "The update didn't install", the toast stays.
+- [ ] Plain restart: overlay, about 10 s of downtime, reload with "Site restarted".
+- [ ] The real no-follow adapter on Linux: as the service user, replace `updates/<tag>` with a symlink to `/etc`, replace the staged binary with a symlink, replace the marker with a symlink, and swap the staged file during
+      an update (a loop that rewrites it); the helper refuses or installs only verified bytes, and nothing outside the data directory is read or changed.
+- [ ] Planted symlink at `update-result.json` pointing at a root-only file: the helper does not write through it.
+- [ ] Binary directory ownership, SELinux and AppArmor do not block the atomic rename, and the temp file is on the same filesystem as the binary; the helper's private temp directory is root-owned 0700 and is removed.
+- [ ] A hand-written marker with another tag, as the service user: refused, binary untouched.
+- [ ] `sudo renewcms disable-browser-updates` removes the units and status file; the card returns to "Not prepared"; nothing else is deleted.
+- [ ] A reverse proxy (nginx or Caddy) returns 502 during the restart and the overlay survives it; `/healthz` is not cached.
+- [ ] Two owners in two browsers during a restart: both show the overlay; only the tab that started it gets the toast and focus.
+- [ ] Embedded SPA build (no `-tags nofrontend`) serves `/settings` with the new dialogs and overlay.
+- [ ] Journal and files contain no secret, and technical reasons are only in the journal.
+
+## Final note
+Not verifiable automatically: the whole privileged path on a real systemd Linux machine (generated units, path-unit trigger from the sandboxed app, real service restart, atomic swap on a real filesystem, real rollback, O_NOFOLLOW behaviour, permissions, SELinux or AppArmor, reverse-proxy behaviour). It needs the manual test on WSL2 with systemd or a VPS, which the user will do.

internal/domain/update/updateDomain.go

@@ -59,6 +59,7 @@ type UpdateStatus struct {
 	Progress   *Progress     `json:"progress"`
 	Error      *string       `json:"error"`
 	StartedAt  *time.Time    `json:"started_at"`
+	FinishedAt *time.Time    `json:"finished_at"`
 }
 
 func NewResult(release Release, checkedAt time.Time) CheckResult {

internal/domain/update/updateInstall.go

@@ -0,0 +1,138 @@
+package update
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+)
+
+var (
+	ErrNeedsLinux      = errors.New("Browser updates need Linux with systemd.")
+	ErrNeedsSystemd    = errors.New("Browser updates need systemd, which this machine is not running.")
+	ErrNeedsRoot       = errors.New("Run this command as root, for example with sudo.")
+	ErrServiceNotFound = errors.New("Could not find the RenewCMS service. Pass --service, --binary and --data-dir.")
+	ErrDataDirNotFound = errors.New("Could not find the data directory. Pass --data-dir.")
+	ErrInvalidPort     = errors.New("The port must be a number between 1 and 65535.")
+)
+
+const (
+	OSLinux             = "linux"
+	pathUnitDescription = "Watch for a RenewCMS restart request"
+)
+
+type ServiceDescription struct {
+	Name            string
+	BinaryPath      string
+	DataDir         string
+	EnvironmentFile string
+}
+
+type InstallOptions struct {
+	Service string
+	Binary  string
+	DataDir string
+	Port    string
+}
+
+type MachineProbe interface {
+	OS() string
+	SystemdRunning() bool
+	IsRoot() bool
+}
+
+type ServiceLocator interface {
+	Locate(name string) (ServiceDescription, bool)
+	PortFromEnvironmentFile(path string) (string, bool)
+}
+
+type UnitWriter interface {
+	Write(name string, content string) error
+	Remove(name string) (bool, error)
+}
+
+type UnitManager interface {
+	DaemonReload() error
+	EnableNow(unit string) error
+	DisableNow(unit string) error
+}
+
+type HelperStatusWriter interface {
+	Write(dataDir string, status HelperStatus) error
+	Remove(dataDir string) (bool, error)
+}
+
+func CheckInstallEnvironment(probe MachineProbe) error {
+	if probe.OS() != OSLinux {
+		return ErrNeedsLinux
+	}
+	if !probe.SystemdRunning() {
+		return ErrNeedsSystemd
+	}
+	if !probe.IsRoot() {
+		return ErrNeedsRoot
+	}
+	return nil
+}
+
+func ValidatePort(port string) error {
+	number, err := strconv.Atoi(port)
+	if err != nil || number < 1 || number > 65535 {
+		return ErrInvalidPort
+	}
+	return nil
+}
+
+func RenderPathUnit(layout HelperLayout) string {
+	lines := []string{
+		"[Unit]",
+		"Description=" + pathUnitDescription,
+		"",
+		"[Path]",
+		"PathExists=" + layout.RestartRequestPath(),
+		"Unit=" + ServiceUnitName,
+		"",
+		"[Install]",
+		"WantedBy=multi-user.target",
+		"",
+	}
+	return strings.Join(lines, "\n")
+}
+
+func RenderServiceUnit(options InstallOptions) string {
+	command := []string{
+		quoteUnitArgument(options.Binary),
+		"apply-update",
+		"--service", quoteUnitArgument(options.Service),
+		"--binary", quoteUnitArgument(options.Binary),
+		"--data-dir", quoteUnitArgument(options.DataDir),
+		"--port", options.Port,
+	}
+	lines := []string{
+		"[Unit]",
+		"Description=RenewCMS update helper",
+		"",
+		"[Service]",
+		"Type=oneshot",
+		"User=root",
+		"ExecStart=" + strings.Join(command, " "),
+		"",
+	}
+	return strings.Join(lines, "\n")
+}
+
+var unitArgumentEscaper = strings.NewReplacer(
+	`\`, `\\`,
+	`"`, `\"`,
+	`%`, `%%`,
+	`$`, `$$`,
+	"\n", `\n`,
+	"\r", `\r`,
+	"\t", `\t`,
+)
+
+func quoteUnitArgument(value string) string {
+	if !strings.ContainsAny(value, " \t\r\n\"'\\%$;") {
+		return value
+	}
+	return `"` + unitArgumentEscaper.Replace(value) + `"`
+}

internal/domain/update/updateLayout.go

@@ -0,0 +1,63 @@
+package update
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"path"
+)
+
+const (
+	RestartRequestFileName = "update-restart-request.json"
+	ResultFileName         = "update-result.json"
+	HelperStatusFileName   = "update-helper.json"
+	RunningInfoFileName    = "update-running.json"
+	UpdatesDirName         = "updates"
+	HelperStatusVersion    = 1
+
+	PathUnitName    = "renewcms-update.path"
+	ServiceUnitName = "renewcms-update.service"
+	DefaultService  = "renewcms"
+	DefaultPort     = "8080"
+
+	PreviousSuffix     = ".previous"
+	PreviousTempSuffix = ".previous.tmp"
+	InstallTempSuffix  = ".new"
+	RestoreTempSuffix  = ".restore"
+	ResultTempSuffix   = ".tmp"
+	ExecutableMode     = 0o755
+	PrivateFileMode    = 0o600
+)
+
+type HelperLayout struct {
+	DataDir    string
+	BinaryPath string
+}
+
+func (l HelperLayout) UpdatesDir() string {
+	return path.Join(l.DataDir, UpdatesDirName)
+}
+
+func (l HelperLayout) StagedDir(tag string) string {
+	return path.Join(l.UpdatesDir(), tag)
+}
+
+func (l HelperLayout) ResultPath() string {
+	return path.Join(l.DataDir, ResultFileName)
+}
+
+func (l HelperLayout) ResultTempPath() string {
+	return l.ResultPath() + ResultTempSuffix
+}
+
+func (l HelperLayout) RestartRequestPath() string {
+	return path.Join(l.DataDir, RestartRequestFileName)
+}
+
+func (l HelperLayout) PreviousPath() string {
+	return l.BinaryPath + PreviousSuffix
+}
+
+func SHA256Hex(content []byte) string {
+	sum := sha256.Sum256(content)
+	return hex.EncodeToString(sum[:])
+}

internal/domain/update/updateRestart.go

@@ -0,0 +1,158 @@
+package update
+
+import (
+	"errors"
+	"regexp"
+	"time"
+)
+
+const (
+	StateRestarting = "restarting"
+	StateSucceeded  = "succeeded"
+
+	ErrorKindRolledBack = "rolled_back"
+	ErrorKindInstall    = "install"
+
+	RestartKindUpdate  = "update"
+	RestartKindRestart = "restart"
+
+	OutcomeRunning    = "running"
+	OutcomeSucceeded  = "succeeded"
+	OutcomeRolledBack = "rolled_back"
+	OutcomeFailed     = "failed"
+
+	RunningResultMaxAge = 5 * time.Minute
+)
+
+var (
+	ErrRestartPending      = errors.New("a restart is already pending or running")
+	ErrRestartKindMismatch = errors.New("the requested restart does not match the current state")
+	ErrNoRestartRequest    = errors.New("there is no restart request")
+	ErrSymlinkRefused      = errors.New("a symbolic link was found where a regular file is required")
+	ErrInvalidRestartTag   = errors.New("the restart request names an invalid version")
+	ErrHelperUnsupported   = errors.New("the privileged helper needs Linux")
+)
+
+var restartTagPattern = regexp.MustCompile(`^v[0-9]+(\.[0-9]+)*(-[0-9A-Za-z.]+)?$`)
+
+type RestartRequest struct {
+	Kind        string    `json:"kind"`
+	Tag         string    `json:"tag,omitempty"`
+	RequestedAt time.Time `json:"requested_at"`
+	RequestedBy uint32    `json:"requested_by"`
+}
+
+type Result struct {
+	Outcome     string     `json:"outcome"`
+	Kind        string     `json:"kind"`
+	Tag         string     `json:"tag"`
+	FromVersion string     `json:"from_version"`
+	StartedAt   time.Time  `json:"started_at"`
+	FinishedAt  *time.Time `json:"finished_at"`
+}
+
+type RunningInfo struct {
+	Version   string    `json:"version"`
+	Pid       int       `json:"pid"`
+	StartedAt time.Time `json:"started_at"`
+}
+
+type HelperStatus struct {
+	Version     int       `json:"version"`
+	Service     string    `json:"service"`
+	Binary      string    `json:"binary"`
+	DataDir     string    `json:"data_dir"`
+	InstalledAt time.Time `json:"installed_at"`
+}
+
+type FileInfo struct {
+	IsSymlink bool
+	IsDir     bool
+	IsRegular bool
+}
+
+type RestartRequestStore interface {
+	Write(request RestartRequest) error
+	Read() (RestartRequest, error)
+	Delete() error
+}
+
+type ResultStore interface {
+	Read() (Result, bool)
+	Write(result Result) error
+	Delete() error
+}
+
+type RunningInfoStore interface {
+	Write(info RunningInfo) error
+	Read() (RunningInfo, bool)
+}
+
+type HelperFilesystem interface {
+	Lstat(path string) (FileInfo, error)
+	ReadFile(path string) ([]byte, error)
+	CreateExclusive(path string, content []byte, mode uint32) error
+	Copy(source string, destination string, mode uint32) error
+	Rename(oldPath string, newPath string) error
+	Remove(path string) error
+	RemoveAll(path string) error
+	Chmod(path string, mode uint32) error
+	MakePrivateTempDir() (string, error)
+}
+
+type ServiceControl interface {
+	Restart() error
+	Status() (bool, error)
+}
+
+type HealthChecker interface {
+	Healthy() bool
+}
+
+type Clock interface {
+	Now() time.Time
+	Sleep(duration time.Duration)
+}
+
+func ValidateRestartTag(tag string, runningVersion string) error {
+	if !restartTagPattern.MatchString(tag) {
+		return ErrInvalidRestartTag
+	}
+	if _, err := ParseVersion(tag); err != nil || !IsNewer(runningVersion, tag) {
+		return ErrInvalidRestartTag
+	}
+	return nil
+}
+
+func (r Result) IsRunning() bool {
+	return r.Outcome == OutcomeRunning
+}
+
+func (r Result) IsKnown() bool {
+	switch r.Outcome {
+	case OutcomeRunning, OutcomeSucceeded, OutcomeRolledBack, OutcomeFailed:
+		return true
+	}
+	return false
+}
+
+func (i RunningInfo) IsNewerThan(previous RunningInfo, restartedAt time.Time) bool {
+	return i.Pid != previous.Pid || i.StartedAt.After(restartedAt)
+}
+
+const (
+	RestartWindow = 60 * time.Second
+	PollInterval  = time.Second
+)
+
+type SymlinkError struct {
+	Path string
+}
+
+func (e SymlinkError) Error() string {
+	return e.Path + " is a symbolic link"
+}
+
+func (e SymlinkError) Is(target error) bool {
+	return target == ErrSymlinkRefused
+}

internal/domain/update/updateRestartState.go

@@ -0,0 +1,38 @@
+package update
+
+import "time"
+
+func (s UpdateStatus) WithRestartRequest(request RestartRequest) UpdateStatus {
+	return s.settled(StateRestarting, "", request.RequestedAt)
+}
+
+func (s UpdateStatus) WithResult(result Result, currentVersion string, now time.Time) UpdateStatus {
+	if result.IsRunning() && now.Sub(result.StartedAt) < RunningResultMaxAge {
+		return s.settled(StateRestarting, "", result.StartedAt)
+	}
+	if result.IsRunning() || result.Outcome == OutcomeFailed {
+		return s.settled(StateFailed, ErrorKindInstall, result.StartedAt)
+	}
+	if result.Outcome == OutcomeRolledBack {
+		return s.settled(StateFailed, ErrorKindRolledBack, result.StartedAt)
+	}
+	if result.Kind == RestartKindUpdate && result.Tag == currentVersion {
+		return s.settled(StateSucceeded, "", result.StartedAt)
+	}
+	s.State = StateIdle
+	s.Progress = nil
+	s.Error = nil
+	s.StartedAt = nil
+	return s
+}
+
+func (s UpdateStatus) settled(state string, errorKind string, startedAt time.Time) UpdateStatus {
+	s.State = state
+	s.Progress = nil
+	s.Error = nil
+	if errorKind != "" {
+		s.Error = &errorKind
+	}
+	s.StartedAt = &startedAt
+	return s
+}

internal/infrastructure/update/atomicFile.go

@@ -0,0 +1,46 @@
+package update
+
+import (
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+)
+
+const readableFilePermissions = 0o644
+
+func writeFileAtomically(path string, content []byte, permissions os.FileMode) error {
+	temporary := path + ".tmp"
+	if err := os.WriteFile(temporary, content, permissions); err != nil {
+		return err
+	}
+	if err := os.Rename(temporary, path); err != nil {
+		_ = os.Remove(temporary)
+		return err
+	}
+	return nil
+}
+
+func writeJSONAtomically(path string, value any, permissions os.FileMode) error {
+	content, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	return writeFileAtomically(path, content, permissions)
+}
+
+func removeFile(path string) (bool, error) {
+	err := os.Remove(path)
+	if err == nil {
+		return true, nil
+	}
+	if errors.Is(err, fs.ErrNotExist) {
+		return false, nil
+	}
+	return false, err
+}
+
+func removeIfPresent(path string) error {
+	_, err := removeFile(path)
+	return err
+}

internal/infrastructure/update/fsRestartRequestStore.go

@@ -0,0 +1,82 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+)
+
+type FSRestartRequestStore struct {
+	files domain.HelperFilesystem
+	path  string
+}
+
+var _ domain.RestartRequestStore = &FSRestartRequestStore{}
+
+func NewFSRestartRequestStore(files domain.HelperFilesystem, path string) *FSRestartRequestStore {
+	return &FSRestartRequestStore{files: files, path: path}
+}
+
+func (s *FSRestartRequestStore) Write(request domain.RestartRequest) error {
+	return writeJSONThroughTemporary(s.files, s.path, request, statusFilePermissions)
+}
+
+func (s *FSRestartRequestStore) Read() (domain.RestartRequest, error) {
+	info, err := s.files.Lstat(s.path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return domain.RestartRequest{}, domain.ErrNoRestartRequest
+	}
+	if err != nil {
+		return domain.RestartRequest{}, err
+	}
+	if info.IsSymlink {
+		return domain.RestartRequest{}, domain.SymlinkError{Path: s.path}
+	}
+	if !info.IsRegular {
+		return domain.RestartRequest{}, fmt.Errorf("%s is not a regular file", s.path)
+	}
+	content, err := s.files.ReadFile(s.path)
+	if err != nil {
+		return domain.RestartRequest{}, err
+	}
+	var request domain.RestartRequest
+	return request, json.Unmarshal(content, &request)
+}
+
+func (s *FSRestartRequestStore) Delete() error {
+	return removeThrough(s.files, s.path)
+}
+
+func removeThrough(files domain.HelperFilesystem, path string) error {
+	if err := files.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	return nil
+}
+
+func writeJSONThroughTemporary(files domain.HelperFilesystem, path string, value any, mode uint32) error {
+	content, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	return writeThroughTemporary(files, path, content, mode)
+}
+
+func writeThroughTemporary(files domain.HelperFilesystem, path string, content []byte, mode uint32) error {
+	temporary := path + domain.ResultTempSuffix
+	if _, err := files.Lstat(temporary); err == nil {
+		if err := files.Remove(temporary); err != nil {
+			return err
+		}
+	}
+	if err := files.CreateExclusive(temporary, content, mode); err != nil {
+		return err
+	}
+	if err := files.Rename(temporary, path); err != nil {
+		_ = files.Remove(temporary)
+		return err
+	}
+	return nil
+}

internal/infrastructure/update/fsResultStore.go

@@ -0,0 +1,36 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+)
+
+type FSResultStore struct {
+	files domain.HelperFilesystem
+	path  string
+}
+
+var _ domain.ResultStore = &FSResultStore{}
+
+func NewFSResultStore(files domain.HelperFilesystem, path string) *FSResultStore {
+	return &FSResultStore{files: files, path: path}
+}
+
+func (s *FSResultStore) Read() (domain.Result, bool) {
+	info, err := s.files.Lstat(s.path)
+	if err != nil || !info.IsRegular {
+		return domain.Result{}, false
+	}
+	content, err := s.files.ReadFile(s.path)
+	if err != nil {
+		return domain.Result{}, false
+	}
+	return decodeResult(content)
+}
+
+func (s *FSResultStore) Write(result domain.Result) error {
+	return writeJSONThroughTemporary(s.files, s.path, result, readableFilePermissions)
+}
+
+func (s *FSResultStore) Delete() error {
+	return removeThrough(s.files, s.path)
+}

internal/infrastructure/update/httpHealthChecker.go

@@ -0,0 +1,32 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"net/http"
+	"time"
+)
+
+const healthCheckTimeout = 2 * time.Second
+
+type HTTPHealthChecker struct {
+	url    string
+	client *http.Client
+}
+
+var _ domain.HealthChecker = &HTTPHealthChecker{}
+
+func NewHTTPHealthChecker(port string) *HTTPHealthChecker {
+	return &HTTPHealthChecker{
+		url:    "http://127.0.0.1:" + port + "/healthz",
+		client: &http.Client{Timeout: healthCheckTimeout},
+	}
+}
+
+func (c *HTTPHealthChecker) Healthy() bool {
+	response, err := c.client.Get(c.url)
+	if err != nil {
+		return false
+	}
+	defer response.Body.Close()
+	return response.StatusCode == http.StatusOK
+}

internal/infrastructure/update/jsonHelperStatusWriter.go

@@ -0,0 +1,22 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"path/filepath"
+)
+
+type JSONHelperStatusWriter struct{}
+
+var _ domain.HelperStatusWriter = &JSONHelperStatusWriter{}
+
+func NewJSONHelperStatusWriter() *JSONHelperStatusWriter {
+	return &JSONHelperStatusWriter{}
+}
+
+func (w *JSONHelperStatusWriter) Write(dataDir string, status domain.HelperStatus) error {
+	return writeJSONAtomically(filepath.Join(dataDir, domain.HelperStatusFileName), status, readableFilePermissions)
+}
+
+func (w *JSONHelperStatusWriter) Remove(dataDir string) (bool, error) {
+	return removeFile(filepath.Join(dataDir, domain.HelperStatusFileName))
+}

internal/infrastructure/update/jsonRestartRequestStore.go

@@ -0,0 +1,54 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"sync"
+)
+
+type JSONRestartRequestStore struct {
+	path string
+	mu   sync.Mutex
+}
+
+var _ domain.RestartRequestStore = &JSONRestartRequestStore{}
+
+func NewJSONRestartRequestStore(path string) *JSONRestartRequestStore {
+	return &JSONRestartRequestStore{path: path}
+}
+
+func (s *JSONRestartRequestStore) Write(request domain.RestartRequest) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return writeJSONAtomically(s.path, request, statusFilePermissions)
+}
+
+func (s *JSONRestartRequestStore) Read() (domain.RestartRequest, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	info, err := os.Lstat(s.path)
+	if errors.Is(err, fs.ErrNotExist) || (err == nil && info.IsDir()) {
+		return domain.RestartRequest{}, domain.ErrNoRestartRequest
+	}
+	if err != nil {
+		return domain.RestartRequest{}, err
+	}
+	content, err := os.ReadFile(s.path)
+	if err != nil {
+		return domain.RestartRequest{}, err
+	}
+	var request domain.RestartRequest
+	return request, json.Unmarshal(content, &request)
+}
+
+func (s *JSONRestartRequestStore) Delete() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return removeIfPresent(s.path)
+}

internal/infrastructure/update/jsonResultStore.go

@@ -0,0 +1,52 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"encoding/json"
+	"os"
+	"sync"
+)
+
+type JSONResultStore struct {
+	path string
+	mu   sync.Mutex
+}
+
+var _ domain.ResultStore = &JSONResultStore{}
+
+func NewJSONResultStore(path string) *JSONResultStore {
+	return &JSONResultStore{path: path}
+}
+
+func (s *JSONResultStore) Read() (domain.Result, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	content, err := os.ReadFile(s.path)
+	if err != nil {
+		return domain.Result{}, false
+	}
+	return decodeResult(content)
+}
+
+func (s *JSONResultStore) Write(result domain.Result) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return writeJSONAtomically(s.path, result, readableFilePermissions)
+}
+
+func (s *JSONResultStore) Delete() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return removeIfPresent(s.path)
+}
+
+func decodeResult(content []byte) (domain.Result, bool) {
+	var result domain.Result
+	if err := json.Unmarshal(content, &result); err != nil || !result.IsKnown() {
+		return domain.Result{}, false
+	}
+	return result, true
+}

internal/infrastructure/update/jsonRunningInfoStore.go

@@ -0,0 +1,45 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"encoding/json"
+	"os"
+	"sync"
+)
+
+type JSONRunningInfoStore struct {
+	path string
+	mu   sync.Mutex
+}
+
+var _ domain.RunningInfoStore = &JSONRunningInfoStore{}
+
+func NewJSONRunningInfoStore(path string) *JSONRunningInfoStore {
+	return &JSONRunningInfoStore{path: path}
+}
+
+func (s *JSONRunningInfoStore) Write(info domain.RunningInfo) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return writeJSONAtomically(s.path, info, readableFilePermissions)
+}
+
+func (s *JSONRunningInfoStore) Read() (domain.RunningInfo, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	linkInfo, err := os.Lstat(s.path)
+	if err != nil || !linkInfo.Mode().IsRegular() {
+		return domain.RunningInfo{}, false
+	}
+	content, err := os.ReadFile(s.path)
+	if err != nil {
+		return domain.RunningInfo{}, false
+	}
+	var info domain.RunningInfo
+	if err := json.Unmarshal(content, &info); err != nil || info.Version == "" || info.Pid == 0 {
+		return domain.RunningInfo{}, false
+	}
+	return info, true
+}

internal/infrastructure/update/noFollowFilesystem_linux.go

@@ -0,0 +1,163 @@
+//go:build linux
+
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+const (
+	privateTempDirPrefix = "renewcms-update-"
+	readNoFollowFlags    = os.O_RDONLY | syscall.O_NOFOLLOW | syscall.O_NONBLOCK
+	createNoFollowFlags  = os.O_WRONLY | os.O_CREATE | os.O_EXCL | syscall.O_NOFOLLOW
+	directoryFlags       = os.O_RDONLY | syscall.O_NOFOLLOW | syscall.O_DIRECTORY
+)
+
+var errNotRegularFile = errors.New("not a regular file")
+
+type NoFollowFilesystem struct{}
+
+var _ domain.HelperFilesystem = &NoFollowFilesystem{}
+
+func NewNoFollowFilesystem() *NoFollowFilesystem {
+	return &NoFollowFilesystem{}
+}
+
+func (f *NoFollowFilesystem) Lstat(path string) (domain.FileInfo, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return domain.FileInfo{}, err
+	}
+	mode := info.Mode()
+	return domain.FileInfo{
+		IsSymlink: mode&fs.ModeSymlink != 0,
+		IsDir:     mode.IsDir(),
+		IsRegular: mode.IsRegular(),
+	}, nil
+}
+
+func (f *NoFollowFilesystem) ReadFile(path string) ([]byte, error) {
+	file, err := openRegularNoFollow(path)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	return io.ReadAll(file)
+}
+
+func (f *NoFollowFilesystem) CreateExclusive(path string, content []byte, mode uint32) error {
+	file, err := os.OpenFile(path, createNoFollowFlags, fs.FileMode(mode))
+	if err != nil {
+		return err
+	}
+	if _, err := file.Write(content); err != nil {
+		file.Close()
+		return err
+	}
+	return finishWrite(file, mode)
+}
+
+func (f *NoFollowFilesystem) Copy(source string, destination string, mode uint32) error {
+	input, err := openRegularNoFollow(source)
+	if err != nil {
+		return err
+	}
+	defer input.Close()
+	output, err := os.OpenFile(destination, createNoFollowFlags, fs.FileMode(mode))
+	if err != nil {
+		return err
+	}
+	if _, err := io.Copy(output, input); err != nil {
+		output.Close()
+		return err
+	}
+	return finishWrite(output, mode)
+}
+
+func (f *NoFollowFilesystem) Rename(oldPath string, newPath string) error {
+	return os.Rename(oldPath, newPath)
+}
+
+func (f *NoFollowFilesystem) Remove(path string) error {
+	return os.Remove(path)
+}
+
+func (f *NoFollowFilesystem) RemoveAll(path string) error {
+	info, err := os.Lstat(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if !info.IsDir() {
+		return os.Remove(path)
+	}
+	names, err := readDirectoryNames(path)
+	if err != nil {
+		return err
+	}
+	for _, name := range names {
+		if err := f.RemoveAll(filepath.Join(path, name)); err != nil {
+			return err
+		}
+	}
+	return os.Remove(path)
+}
+
+func (f *NoFollowFilesystem) Chmod(path string, mode uint32) error {
+	file, err := os.OpenFile(path, readNoFollowFlags, 0)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	return file.Chmod(fs.FileMode(mode))
+}
+
+func (f *NoFollowFilesystem) MakePrivateTempDir() (string, error) {
+	return os.MkdirTemp("", privateTempDirPrefix)
+}
+
+func openRegularNoFollow(path string) (*os.File, error) {
+	file, err := os.OpenFile(path, readNoFollowFlags, 0)
+	if err != nil {
+		return nil, err
+	}
+	info, err := file.Stat()
+	if err != nil {
+		file.Close()
+		return nil, err
+	}
+	if !info.Mode().IsRegular() {
+		file.Close()
+		return nil, errNotRegularFile
+	}
+	return file, nil
+}
+
+func finishWrite(file *os.File, mode uint32) error {
+	if err := file.Chmod(fs.FileMode(mode)); err != nil {
+		file.Close()
+		return err
+	}
+	if err := file.Sync(); err != nil {
+		file.Close()
+		return err
+	}
+	return file.Close()
+}
+
+func readDirectoryNames(path string) ([]string, error) {
+	directory, err := os.OpenFile(path, directoryFlags, 0)
+	if err != nil {
+		return nil, err
+	}
+	defer directory.Close()
+	return directory.Readdirnames(-1)
+}

internal/infrastructure/update/noFollowFilesystem_other.go

@@ -0,0 +1,49 @@
+//go:build !linux
+
+package update
+
+import domain "RenewCMS/internal/domain/update"
+
+type NoFollowFilesystem struct{}
+
+var _ domain.HelperFilesystem = &NoFollowFilesystem{}
+
+func NewNoFollowFilesystem() *NoFollowFilesystem {
+	return &NoFollowFilesystem{}
+}
+
+func (f *NoFollowFilesystem) Lstat(string) (domain.FileInfo, error) {
+	return domain.FileInfo{}, domain.ErrHelperUnsupported
+}
+
+func (f *NoFollowFilesystem) ReadFile(string) ([]byte, error) {
+	return nil, domain.ErrHelperUnsupported
+}
+
+func (f *NoFollowFilesystem) CreateExclusive(string, []byte, uint32) error {
+	return domain.ErrHelperUnsupported
+}
+
+func (f *NoFollowFilesystem) Copy(string, string, uint32) error {
+	return domain.ErrHelperUnsupported
+}
+
+func (f *NoFollowFilesystem) Rename(string, string) error {
+	return domain.ErrHelperUnsupported
+}
+
+func (f *NoFollowFilesystem) Remove(string) error {
+	return domain.ErrHelperUnsupported
+}
+
+func (f *NoFollowFilesystem) RemoveAll(string) error {
+	return domain.ErrHelperUnsupported
+}
+
+func (f *NoFollowFilesystem) Chmod(string, uint32) error {
+	return domain.ErrHelperUnsupported
+}
+
+func (f *NoFollowFilesystem) MakePrivateTempDir() (string, error) {
+	return "", domain.ErrHelperUnsupported
+}

internal/infrastructure/update/systemClock.go

@@ -0,0 +1,22 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"time"
+)
+
+type SystemClock struct{}
+
+var _ domain.Clock = &SystemClock{}
+
+func NewSystemClock() *SystemClock {
+	return &SystemClock{}
+}
+
+func (c *SystemClock) Now() time.Time {
+	return time.Now()
+}
+
+func (c *SystemClock) Sleep(duration time.Duration) {
+	time.Sleep(duration)
+}

internal/infrastructure/update/systemMachineProbe.go

@@ -0,0 +1,30 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"os"
+	"runtime"
+)
+
+const systemdRuntimeDirectory = "/run/systemd/system"
+
+type SystemMachineProbe struct{}
+
+var _ domain.MachineProbe = &SystemMachineProbe{}
+
+func NewSystemMachineProbe() *SystemMachineProbe {
+	return &SystemMachineProbe{}
+}
+
+func (p *SystemMachineProbe) OS() string {
+	return runtime.GOOS
+}
+
+func (p *SystemMachineProbe) SystemdRunning() bool {
+	info, err := os.Stat(systemdRuntimeDirectory)
+	return err == nil && info.IsDir()
+}
+
+func (p *SystemMachineProbe) IsRoot() bool {
+	return os.Geteuid() == 0
+}

internal/infrastructure/update/systemctlControl.go

@@ -0,0 +1,57 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+const systemctlCommand = "systemctl"
+
+type SystemctlControl struct {
+	service string
+}
+
+var (
+	_ domain.ServiceControl = &SystemctlControl{}
+	_ domain.UnitManager    = &SystemctlControl{}
+)
+
+func NewSystemctlControl(service string) *SystemctlControl {
+	return &SystemctlControl{service: service}
+}
+
+func (c *SystemctlControl) Restart() error {
+	return runSystemctl("restart", c.service)
+}
+
+func (c *SystemctlControl) Status() (bool, error) {
+	err := exec.Command(systemctlCommand, "is-active", "--quiet", c.service).Run()
+	var exitErr *exec.ExitError
+	if errors.As(err, &exitErr) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
+func (c *SystemctlControl) DaemonReload() error {
+	return runSystemctl("daemon-reload")
+}
+
+func (c *SystemctlControl) EnableNow(unit string) error {
+	return runSystemctl("enable", "--now", unit)
+}
+
+func (c *SystemctlControl) DisableNow(unit string) error {
+	return runSystemctl("disable", "--now", unit)
+}
+
+func runSystemctl(arguments ...string) error {
+	output, err := exec.Command(systemctlCommand, arguments...).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("systemctl %s: %w: %s", strings.Join(arguments, " "), err, strings.TrimSpace(string(output)))
+	}
+	return nil
+}

internal/infrastructure/update/systemdUnits.go

@@ -0,0 +1,104 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+const (
+	systemUnitDirectory = "/etc/systemd/system"
+	unitFilePermissions = 0o644
+	unitFileSuffix      = ".service"
+)
+
+type SystemdUnits struct {
+	directory string
+}
+
+var (
+	_ domain.UnitWriter     = &SystemdUnits{}
+	_ domain.ServiceLocator = &SystemdUnits{}
+)
+
+func NewSystemdUnits() *SystemdUnits {
+	return NewSystemdUnitsIn(systemUnitDirectory)
+}
+
+func NewSystemdUnitsIn(directory string) *SystemdUnits {
+	return &SystemdUnits{directory: directory}
+}
+
+func (u *SystemdUnits) Write(name string, content string) error {
+	return os.WriteFile(filepath.Join(u.directory, name), []byte(content), unitFilePermissions)
+}
+
+func (u *SystemdUnits) Remove(name string) (bool, error) {
+	return removeFile(filepath.Join(u.directory, name))
+}
+
+func (u *SystemdUnits) Locate(name string) (domain.ServiceDescription, bool) {
+	content, err := os.ReadFile(filepath.Join(u.directory, name+unitFileSuffix))
+	if err != nil {
+		return domain.ServiceDescription{}, false
+	}
+	description := ParseServiceUnit(string(content))
+	description.Name = name
+	return description, true
+}
+
+func (u *SystemdUnits) PortFromEnvironmentFile(path string) (string, bool) {
+	if path == "" {
+		return "", false
+	}
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return "", false
+	}
+	return portFromEnvironment(string(content))
+}
+
+func ParseServiceUnit(content string) domain.ServiceDescription {
+	var description domain.ServiceDescription
+	for _, line := range strings.Split(content, "\n") {
+		key, value, found := strings.Cut(strings.TrimSpace(line), "=")
+		if !found {
+			continue
+		}
+		switch key {
+		case "ExecStart":
+			description.BinaryPath = firstUnitPath(value, "@-:+!")
+		case "EnvironmentFile":
+			description.EnvironmentFile = firstUnitPath(value, "-")
+		case "ReadWritePaths":
+			if description.DataDir == "" {
+				description.DataDir = firstUnitPath(value, "-+!")
+			}
+		}
+	}
+	return description
+}
+
+func firstUnitPath(value string, prefixes string) string {
+	fields := strings.Fields(value)
+	if len(fields) == 0 {
+		return ""
+	}
+	return strings.Trim(strings.TrimLeft(fields[0], prefixes), `"`)
+}
+
+func portFromEnvironment(content string) (string, bool) {
+	for _, line := range strings.Split(content, "\n") {
+		key, value, found := strings.Cut(strings.TrimSpace(line), "=")
+		if !found || strings.TrimSpace(key) != "PORT" {
+			continue
+		}
+		port := strings.Trim(strings.TrimSpace(value), `"'`)
+		if _, err := strconv.Atoi(port); err == nil {
+			return port, true
+		}
+	}
+	return "", false
+}

internal/infrastructure/useCases/ApplyRestartRequest.go

@@ -0,0 +1,382 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/update"
+	"errors"
+	"fmt"
+	"path"
+	"time"
+)
+
+type ApplyRestartRequestUseCase struct {
+	requests update.RestartRequestStore
+	results  update.ResultStore
+	running  update.RunningInfoStore
+	files    update.HelperFilesystem
+	service  update.ServiceControl
+	health   update.HealthChecker
+	verifier update.SignatureVerifier
+	clock    update.Clock
+	logger   update.Logger
+	layout   update.HelperLayout
+	platform update.Platform
+}
+
+type ApplyRestartRequestDependencies struct {
+	Requests update.RestartRequestStore
+	Results  update.ResultStore
+	Running  update.RunningInfoStore
+	Files    update.HelperFilesystem
+	Service  update.ServiceControl
+	Health   update.HealthChecker
+	Verifier update.SignatureVerifier
+	Clock    update.Clock
+	Logger   update.Logger
+	Layout   update.HelperLayout
+	Platform update.Platform
+}
+
+func NewApplyRestartRequestUseCase(dependencies ApplyRestartRequestDependencies) *ApplyRestartRequestUseCase {
+	return &ApplyRestartRequestUseCase{
+		requests: dependencies.Requests,
+		results:  dependencies.Results,
+		running:  dependencies.Running,
+		files:    dependencies.Files,
+		service:  dependencies.Service,
+		health:   dependencies.Health,
+		verifier: dependencies.Verifier,
+		clock:    dependencies.Clock,
+		logger:   dependencies.Logger,
+		layout:   dependencies.Layout,
+		platform: dependencies.Platform,
+	}
+}
+
+type helperRun struct {
+	apply     *ApplyRestartRequestUseCase
+	result    update.Result
+	tempDir   string
+	stagedTag string
+}
+
+type verifiedCopy struct {
+	binaryPath string
+	checksum   string
+}
+
+func (a *ApplyRestartRequestUseCase) Apply() (err error) {
+	request, readErr := a.requests.Read()
+	if errors.Is(readErr, update.ErrNoRestartRequest) {
+		a.logger.Printf("no restart request found, nothing to do")
+		return nil
+	}
+	run := &helperRun{apply: a, result: update.Result{
+		Outcome:   update.OutcomeRunning,
+		Kind:      request.Kind,
+		Tag:       request.Tag,
+		StartedAt: a.clock.Now().UTC(),
+	}}
+	defer run.recoverPanic(&err)
+
+	deleteErr := a.requests.Delete()
+	symlinkErr := a.symlinkedDataFile()
+	if info, found := a.running.Read(); found {
+		run.result.FromVersion = info.Version
+	}
+	run.record()
+
+	for _, refusal := range []error{readErr, deleteErr, symlinkErr} {
+		if refusal != nil {
+			return run.fail(refusal)
+		}
+	}
+	return run.dispatch()
+}
+
+func (a *ApplyRestartRequestUseCase) symlinkedDataFile() error {
+	for _, candidate := range []string{a.layout.ResultPath(), a.layout.ResultTempPath()} {
+		if info, err := a.files.Lstat(candidate); err == nil && info.IsSymlink {
+			return update.SymlinkError{Path: candidate}
+		}
+	}
+	return nil
+}
+
+func (r *helperRun) dispatch() error {
+	switch r.result.Kind {
+	case update.RestartKindRestart:
+		return r.plainRestart()
+	case update.RestartKindUpdate:
+		return r.installUpdate()
+	}
+	return r.fail(fmt.Errorf("unknown restart kind %q", r.result.Kind))
+}
+
+func (r *helperRun) plainRestart() error {
+	if !r.apply.restartAndAwait("") {
+		return r.failLoudly(errors.New("the site did not come back after the restart"))
+	}
+	return r.finish(update.OutcomeSucceeded)
+}
+
+func (r *helperRun) installUpdate() error {
+	a := r.apply
+	tag := r.result.Tag
+	if r.result.FromVersion == "" {
+		return r.fail(errors.New("the running version could not be read from update-running.json"))
+	}
+	if err := update.ValidateRestartTag(tag, r.result.FromVersion); err != nil {
+		return r.fail(fmt.Errorf("tag %q: %w", tag, err))
+	}
+	r.stagedTag = tag
+
+	assetName := update.AssetName(tag, a.platform)
+	if err := a.requireStagedFiles(tag, assetName); err != nil {
+		return r.fail(err)
+	}
+	verified, err := r.copyAndVerify(tag, assetName)
+	if err != nil {
+		return r.fail(err)
+	}
+	if err := a.swapBinary(verified); err != nil {
+		return r.fail(err)
+	}
+	if a.restartAndAwait(tag) {
+		return r.finish(update.OutcomeSucceeded)
+	}
+	return r.rollBack()
+}
+
+func (r *helperRun) copyAndVerify(tag string, assetName string) (verifiedCopy, error) {
+	a := r.apply
+	tempDir, err := a.files.MakePrivateTempDir()
+	if err != nil {
+		return verifiedCopy{}, err
+	}
+	r.tempDir = tempDir
+	stagedDir := a.layout.StagedDir(tag)
+	for _, name := range []string{assetName, update.ChecksumsAssetName, update.SignatureAssetName} {
+		original := path.Join(stagedDir, name)
+		if err := a.files.Copy(original, path.Join(tempDir, name), update.PrivateFileMode); err != nil {
+			return verifiedCopy{}, fmt.Errorf("copying %s: %w", original, err)
+		}
+	}
+	return a.verifyCopy(tempDir, assetName)
+}
+
+func (a *ApplyRestartRequestUseCase) verifyCopy(tempDir string, assetName string) (verifiedCopy, error) {
+	checksumsPath := path.Join(tempDir, update.ChecksumsAssetName)
+	if err := a.verifier.Verify(checksumsPath, path.Join(tempDir, update.SignatureAssetName)); err != nil {
+		return verifiedCopy{}, fmt.Errorf("signature check: %w", err)
+	}
+	checksums, err := a.files.ReadFile(checksumsPath)
+	if err != nil {
+		return verifiedCopy{}, err
+	}
+	expected, found := update.ChecksumFor(string(checksums), assetName)
+	if !found {
+		return verifiedCopy{}, fmt.Errorf("checksums.txt has no line for %q", assetName)
+	}
+	binaryPath := path.Join(tempDir, assetName)
+	content, err := a.files.ReadFile(binaryPath)
+	if err != nil {
+		return verifiedCopy{}, err
+	}
+	if update.SHA256Hex(content) != expected {
+		return verifiedCopy{}, fmt.Errorf("sha-256 mismatch for the staged %q", assetName)
+	}
+	return verifiedCopy{binaryPath: binaryPath, checksum: expected}, nil
+}
+
+func (a *ApplyRestartRequestUseCase) requireStagedFiles(tag string, assetName string) error {
+	for _, directory := range []string{a.layout.UpdatesDir(), a.layout.StagedDir(tag)} {
+		if err := a.requireDirectory(directory); err != nil {
+			return err
+		}
+	}
+	for _, name := range []string{assetName, update.ChecksumsAssetName, update.SignatureAssetName} {
+		if err := a.requireRegularFile(path.Join(a.layout.StagedDir(tag), name)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (a *ApplyRestartRequestUseCase) requireDirectory(target string) error {
+	return a.requireEntry(target, "a directory", func(info update.FileInfo) bool { return info.IsDir })
+}
+
+func (a *ApplyRestartRequestUseCase) requireRegularFile(target string) error {
+	return a.requireEntry(target, "a regular file", func(info update.FileInfo) bool { return info.IsRegular })
+}
+
+func (a *ApplyRestartRequestUseCase) requireEntry(target string, description string, matches func(update.FileInfo) bool) error {
+	info, err := a.files.Lstat(target)
+	if err != nil {
+		return fmt.Errorf("%s: %w", target, err)
+	}
+	if info.IsSymlink {
+		return update.SymlinkError{Path: target}
+	}
+	if !matches(info) {
+		return fmt.Errorf("%s is not %s", target, description)
+	}
+	return nil
+}
+
+func (a *ApplyRestartRequestUseCase) swapBinary(verified verifiedCopy) error {
+	binary := a.layout.BinaryPath
+	if err := a.replaceViaTemp(binary, a.layout.PreviousPath(), binary+update.PreviousTempSuffix); err != nil {
+		return fmt.Errorf("keeping the previous binary: %w", err)
+	}
+	installTemp := binary + update.InstallTempSuffix
+	a.removeQuietly(installTemp)
+	if err := a.files.Copy(verified.binaryPath, installTemp, update.ExecutableMode); err != nil {
+		a.removeQuietly(installTemp)
+		return fmt.Errorf("writing the new binary: %w", err)
+	}
+	if err := a.installIfUnchanged(installTemp, verified.checksum); err != nil {
+		a.removeQuietly(installTemp)
+		return err
+	}
+	return nil
+}
+
+func (a *ApplyRestartRequestUseCase) installIfUnchanged(installTemp string, checksum string) error {
+	content, err := a.files.ReadFile(installTemp)
+	if err != nil {
+		return err
+	}
+	if update.SHA256Hex(content) != checksum {
+		return fmt.Errorf("%s changed after it was verified", installTemp)
+	}
+	if err := a.files.Chmod(installTemp, update.ExecutableMode); err != nil {
+		return err
+	}
+	if err := a.files.Rename(installTemp, a.layout.BinaryPath); err != nil {
+		return fmt.Errorf("installing the new binary: %w", err)
+	}
+	return nil
+}
+
+func (a *ApplyRestartRequestUseCase) replaceViaTemp(source string, destination string, temporary string) error {
+	a.removeQuietly(temporary)
+	if err := a.files.Copy(source, temporary, update.ExecutableMode); err != nil {
+		a.removeQuietly(temporary)
+		return err
+	}
+	if err := a.files.Rename(temporary, destination); err != nil {
+		a.removeQuietly(temporary)
+		return err
+	}
+	return nil
+}
+
+func (r *helperRun) rollBack() error {
+	a := r.apply
+	a.logger.Printf("version %s did not come up, restoring %s", r.result.Tag, a.layout.PreviousPath())
+	restoreTemp := a.layout.BinaryPath + update.RestoreTempSuffix
+	if err := a.replaceViaTemp(a.layout.PreviousPath(), a.layout.BinaryPath, restoreTemp); err != nil {
+		return r.failLoudly(fmt.Errorf("the previous binary could not be restored, the site may be down: %w", err))
+	}
+	if !a.restartAndAwait(r.result.FromVersion) {
+		return r.failLoudly(errors.New("the previous version did not come back after the rollback"))
+	}
+	return r.finish(update.OutcomeRolledBack)
+}
+
+func (a *ApplyRestartRequestUseCase) restartAndAwait(expectedVersion string) bool {
+	baseline, _ := a.running.Read()
+	restartedAt := a.clock.Now()
+	if err := a.service.Restart(); err != nil {
+		a.logger.Printf("restarting the service failed: %v", err)
+		return false
+	}
+	for a.clock.Now().Sub(restartedAt) < update.RestartWindow {
+		if a.isBackUp(baseline, restartedAt, expectedVersion) {
+			return true
+		}
+		a.clock.Sleep(update.PollInterval)
+	}
+	return false
+}
+
+func (a *ApplyRestartRequestUseCase) isBackUp(baseline update.RunningInfo, restartedAt time.Time, expectedVersion string) bool {
+	if !a.health.Healthy() {
+		return false
+	}
+	info, found := a.running.Read()
+	if !found || !info.IsNewerThan(baseline, restartedAt) {
+		return false
+	}
+	return expectedVersion == "" || info.Version == expectedVersion
+}
+
+func (r *helperRun) record() {
+	if err := r.apply.results.Write(r.result); err != nil {
+		r.apply.logger.Printf("update-result.json could not be written: %v", err)
+	}
+}
+
+func (r *helperRun) finish(outcome string) error {
+	finishedAt := r.apply.clock.Now().UTC()
+	r.result.Outcome = outcome
+	r.result.FinishedAt = &finishedAt
+	r.record()
+	r.cleanUp()
+	return nil
+}
+
+func (r *helperRun) fail(reason error) error {
+	r.apply.logger.Printf("restart request refused or failed: %v", reason)
+	return r.finish(update.OutcomeFailed)
+}
+
+func (r *helperRun) failLoudly(reason error) error {
+	r.apply.logger.Printf("restart request failed: %v", reason)
+	_ = r.finish(update.OutcomeFailed)
+	return reason
+}
+
+func (r *helperRun) recoverPanic(err *error) {
+	if recovered := recover(); recovered != nil {
+		*err = r.failLoudly(fmt.Errorf("panic: %v", recovered))
+	}
+}
+
+func (r *helperRun) cleanUp() {
+	a := r.apply
+	if r.tempDir != "" {
+		a.removeTreeQuietly(r.tempDir)
+	}
+	if r.stagedTag != "" {
+		a.removeStaged(r.stagedTag)
+	}
+}
+
+func (a *ApplyRestartRequestUseCase) removeStaged(tag string) {
+	if err := a.requireDirectory(a.layout.UpdatesDir()); err != nil {
+		a.logger.Printf("staged files left in place: %v", err)
+		return
+	}
+	staged := a.layout.StagedDir(tag)
+	info, err := a.files.Lstat(staged)
+	if err != nil {
+		return
+	}
+	if info.IsSymlink {
+		a.removeQuietly(staged)
+		return
+	}
+	a.removeTreeQuietly(staged)
+}
+
+func (a *ApplyRestartRequestUseCase) removeQuietly(target string) {
+	_ = a.files.Remove(target)
+}
+
+func (a *ApplyRestartRequestUseCase) removeTreeQuietly(target string) {
+	if err := a.files.RemoveAll(target); err != nil {
+		a.logger.Printf("could not remove %s: %v", target, err)
+	}
+}

internal/infrastructure/useCases/GetUpdateStatus.go

@@ -1,32 +1,22 @@
 package useCases
 
-import "RenewCMS/internal/domain/update"
+import (
+	"RenewCMS/internal/domain/update"
+	"time"
+)
 
 type GetUpdateStatusUseCase struct {
-	store          update.StatusStore
-	jobs           update.JobStore
+	status updateStatusBuilder
 	helper update.HelperDetector
-	currentVersion string
 }
 
-func NewGetUpdateStatusUseCase(store update.StatusStore, jobs update.JobStore, helper update.HelperDetector, currentVersion string) *GetUpdateStatusUseCase {
-	return &GetUpdateStatusUseCase{store: store, jobs: jobs, helper: helper, currentVersion: currentVersion}
+func NewGetUpdateStatusUseCase(store update.StatusStore, jobs update.JobStore, helper update.HelperDetector, results update.ResultStore, requests update.RestartRequestStore, currentVersion string, now func() time.Time) *GetUpdateStatusUseCase {
+	return &GetUpdateStatusUseCase{
+		status: updateStatusBuilder{store: store, jobs: jobs, results: results, requests: requests, currentVersion: currentVersion, now: now},
+		helper: helper,
+	}
 }
 
 func (g *GetUpdateStatusUseCase) GetStatus(isOwner bool) update.UpdateStatus {
-	return buildUpdateStatus(g.store, g.jobs, g.currentVersion, isOwner && g.helper.Installed())
-}
-
-func buildUpdateStatus(store update.StatusStore, jobs update.JobStore, currentVersion string, canApply bool) update.UpdateStatus {
-	var status update.UpdateStatus
-	if result, found := store.Load(); found {
-		status = update.NewStatus(currentVersion, &result)
-	} else {
-		status = update.NewStatus(currentVersion, nil)
-	}
-	if job, found := jobs.Load(); found {
-		status = status.WithJob(job)
-	}
-	status.CanApply = canApply
-	return status
+	return g.status.build(isOwner && g.helper.Installed())
 }

internal/infrastructure/useCases/ManageBrowserUpdates.go

@@ -0,0 +1,175 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/update"
+	"strings"
+	"time"
+)
+
+type ManageBrowserUpdatesDependencies struct {
+	Probe   update.MachineProbe
+	Locator update.ServiceLocator
+	Units   update.UnitWriter
+	Manager update.UnitManager
+	Status  update.HelperStatusWriter
+	Now     func() time.Time
+}
+
+type EnableBrowserUpdatesUseCase struct {
+	dependencies ManageBrowserUpdatesDependencies
+}
+
+type DisableBrowserUpdatesUseCase struct {
+	dependencies ManageBrowserUpdatesDependencies
+}
+
+func NewEnableBrowserUpdatesUseCase(dependencies ManageBrowserUpdatesDependencies) *EnableBrowserUpdatesUseCase {
+	return &EnableBrowserUpdatesUseCase{dependencies: dependencies}
+}
+
+func NewDisableBrowserUpdatesUseCase(dependencies ManageBrowserUpdatesDependencies) *DisableBrowserUpdatesUseCase {
+	return &DisableBrowserUpdatesUseCase{dependencies: dependencies}
+}
+
+func (e *EnableBrowserUpdatesUseCase) Enable(options update.InstallOptions) (string, error) {
+	d := e.dependencies
+	if err := update.CheckInstallEnvironment(d.Probe); err != nil {
+		return "", err
+	}
+	resolved, err := e.resolve(options)
+	if err != nil {
+		return "", err
+	}
+	if err := e.install(resolved); err != nil {
+		e.undo()
+		return "", err
+	}
+	status := update.HelperStatus{
+		Version:     update.HelperStatusVersion,
+		Service:     resolved.Service,
+		Binary:      resolved.Binary,
+		DataDir:     resolved.DataDir,
+		InstalledAt: d.Now().UTC(),
+	}
+	if err := d.Status.Write(resolved.DataDir, status); err != nil {
+		e.undo()
+		return "", err
+	}
+	return enabledMessage(resolved), nil
+}
+
+func (e *EnableBrowserUpdatesUseCase) resolve(options update.InstallOptions) (update.InstallOptions, error) {
+	service := firstNonEmpty(options.Service, update.DefaultService)
+	description, found := e.dependencies.Locator.Locate(service)
+	resolved := update.InstallOptions{
+		Service: service,
+		Binary:  firstNonEmpty(options.Binary, description.BinaryPath),
+		DataDir: firstNonEmpty(options.DataDir, description.DataDir),
+	}
+	if resolved.Binary == "" || (resolved.DataDir == "" && !found) {
+		return resolved, update.ErrServiceNotFound
+	}
+	if resolved.DataDir == "" {
+		return resolved, update.ErrDataDirNotFound
+	}
+	resolved.Port = e.port(options.Port, description)
+	return resolved, update.ValidatePort(resolved.Port)
+}
+
+func (e *EnableBrowserUpdatesUseCase) port(flag string, description update.ServiceDescription) string {
+	if flag != "" {
+		return flag
+	}
+	if port, found := e.dependencies.Locator.PortFromEnvironmentFile(description.EnvironmentFile); found {
+		return port
+	}
+	return update.DefaultPort
+}
+
+func (e *EnableBrowserUpdatesUseCase) install(options update.InstallOptions) error {
+	d := e.dependencies
+	layout := update.HelperLayout{DataDir: options.DataDir, BinaryPath: options.Binary}
+	if err := d.Units.Write(update.ServiceUnitName, update.RenderServiceUnit(options)); err != nil {
+		return err
+	}
+	if err := d.Units.Write(update.PathUnitName, update.RenderPathUnit(layout)); err != nil {
+		return err
+	}
+	if err := d.Manager.DaemonReload(); err != nil {
+		return err
+	}
+	return d.Manager.EnableNow(update.PathUnitName)
+}
+
+func (e *EnableBrowserUpdatesUseCase) undo() {
+	d := e.dependencies
+	_ = d.Manager.DisableNow(update.PathUnitName)
+	_, _ = d.Units.Remove(update.ServiceUnitName)
+	_, _ = d.Units.Remove(update.PathUnitName)
+	_ = d.Manager.DaemonReload()
+}
+
+func enabledMessage(options update.InstallOptions) string {
+	lines := []string{
+		"Browser updates are enabled for " + options.Service + ".",
+		"Installed " + update.PathUnitName + " and " + update.ServiceUnitName + " (port " + options.Port + ") and wrote " + update.HelperStatusFileName + " in " + options.DataDir + ".",
+		"To undo it, run: renewcms disable-browser-updates",
+	}
+	return strings.Join(lines, "\n")
+}
+
+func (u *DisableBrowserUpdatesUseCase) Disable(options update.InstallOptions) (string, error) {
+	d := u.dependencies
+	if d.Probe.OS() != update.OSLinux || !d.Probe.SystemdRunning() {
+		return notEnabledMessage, nil
+	}
+	if err := update.CheckInstallEnvironment(d.Probe); err != nil {
+		return "", err
+	}
+	dataDir := firstNonEmpty(options.DataDir, u.locatedDataDir(options.Service))
+
+	_ = d.Manager.DisableNow(update.PathUnitName)
+	removed := u.removeUnits()
+	if dataDir == "" {
+		return "", update.ErrDataDirNotFound
+	}
+	statusRemoved, err := d.Status.Remove(dataDir)
+	if err != nil {
+		return "", err
+	}
+	if !removed && !statusRemoved {
+		return notEnabledMessage, nil
+	}
+	if err := d.Manager.DaemonReload(); err != nil {
+		return "", err
+	}
+	return disabledMessage, nil
+}
+
+func (u *DisableBrowserUpdatesUseCase) locatedDataDir(service string) string {
+	description, _ := u.dependencies.Locator.Locate(firstNonEmpty(service, update.DefaultService))
+	return description.DataDir
+}
+
+func (u *DisableBrowserUpdatesUseCase) removeUnits() bool {
+	removedAny := false
+	for _, name := range []string{update.PathUnitName, update.ServiceUnitName} {
+		removed, err := u.dependencies.Units.Remove(name)
+		removedAny = removedAny || (removed && err == nil)
+	}
+	return removedAny
+}
+
+const (
+	notEnabledMessage = "Browser updates were not enabled, nothing to remove."
+	disabledMessage   = "Browser updates are disabled. The restart request, the result, the staged files and the backups were left in place."
+)
+
+func firstNonEmpty(values ...string) string {
+	for _, value := range values {
+		if value != "" {
+			return value
+		}
+	}
+	return ""
+}

internal/infrastructure/useCases/RecordRunningInfo.go

@@ -0,0 +1,21 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/update"
+	"time"
+)
+
+type RecordRunningInfoUseCase struct {
+	store   update.RunningInfoStore
+	version string
+	pid     int
+	now     func() time.Time
+}
+
+func NewRecordRunningInfoUseCase(store update.RunningInfoStore, version string, pid int, now func() time.Time) *RecordRunningInfoUseCase {
+	return &RecordRunningInfoUseCase{store: store, version: version, pid: pid, now: now}
+}
+
+func (r *RecordRunningInfoUseCase) Record() error {
+	return r.store.Write(update.RunningInfo{Version: r.version, Pid: r.pid, StartedAt: r.now().UTC()})
+}

internal/infrastructure/useCases/RequestRestart.go

@@ -0,0 +1,79 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/update"
+	"sync"
+	"time"
+)
+
+type RequestRestartUseCase struct {
+	jobs     update.JobStore
+	helper   update.HelperDetector
+	results  update.ResultStore
+	requests update.RestartRequestStore
+	status   updateStatusBuilder
+	now      func() time.Time
+	mu       sync.Mutex
+}
+
+func NewRequestRestartUseCase(store update.StatusStore, jobs update.JobStore, helper update.HelperDetector, results update.ResultStore, requests update.RestartRequestStore, currentVersion string, now func() time.Time) *RequestRestartUseCase {
+	return &RequestRestartUseCase{
+		jobs:     jobs,
+		helper:   helper,
+		results:  results,
+		requests: requests,
+		status:   updateStatusBuilder{store: store, jobs: jobs, results: results, requests: requests, currentVersion: currentVersion, now: now},
+		now:      now,
+	}
+}
+
+func (r *RequestRestartUseCase) Request(userId uint32, kind string) (update.UpdateStatus, error) {
+	if !r.helper.Installed() {
+		return update.UpdateStatus{}, update.ErrNotPrepared
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	current := r.status.build(true)
+	if err := refuseWhileBusy(current); err != nil {
+		return update.UpdateStatus{}, err
+	}
+	request, err := r.requestFor(kind, userId)
+	if err != nil {
+		return update.UpdateStatus{}, err
+	}
+	if err := r.results.Delete(); err != nil {
+		return update.UpdateStatus{}, err
+	}
+	if err := r.requests.Write(request); err != nil {
+		return update.UpdateStatus{}, err
+	}
+	return r.status.build(true), nil
+}
+
+func refuseWhileBusy(status update.UpdateStatus) error {
+	switch status.State {
+	case update.StateDownloading, update.StateVerifying:
+		return update.ErrJobInProgress
+	case update.StateRestarting:
+		return update.ErrRestartPending
+	}
+	return nil
+}
+
+func (r *RequestRestartUseCase) requestFor(kind string, userId uint32) (update.RestartRequest, error) {
+	request := update.RestartRequest{
+		Kind:        update.RestartKindRestart,
+		RequestedAt: r.now().UTC(),
+		RequestedBy: userId,
+	}
+	if job, found := r.jobs.Load(); found && job.State == update.StateReady {
+		request.Kind = update.RestartKindUpdate
+		request.Tag = job.Tag
+	}
+	if kind != "" && kind != request.Kind {
+		return update.RestartRequest{}, update.ErrRestartKindMismatch
+	}
+	return request, nil
+}

internal/infrastructure/useCases/StartUpdateDownload.go

@@ -12,6 +12,8 @@ type StartUpdateDownloadUseCase struct {
 	store          update.StatusStore
 	jobs           update.JobStore
 	helper         update.HelperDetector
+	results        update.ResultStore
+	status         updateStatusBuilder
 	fetcher        update.AssetFetcher
 	verifier       update.SignatureVerifier
 	runner         update.StagedBinaryRunner
@@ -29,6 +31,8 @@ type StartUpdateDownloadDependencies struct {
 	Store          update.StatusStore
 	Jobs           update.JobStore
 	Helper         update.HelperDetector
+	Results        update.ResultStore
+	Requests       update.RestartRequestStore
 	Fetcher        update.AssetFetcher
 	Verifier       update.SignatureVerifier
 	Runner         update.StagedBinaryRunner
@@ -55,6 +59,15 @@ func NewStartUpdateDownloadUseCase(dependencies StartUpdateDownloadDependencies)
 		store:   dependencies.Store,
 		jobs:    dependencies.Jobs,
 		helper:  dependencies.Helper,
+		results: dependencies.Results,
+		status: updateStatusBuilder{
+			store:          dependencies.Store,
+			jobs:           dependencies.Jobs,
+			results:        dependencies.Results,
+			requests:       dependencies.Requests,
+			currentVersion: dependencies.CurrentVersion,
+			now:            dependencies.Now,
+		},
 		fetcher:        dependencies.Fetcher,
 		verifier:       dependencies.Verifier,
 		runner:         dependencies.Runner,
@@ -79,6 +92,9 @@ func (s *StartUpdateDownloadUseCase) Start() (update.UpdateStatus, error) {
 	if job, found := s.jobs.Load(); found && job.Occupies() {
 		return update.UpdateStatus{}, update.ErrJobInProgress
 	}
+	if s.status.build(true).State == update.StateRestarting {
+		return update.UpdateStatus{}, update.ErrRestartPending
+	}
 	result, found := s.store.Load()
 	if !found || !update.IsNewer(s.currentVersion, result.Latest) {
 		return update.UpdateStatus{}, update.ErrNothingToUpdate
@@ -95,10 +111,13 @@ func (s *StartUpdateDownloadUseCase) Start() (update.UpdateStatus, error) {
 		StartedAt:  s.now().UTC(),
 		TotalBytes: binary.Size,
 	}
+	if err := s.results.Delete(); err != nil {
+		return update.UpdateStatus{}, err
+	}
 	if err := s.jobs.Save(job); err != nil {
 		return update.UpdateStatus{}, err
 	}
-	status := buildUpdateStatus(s.store, s.jobs, s.currentVersion, true)
+	status := s.status.build(true)
 	go s.run(job, binary, checksums, signature)
 
 	return status, nil

internal/infrastructure/useCases/updateStatusBuilder.go

@@ -0,0 +1,44 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/update"
+	"errors"
+	"time"
+)
+
+type updateStatusBuilder struct {
+	store          update.StatusStore
+	jobs           update.JobStore
+	results        update.ResultStore
+	requests       update.RestartRequestStore
+	currentVersion string
+	now            func() time.Time
+}
+
+func (b updateStatusBuilder) build(canApply bool) update.UpdateStatus {
+	status := b.baseStatus()
+	if job, found := b.jobs.Load(); found {
+		status = status.WithJob(job)
+	}
+	status.CanApply = canApply
+
+	request, requestErr := b.requests.Read()
+	result, hasResult := b.results.Read()
+	if hasResult {
+		status.FinishedAt = result.FinishedAt
+	}
+	switch {
+	case !errors.Is(requestErr, update.ErrNoRestartRequest):
+		return status.WithRestartRequest(request)
+	case hasResult:
+		return status.WithResult(result, b.currentVersion, b.now())
+	}
+	return status
+}
+
+func (b updateStatusBuilder) baseStatus() update.UpdateStatus {
+	if result, found := b.store.Load(); found {
+		return update.NewStatus(b.currentVersion, &result)
+	}
+	return update.NewStatus(b.currentVersion, nil)
+}

test/update_dispatch_test.go

@@ -0,0 +1,186 @@
+package test
+
+import (
+	"RenewCMS/internal/domain/update"
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+)
+
+func runBinary(t *testing.T, binary string, workDir string, args ...string) (string, string, int) {
+	t.Helper()
+	command := exec.Command(binary, args...)
+	command.Dir = workDir
+	command.Env = emptyEnvironment()
+	var stdout, stderr bytes.Buffer
+	command.Stdout, command.Stderr = &stdout, &stderr
+	err := command.Run()
+	code := 0
+	if exitErr, ok := err.(*exec.ExitError); ok {
+		code = exitErr.ExitCode()
+	} else if err != nil {
+		t.Fatal(err)
+	}
+	return stdout.String(), stderr.String(), code
+}
+
+func assertEmptyDirectory(t *testing.T, directory string) {
+	t.Helper()
+	if entries, _ := os.ReadDir(directory); len(entries) != 0 {
+		t.Errorf("the working directory must stay empty, got %d entries", len(entries))
+	}
+}
+
+func TestCommandDispatcher(t *testing.T) {
+	binary := buildServerBinary(t, "-X main.version=v9.9.9")
+
+	t.Run("--version prints the version and exits 0", func(t *testing.T) {
+		workDir := t.TempDir()
+
+		stdout, _, code := runBinary(t, binary, workDir, "--version")
+
+		if code != 0 || strings.TrimSpace(stdout) != "v9.9.9" {
+			t.Errorf("code = %d, stdout = %q", code, stdout)
+		}
+		assertEmptyDirectory(t, workDir)
+	})
+
+	t.Run("an unknown subcommand prints a usage message and does not start the server", func(t *testing.T) {
+		workDir := t.TempDir()
+
+		stdout, stderr, code := runBinary(t, binary, workDir, "frobnicate")
+
+		if code == 0 || !strings.Contains(stderr, "usage:") || stdout != "" {
+			t.Errorf("code = %d, stdout = %q, stderr = %q", code, stdout, stderr)
+		}
+		assertEmptyDirectory(t, workDir)
+	})
+
+	t.Run("apply-update runs without .env and creates no data directory", func(t *testing.T) {
+		workDir := t.TempDir()
+
+		_, stderr, code := runBinary(t, binary, workDir, "apply-update")
+
+		if code == 0 || strings.Contains(stderr, "PUBLIC_URL") || strings.Contains(stderr, ".env") {
+			t.Errorf("code = %d, stderr = %q", code, stderr)
+		}
+		assertEmptyDirectory(t, workDir)
+	})
+
+	t.Run("apply-update with its flags never reads .env or opens the database", func(t *testing.T) {
+		if runtime.GOOS == "linux" {
+			t.Skip("on Linux the helper would act on the machine")
+		}
+		workDir := t.TempDir()
+
+		_, stderr, _ := runBinary(t, binary, workDir, "apply-update", "--binary", filepath.Join(workDir, "bin"), "--data-dir", filepath.Join(workDir, "data"))
+
+		if strings.Contains(stderr, "PUBLIC_URL") {
+			t.Errorf("stderr = %q", stderr)
+		}
+		if _, err := os.Stat(filepath.Join(workDir, "data")); err == nil {
+			t.Error("no data directory may be created")
+		}
+	})
+
+	t.Run("enable-browser-updates and disable-browser-updates refuse off Linux", func(t *testing.T) {
+		if runtime.GOOS == "linux" {
+			t.Skip("on Linux these commands would act on the machine's systemd")
+		}
+		workDir := t.TempDir()
+
+		_, stderr, code := runBinary(t, binary, workDir, "enable-browser-updates")
+		stdout, _, disableCode := runBinary(t, binary, workDir, "disable-browser-updates")
+
+		if code == 0 || strings.TrimSpace(stderr) != update.ErrNeedsLinux.Error() {
+			t.Errorf("enable: code = %d, stderr = %q", code, stderr)
+		}
+		if disableCode != 0 || !strings.Contains(stdout, "not enabled") {
+			t.Errorf("disable: code = %d, stdout = %q", disableCode, stdout)
+		}
+		assertEmptyDirectory(t, workDir)
+	})
+
+	t.Run("no arguments is the normal server start", func(t *testing.T) {
+		workDir := t.TempDir()
+
+		_, stderr, code := runBinary(t, binary, workDir)
+
+		if code == 0 || !strings.Contains(stderr, "PUBLIC_URL") {
+			t.Errorf("code = %d, stderr = %q", code, stderr)
+		}
+	})
+}
+
+func freeTCPPort(t *testing.T) string {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+	return fmt.Sprint(listener.Addr().(*net.TCPAddr).Port)
+}
+
+func TestServerWritesRunningInfoBeforeServing(t *testing.T) {
+	if os.Getenv("RENEWCMS_TEST_SPAWN_SERVER") == "" {
+		t.Skip("spawns the real server, which triggers Windows firewall prompts; set RENEWCMS_TEST_SPAWN_SERVER=1 to run")
+	}
+	binary := buildServerBinary(t, "-X main.version=v9.9.9")
+	workDir := t.TempDir()
+	dataDir := filepath.Join(workDir, "data")
+	port := freeTCPPort(t)
+	command := exec.Command(binary)
+	command.Dir = workDir
+	command.Env = append(emptyEnvironment(),
+		"ENVIRONMENT=development", "PORT="+port, "PUBLIC_URL=http://localhost", "JWT_SECRET=test-secret-for-dispatch",
+		"SMTP_LOGIN=a@example.com", "SMTP_SENDER=a@example.com", "SMTP_PASSWORD=x", "SMTP_HOST=localhost", "SMTP_PORT=2525",
+		"DB_FILE="+filepath.Join(dataDir, "renewcms.db"), "UPLOAD_DIR="+filepath.Join(dataDir, "uploads"),
+		"UPDATE_FEED_URL=https://git.example")
+	var stderr bytes.Buffer
+	command.Stderr = &stderr
+	started := time.Now()
+	if err := command.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_ = command.Process.Kill()
+		_, _ = command.Process.Wait()
+	}()
+
+	healthy := false
+	for deadline := time.Now().Add(20 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		response, err := http.Get("http://127.0.0.1:" + port + "/healthz")
+		if err == nil {
+			response.Body.Close()
+			healthy = response.StatusCode == http.StatusOK
+			if healthy {
+				break
+			}
+		}
+	}
+	if !healthy {
+		t.Fatalf("the server never answered /healthz: %s", stderr.String())
+	}
+
+	content, err := os.ReadFile(filepath.Join(dataDir, update.RunningInfoFileName))
+	if err != nil {
+		t.Fatalf("update-running.json must exist as soon as /healthz answers: %v", err)
+	}
+	var info update.RunningInfo
+	if err := json.Unmarshal(content, &info); err != nil {
+		t.Fatal(err)
+	}
+	if info.Version != "v9.9.9" || info.Pid != command.Process.Pid || info.StartedAt.Before(started.Add(-2*time.Second)) || info.StartedAt.After(time.Now()) {
+		t.Errorf("info = %+v, pid = %d", info, command.Process.Pid)
+	}
+}

test/update_download_test.go

@@ -305,6 +305,8 @@ type downloadRig struct {
 	store      *fakeUpdateStore
 	jobs       *fakeJobStore
 	helper     *fakeHelperDetector
+	results    *fakeResultStore
+	requests   *fakeRestartRequestStore
 	fetcher    *fakeAssetFetcher
 	runner     *fakeStagedRunner
 	backup     *fakeDatabaseBackup
@@ -337,6 +339,8 @@ func newDownloadRigFor(t *testing.T, platform update.Platform, binary []byte) *d
 		store:      &fakeUpdateStore{},
 		jobs:       &fakeJobStore{},
 		helper:     &fakeHelperDetector{installed: true},
+		results:    &fakeResultStore{},
+		requests:   &fakeRestartRequestStore{},
 		fetcher: &fakeAssetFetcher{
 			files:   map[string][]byte{},
 			errors:  map[string]error{},
@@ -369,6 +373,8 @@ func (r *downloadRig) rebuild() {
 		Store:          r.store,
 		Jobs:           r.jobs,
 		Helper:         r.helper,
+		Results:        r.results,
+		Requests:       r.requests,
 		Fetcher:        r.fetcher,
 		Verifier:       verifier,
 		Runner:         r.runner,
@@ -380,7 +386,7 @@ func (r *downloadRig) rebuild() {
 		FeedURL:        downloadFeedURL,
 		Now:            func() time.Time { return updateTestCheckedAt },
 	})
-	r.status = useCases.NewGetUpdateStatusUseCase(r.store, r.jobs, r.helper, updateRunning)
+	r.status = useCases.NewGetUpdateStatusUseCase(r.store, r.jobs, r.helper, r.results, r.requests, updateRunning, time.Now)
 }
 
 func (r *downloadRig) checksumsFor(name string, content []byte) string {
@@ -690,7 +696,7 @@ func TestJSONJobStorePersistence(t *testing.T) {
 		path := filepath.Join(dir, "update-job.json")
 		_ = infraUpdate.NewJSONJobStore(path).Save(update.Job{Tag: downloadTag, State: update.StateReady, StartedAt: startedAt, StagedBinary: binary})
 
-		status := useCases.NewGetUpdateStatusUseCase(&fakeUpdateStore{result: newStoredUpdateResult(), found: true}, infraUpdate.NewJSONJobStore(path), &fakeHelperDetector{}, updateRunning).GetStatus(true)
+		status := newUpdateStatusUseCase(&fakeUpdateStore{result: newStoredUpdateResult(), found: true}, infraUpdate.NewJSONJobStore(path), &fakeHelperDetector{}, updateRunning).GetStatus(true)
 
 		if status.State != update.StateReady {
 			t.Errorf("state = %q", status.State)
@@ -702,7 +708,7 @@ func TestJSONJobStorePersistence(t *testing.T) {
 			path := filepath.Join(t.TempDir(), "update-job.json")
 			_ = infraUpdate.NewJSONJobStore(path).Save(update.Job{Tag: downloadTag, State: state, StartedAt: startedAt, DownloadedBytes: 4, TotalBytes: 9})
 
-			status := useCases.NewGetUpdateStatusUseCase(&fakeUpdateStore{result: newStoredUpdateResult(), found: true}, infraUpdate.NewJSONJobStore(path), &fakeHelperDetector{}, updateRunning).GetStatus(true)
+			status := newUpdateStatusUseCase(&fakeUpdateStore{result: newStoredUpdateResult(), found: true}, infraUpdate.NewJSONJobStore(path), &fakeHelperDetector{}, updateRunning).GetStatus(true)
 
 			if status.State != update.StateFailed || status.Error == nil || *status.Error != "download" || status.Progress != nil {
 				t.Errorf("%s: status = %+v", state, status)
@@ -714,7 +720,7 @@ func TestJSONJobStorePersistence(t *testing.T) {
 		path := filepath.Join(t.TempDir(), "update-job.json")
 		_ = infraUpdate.NewJSONJobStore(path).Save(update.Job{Tag: downloadTag, State: update.StateReady, StartedAt: startedAt, StagedBinary: filepath.Join(t.TempDir(), "missing")})
 
-		status := useCases.NewGetUpdateStatusUseCase(&fakeUpdateStore{result: newStoredUpdateResult(), found: true}, infraUpdate.NewJSONJobStore(path), &fakeHelperDetector{}, updateRunning).GetStatus(true)
+		status := newUpdateStatusUseCase(&fakeUpdateStore{result: newStoredUpdateResult(), found: true}, infraUpdate.NewJSONJobStore(path), &fakeHelperDetector{}, updateRunning).GetStatus(true)
 
 		if status.State != update.StateIdle || status.StartedAt != nil {
 			t.Errorf("status = %+v", status)

test/update_helper_files_test.go

@@ -0,0 +1,188 @@
+package test
+
+import (
+	"RenewCMS/internal/domain/update"
+	infraUpdate "RenewCMS/internal/infrastructure/update"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestRestartRequestJSONStore(t *testing.T) {
+	t.Run("it round trips and replaces atomically", func(t *testing.T) {
+		directory := t.TempDir()
+		path := filepath.Join(directory, update.RestartRequestFileName)
+		store := infraUpdate.NewJSONRestartRequestStore(path)
+		if _, err := store.Read(); !errors.Is(err, update.ErrNoRestartRequest) {
+			t.Fatalf("an absent marker = %v", err)
+		}
+		first := update.RestartRequest{Kind: "update", Tag: downloadTag, RequestedAt: restartBaseTime, RequestedBy: 7}
+		second := update.RestartRequest{Kind: "restart", RequestedAt: restartBaseTime.Add(time.Minute), RequestedBy: 8}
+
+		if err := store.Write(first); err != nil {
+			t.Fatal(err)
+		}
+		if err := store.Write(second); err != nil {
+			t.Fatal(err)
+		}
+
+		got, err := store.Read()
+		if err != nil || got != second {
+			t.Errorf("got = %+v, err = %v", got, err)
+		}
+		if entries, _ := os.ReadDir(directory); len(entries) != 1 {
+			t.Errorf("no temporary file may remain, got %d entries", len(entries))
+		}
+		if err := store.Delete(); err != nil {
+			t.Fatal(err)
+		}
+		if err := store.Delete(); err != nil {
+			t.Errorf("deleting twice = %v", err)
+		}
+		if _, err := store.Read(); !errors.Is(err, update.ErrNoRestartRequest) {
+			t.Errorf("after delete = %v", err)
+		}
+	})
+
+	t.Run("a corrupt marker still counts as present", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), update.RestartRequestFileName)
+		_ = os.WriteFile(path, []byte("{nope"), 0o600)
+
+		_, err := infraUpdate.NewJSONRestartRequestStore(path).Read()
+
+		if err == nil || errors.Is(err, update.ErrNoRestartRequest) {
+			t.Errorf("err = %v", err)
+		}
+	})
+}
+
+func TestResultJSONStore(t *testing.T) {
+	t.Run("it round trips, keeps null finished_at and ignores corrupt or unknown files", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), update.ResultFileName)
+		store := infraUpdate.NewJSONResultStore(path)
+		if _, found := store.Read(); found {
+			t.Fatal("absent file")
+		}
+		running := update.Result{Outcome: update.OutcomeRunning, Kind: "update", Tag: downloadTag, FromVersion: helperOld, StartedAt: restartBaseTime}
+
+		if err := store.Write(running); err != nil {
+			t.Fatal(err)
+		}
+		got, found := store.Read()
+		if !found || got.Outcome != "running" || got.FinishedAt != nil || !got.StartedAt.Equal(restartBaseTime) {
+			t.Errorf("got = %+v", got)
+		}
+
+		for name, content := range map[string]string{"corrupt": "{nope", "unknown outcome": `{"outcome":"weird"}`, "empty": ""} {
+			_ = os.WriteFile(path, []byte(content), 0o644)
+			if _, found := store.Read(); found {
+				t.Errorf("%s must count as no result", name)
+			}
+		}
+
+		_ = store.Write(running)
+		if err := store.Delete(); err != nil {
+			t.Fatal(err)
+		}
+		if _, found := store.Read(); found {
+			t.Error("deleted")
+		}
+		if err := store.Delete(); err != nil {
+			t.Errorf("deleting twice = %v", err)
+		}
+	})
+}
+
+func TestRunningInfoJSONStore(t *testing.T) {
+	t.Run("it round trips and rejects missing, corrupt and incomplete files", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), update.RunningInfoFileName)
+		store := infraUpdate.NewJSONRunningInfoStore(path)
+		if _, found := store.Read(); found {
+			t.Fatal("absent file")
+		}
+		info := update.RunningInfo{Version: downloadTag, Pid: 12, StartedAt: restartBaseTime}
+
+		if err := store.Write(info); err != nil {
+			t.Fatal(err)
+		}
+		if got, found := store.Read(); !found || got != info {
+			t.Errorf("got = %+v", got)
+		}
+		for name, content := range map[string]string{"corrupt": "{nope", "no pid": `{"version":"v1.0.0"}`, "no version": `{"pid":3}`} {
+			_ = os.WriteFile(path, []byte(content), 0o644)
+			if _, found := store.Read(); found {
+				t.Errorf("%s must not be read as running info", name)
+			}
+		}
+	})
+
+	t.Run("a symlink is never read", func(t *testing.T) {
+		directory := t.TempDir()
+		target := filepath.Join(directory, "target.json")
+		_ = os.WriteFile(target, []byte(`{"version":"v9.9.9","pid":1,"started_at":"2026-09-30T09:50:00Z"}`), 0o644)
+		link := filepath.Join(directory, update.RunningInfoFileName)
+		if err := os.Symlink(target, link); err != nil {
+			t.Skipf("symlinks are not available: %v", err)
+		}
+
+		if _, found := infraUpdate.NewJSONRunningInfoStore(link).Read(); found {
+			t.Error("a symlink must not count")
+		}
+	})
+}
+
+func TestHelperStatusFile(t *testing.T) {
+	t.Run("it is written world readable so the app can detect it", func(t *testing.T) {
+		directory := t.TempDir()
+		writer := infraUpdate.NewJSONHelperStatusWriter()
+
+		err := writer.Write(directory, update.HelperStatus{Version: 1, Service: "renewcms", Binary: "/opt/renewcms/renewcms", DataDir: directory, InstalledAt: restartBaseTime})
+
+		path := filepath.Join(directory, update.HelperStatusFileName)
+		if err != nil || !infraUpdate.NewFileHelperDetector(path).Installed() {
+			t.Fatalf("err = %v", err)
+		}
+		if info, _ := os.Stat(path); info.Mode().Perm()&0o044 != 0o044 && filepath.Separator == '/' {
+			t.Errorf("mode = %v", info.Mode())
+		}
+		removed, err := writer.Remove(directory)
+		if err != nil || !removed {
+			t.Errorf("removed = %v, err = %v", removed, err)
+		}
+		removed, err = writer.Remove(directory)
+		if err != nil || removed {
+			t.Errorf("a second removal = %v, %v", removed, err)
+		}
+	})
+}
+
+func TestServiceUnitParsing(t *testing.T) {
+	t.Run("it reads the binary, the data directory and the environment file", func(t *testing.T) {
+		unit := "[Service]\nUser=renewcms\nEnvironmentFile=/etc/renewcms/renewcms.env\nExecStart=/opt/renewcms/renewcms\nProtectSystem=strict\nReadWritePaths=/var/lib/renewcms\n"
+
+		got := infraUpdate.ParseServiceUnit(unit)
+
+		if got.BinaryPath != "/opt/renewcms/renewcms" || got.DataDir != "/var/lib/renewcms" || got.EnvironmentFile != "/etc/renewcms/renewcms.env" {
+			t.Errorf("got = %+v", got)
+		}
+	})
+
+	t.Run("systemd prefixes are stripped", func(t *testing.T) {
+		unit := "ExecStart=-@/opt/renewcms/renewcms --flag\nEnvironmentFile=-/etc/x.env\nReadWritePaths=-/var/lib/renewcms /other\n"
+
+		got := infraUpdate.ParseServiceUnit(unit)
+
+		if got.BinaryPath != "/opt/renewcms/renewcms" || got.EnvironmentFile != "/etc/x.env" || got.DataDir != "/var/lib/renewcms" {
+			t.Errorf("got = %+v", got)
+		}
+	})
+}
+
+func TestNoFollowFilesystemExists(t *testing.T) {
+	var files update.HelperFilesystem = infraUpdate.NewNoFollowFilesystem()
+	if files == nil {
+		t.Fatal("the adapter must compile on every platform")
+	}
+}

test/update_helper_gaps_test.go

@@ -0,0 +1,399 @@
+package test
+
+import (
+	"RenewCMS/internal/domain/update"
+	infraUpdate "RenewCMS/internal/infrastructure/update"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestApplyRefusesStagedEntriesThatAreNotRegularFiles(t *testing.T) {
+	for _, name := range []string{helperAsset, update.ChecksumsAssetName, update.SignatureAssetName} {
+		t.Run("a directory in place of "+name, func(t *testing.T) {
+			rig := newHelperRig(t)
+			rig.stage()
+			rig.markUpdate(downloadTag)
+			target := path.Join(helperStagedDir, name)
+			rig.forget(target)
+			rig.fs.putDir(target)
+
+			err := rig.apply()
+
+			if err != nil || rig.result().Outcome != update.OutcomeFailed {
+				t.Errorf("err = %v, result = %+v", err, rig.result())
+			}
+			if !strings.Contains(rig.logger.text(), target+" is not a regular file") {
+				t.Errorf("the refusal must name the entry: %s", rig.logger.text())
+			}
+			if rig.fs.operationCount("tempdir") != 0 {
+				t.Error("nothing may be copied once a staged entry is refused")
+			}
+			rig.assertUntouched()
+		})
+	}
+}
+
+func TestApplyKeepsThePreviousBinaryOrFails(t *testing.T) {
+	t.Run("a failed rename of the previous-binary backup stops the install", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.fs.failNth("rename", 2, errors.New("cross-device link"))
+
+		err := rig.apply()
+
+		if err != nil || rig.result().Outcome != update.OutcomeFailed || rig.service.restartCount() != 0 {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+		rig.assertBinary("old")
+		if rig.fs.exists(helperBinary+".previous") || rig.fs.exists(helperBinary+".previous.tmp") {
+			t.Error("no backup file may be left behind")
+		}
+		if !strings.Contains(rig.logger.text(), "keeping the previous binary: ") {
+			t.Errorf("log = %s", rig.logger.text())
+		}
+	})
+
+	t.Run("a failed rename of the rollback restore is reported loudly", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.service.failOn[1] = errors.New("restart failed")
+		rig.fs.failNth("rename", 4, errors.New("input/output error"))
+
+		err := rig.apply()
+
+		if err == nil || rig.result().Outcome != update.OutcomeFailed || rig.service.restartCount() != 1 {
+			t.Errorf("err = %v, result = %+v, restarts = %d", err, rig.result(), rig.service.restartCount())
+		}
+		if !strings.Contains(rig.logger.text(), "the site may be down") || rig.fs.exists(helperBinary+".restore") {
+			t.Errorf("log = %s", rig.logger.text())
+		}
+	})
+}
+
+func TestApplyRestartWindowBoundary(t *testing.T) {
+	cases := []struct {
+		name      string
+		comesBack int
+		wantOK    bool
+	}{
+		{"the site back one second before the window ends counts", 59, true},
+		{"the site back exactly when the window ends is too late", 60, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rig := newHelperRig(t)
+			rig.markRestart()
+			rig.service.onRestart = func(int) {}
+			rig.clock.onSleep = func(sleeps int) {
+				if sleeps == tc.comesBack {
+					rig.running.set(update.RunningInfo{Version: helperOld, Pid: 300, StartedAt: rig.clock.Now().Add(time.Second)})
+				}
+			}
+
+			err := rig.apply()
+
+			if tc.wantOK && (err != nil || rig.result().Outcome != update.OutcomeSucceeded) {
+				t.Errorf("err = %v, result = %+v", err, rig.result())
+			}
+			if !tc.wantOK && (err == nil || rig.result().Outcome != update.OutcomeFailed || rig.service.restartCount() != 1) {
+				t.Errorf("err = %v, result = %+v", err, rig.result())
+			}
+		})
+	}
+}
+
+func TestApplyLogsOnlyRealFailures(t *testing.T) {
+	t.Run("a clean update logs neither a write nor a removal failure", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+
+		if err := rig.apply(); err != nil {
+			t.Fatal(err)
+		}
+
+		for _, unwanted := range []string{"could not be written", "could not remove", "staged files left in place"} {
+			if strings.Contains(rig.logger.text(), unwanted) {
+				t.Errorf("unexpected log %q in %s", unwanted, rig.logger.text())
+			}
+		}
+	})
+
+	t.Run("a result that cannot be written is logged and does not stop the restart", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.markRestart()
+		rig.fs.failNth("create", 1, errors.New("disk full"))
+
+		err := rig.apply()
+
+		if err != nil || rig.service.restartCount() != 1 {
+			t.Errorf("err = %v, restarts = %d", err, rig.service.restartCount())
+		}
+		if !strings.Contains(rig.logger.text(), "update-result.json could not be written: disk full") {
+			t.Errorf("log = %s", rig.logger.text())
+		}
+	})
+
+	t.Run("a temp directory that cannot be removed is logged and the update still succeeds", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.fs.failNth("removeall", 1, errors.New("device busy"))
+
+		err := rig.apply()
+
+		if err != nil || rig.result().Outcome != update.OutcomeSucceeded {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+		if !strings.Contains(rig.logger.text(), "could not remove /tmp/renewcms-update-1: device busy") {
+			t.Errorf("log = %s", rig.logger.text())
+		}
+	})
+
+	t.Run("staged files that are already gone at cleanup are not an error", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.fs.after("removeall", 1, func(f *fakeHelperFS) {
+			for name := range f.nodes {
+				if name == helperStagedDir || strings.HasPrefix(name, helperStagedDir+"/") {
+					delete(f.nodes, name)
+				}
+			}
+		})
+
+		err := rig.apply()
+
+		if err != nil || rig.result().Outcome != update.OutcomeSucceeded {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+		if strings.Contains(rig.logger.text(), "could not remove") || strings.Contains(rig.logger.text(), "staged files left in place") {
+			t.Errorf("log = %s", rig.logger.text())
+		}
+		if rig.fs.operationCount("removeall") != 1 {
+			t.Errorf("removeall calls = %d, a missing staged directory needs none", rig.fs.operationCount("removeall"))
+		}
+	})
+}
+
+func TestEnableAndDisableBrowserUpdatesEdges(t *testing.T) {
+	t.Run("a binary given by flag still needs a data directory or a known service", func(t *testing.T) {
+		rig := newInstallRig()
+		rig.locator.found = false
+		rig.locator.description = update.ServiceDescription{}
+
+		_, err := rig.enable.Enable(update.InstallOptions{Binary: "/opt/cms/renewcms"})
+
+		if !errors.Is(err, update.ErrServiceNotFound) || len(rig.events) != 0 {
+			t.Errorf("err = %v, events = %v", err, rig.events)
+		}
+	})
+
+	t.Run("every flag given makes an unknown service installable", func(t *testing.T) {
+		rig := newInstallRig()
+		rig.locator.found = false
+		rig.locator.description = update.ServiceDescription{}
+
+		_, err := rig.enable.Enable(update.InstallOptions{Binary: "/opt/cms/renewcms", DataDir: "/srv/cms", Port: "8081"})
+
+		if err != nil || len(rig.units.units) != 2 {
+			t.Errorf("err = %v, units = %v", err, rig.units.units)
+		}
+		if _, found := rig.status.status["/srv/cms"]; !found {
+			t.Error("the status file goes to the data directory given by flag")
+		}
+	})
+
+	t.Run("the port is accepted from 1 to 65535 and refused outside it", func(t *testing.T) {
+		for port, valid := range map[string]bool{"1": true, "65535": true, "0": false, "65536": false, "-1": false, "80a": false} {
+			rig := newInstallRig()
+
+			_, err := rig.enable.Enable(update.InstallOptions{Port: port})
+
+			if valid && err != nil {
+				t.Errorf("port %q: %v", port, err)
+			}
+			if !valid && !errors.Is(err, update.ErrInvalidPort) {
+				t.Errorf("port %q: err = %v", port, err)
+			}
+		}
+	})
+
+	t.Run("disable with the units present but no status file still disables", func(t *testing.T) {
+		rig := newInstallRig()
+		if _, err := rig.enable.Enable(update.InstallOptions{}); err != nil {
+			t.Fatal(err)
+		}
+		delete(rig.status.status, "/var/lib/renewcms")
+		rig.events = nil
+
+		message, err := rig.disable.Disable(update.InstallOptions{})
+
+		if err != nil || strings.Contains(message, "not enabled") || len(rig.units.units) != 0 {
+			t.Errorf("message = %q, err = %v, units = %v", message, err, rig.units.units)
+		}
+		assertInOrder(t, rig.events, "disable "+update.PathUnitName, "daemon-reload")
+	})
+
+	t.Run("disable with a status file but no units still disables", func(t *testing.T) {
+		rig := newInstallRig()
+		if _, err := rig.enable.Enable(update.InstallOptions{}); err != nil {
+			t.Fatal(err)
+		}
+		rig.units.units = map[string]string{}
+		rig.events = nil
+
+		message, err := rig.disable.Disable(update.InstallOptions{})
+
+		if err != nil || strings.Contains(message, "not enabled") || len(rig.status.status) != 0 {
+			t.Errorf("message = %q, err = %v", message, err)
+		}
+	})
+}
+
+func TestFSStoresReportRealFailures(t *testing.T) {
+	stores := map[string]func(files *fakeHelperFS) (write func() error, remove func() error){
+		"the result store": func(files *fakeHelperFS) (func() error, func() error) {
+			store := infraUpdate.NewFSResultStore(files, helperResult)
+			return func() error {
+				return store.Write(update.Result{Outcome: update.OutcomeFailed, StartedAt: restartBaseTime})
+			}, store.Delete
+		},
+		"the restart request store": func(files *fakeHelperFS) (func() error, func() error) {
+			store := infraUpdate.NewFSRestartRequestStore(files, helperMarker)
+			return func() error {
+				return store.Write(update.RestartRequest{Kind: update.RestartKindRestart, RequestedAt: restartBaseTime})
+			}, store.Delete
+		},
+	}
+	for name, build := range stores {
+		t.Run(name+": deleting a file that is not there is fine", func(t *testing.T) {
+			files := newFakeHelperFS()
+			files.putDir(helperData)
+			_, remove := build(files)
+
+			if err := remove(); err != nil {
+				t.Errorf("err = %v", err)
+			}
+		})
+
+		t.Run(name+": a delete that fails for another reason is returned", func(t *testing.T) {
+			files := newFakeHelperFS()
+			files.putDir(helperData)
+			files.failNth("remove", 1, errors.New("read-only file system"))
+			_, remove := build(files)
+
+			if err := remove(); err == nil || err.Error() != "read-only file system" {
+				t.Errorf("err = %v", err)
+			}
+		})
+
+		t.Run(name+": a failed rename is returned and the temp file is removed", func(t *testing.T) {
+			files := newFakeHelperFS()
+			files.putDir(helperData)
+			files.failNth("rename", 1, errors.New("cross-device link"))
+			write, _ := build(files)
+
+			err := write()
+
+			if err == nil || err.Error() != "cross-device link" {
+				t.Errorf("err = %v", err)
+			}
+			for node := range files.nodes {
+				if strings.HasSuffix(node, ".tmp") {
+					t.Errorf("the temp file %s must be removed", node)
+				}
+			}
+		})
+
+		t.Run(name+": a stale temp file that cannot be removed fails the write", func(t *testing.T) {
+			files := newFakeHelperFS()
+			files.putDir(helperData)
+			files.putFile(helperMarker+".tmp", "stale")
+			files.putFile(helperResult+".tmp", "stale")
+			files.failNth("remove", 1, errors.New("operation not permitted"))
+			write, _ := build(files)
+
+			err := write()
+
+			if err == nil || err.Error() != "operation not permitted" || files.operationCount("create") != 0 {
+				t.Errorf("err = %v, creates = %d", err, files.operationCount("create"))
+			}
+		})
+	}
+}
+
+func TestHTTPHealthChecker(t *testing.T) {
+	serve := func(status int) (string, func()) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path != "/healthz" {
+				w.WriteHeader(http.StatusNotFound)
+				return
+			}
+			w.WriteHeader(status)
+		}))
+		return strings.TrimPrefix(server.URL, "http://127.0.0.1:"), server.Close
+	}
+
+	t.Run("a 200 answer on /healthz is healthy", func(t *testing.T) {
+		port, stop := serve(http.StatusOK)
+		defer stop()
+
+		if !infraUpdate.NewHTTPHealthChecker(port).Healthy() {
+			t.Error("a 200 must be healthy")
+		}
+	})
+
+	t.Run("any other status is not healthy", func(t *testing.T) {
+		for _, status := range []int{http.StatusNoContent, http.StatusInternalServerError, http.StatusServiceUnavailable} {
+			port, stop := serve(status)
+
+			healthy := infraUpdate.NewHTTPHealthChecker(port).Healthy()
+			stop()
+
+			if healthy {
+				t.Errorf("status %d must not be healthy", status)
+			}
+		}
+	})
+
+	t.Run("nothing listening is not healthy", func(t *testing.T) {
+		port, stop := serve(http.StatusOK)
+		stop()
+
+		if infraUpdate.NewHTTPHealthChecker(port).Healthy() {
+			t.Error("a closed port must not be healthy")
+		}
+	})
+}
+
+func TestSystemMachineProbe(t *testing.T) {
+	probe := infraUpdate.NewSystemMachineProbe()
+
+	t.Run("it reports the real OS and effective user", func(t *testing.T) {
+		if probe.OS() != runtime.GOOS {
+			t.Errorf("OS = %q, want %q", probe.OS(), runtime.GOOS)
+		}
+		if probe.IsRoot() != (os.Geteuid() == 0) {
+			t.Errorf("IsRoot = %v, euid = %d", probe.IsRoot(), os.Geteuid())
+		}
+	})
+
+	t.Run("it reports systemd only where its runtime directory exists", func(t *testing.T) {
+		info, err := os.Stat("/run/systemd/system")
+		want := err == nil && info.IsDir()
+
+		if probe.SystemdRunning() != want {
+			t.Errorf("SystemdRunning = %v, want %v", probe.SystemdRunning(), want)
+		}
+	})
+}

test/update_helper_install_test.go

@@ -0,0 +1,466 @@
+package test
+
+import (
+	"RenewCMS/internal/domain/update"
+	infraUpdate "RenewCMS/internal/infrastructure/update"
+	"RenewCMS/internal/infrastructure/useCases"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+type fakeMachineProbe struct {
+	os      string
+	systemd bool
+	root    bool
+}
+
+var _ update.MachineProbe = &fakeMachineProbe{}
+
+func (f *fakeMachineProbe) OS() string           { return f.os }
+func (f *fakeMachineProbe) SystemdRunning() bool { return f.systemd }
+func (f *fakeMachineProbe) IsRoot() bool         { return f.root }
+
+type fakeServiceLocator struct {
+	description update.ServiceDescription
+	found       bool
+	port        string
+	hasPort     bool
+}
+
+var _ update.ServiceLocator = &fakeServiceLocator{}
+
+func (f *fakeServiceLocator) Locate(name string) (update.ServiceDescription, bool) {
+	description := f.description
+	description.Name = name
+	return description, f.found
+}
+
+func (f *fakeServiceLocator) PortFromEnvironmentFile(string) (string, bool) {
+	return f.port, f.hasPort
+}
+
+type fakeUnitWriter struct {
+	units   map[string]string
+	writes  int
+	failNth int
+	events  *[]string
+}
+
+var _ update.UnitWriter = &fakeUnitWriter{}
+
+func (f *fakeUnitWriter) Write(name string, content string) error {
+	f.writes++
+	*f.events = append(*f.events, "write "+name)
+	if f.failNth == f.writes {
+		return errors.New("disk full")
+	}
+	f.units[name] = content
+	return nil
+}
+
+func (f *fakeUnitWriter) Remove(name string) (bool, error) {
+	_, existed := f.units[name]
+	delete(f.units, name)
+	*f.events = append(*f.events, "remove "+name)
+	return existed, nil
+}
+
+type fakeUnitManager struct {
+	reloadErr error
+	enableErr error
+	events    *[]string
+}
+
+var _ update.UnitManager = &fakeUnitManager{}
+
+func (f *fakeUnitManager) DaemonReload() error {
+	*f.events = append(*f.events, "daemon-reload")
+	return f.reloadErr
+}
+
+func (f *fakeUnitManager) EnableNow(unit string) error {
+	*f.events = append(*f.events, "enable "+unit)
+	return f.enableErr
+}
+
+func (f *fakeUnitManager) DisableNow(unit string) error {
+	*f.events = append(*f.events, "disable "+unit)
+	return nil
+}
+
+type fakeHelperStatusWriter struct {
+	status map[string]update.HelperStatus
+	events *[]string
+}
+
+var _ update.HelperStatusWriter = &fakeHelperStatusWriter{}
+
+func (f *fakeHelperStatusWriter) Write(dataDir string, status update.HelperStatus) error {
+	*f.events = append(*f.events, "status")
+	f.status[dataDir] = status
+	return nil
+}
+
+func (f *fakeHelperStatusWriter) Remove(dataDir string) (bool, error) {
+	_, existed := f.status[dataDir]
+	delete(f.status, dataDir)
+	*f.events = append(*f.events, "status-removed")
+	return existed, nil
+}
+
+type installRig struct {
+	probe   *fakeMachineProbe
+	locator *fakeServiceLocator
+	units   *fakeUnitWriter
+	manager *fakeUnitManager
+	status  *fakeHelperStatusWriter
+	events  []string
+	enable  *useCases.EnableBrowserUpdatesUseCase
+	disable *useCases.DisableBrowserUpdatesUseCase
+}
+
+func newInstallRig() *installRig {
+	rig := &installRig{
+		probe: &fakeMachineProbe{os: "linux", systemd: true, root: true},
+		locator: &fakeServiceLocator{
+			found: true,
+			description: update.ServiceDescription{
+				BinaryPath:      "/opt/renewcms/renewcms",
+				DataDir:         "/var/lib/renewcms",
+				EnvironmentFile: "/etc/renewcms/renewcms.env",
+			},
+		},
+	}
+	rig.units = &fakeUnitWriter{units: map[string]string{}, events: &rig.events}
+	rig.manager = &fakeUnitManager{events: &rig.events}
+	rig.status = &fakeHelperStatusWriter{status: map[string]update.HelperStatus{}, events: &rig.events}
+	rig.rebuild()
+	return rig
+}
+
+func (r *installRig) rebuild() {
+	dependencies := useCases.ManageBrowserUpdatesDependencies{
+		Probe: r.probe, Locator: r.locator, Units: r.units, Manager: r.manager, Status: r.status,
+		Now: func() time.Time { return restartBaseTime },
+	}
+	r.enable = useCases.NewEnableBrowserUpdatesUseCase(dependencies)
+	r.disable = useCases.NewDisableBrowserUpdatesUseCase(dependencies)
+}
+
+func TestEnableBrowserUpdatesRefusals(t *testing.T) {
+	cases := []struct {
+		name    string
+		prepare func(*installRig)
+		message string
+	}{
+		{"the OS is not Linux", func(r *installRig) { r.probe.os = "windows" }, "Browser updates need Linux with systemd."},
+		{"Linux without systemd", func(r *installRig) { r.probe.systemd = false }, "Browser updates need systemd, which this machine is not running."},
+		{"not run as root", func(r *installRig) { r.probe.root = false }, "Run this command as root, for example with sudo."},
+		{"no unit for the service and no flags", func(r *installRig) { r.locator.found = false; r.locator.description = update.ServiceDescription{} }, "Could not find the RenewCMS service. Pass --service, --binary and --data-dir."},
+		{"the data directory cannot be resolved", func(r *installRig) { r.locator.description.DataDir = "" }, "Could not find the data directory. Pass --data-dir."},
+	}
+	for _, tc := range cases {
+		t.Run("enable-browser-updates refuses when it cannot work: "+tc.name, func(t *testing.T) {
+			rig := newInstallRig()
+			tc.prepare(rig)
+
+			_, err := rig.enable.Enable(update.InstallOptions{})
+
+			if err == nil || err.Error() != tc.message {
+				t.Errorf("err = %v, want %q", err, tc.message)
+			}
+			if len(rig.events) != 0 || len(rig.units.units) != 0 || len(rig.status.status) != 0 {
+				t.Errorf("nothing may be written: %v", rig.events)
+			}
+		})
+	}
+}
+
+func TestEnableBrowserUpdates(t *testing.T) {
+	t.Run("enable-browser-updates installs the units", func(t *testing.T) {
+		rig := newInstallRig()
+		rig.locator.port, rig.locator.hasPort = "9090", true
+
+		message, err := rig.enable.Enable(update.InstallOptions{})
+
+		if err != nil {
+			t.Fatal(err)
+		}
+		service := rig.units.units[update.ServiceUnitName]
+		path := rig.units.units[update.PathUnitName]
+		for _, want := range []string{"Type=oneshot", "User=root", "ExecStart=/opt/renewcms/renewcms apply-update", "--service renewcms", "--binary /opt/renewcms/renewcms", "--data-dir /var/lib/renewcms", "--port 9090"} {
+			if !strings.Contains(service, want) {
+				t.Errorf("service unit lacks %q:\n%s", want, service)
+			}
+		}
+		if !strings.Contains(path, "PathExists=/var/lib/renewcms/update-restart-request.json") || !strings.Contains(path, "Unit=renewcms-update.service") {
+			t.Errorf("path unit:\n%s", path)
+		}
+		assertInOrder(t, rig.events, "write", "write", "daemon-reload", "enable renewcms-update.path", "status")
+		if rig.events[len(rig.events)-1] != "status" {
+			t.Errorf("the status file must be written last: %v", rig.events)
+		}
+		status := rig.status.status["/var/lib/renewcms"]
+		if status.Version != 1 || status.Service != "renewcms" || status.Binary != "/opt/renewcms/renewcms" || status.DataDir != "/var/lib/renewcms" || !status.InstalledAt.Equal(restartBaseTime) {
+			t.Errorf("status = %+v", status)
+		}
+		if !strings.Contains(message, "renewcms disable-browser-updates") || !strings.Contains(message, update.PathUnitName) {
+			t.Errorf("message = %q", message)
+		}
+	})
+
+	t.Run("the port comes from --port, else the environment file, else 8080", func(t *testing.T) {
+		cases := []struct {
+			flag, env string
+			hasEnv    bool
+			want      string
+		}{
+			{"7000", "9090", true, "--port 7000"},
+			{"", "9090", true, "--port 9090"},
+			{"", "", false, "--port 8080"},
+		}
+		for _, tc := range cases {
+			rig := newInstallRig()
+			rig.locator.port, rig.locator.hasPort = tc.env, tc.hasEnv
+
+			if _, err := rig.enable.Enable(update.InstallOptions{Port: tc.flag}); err != nil {
+				t.Fatal(err)
+			}
+
+			if !strings.Contains(rig.units.units[update.ServiceUnitName], tc.want) {
+				t.Errorf("want %q in:\n%s", tc.want, rig.units.units[update.ServiceUnitName])
+			}
+		}
+	})
+
+	t.Run("flags override the unit", func(t *testing.T) {
+		rig := newInstallRig()
+
+		_, err := rig.enable.Enable(update.InstallOptions{Service: "cms", Binary: "/srv/cms bin/renewcms", DataDir: "/srv/data", Port: "81"})
+
+		service := rig.units.units[update.ServiceUnitName]
+		if err != nil || !strings.Contains(service, `"/srv/cms bin/renewcms" apply-update --service cms --binary "/srv/cms bin/renewcms" --data-dir /srv/data --port 81`) {
+			t.Errorf("err = %v, unit:\n%s", err, service)
+		}
+		if _, found := rig.status.status["/srv/data"]; !found {
+			t.Error("the status file goes to the overridden data directory")
+		}
+	})
+
+	t.Run("an invalid port is refused", func(t *testing.T) {
+		rig := newInstallRig()
+
+		_, err := rig.enable.Enable(update.InstallOptions{Port: "http"})
+
+		if !errors.Is(err, update.ErrInvalidPort) || len(rig.units.units) != 0 {
+			t.Errorf("err = %v", err)
+		}
+	})
+
+	t.Run("enable-browser-updates undoes its own partial work", func(t *testing.T) {
+		cases := map[string]func(*installRig){
+			"writing the second unit": func(r *installRig) { r.units.failNth = 2 },
+			"daemon-reload":           func(r *installRig) { r.manager.reloadErr = errors.New("reload failed") },
+			"enable":                  func(r *installRig) { r.manager.enableErr = errors.New("enable failed") },
+		}
+		for name, fail := range cases {
+			t.Run(name, func(t *testing.T) {
+				rig := newInstallRig()
+				fail(rig)
+
+				_, err := rig.enable.Enable(update.InstallOptions{})
+
+				if err == nil || len(rig.units.units) != 0 || len(rig.status.status) != 0 {
+					t.Errorf("err = %v, units = %v, status = %v", err, rig.units.units, rig.status.status)
+				}
+				for _, event := range rig.events {
+					if event == "status" {
+						t.Error("update-helper.json must not be written")
+					}
+				}
+			})
+		}
+	})
+
+	t.Run("enable-browser-updates is idempotent", func(t *testing.T) {
+		rig := newInstallRig()
+		if _, err := rig.enable.Enable(update.InstallOptions{}); err != nil {
+			t.Fatal(err)
+		}
+		first := map[string]string{}
+		for name, content := range rig.units.units {
+			first[name] = content
+		}
+
+		if _, err := rig.enable.Enable(update.InstallOptions{}); err != nil {
+			t.Fatal(err)
+		}
+		if len(rig.units.units) != 2 || rig.units.units[update.ServiceUnitName] != first[update.ServiceUnitName] || rig.units.units[update.PathUnitName] != first[update.PathUnitName] {
+			t.Error("a second run must rewrite identical units")
+		}
+
+		rig.locator.description.BinaryPath = "/usr/local/bin/renewcms"
+		if _, err := rig.enable.Enable(update.InstallOptions{Service: "renewcms2"}); err != nil {
+			t.Fatal(err)
+		}
+		if len(rig.units.units) != 2 || !strings.Contains(rig.units.units[update.ServiceUnitName], "/usr/local/bin/renewcms") || !strings.Contains(rig.units.units[update.ServiceUnitName], "--service renewcms2") {
+			t.Errorf("units must follow the new values: %v", rig.units.units)
+		}
+		if rig.status.status["/var/lib/renewcms"].Binary != "/usr/local/bin/renewcms" {
+			t.Error("the status file follows the new values")
+		}
+	})
+}
+
+func TestBrowserUpdatesOverRealFiles(t *testing.T) {
+	setup := func(t *testing.T) (*installRig, string, string, string) {
+		t.Helper()
+		directory := t.TempDir()
+		unitDirectory := filepath.Join(directory, "units")
+		dataDir := filepath.Join(directory, "data")
+		envFile := filepath.Join(directory, "renewcms.env")
+		for _, path := range []string{unitDirectory, dataDir} {
+			if err := os.MkdirAll(path, 0o755); err != nil {
+				t.Fatal(err)
+			}
+		}
+		environment := "ENVIRONMENT=production\nPORT=9191\nJWT_SECRET=sentinel-secret\nSMTP_PASSWORD=sentinel-smtp\n"
+		if err := os.WriteFile(envFile, []byte(environment), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		unit := "[Service]\nUser=renewcms\nEnvironmentFile=-" + envFile + "\nExecStart=/opt/renewcms/renewcms\nReadWritePaths=" + dataDir + "\n"
+		if err := os.WriteFile(filepath.Join(unitDirectory, "renewcms.service"), []byte(unit), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		rig := newInstallRig()
+		units := infraUpdate.NewSystemdUnitsIn(unitDirectory)
+		rig.locator = nil
+		dependencies := useCases.ManageBrowserUpdatesDependencies{
+			Probe: rig.probe, Locator: units, Units: units, Manager: rig.manager,
+			Status: infraUpdate.NewJSONHelperStatusWriter(), Now: func() time.Time { return restartBaseTime },
+		}
+		rig.enable = useCases.NewEnableBrowserUpdatesUseCase(dependencies)
+		rig.disable = useCases.NewDisableBrowserUpdatesUseCase(dependencies)
+		return rig, unitDirectory, dataDir, envFile
+	}
+
+	t.Run("it reads the unit and writes no secret and no environment value", func(t *testing.T) {
+		rig, unitDirectory, dataDir, _ := setup(t)
+
+		if _, err := rig.enable.Enable(update.InstallOptions{}); err != nil {
+			t.Fatal(err)
+		}
+
+		for _, name := range []string{update.ServiceUnitName, update.PathUnitName} {
+			content, err := os.ReadFile(filepath.Join(unitDirectory, name))
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, forbidden := range []string{"JWT_SECRET", "sentinel-secret", "sentinel-smtp", "SMTP_PASSWORD", "ENVIRONMENT"} {
+				if strings.Contains(string(content), forbidden) {
+					t.Errorf("%s contains %q", name, forbidden)
+				}
+			}
+		}
+		service, _ := os.ReadFile(filepath.Join(unitDirectory, update.ServiceUnitName))
+		if !strings.Contains(string(service), "--port 9191") || !strings.Contains(string(service), "--data-dir ") {
+			t.Errorf("service unit:\n%s", service)
+		}
+		if !infraUpdate.NewFileHelperDetector(filepath.Join(dataDir, update.HelperStatusFileName)).Installed() {
+			t.Error("can_apply must read true afterwards")
+		}
+	})
+
+	t.Run("disable-browser-updates", func(t *testing.T) {
+		rig, unitDirectory, dataDir, _ := setup(t)
+		if _, err := rig.enable.Enable(update.InstallOptions{}); err != nil {
+			t.Fatal(err)
+		}
+		kept := []string{update.RestartRequestFileName, update.ResultFileName, "updates/v2.3.0-beta/binary", "backups/renewcms-1.db"}
+		for _, name := range kept {
+			full := filepath.Join(dataDir, filepath.FromSlash(name))
+			_ = os.MkdirAll(filepath.Dir(full), 0o755)
+			if err := os.WriteFile(full, []byte("keep"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+		}
+		rig.events = nil
+
+		message, err := rig.disable.Disable(update.InstallOptions{})
+
+		if err != nil || !strings.Contains(message, "disabled") {
+			t.Fatalf("message = %q, err = %v", message, err)
+		}
+		for _, name := range []string{update.PathUnitName, update.ServiceUnitName} {
+			if _, statErr := os.Stat(filepath.Join(unitDirectory, name)); statErr == nil {
+				t.Errorf("%s must be removed", name)
+			}
+		}
+		assertInOrder(t, rig.events, "disable renewcms-update.path", "daemon-reload")
+		for _, name := range kept {
+			if _, statErr := os.Stat(filepath.Join(dataDir, filepath.FromSlash(name))); statErr != nil {
+				t.Errorf("%s must be left in place", name)
+			}
+		}
+		if infraUpdate.NewFileHelperDetector(filepath.Join(dataDir, update.HelperStatusFileName)).Installed() {
+			t.Error("can_apply must read false afterwards")
+		}
+
+		again, err := rig.disable.Disable(update.InstallOptions{})
+		if err != nil || !strings.Contains(again, "not enabled") {
+			t.Errorf("a second run: message = %q, err = %v", again, err)
+		}
+	})
+
+	t.Run("disable-browser-updates where it was never enabled exits cleanly", func(t *testing.T) {
+		rig, _, _, _ := setup(t)
+
+		message, err := rig.disable.Disable(update.InstallOptions{})
+
+		if err != nil || !strings.Contains(message, "not enabled") {
+			t.Errorf("message = %q, err = %v", message, err)
+		}
+	})
+
+	t.Run("disable-browser-updates on a machine without systemd is a no-op", func(t *testing.T) {
+		rig := newInstallRig()
+		rig.probe.os = "windows"
+
+		message, err := rig.disable.Disable(update.InstallOptions{})
+
+		if err != nil || !strings.Contains(message, "not enabled") || len(rig.events) != 0 {
+			t.Errorf("message = %q, err = %v, events = %v", message, err, rig.events)
+		}
+	})
+}
+
+func TestRenderServiceUnitEscaping(t *testing.T) {
+	t.Run("backslashes, quotes, percent and dollar in a value cannot alter the unit", func(t *testing.T) {
+		unit := update.RenderServiceUnit(update.InstallOptions{
+			Service: `svc\x`,
+			Binary:  `/opt/a\b"c%d$e/bin`,
+			DataDir: "/data\nUser=evil",
+			Port:    "80",
+		})
+
+		want := `ExecStart="/opt/a\\b\"c%%d$$e/bin" apply-update --service "svc\\x" --binary "/opt/a\\b\"c%%d$$e/bin" --data-dir "/data\nUser=evil" --port 80`
+		if !strings.Contains(unit, want) {
+			t.Errorf("unit:\n%s\nwant line %s", unit, want)
+		}
+		if strings.Count(unit, "\nUser=") != 1 {
+			t.Errorf("an injected directive must not appear:\n%s", unit)
+		}
+	})
+
+	t.Run("a plain value stays unquoted", func(t *testing.T) {
+		unit := update.RenderServiceUnit(update.InstallOptions{Service: "renewcms", Binary: "/opt/renewcms/renewcms", DataDir: "/var/lib/renewcms", Port: "8080"})
+
+		if !strings.Contains(unit, "ExecStart=/opt/renewcms/renewcms apply-update --service renewcms") {
+			t.Errorf("unit:\n%s", unit)
+		}
+	})
+}

test/update_helper_nofollow_linux_test.go

@@ -0,0 +1,124 @@
+//go:build linux
+
+package test
+
+import (
+	infraUpdate "RenewCMS/internal/infrastructure/update"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestNoFollowFilesystemOnLinux(t *testing.T) {
+	files := infraUpdate.NewNoFollowFilesystem()
+	directory := t.TempDir()
+	outside := filepath.Join(t.TempDir(), "outside.txt")
+	if err := os.WriteFile(outside, []byte("sentinel"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(directory, "link")
+	if err := os.Symlink(outside, link); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("lstat reports a symlink without following it", func(t *testing.T) {
+		info, err := files.Lstat(link)
+		if err != nil || !info.IsSymlink || info.IsRegular {
+			t.Errorf("info = %+v, err = %v", info, err)
+		}
+	})
+
+	t.Run("it never reads, copies, writes or chmods through a symlink", func(t *testing.T) {
+		if _, err := files.ReadFile(link); err == nil {
+			t.Error("read followed the link")
+		}
+		if err := files.Copy(link, filepath.Join(directory, "copy"), 0o600); err == nil {
+			t.Error("copy followed the link")
+		}
+		if err := files.CreateExclusive(link, []byte("x"), 0o600); err == nil {
+			t.Error("create followed the link")
+		}
+		if err := files.Chmod(link, 0o777); err == nil {
+			t.Error("chmod followed the link")
+		}
+		if content, _ := os.ReadFile(outside); string(content) != "sentinel" {
+			t.Errorf("the target changed: %q", content)
+		}
+		if info, _ := os.Stat(outside); info.Mode().Perm() != 0o644 {
+			t.Errorf("the target mode changed: %v", info.Mode())
+		}
+	})
+
+	t.Run("create-exclusive refuses an existing file and sets the mode", func(t *testing.T) {
+		path := filepath.Join(directory, "exclusive")
+		if err := files.CreateExclusive(path, []byte("one"), 0o640); err != nil {
+			t.Fatal(err)
+		}
+		if err := files.CreateExclusive(path, []byte("two"), 0o640); err == nil {
+			t.Error("the second create must fail")
+		}
+		if info, _ := os.Stat(path); info.Mode().Perm() != 0o640 {
+			t.Errorf("mode = %v", info.Mode())
+		}
+	})
+
+	t.Run("copy, rename, chmod and remove work on regular files", func(t *testing.T) {
+		source := filepath.Join(directory, "source")
+		_ = os.WriteFile(source, []byte("payload"), 0o600)
+		copied := filepath.Join(directory, "copied")
+
+		if err := files.Copy(source, copied, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		renamed := filepath.Join(directory, "renamed")
+		if err := files.Rename(copied, renamed); err != nil {
+			t.Fatal(err)
+		}
+		if err := files.Chmod(renamed, 0o700); err != nil {
+			t.Fatal(err)
+		}
+		content, _ := files.ReadFile(renamed)
+		info, _ := os.Stat(renamed)
+		if string(content) != "payload" || info.Mode().Perm() != 0o700 {
+			t.Errorf("content = %q, mode = %v", content, info.Mode())
+		}
+		if err := files.Remove(renamed); err != nil {
+			t.Error(err)
+		}
+	})
+
+	t.Run("remove-all unlinks links and never descends into them", func(t *testing.T) {
+		tree := filepath.Join(directory, "tree")
+		_ = os.MkdirAll(filepath.Join(tree, "nested"), 0o755)
+		_ = os.WriteFile(filepath.Join(tree, "nested", "file"), []byte("x"), 0o644)
+		escape := t.TempDir()
+		_ = os.WriteFile(filepath.Join(escape, "keep"), []byte("keep"), 0o644)
+		_ = os.Symlink(escape, filepath.Join(tree, "escape"))
+
+		if err := files.RemoveAll(tree); err != nil {
+			t.Fatal(err)
+		}
+
+		if _, err := os.Stat(tree); err == nil {
+			t.Error("the tree must be gone")
+		}
+		if content, _ := os.ReadFile(filepath.Join(escape, "keep")); string(content) != "keep" {
+			t.Error("the link target must be intact")
+		}
+		if err := files.RemoveAll(tree); err != nil {
+			t.Errorf("removing a missing path = %v", err)
+		}
+	})
+
+	t.Run("the temp directory is private", func(t *testing.T) {
+		temp, err := files.MakePrivateTempDir()
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer os.RemoveAll(temp)
+		info, _ := os.Stat(temp)
+		if !info.IsDir() || info.Mode().Perm() != 0o700 {
+			t.Errorf("mode = %v", info.Mode())
+		}
+	})
+}

test/update_helper_nofollow_other_test.go

@@ -0,0 +1,34 @@
+//go:build !linux
+
+package test
+
+import (
+	"RenewCMS/internal/domain/update"
+	infraUpdate "RenewCMS/internal/infrastructure/update"
+	"errors"
+	"testing"
+)
+
+func TestNoFollowFilesystemStubRefuses(t *testing.T) {
+	files := infraUpdate.NewNoFollowFilesystem()
+
+	_, lstatErr := files.Lstat("x")
+	_, readErr := files.ReadFile("x")
+	_, tempErr := files.MakePrivateTempDir()
+
+	for name, err := range map[string]error{
+		"lstat":     lstatErr,
+		"read":      readErr,
+		"tempdir":   tempErr,
+		"create":    files.CreateExclusive("x", nil, 0o600),
+		"copy":      files.Copy("x", "y", 0o600),
+		"rename":    files.Rename("x", "y"),
+		"remove":    files.Remove("x"),
+		"removeAll": files.RemoveAll("x"),
+		"chmod":     files.Chmod("x", 0o600),
+	} {
+		if !errors.Is(err, update.ErrHelperUnsupported) {
+			t.Errorf("%s = %v", name, err)
+		}
+	}
+}

test/update_helper_test.go

@@ -0,0 +1,913 @@
+package test
+
+import (
+	"RenewCMS/internal/domain/update"
+	infraUpdate "RenewCMS/internal/infrastructure/update"
+	"RenewCMS/internal/infrastructure/useCases"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+const (
+	helperData      = "/var/lib/renewcms"
+	helperBinary    = "/opt/renewcms/renewcms"
+	helperBinaryDir = "/opt/renewcms"
+	helperOld       = "v2.2.0-beta"
+	helperSentinel  = "sentinel bytes that must never change"
+)
+
+var (
+	helperMarker     = helperData + "/" + update.RestartRequestFileName
+	helperResult     = helperData + "/" + update.ResultFileName
+	helperResultTmp  = helperResult + ".tmp"
+	helperUpdatesDir = helperData + "/" + update.UpdatesDirName
+	helperStagedDir  = helperUpdatesDir + "/" + downloadTag
+	helperAsset      = update.AssetName(downloadTag, update.Platform{OS: "linux", Arch: "amd64"})
+)
+
+type fsVerifier struct {
+	files  *fakeHelperFS
+	key    ed25519.PublicKey
+	events *[]string
+}
+
+var _ update.SignatureVerifier = &fsVerifier{}
+
+func (v *fsVerifier) Verify(checksumsPath string, signaturePath string) error {
+	*v.events = append(*v.events, "verify "+checksumsPath)
+	checksums, found := v.files.content(checksumsPath)
+	if !found {
+		return errors.New("checksums missing")
+	}
+	rawSignature, found := v.files.content(signaturePath)
+	if !found {
+		return errors.New("signature missing")
+	}
+	signature, err := base64.StdEncoding.DecodeString(strings.TrimSpace(rawSignature))
+	if err != nil || !ed25519.Verify(v.key, []byte(checksums), signature) {
+		return errors.New("signature mismatch")
+	}
+	return nil
+}
+
+type helperRig struct {
+	t            *testing.T
+	fs           *fakeHelperFS
+	running      *fakeRunningInfoStore
+	clock        *fakeClock
+	service      *fakeServiceControl
+	health       *fakeHealthChecker
+	logger       *fakeUpdateLogger
+	events       []string
+	public       ed25519.PublicKey
+	private      ed25519.PrivateKey
+	newBinary    string
+	bootVersions []string
+	oldInfo      update.RunningInfo
+	usecase      *useCases.ApplyRestartRequestUseCase
+}
+
+func newHelperRig(t *testing.T) *helperRig {
+	t.Helper()
+	public, private, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rig := &helperRig{
+		t:            t,
+		fs:           newFakeHelperFS(),
+		running:      &fakeRunningInfoStore{},
+		clock:        &fakeClock{now: restartBaseTime},
+		health:       &fakeHealthChecker{healthy: true},
+		logger:       &fakeUpdateLogger{},
+		public:       public,
+		private:      private,
+		newBinary:    "new binary bytes 2.3.0",
+		bootVersions: []string{downloadTag, helperOld},
+		oldInfo:      update.RunningInfo{Version: helperOld, Pid: 100, StartedAt: restartBaseTime.Add(-time.Hour)},
+	}
+	rig.fs.events = &rig.events
+	rig.fs.putFile(helperBinary, "old")
+	rig.fs.putDir(helperData)
+	rig.running.set(rig.oldInfo)
+	rig.service = &fakeServiceControl{clock: rig.clock, failOn: map[int]error{}, events: &rig.events}
+	rig.service.onRestart = func(call int) {
+		version := rig.bootVersions[min(call, len(rig.bootVersions))-1]
+		rig.running.set(update.RunningInfo{Version: version, Pid: 200 + call, StartedAt: rig.clock.Now().Add(time.Second)})
+	}
+	rig.usecase = rig.build()
+	return rig
+}
+
+func (r *helperRig) build() *useCases.ApplyRestartRequestUseCase {
+	return useCases.NewApplyRestartRequestUseCase(useCases.ApplyRestartRequestDependencies{
+		Requests: infraUpdate.NewFSRestartRequestStore(r.fs, helperMarker),
+		Results:  infraUpdate.NewFSResultStore(r.fs, helperResult),
+		Running:  r.running,
+		Files:    r.fs,
+		Service:  r.service,
+		Health:   r.health,
+		Verifier: &fsVerifier{files: r.fs, key: r.public, events: &r.events},
+		Clock:    r.clock,
+		Logger:   r.logger,
+		Layout:   update.HelperLayout{DataDir: helperData, BinaryPath: helperBinary},
+		Platform: update.Platform{OS: "linux", Arch: "amd64"},
+	})
+}
+
+func (r *helperRig) checksumsFor(binary string) string {
+	return update.SHA256Hex([]byte(binary)) + "  " + helperAsset + "\n"
+}
+
+func (r *helperRig) sign(checksums string, key ed25519.PrivateKey) string {
+	return base64.StdEncoding.EncodeToString(ed25519.Sign(key, []byte(checksums))) + "\n"
+}
+
+func (r *helperRig) stage() {
+	checksums := r.checksumsFor(r.newBinary)
+	r.fs.putFile(helperStagedDir+"/"+helperAsset, r.newBinary)
+	r.fs.putFile(helperStagedDir+"/checksums.txt", checksums)
+	r.fs.putFile(helperStagedDir+"/checksums.txt.sig", r.sign(checksums, r.private))
+}
+
+func (r *helperRig) markUpdate(tag string) {
+	r.writeMarker(update.RestartRequest{Kind: update.RestartKindUpdate, Tag: tag, RequestedAt: restartBaseTime, RequestedBy: 1})
+}
+
+func (r *helperRig) markRestart() {
+	r.bootVersions = []string{helperOld, helperOld}
+	r.writeMarker(update.RestartRequest{Kind: update.RestartKindRestart, RequestedAt: restartBaseTime, RequestedBy: 1})
+}
+
+func (r *helperRig) writeMarker(request update.RestartRequest) {
+	content, _ := json.Marshal(request)
+	r.fs.putFile(helperMarker, string(content))
+}
+
+func (r *helperRig) apply() error {
+	r.t.Helper()
+	return r.usecase.Apply()
+}
+
+func (r *helperRig) result() update.Result {
+	r.t.Helper()
+	content, found := r.fs.content(helperResult)
+	if !found {
+		r.t.Fatal("update-result.json was not written")
+	}
+	var result update.Result
+	if err := json.Unmarshal([]byte(content), &result); err != nil {
+		r.t.Fatalf("result is not json: %v", err)
+	}
+	return result
+}
+
+func (r *helperRig) outcomes() []string {
+	var outcomes []string
+	for _, content := range r.fs.history[helperResult] {
+		var result update.Result
+		_ = json.Unmarshal([]byte(content), &result)
+		outcomes = append(outcomes, result.Outcome)
+	}
+	return outcomes
+}
+
+func (r *helperRig) assertBinary(want string) {
+	r.t.Helper()
+	if content, _ := r.fs.content(helperBinary); content != want {
+		r.t.Errorf("binary = %q, want %q", content, want)
+	}
+}
+
+func (r *helperRig) assertUntouched() {
+	r.t.Helper()
+	r.assertBinary("old")
+	if r.fs.exists(helperBinary + ".previous") {
+		r.t.Error("no .previous may be written")
+	}
+	if r.service.restartCount() != 0 {
+		r.t.Errorf("restarts = %d, want 0", r.service.restartCount())
+	}
+}
+
+func (r *helperRig) assertOutsideUntouched(sentinelPaths ...string) {
+	r.t.Helper()
+	if outside := r.fs.resolvedOutside(helperData, helperBinaryDir, "/tmp"); len(outside) != 0 {
+		r.t.Errorf("operations reached outside the allowed directories: %v", outside)
+	}
+	for _, target := range sentinelPaths {
+		if content, _ := r.fs.content(target); content != helperSentinel {
+			r.t.Errorf("%s changed: %q", target, content)
+		}
+	}
+}
+
+func (r *helperRig) assertCleaned() {
+	r.t.Helper()
+	if r.fs.exists(helperStagedDir) {
+		r.t.Error("the staged directory must be removed")
+	}
+	for name := range r.fs.nodes {
+		if strings.HasPrefix(name, "/tmp/renewcms-update-") {
+			r.t.Errorf("the temp directory must be removed, found %s", name)
+		}
+	}
+}
+
+func assertInOrder(t *testing.T, events []string, wants ...string) {
+	t.Helper()
+	position := 0
+	for _, want := range wants {
+		found := false
+		for ; position < len(events); position++ {
+			if strings.HasPrefix(events[position], want) {
+				found = true
+				position++
+				break
+			}
+		}
+		if !found {
+			t.Fatalf("%q is missing or out of order in:\n%s", want, strings.Join(events, "\n"))
+		}
+	}
+}
+
+func TestApplyPlainRestart(t *testing.T) {
+	t.Run("apply-update, a plain restart", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.markRestart()
+		rig.fs.putFile(helperStagedDir+"/keep", "staged")
+
+		if err := rig.apply(); err != nil {
+			t.Fatal(err)
+		}
+
+		assertInOrder(t, rig.events, "lstat "+helperMarker, "read "+helperMarker, "remove "+helperMarker, "create "+helperResultTmp, "restart", "create "+helperResultTmp)
+		if got := rig.outcomes(); len(got) != 2 || got[0] != "running" || got[1] != "succeeded" {
+			t.Errorf("outcomes = %v", got)
+		}
+		result := rig.result()
+		if result.Kind != "restart" || result.FinishedAt == nil || result.FromVersion != helperOld || !result.StartedAt.Equal(restartBaseTime) {
+			t.Errorf("result = %+v", result)
+		}
+		if rig.service.restartCount() != 1 || rig.fs.exists(helperBinary+".previous") {
+			t.Error("one restart, no write next to the binary")
+		}
+		rig.assertBinary("old")
+		if content, _ := rig.fs.content(helperStagedDir + "/keep"); content != "staged" {
+			t.Error("the staged files must be untouched")
+		}
+		if rig.fs.exists(helperMarker) {
+			t.Error("the marker must be deleted")
+		}
+	})
+
+	t.Run("no marker means nothing to do", func(t *testing.T) {
+		rig := newHelperRig(t)
+
+		if err := rig.apply(); err != nil || rig.fs.exists(helperResult) || rig.service.restartCount() != 0 {
+			t.Errorf("err = %v", err)
+		}
+	})
+
+	t.Run("a corrupt marker or an unknown kind fails without restarting", func(t *testing.T) {
+		for name, content := range map[string]string{"corrupt": "{nope", "unknown kind": `{"kind":"reboot","requested_at":"2026-09-30T09:50:00Z"}`} {
+			t.Run(name, func(t *testing.T) {
+				rig := newHelperRig(t)
+				rig.fs.putFile(helperMarker, content)
+
+				err := rig.apply()
+
+				if err != nil || rig.result().Outcome != "failed" || rig.service.restartCount() != 0 || rig.fs.exists(helperMarker) {
+					t.Errorf("err = %v, result = %+v", err, rig.result())
+				}
+			})
+		}
+	})
+}
+
+func TestApplyStaleRunningInfo(t *testing.T) {
+	staleRows := map[string]struct {
+		kind  string
+		boots func(rig *helperRig, call int)
+	}{
+		"still holds the old pid and old started_at": {"restart", func(rig *helperRig, call int) {}},
+		"holds the target version but the old pid and an old started_at": {"update", func(rig *helperRig, call int) {
+			rig.running.set(update.RunningInfo{Version: downloadTag, Pid: rig.oldInfo.Pid, StartedAt: rig.oldInfo.StartedAt})
+		}},
+		"is missing": {"restart", func(rig *helperRig, call int) { rig.running.unreadable() }},
+		"is corrupt": {"restart", func(rig *helperRig, call int) { rig.running.unreadable() }},
+		"holds the old version with a new pid (for an update)": {"update", func(rig *helperRig, call int) {
+			rig.running.set(update.RunningInfo{Version: helperOld, Pid: 300, StartedAt: rig.clock.Now().Add(time.Second)})
+		}},
+	}
+	for name, row := range staleRows {
+		t.Run("A stale running file never counts as success: "+name, func(t *testing.T) {
+			rig := newHelperRig(t)
+			if row.kind == "update" {
+				rig.stage()
+				rig.markUpdate(downloadTag)
+			} else {
+				rig.markRestart()
+			}
+			rig.service.onRestart = func(call int) {
+				if call == 1 {
+					row.boots(rig, call)
+					return
+				}
+				rig.running.set(update.RunningInfo{Version: helperOld, Pid: 500, StartedAt: rig.clock.Now().Add(time.Second)})
+			}
+
+			err := rig.apply()
+
+			result := rig.result()
+			first := rig.service.restarts[0]
+			if row.kind == "restart" {
+				if err == nil || result.Outcome != "failed" || rig.service.restartCount() != 1 {
+					t.Errorf("err = %v, result = %+v", err, result)
+				}
+				if rig.clock.Now().Sub(first) < update.RestartWindow {
+					t.Errorf("gave up after %v", rig.clock.Now().Sub(first))
+				}
+				return
+			}
+			if result.Outcome != "rolled_back" || rig.service.restartCount() != 2 {
+				t.Fatalf("result = %+v, restarts = %d", result, rig.service.restartCount())
+			}
+			if rig.service.restarts[1].Sub(first) < update.RestartWindow {
+				t.Errorf("rolled back after %v, before the 60 s window", rig.service.restarts[1].Sub(first))
+			}
+		})
+	}
+
+	t.Run("a file with the same pid but a later started_at counts as new", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.markRestart()
+		rig.service.onRestart = func(int) {
+			rig.running.set(update.RunningInfo{Version: helperOld, Pid: rig.oldInfo.Pid, StartedAt: rig.clock.Now().Add(time.Second)})
+		}
+
+		if err := rig.apply(); err != nil || rig.result().Outcome != "succeeded" || rig.clock.sleeps != 0 {
+			t.Errorf("err = %v, outcome = %v, sleeps = %d", err, rig.result().Outcome, rig.clock.sleeps)
+		}
+	})
+
+	t.Run("success needs a healthy answer too", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.markRestart()
+		rig.health.healthy = false
+
+		err := rig.apply()
+
+		if err == nil || rig.result().Outcome != "failed" {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+	})
+}
+
+func TestApplyUpdate(t *testing.T) {
+	t.Run("apply-update, an update, happy path", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		temp := "/tmp/renewcms-update-1"
+
+		if err := rig.apply(); err != nil {
+			t.Fatal(err)
+		}
+
+		assertInOrder(t, rig.events,
+			"read "+helperMarker, "remove "+helperMarker, "create "+helperResultTmp,
+			"lstat "+helperStagedDir+"/"+helperAsset, "tempdir",
+			"copy "+helperStagedDir+"/"+helperAsset, "copy "+helperStagedDir+"/checksums.txt", "copy "+helperStagedDir+"/checksums.txt.sig",
+			"verify "+temp+"/checksums.txt", "read "+temp+"/checksums.txt", "read "+temp+"/"+helperAsset,
+			"copy "+helperBinary, "rename "+helperBinary+".previous.tmp",
+			"copy "+temp+"/"+helperAsset, "read "+helperBinary+".new", "chmod "+helperBinary+".new", "rename "+helperBinary+".new",
+			"restart", "create "+helperResultTmp, "removeall "+temp, "removeall "+helperStagedDir)
+		rig.assertBinary(rig.newBinary)
+		if previous, _ := rig.fs.content(helperBinary + ".previous"); previous != "old" {
+			t.Errorf(".previous = %q", previous)
+		}
+		if rig.fs.mode(helperBinary) != 0o755 || rig.fs.mode(temp) != 0 {
+			t.Errorf("binary mode = %o, temp directory must be gone", rig.fs.mode(helperBinary))
+		}
+		if rig.clock.sleeps != 0 || rig.service.restartCount() != 1 {
+			t.Errorf("success must be declared on the first matching poll: sleeps = %d", rig.clock.sleeps)
+		}
+		result := rig.result()
+		if result.Outcome != "succeeded" || result.Kind != "update" || result.Tag != downloadTag || result.FromVersion != helperOld {
+			t.Errorf("result = %+v", result)
+		}
+		rig.assertCleaned()
+		rig.assertOutsideUntouched()
+		if rig.fs.exists(helperBinary+".new") || rig.fs.exists(helperBinary+".previous.tmp") {
+			t.Error("no temp file may be left next to the binary")
+		}
+	})
+
+	t.Run("the verified copy lives in a private temp directory", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.fs.after("read", 4, func(f *fakeHelperFS) {
+			if f.mode("/tmp/renewcms-update-1") != 0o700 || f.nodes["/tmp/renewcms-update-1"].owner != "root" {
+				t.Errorf("temp directory mode = %o owner = %s", f.mode("/tmp/renewcms-update-1"), f.nodes["/tmp/renewcms-update-1"].owner)
+			}
+		})
+
+		_ = rig.apply()
+	})
+
+	t.Run("apply-update refuses an untrusted staged binary", func(t *testing.T) {
+		faults := map[string]struct {
+			mutate func(*helperRig)
+			reason string
+		}{
+			"the binary was changed after the job verified it": {func(r *helperRig) { r.fs.putFile(helperStagedDir+"/"+helperAsset, "tampered") }, "sha-256 mismatch"},
+			"checksums.txt was changed": {func(r *helperRig) {
+				r.fs.putFile(helperStagedDir+"/checksums.txt", r.checksumsFor("tampered"))
+			}, "signature"},
+			"the signature is from a different key": {func(r *helperRig) {
+				_, other, _ := ed25519.GenerateKey(rand.Reader)
+				r.fs.putFile(helperStagedDir+"/checksums.txt.sig", r.sign(r.checksumsFor(r.newBinary), other))
+			}, "signature"},
+			"the signature is missing": {func(r *helperRig) { delete(r.fs.nodes, helperStagedDir+"/checksums.txt.sig") }, "checksums.txt.sig"},
+			"checksums.txt has no line for the asset": {func(r *helperRig) {
+				checksums := update.SHA256Hex([]byte("x")) + "  something_else\n"
+				r.fs.putFile(helperStagedDir+"/checksums.txt", checksums)
+				r.fs.putFile(helperStagedDir+"/checksums.txt.sig", r.sign(checksums, r.private))
+			}, "no line"},
+			"the staged binary is missing": {func(r *helperRig) { delete(r.fs.nodes, helperStagedDir+"/"+helperAsset) }, helperAsset},
+		}
+		for name, fault := range faults {
+			t.Run(name, func(t *testing.T) {
+				rig := newHelperRig(t)
+				rig.stage()
+				rig.markUpdate(downloadTag)
+				fault.mutate(rig)
+
+				err := rig.apply()
+
+				if err != nil || rig.result().Outcome != "failed" {
+					t.Errorf("err = %v, result = %+v", err, rig.result())
+				}
+				rig.assertUntouched()
+				rig.assertCleaned()
+				if !strings.Contains(rig.logger.text(), fault.reason) {
+					t.Errorf("the log must carry the reason %q: %s", fault.reason, rig.logger.text())
+				}
+				if raw, _ := rig.fs.content(helperResult); strings.Contains(raw, "mismatch") || strings.Contains(raw, helperData) {
+					t.Errorf("the technical reason must stay out of the result file: %s", raw)
+				}
+			})
+		}
+	})
+}
+
+func TestApplyRefusesSymlinks(t *testing.T) {
+	const outside = "/outside"
+	type row struct {
+		setup func(*helperRig)
+		link  string
+		keep  []string
+	}
+	rows := map[string]row{
+		"the marker itself is a symlink": {func(r *helperRig) {
+			r.fs.putFile(outside+"/secret", helperSentinel)
+			r.fs.putSymlink(helperMarker, outside+"/secret")
+		}, helperMarker, []string{outside + "/secret"}},
+		"<data>/updates is a symlink to another directory": {func(r *helperRig) {
+			r.fs.putDir(outside + "/updates/" + downloadTag)
+			r.fs.putFile(outside+"/updates/"+downloadTag+"/"+helperAsset, helperSentinel)
+			r.fs.putFile(outside+"/updates/"+downloadTag+"/checksums.txt", helperSentinel)
+			r.fs.putFile(outside+"/updates/"+downloadTag+"/checksums.txt.sig", helperSentinel)
+			r.forget(helperUpdatesDir)
+			r.fs.putSymlink(helperUpdatesDir, outside+"/updates")
+		}, helperUpdatesDir, []string{outside + "/updates/" + downloadTag + "/" + helperAsset}},
+		"<data>/updates/<tag> is a symlink to another directory": {func(r *helperRig) {
+			r.fs.putFile(outside+"/tag/"+helperAsset, helperSentinel)
+			r.fs.putFile(outside+"/tag/checksums.txt", helperSentinel)
+			r.fs.putFile(outside+"/tag/checksums.txt.sig", helperSentinel)
+			r.forget(helperStagedDir)
+			r.fs.putSymlink(helperStagedDir, outside+"/tag")
+		}, helperStagedDir, []string{outside + "/tag/" + helperAsset, outside + "/tag/checksums.txt"}},
+		"the staged binary is a symlink to /usr/bin/something": {func(r *helperRig) {
+			r.fs.putFile("/usr/bin/something", helperSentinel)
+			delete(r.fs.nodes, helperStagedDir+"/"+helperAsset)
+			r.fs.putSymlink(helperStagedDir+"/"+helperAsset, "/usr/bin/something")
+		}, helperStagedDir + "/" + helperAsset, []string{"/usr/bin/something"}},
+		"checksums.txt is a symlink": {func(r *helperRig) {
+			r.fs.putFile(outside+"/c", helperSentinel)
+			delete(r.fs.nodes, helperStagedDir+"/checksums.txt")
+			r.fs.putSymlink(helperStagedDir+"/checksums.txt", outside+"/c")
+		}, helperStagedDir + "/checksums.txt", []string{outside + "/c"}},
+		"checksums.txt.sig is a symlink": {func(r *helperRig) {
+			r.fs.putFile(outside+"/s", helperSentinel)
+			delete(r.fs.nodes, helperStagedDir+"/checksums.txt.sig")
+			r.fs.putSymlink(helperStagedDir+"/checksums.txt.sig", outside+"/s")
+		}, helperStagedDir + "/checksums.txt.sig", []string{outside + "/s"}},
+		"a symlink is placed at the result path": {func(r *helperRig) {
+			r.fs.putFile(outside+"/result-target", helperSentinel)
+			r.fs.putSymlink(helperResult, outside+"/result-target")
+		}, helperResult, []string{outside + "/result-target"}},
+		"a symlink is placed at a temp file name": {func(r *helperRig) {
+			r.fs.putFile(outside+"/tmp-target", helperSentinel)
+			r.fs.putSymlink(helperResultTmp, outside+"/tmp-target")
+		}, helperResultTmp, []string{outside + "/tmp-target"}},
+	}
+	for name, tc := range rows {
+		t.Run("apply-update refuses symlinks: "+name, func(t *testing.T) {
+			rig := newHelperRig(t)
+			rig.stage()
+			rig.markUpdate(downloadTag)
+			tc.setup(rig)
+
+			err := rig.apply()
+
+			if err != nil || rig.result().Outcome != "failed" {
+				t.Errorf("err = %v, result = %+v", err, rig.result())
+			}
+			rig.assertUntouched()
+			rig.assertOutsideUntouched(tc.keep...)
+			if !strings.Contains(rig.logger.text(), tc.link) {
+				t.Errorf("the log must name %s: %s", tc.link, rig.logger.text())
+			}
+			if node := rig.fs.nodes[helperResult]; node == nil || node.kind != "file" {
+				t.Error("the result must be a regular file written next to the link, not through it")
+			}
+			if len(rig.fs.touched("read", "copy")) > 0 {
+				for _, operation := range rig.fs.touched("read", "copy") {
+					if strings.HasPrefix(operation.resolved, outside) || strings.HasPrefix(operation.resolved, "/usr") {
+						t.Errorf("read through a link: %+v", operation)
+					}
+				}
+			}
+		})
+	}
+
+	t.Run("A symlinked marker is removed, not followed", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.fs.putFile(outside+"/secret", helperSentinel)
+		rig.fs.putSymlink(helperMarker, outside+"/secret")
+
+		err := rig.apply()
+
+		if err != nil || rig.fs.exists(helperMarker) || rig.result().Outcome != "failed" {
+			t.Errorf("err = %v, marker present = %v", err, rig.fs.exists(helperMarker))
+		}
+		if content, _ := rig.fs.content(outside + "/secret"); content != helperSentinel {
+			t.Error("the target must be intact")
+		}
+	})
+
+	t.Run("a link found in the staged directory is unlinked, not followed, when cleaning", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.fs.putFile(outside+"/tag/"+helperAsset, helperSentinel)
+		rig.forget(helperStagedDir)
+		rig.fs.putSymlink(helperStagedDir, outside+"/tag")
+
+		_ = rig.apply()
+
+		if rig.fs.exists(helperStagedDir) {
+			t.Error("the link itself may be removed")
+		}
+		if content, _ := rig.fs.content(outside + "/tag/" + helperAsset); content != helperSentinel {
+			t.Error("the target must be intact")
+		}
+	})
+}
+
+func (r *helperRig) forget(prefix string) {
+	for name := range r.fs.nodes {
+		if name == prefix || strings.HasPrefix(name, prefix+"/") {
+			delete(r.fs.nodes, name)
+		}
+	}
+}
+
+func TestApplySwapIsRaceFree(t *testing.T) {
+	t.Run("A file swapped after verification is not installed", func(t *testing.T) {
+		swapAfter := map[string]struct {
+			operation string
+			call      int
+		}{
+			"the copy step":              {"copy", 3},
+			"the signature check":        {"read", 2},
+			"the hash check":             {"read", 3},
+			"the .previous copy":         {"copy", 4},
+			"the final copy and install": {"copy", 5},
+		}
+		for name, point := range swapAfter {
+			t.Run(name, func(t *testing.T) {
+				rig := newHelperRig(t)
+				rig.stage()
+				rig.markUpdate(downloadTag)
+				rig.fs.after(point.operation, point.call, func(f *fakeHelperFS) {
+					f.putFile(helperStagedDir+"/"+helperAsset, "attacker bytes")
+				})
+
+				err := rig.apply()
+
+				if err != nil {
+					t.Fatal(err)
+				}
+				rig.assertBinary(rig.newBinary)
+				if rig.result().Outcome != "succeeded" {
+					t.Errorf("result = %+v", rig.result())
+				}
+			})
+		}
+	})
+
+	t.Run("a swap of the temp file in the binary's directory before the rename is caught by the re-hash", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.fs.after("copy", 5, func(f *fakeHelperFS) {
+			f.putFile(helperBinary+".new", "attacker bytes in the temp file")
+		})
+
+		err := rig.apply()
+
+		if err != nil || rig.result().Outcome != "failed" {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+		rig.assertBinary("old")
+		if rig.service.restartCount() != 0 || rig.fs.exists(helperBinary+".new") {
+			t.Error("no restart and the temp file must be removed")
+		}
+	})
+}
+
+func TestApplyResultWrites(t *testing.T) {
+	t.Run("Result and temp files are written without following links", func(t *testing.T) {
+		files := newFakeHelperFS()
+		files.putFile("/outside/a", helperSentinel)
+		files.putFile("/outside/b", helperSentinel)
+		files.putDir(helperData)
+		files.putSymlink(helperResult, "/outside/a")
+		files.putSymlink(helperResultTmp, "/outside/b")
+		store := infraUpdate.NewFSResultStore(files, helperResult)
+
+		err := store.Write(update.Result{Outcome: update.OutcomeFailed, Kind: "update", StartedAt: restartBaseTime, FinishedAt: finishedAt(restartBaseTime)})
+
+		if err != nil {
+			t.Fatal(err)
+		}
+		if a, _ := files.content("/outside/a"); a != helperSentinel {
+			t.Error("the result link target must be untouched")
+		}
+		if b, _ := files.content("/outside/b"); b != helperSentinel {
+			t.Error("the temp link target must be untouched")
+		}
+		if node := files.nodes[helperResult]; node == nil || node.kind != "file" || node.mode != 0o644 {
+			t.Errorf("result node = %+v", node)
+		}
+		if got, found := store.Read(); !found || got.Outcome != update.OutcomeFailed {
+			t.Errorf("read back = %+v, %v", got, found)
+		}
+		assertInOrder(t, files.eventsFrom(), "lstat", "remove", "create", "rename")
+	})
+}
+
+func (f *fakeHelperFS) eventsFrom() []string {
+	names := make([]string, 0, len(f.ops))
+	for _, operation := range f.ops {
+		names = append(names, operation.name+" "+operation.path)
+	}
+	return names
+}
+
+func TestApplyDistrustsTheMarker(t *testing.T) {
+	tags := map[string]string{
+		"../../etc/passwd":                     "../../etc/passwd",
+		"v2.3.0-beta/../../x":                  "v2.3.0-beta/../../x",
+		"an empty string":                      "",
+		"v2.1.0-beta (older than the running)": "v2.1.0-beta",
+		"not-a-version":                        "not-a-version",
+		"the running version itself":           helperOld,
+	}
+	for name, tag := range tags {
+		t.Run("apply-update distrusts the marker: "+name, func(t *testing.T) {
+			rig := newHelperRig(t)
+			rig.stage()
+			rig.fs.putFile("/var/lib/renewcms/etc/passwd", helperSentinel)
+			rig.markUpdate(tag)
+
+			err := rig.apply()
+
+			if err != nil || rig.result().Outcome != "failed" {
+				t.Errorf("err = %v, result = %+v", err, rig.result())
+			}
+			rig.assertUntouched()
+			rig.assertOutsideUntouched()
+			for _, operation := range rig.fs.ops {
+				if strings.Contains(operation.path, "..") || strings.Contains(operation.path, "passwd") || strings.HasPrefix(operation.path, helperUpdatesDir) {
+					t.Errorf("a distrusted tag reached the filesystem: %+v", operation)
+				}
+			}
+			if !rig.fs.exists(helperStagedDir + "/" + helperAsset) {
+				t.Error("staged files of another tag must be left alone")
+			}
+		})
+	}
+}
+
+func TestApplyRollsBack(t *testing.T) {
+	faults := map[string]func(*helperRig){
+		"/healthz never answers within 60 s": func(r *helperRig) {
+			r.health.healthy = false
+			r.service.onRestart = func(call int) {
+				if call == 2 {
+					r.health.healthy = true
+				}
+				r.running.set(update.RunningInfo{Version: r.bootVersions[call-1], Pid: 200 + call, StartedAt: r.clock.Now().Add(time.Second)})
+			}
+		},
+		"/healthz answers but update-running.json stays old": func(r *helperRig) {
+			r.service.onRestart = func(call int) {
+				if call == 2 {
+					r.running.set(update.RunningInfo{Version: helperOld, Pid: 300, StartedAt: r.clock.Now().Add(time.Second)})
+				}
+			}
+		},
+		"update-running.json holds another version": func(r *helperRig) {
+			r.service.onRestart = func(call int) {
+				version := "v9.9.9"
+				if call == 2 {
+					version = helperOld
+				}
+				r.running.set(update.RunningInfo{Version: version, Pid: 200 + call, StartedAt: r.clock.Now().Add(time.Second)})
+			}
+		},
+		"the service restart command fails": func(r *helperRig) {
+			r.service.failOn[1] = errors.New("systemctl restart renewcms: exit status 1")
+		},
+	}
+	for name, fault := range faults {
+		t.Run("apply-update rolls back when the new version does not come up: "+name, func(t *testing.T) {
+			rig := newHelperRig(t)
+			rig.stage()
+			rig.markUpdate(downloadTag)
+			fault(rig)
+
+			err := rig.apply()
+
+			if err != nil {
+				t.Fatalf("a rollback that worked is not an error: %v", err)
+			}
+			rig.assertBinary("old")
+			if rig.service.restartCount() != 2 {
+				t.Fatalf("restarts = %d", rig.service.restartCount())
+			}
+			if name != "the service restart command fails" && rig.service.restarts[1].Sub(rig.service.restarts[0]) < update.RestartWindow {
+				t.Errorf("rolled back after %v", rig.service.restarts[1].Sub(rig.service.restarts[0]))
+			}
+			assertInOrder(t, rig.events, "rename "+helperBinary+".new", "restart", "copy "+helperBinary+".previous", "rename "+helperBinary+".restore", "restart")
+			result := rig.result()
+			if result.Outcome != "rolled_back" || result.FromVersion != helperOld || result.Tag != downloadTag || result.FinishedAt == nil {
+				t.Errorf("result = %+v", result)
+			}
+			rig.assertCleaned()
+			if rig.fs.exists(helperBinary + ".restore") {
+				t.Error("no restore temp file may be left")
+			}
+		})
+	}
+}
+
+func TestApplySwapFailures(t *testing.T) {
+	t.Run("copying to .previous fails", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.fs.failNth("copy", 4, errors.New("no space left on device"))
+
+		err := rig.apply()
+
+		if err != nil || rig.result().Outcome != "failed" {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+		rig.assertUntouched()
+	})
+
+	t.Run("the atomic install fails", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.fs.failNth("rename", 3, errors.New("text file busy"))
+
+		err := rig.apply()
+
+		if err != nil || rig.result().Outcome != "failed" || rig.service.restartCount() != 0 {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+		rig.assertBinary("old")
+		if previous, _ := rig.fs.content(helperBinary + ".previous"); previous != "old" {
+			t.Errorf(".previous = %q", previous)
+		}
+		if rig.fs.exists(helperBinary + ".new") {
+			t.Error("the temp file must be removed")
+		}
+	})
+
+	t.Run("the rollback restore itself fails", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.service.failOn[1] = errors.New("restart failed")
+		rig.fs.failNth("copy", 6, errors.New("input/output error"))
+
+		err := rig.apply()
+
+		if err == nil || rig.result().Outcome != "failed" || rig.service.restartCount() != 1 {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+		if !strings.Contains(rig.logger.text(), "the site may be down") {
+			t.Errorf("the failure must be logged loudly: %s", rig.logger.text())
+		}
+	})
+
+	t.Run("the old version never returns after rollback", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.service.onRestart = func(call int) {
+			if call == 1 {
+				rig.running.set(update.RunningInfo{Version: "v9.9.9", Pid: 201, StartedAt: rig.clock.Now().Add(time.Second)})
+			}
+		}
+
+		err := rig.apply()
+
+		if err == nil || rig.result().Outcome != "failed" || rig.service.restartCount() != 2 {
+			t.Errorf("err = %v, result = %+v", err, rig.result())
+		}
+	})
+}
+
+func TestApplyAlwaysWritesAResult(t *testing.T) {
+	t.Run("a panic in the helper still leaves a failed result", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.stage()
+		rig.markUpdate(downloadTag)
+		rig.service.panicOn = 1
+
+		err := rig.apply()
+
+		result := rig.result()
+		if err == nil || result.Outcome != "failed" || result.FinishedAt == nil || result.Kind != "update" || result.Tag != downloadTag || result.FromVersion != helperOld {
+			t.Errorf("err = %v, result = %+v", err, result)
+		}
+		assertInOrder(t, rig.events, "create "+helperResultTmp, "rename "+helperResultTmp, "restart", "create "+helperResultTmp)
+	})
+
+	t.Run("a running record exists before the first service call and every write is a temp file plus a rename", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.markRestart()
+		var seenBeforeRestart []string
+		rig.service.onRestart = func(call int) {
+			seenBeforeRestart = append([]string(nil), rig.outcomes()...)
+			rig.running.set(update.RunningInfo{Version: helperOld, Pid: 300, StartedAt: rig.clock.Now().Add(time.Second)})
+		}
+
+		_ = rig.apply()
+
+		if len(seenBeforeRestart) != 1 || seenBeforeRestart[0] != "running" {
+			t.Errorf("outcomes before the restart = %v", seenBeforeRestart)
+		}
+		creates := rig.fs.operationCount("create")
+		renames := len(rig.fs.history[helperResult])
+		if creates != renames || creates != 2 {
+			t.Errorf("creates = %d, renames = %d", creates, renames)
+		}
+	})
+
+	t.Run("timestamps come from the clock and finished is not before started", func(t *testing.T) {
+		rig := newHelperRig(t)
+		rig.markRestart()
+		rig.clock.onSleep = func(sleeps int) {
+			if sleeps == 3 {
+				rig.running.set(update.RunningInfo{Version: helperOld, Pid: 300, StartedAt: rig.clock.Now().Add(time.Second)})
+			}
+		}
+		rig.service.onRestart = func(int) {}
+
+		if err := rig.apply(); err != nil {
+			t.Fatal(err)
+		}
+
+		result := rig.result()
+		if !result.StartedAt.Equal(restartBaseTime) || result.FinishedAt == nil || !result.FinishedAt.Equal(restartBaseTime.Add(3*time.Second)) || result.FinishedAt.Before(result.StartedAt) {
+			t.Errorf("result = %+v", result)
+		}
+	})
+}

test/update_http_test.go

@@ -28,7 +28,7 @@ const (
 	updateRunning         = "v2.2.0-beta"
 )
 
-var updateStatusKeys = []string{"available", "can_apply", "checked_at", "current", "error", "latest", "notes", "progress", "release_url", "started_at", "state"}
+var updateStatusKeys = []string{"available", "can_apply", "checked_at", "current", "error", "finished_at", "latest", "notes", "progress", "release_url", "started_at", "state"}
 
 type updateHarness struct {
 	router http.Handler
@@ -63,7 +63,7 @@ func newUpdateHarness(t *testing.T, running string) *updateHarness {
 	container := &api.UseCases{
 		Token:                  token,
 		GetUserUseCase:         useCases.NewGetUserUseCase(users),
-		GetUpdateStatusUseCase: useCases.NewGetUpdateStatusUseCase(store, &fakeJobStore{}, &fakeHelperDetector{}, running),
+		GetUpdateStatusUseCase: newUpdateStatusUseCase(store, &fakeJobStore{}, &fakeHelperDetector{}, running),
 		CheckForUpdateUseCase:  useCases.NewCheckForUpdateUseCase(feed, store, running, now),
 	}
 	return &updateHarness{router: api.NewSystemRouter(container), token: token, feed: feed, store: store}
@@ -137,8 +137,8 @@ func TestUpdateStatusHTTP(t *testing.T) {
 		if body["release_url"] != h.store.result.ReleaseURL || body["checked_at"] != "2026-09-30T09:41:00Z" {
 			t.Errorf("release_url = %v, checked_at = %v", body["release_url"], body["checked_at"])
 		}
-		if body["progress"] != nil || body["error"] != nil || body["started_at"] != nil {
-			t.Errorf("progress, error and started_at must be null: %v", body)
+		if body["progress"] != nil || body["error"] != nil || body["started_at"] != nil || body["finished_at"] != nil {
+			t.Errorf("progress, error, started_at and finished_at must be null: %v", body)
 		}
 		notes := body["notes"].(map[string]any)
 		if notes["version"] != "v2.3.0-beta" || len(notes["items"].([]any)) != 1 || notes["released_at"] != "2026-09-24T08:00:00Z" {
@@ -159,7 +159,7 @@ func TestUpdateStatusHTTP(t *testing.T) {
 		if rec.Code != http.StatusOK || body["available"] != false || body["latest"] != "" || body["state"] != "idle" {
 			t.Errorf("status = %d body = %v", rec.Code, body)
 		}
-		for _, key := range []string{"release_url", "notes", "checked_at", "progress", "error", "started_at"} {
+		for _, key := range []string{"release_url", "notes", "checked_at", "progress", "error", "started_at", "finished_at"} {
 			if body[key] != nil {
 				t.Errorf("%s = %v, want null", key, body[key])
 			}
@@ -313,12 +313,4 @@ func TestUpdateCheckHTTP(t *testing.T) {
 		}
 	})
 
-	t.Run("restart is not mounted", func(t *testing.T) {
-		h := newUpdateHarness(t, updateRunning)
-		for _, path := range []string{"/update/restart"} {
-			if rec := h.sendAs(t, http.MethodPost, path, updateOwnerId); rec.Code != http.StatusNotFound && rec.Code != http.StatusMethodNotAllowed {
-				t.Errorf("%s status = %d", path, rec.Code)
-			}
-		}
-	})
 }

test/update_restart_fakes_test.go

@@ -0,0 +1,592 @@
+package test
+
+import (
+	"RenewCMS/internal/domain/update"
+	"RenewCMS/internal/infrastructure/useCases"
+	"errors"
+	"io/fs"
+	"path"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+func newUpdateStatusUseCase(store update.StatusStore, jobs update.JobStore, helper update.HelperDetector, running string) *useCases.GetUpdateStatusUseCase {
+	return useCases.NewGetUpdateStatusUseCase(store, jobs, helper, &fakeResultStore{}, &fakeRestartRequestStore{}, running, time.Now)
+}
+
+type fakeRestartRequestStore struct {
+	mu       sync.Mutex
+	request  update.RestartRequest
+	present  bool
+	corrupt  bool
+	writeErr error
+	writes   int
+	deletes  int
+}
+
+var _ update.RestartRequestStore = &fakeRestartRequestStore{}
+
+func (f *fakeRestartRequestStore) Write(request update.RestartRequest) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.writeErr != nil {
+		return f.writeErr
+	}
+	f.request = request
+	f.present = true
+	f.writes++
+	return nil
+}
+
+func (f *fakeRestartRequestStore) Read() (update.RestartRequest, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.corrupt {
+		return update.RestartRequest{}, errors.New("corrupt marker")
+	}
+	if !f.present {
+		return update.RestartRequest{}, update.ErrNoRestartRequest
+	}
+	return f.request, nil
+}
+
+func (f *fakeRestartRequestStore) Delete() error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.present = false
+	f.deletes++
+	return nil
+}
+
+type fakeResultStore struct {
+	mu       sync.Mutex
+	result   update.Result
+	found    bool
+	writeErr error
+	writes   []update.Result
+	deletes  int
+}
+
+var _ update.ResultStore = &fakeResultStore{}
+
+func (f *fakeResultStore) Read() (update.Result, bool) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.result, f.found
+}
+
+func (f *fakeResultStore) Write(result update.Result) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.writeErr != nil {
+		return f.writeErr
+	}
+	f.result = result
+	f.found = true
+	f.writes = append(f.writes, result)
+	return nil
+}
+
+func (f *fakeResultStore) Delete() error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.found = false
+	f.result = update.Result{}
+	f.deletes++
+	return nil
+}
+
+type fakeRunningInfoStore struct {
+	mu       sync.Mutex
+	info     update.RunningInfo
+	found    bool
+	writeErr error
+	writes   []update.RunningInfo
+}
+
+var _ update.RunningInfoStore = &fakeRunningInfoStore{}
+
+func (f *fakeRunningInfoStore) Write(info update.RunningInfo) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.writeErr != nil {
+		return f.writeErr
+	}
+	f.info = info
+	f.found = true
+	f.writes = append(f.writes, info)
+	return nil
+}
+
+func (f *fakeRunningInfoStore) Read() (update.RunningInfo, bool) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.info, f.found
+}
+
+func (f *fakeRunningInfoStore) set(info update.RunningInfo) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.info = info
+	f.found = true
+}
+
+func (f *fakeRunningInfoStore) unreadable() {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.info = update.RunningInfo{}
+	f.found = false
+}
+
+type fakeClock struct {
+	mu      sync.Mutex
+	now     time.Time
+	sleeps  int
+	onSleep func(sleeps int)
+}
+
+var _ update.Clock = &fakeClock{}
+
+func (f *fakeClock) Now() time.Time {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.now
+}
+
+func (f *fakeClock) Sleep(duration time.Duration) {
+	f.mu.Lock()
+	f.now = f.now.Add(duration)
+	f.sleeps++
+	sleeps, hook := f.sleeps, f.onSleep
+	f.mu.Unlock()
+	if hook != nil {
+		hook(sleeps)
+	}
+}
+
+func (f *fakeClock) advance(duration time.Duration) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.now = f.now.Add(duration)
+}
+
+type fakeServiceControl struct {
+	mu        sync.Mutex
+	restarts  []time.Time
+	clock     *fakeClock
+	failOn    map[int]error
+	panicOn   int
+	onRestart func(call int)
+	events    *[]string
+}
+
+var _ update.ServiceControl = &fakeServiceControl{}
+
+func (f *fakeServiceControl) Restart() error {
+	f.mu.Lock()
+	f.restarts = append(f.restarts, f.clock.Now())
+	call := len(f.restarts)
+	failure := f.failOn[call]
+	shouldPanic := f.panicOn == call
+	hook := f.onRestart
+	f.mu.Unlock()
+	if f.events != nil {
+		*f.events = append(*f.events, "restart")
+	}
+	if shouldPanic {
+		panic("service control exploded")
+	}
+	if failure != nil {
+		return failure
+	}
+	if hook != nil {
+		hook(call)
+	}
+	return nil
+}
+
+func (f *fakeServiceControl) Status() (bool, error) {
+	return true, nil
+}
+
+func (f *fakeServiceControl) restartCount() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.restarts)
+}
+
+type fakeHealthChecker struct {
+	mu      sync.Mutex
+	healthy bool
+	asked   int
+}
+
+var _ update.HealthChecker = &fakeHealthChecker{}
+
+func (f *fakeHealthChecker) Healthy() bool {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.asked++
+	return f.healthy
+}
+
+type fsNode struct {
+	kind    string
+	content []byte
+	mode    uint32
+	target  string
+	owner   string
+}
+
+type fsOperation struct {
+	name     string
+	path     string
+	resolved string
+}
+
+var errFakeLoop = errors.New("too many levels of symbolic links")
+
+type fakeHelperFS struct {
+	mu       sync.Mutex
+	nodes    map[string]*fsNode
+	ops      []fsOperation
+	counts   map[string]int
+	failures map[string]map[int]error
+	hooks    map[string]map[int]func(*fakeHelperFS)
+	tempDirs int
+	events   *[]string
+	history  map[string][]string
+}
+
+var _ update.HelperFilesystem = &fakeHelperFS{}
+
+func newFakeHelperFS() *fakeHelperFS {
+	f := &fakeHelperFS{
+		nodes:    map[string]*fsNode{"/": {kind: "dir", mode: 0o755, owner: "root"}},
+		counts:   map[string]int{},
+		failures: map[string]map[int]error{},
+		hooks:    map[string]map[int]func(*fakeHelperFS){},
+		history:  map[string][]string{},
+	}
+	return f
+}
+
+func (f *fakeHelperFS) failNth(operation string, call int, err error) {
+	if f.failures[operation] == nil {
+		f.failures[operation] = map[int]error{}
+	}
+	f.failures[operation][call] = err
+}
+
+func (f *fakeHelperFS) after(operation string, call int, mutate func(*fakeHelperFS)) {
+	if f.hooks[operation] == nil {
+		f.hooks[operation] = map[int]func(*fakeHelperFS){}
+	}
+	f.hooks[operation][call] = mutate
+}
+
+func (f *fakeHelperFS) putDir(target string) {
+	target = path.Clean(target)
+	for current := target; current != "/"; current = path.Dir(current) {
+		if _, found := f.nodes[current]; !found {
+			f.nodes[current] = &fsNode{kind: "dir", mode: 0o755, owner: "app"}
+		}
+	}
+}
+
+func (f *fakeHelperFS) putFile(target string, content string) {
+	target = path.Clean(target)
+	f.putDir(path.Dir(target))
+	f.nodes[target] = &fsNode{kind: "file", content: []byte(content), mode: 0o644, owner: "app"}
+}
+
+func (f *fakeHelperFS) putSymlink(target string, destination string) {
+	target = path.Clean(target)
+	f.putDir(path.Dir(target))
+	f.nodes[target] = &fsNode{kind: "symlink", target: destination, owner: "app"}
+}
+
+func (f *fakeHelperFS) content(target string) (string, bool) {
+	node, found := f.nodes[path.Clean(target)]
+	if !found || node.kind != "file" {
+		return "", false
+	}
+	return string(node.content), true
+}
+
+func (f *fakeHelperFS) exists(target string) bool {
+	_, found := f.nodes[path.Clean(target)]
+	return found
+}
+
+func (f *fakeHelperFS) mode(target string) uint32 {
+	if node, found := f.nodes[path.Clean(target)]; found {
+		return node.mode
+	}
+	return 0
+}
+
+func (f *fakeHelperFS) resolve(target string, followFinal bool) (string, error) {
+	return f.resolveDepth(path.Clean(target), followFinal, 0)
+}
+
+func (f *fakeHelperFS) resolveDepth(target string, followFinal bool, depth int) (string, error) {
+	if depth > 8 {
+		return "", errFakeLoop
+	}
+	parts := strings.Split(strings.Trim(target, "/"), "/")
+	current := "/"
+	for index, part := range parts {
+		if part == "" {
+			continue
+		}
+		next := path.Join(current, part)
+		node, found := f.nodes[next]
+		last := index == len(parts)-1
+		if found && node.kind == "symlink" && (!last || followFinal) {
+			resolved, err := f.resolveDepth(node.target, true, depth+1)
+			if err != nil {
+				return "", err
+			}
+			current = resolved
+			continue
+		}
+		current = next
+	}
+	return current, nil
+}
+
+func (f *fakeHelperFS) begin(operation string, target string, followFinal bool) (string, error) {
+	f.counts[operation]++
+	resolved, err := f.resolve(target, followFinal)
+	f.ops = append(f.ops, fsOperation{name: operation, path: target, resolved: resolved})
+	if f.events != nil {
+		*f.events = append(*f.events, operation+" "+target)
+	}
+	if failure := f.failures[operation][f.counts[operation]]; failure != nil {
+		return resolved, failure
+	}
+	return resolved, err
+}
+
+func (f *fakeHelperFS) end(operation string) {
+	if hook := f.hooks[operation][f.counts[operation]]; hook != nil {
+		hook(f)
+	}
+}
+
+func missing(operation string, target string) error {
+	return &fs.PathError{Op: operation, Path: target, Err: fs.ErrNotExist}
+}
+
+func (f *fakeHelperFS) Lstat(target string) (update.FileInfo, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("lstat")
+	resolved, err := f.begin("lstat", target, false)
+	if err != nil {
+		return update.FileInfo{}, err
+	}
+	node, found := f.nodes[resolved]
+	if !found {
+		return update.FileInfo{}, missing("lstat", target)
+	}
+	return update.FileInfo{IsSymlink: node.kind == "symlink", IsDir: node.kind == "dir", IsRegular: node.kind == "file"}, nil
+}
+
+func (f *fakeHelperFS) ReadFile(target string) ([]byte, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("read")
+	resolved, err := f.begin("read", target, false)
+	if err != nil {
+		return nil, err
+	}
+	node, found := f.nodes[resolved]
+	if !found {
+		return nil, missing("read", target)
+	}
+	if node.kind == "symlink" {
+		return nil, errFakeLoop
+	}
+	if node.kind != "file" {
+		return nil, errors.New("is a directory")
+	}
+	return append([]byte(nil), node.content...), nil
+}
+
+func (f *fakeHelperFS) createNode(operation string, target string, content []byte, mode uint32) error {
+	resolved, err := f.begin(operation, target, false)
+	if err != nil {
+		return err
+	}
+	if _, found := f.nodes[resolved]; found {
+		return &fs.PathError{Op: operation, Path: target, Err: fs.ErrExist}
+	}
+	parent, found := f.nodes[path.Dir(resolved)]
+	if !found || parent.kind != "dir" {
+		return missing(operation, target)
+	}
+	f.nodes[resolved] = &fsNode{kind: "file", content: content, mode: mode, owner: "root"}
+	return nil
+}
+
+func (f *fakeHelperFS) CreateExclusive(target string, content []byte, mode uint32) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("create")
+	return f.createNode("create", target, append([]byte(nil), content...), mode)
+}
+
+func (f *fakeHelperFS) Copy(source string, destination string, mode uint32) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("copy")
+	resolved, err := f.begin("copy", source, false)
+	if err != nil {
+		return err
+	}
+	node, found := f.nodes[resolved]
+	if !found {
+		return missing("copy", source)
+	}
+	if node.kind == "symlink" {
+		return errFakeLoop
+	}
+	if node.kind != "file" {
+		return errors.New("not a regular file")
+	}
+	f.ops = append(f.ops, fsOperation{name: "copy-to", path: destination})
+	return f.createNode("copy-to", destination, append([]byte(nil), node.content...), mode)
+}
+
+func (f *fakeHelperFS) Rename(oldPath string, newPath string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("rename")
+	from, err := f.begin("rename", oldPath, false)
+	if err != nil {
+		return err
+	}
+	to, err := f.resolve(newPath, false)
+	if err != nil {
+		return err
+	}
+	node, found := f.nodes[from]
+	if !found {
+		return missing("rename", oldPath)
+	}
+	if existing, found := f.nodes[to]; found && existing.kind == "dir" {
+		return errors.New("is a directory")
+	}
+	f.ops = append(f.ops, fsOperation{name: "rename-to", path: newPath, resolved: to})
+	f.nodes[to] = node
+	delete(f.nodes, from)
+	f.history[to] = append(f.history[to], string(node.content))
+	return nil
+}
+
+func (f *fakeHelperFS) Remove(target string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("remove")
+	resolved, err := f.begin("remove", target, false)
+	if err != nil {
+		return err
+	}
+	if _, found := f.nodes[resolved]; !found {
+		return missing("remove", target)
+	}
+	delete(f.nodes, resolved)
+	return nil
+}
+
+func (f *fakeHelperFS) RemoveAll(target string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("removeall")
+	resolved, err := f.begin("removeall", target, false)
+	if err != nil {
+		return err
+	}
+	prefix := resolved + "/"
+	for name := range f.nodes {
+		if name == resolved || strings.HasPrefix(name, prefix) {
+			delete(f.nodes, name)
+		}
+	}
+	return nil
+}
+
+func (f *fakeHelperFS) Chmod(target string, mode uint32) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("chmod")
+	resolved, err := f.begin("chmod", target, false)
+	if err != nil {
+		return err
+	}
+	node, found := f.nodes[resolved]
+	if !found {
+		return missing("chmod", target)
+	}
+	if node.kind == "symlink" {
+		return errFakeLoop
+	}
+	node.mode = mode
+	return nil
+}
+
+func (f *fakeHelperFS) MakePrivateTempDir() (string, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	defer f.end("tempdir")
+	f.tempDirs++
+	directory := "/tmp/renewcms-update-" + string(rune('0'+f.tempDirs))
+	if _, err := f.begin("tempdir", directory, false); err != nil {
+		return "", err
+	}
+	f.nodes["/tmp"] = &fsNode{kind: "dir", mode: 0o1777, owner: "root"}
+	f.nodes[directory] = &fsNode{kind: "dir", mode: 0o700, owner: "root"}
+	return directory, nil
+}
+
+func (f *fakeHelperFS) touched(operations ...string) []fsOperation {
+	wanted := map[string]bool{}
+	for _, name := range operations {
+		wanted[name] = true
+	}
+	var touched []fsOperation
+	for _, operation := range f.ops {
+		if wanted[operation.name] {
+			touched = append(touched, operation)
+		}
+	}
+	return touched
+}
+
+func (f *fakeHelperFS) resolvedOutside(allowed ...string) []string {
+	var outside []string
+	for _, operation := range f.ops {
+		if operation.resolved == "" {
+			continue
+		}
+		inside := false
+		for _, directory := range allowed {
+			if operation.resolved == directory || strings.HasPrefix(operation.resolved, directory+"/") {
+				inside = true
+			}
+		}
+		if !inside {
+			outside = append(outside, operation.name+" "+operation.resolved)
+		}
+	}
+	sort.Strings(outside)
+	return outside
+}
+
+func (f *fakeHelperFS) operationCount(name string) int {
+	return f.counts[name]
+}

test/update_restart_http_test.go

@@ -0,0 +1,623 @@
+package test
+
+import (
+	"RenewCMS/api"
+	"RenewCMS/api/pkg/apperr"
+	validator "RenewCMS/api/pkg/validator"
+	"RenewCMS/internal/domain/update"
+	"RenewCMS/internal/infrastructure/config"
+	infraUpdate "RenewCMS/internal/infrastructure/update"
+	"RenewCMS/internal/infrastructure/useCases"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/go-chi/jwtauth/v5"
+)
+
+const restartPath = "/update/restart"
+
+type restartHTTP struct {
+	router      http.Handler
+	token       *jwtauth.JWTAuth
+	dataDir     string
+	markerPath  string
+	resultPath  string
+	store       *fakeUpdateStore
+	jobs        *fakeJobStore
+	helper      *fakeHelperDetector
+	clock       *fakeClock
+	markers     update.RestartRequestStore
+	resultFiles update.ResultStore
+}
+
+func newRestartHTTP(t *testing.T) *restartHTTP {
+	t.Helper()
+	validator.InitValidator()
+	dataDir := t.TempDir()
+	h := &restartHTTP{
+		token:      jwtauth.New("HS256", []byte("test-secret"), nil),
+		dataDir:    dataDir,
+		markerPath: filepath.Join(dataDir, update.RestartRequestFileName),
+		resultPath: filepath.Join(dataDir, update.ResultFileName),
+		store:      &fakeUpdateStore{result: newStoredUpdateResult(), found: true},
+		jobs:       &fakeJobStore{},
+		helper:     &fakeHelperDetector{installed: true},
+		clock:      &fakeClock{now: restartBaseTime},
+	}
+	h.markers = infraUpdate.NewJSONRestartRequestStore(h.markerPath)
+	h.resultFiles = infraUpdate.NewJSONResultStore(h.resultPath)
+	container := &api.UseCases{
+		Token:          h.token,
+		GetUserUseCase: useCases.NewGetUserUseCase(newUpdateUserRepo()),
+		GetUpdateStatusUseCase: useCases.NewGetUpdateStatusUseCase(
+			h.store, h.jobs, h.helper, h.resultFiles, h.markers, updateRunning, h.clock.Now),
+		RequestRestartUseCase: useCases.NewRequestRestartUseCase(
+			h.store, h.jobs, h.helper, h.resultFiles, h.markers, updateRunning, h.clock.Now),
+	}
+	h.router = api.NewSystemRouter(container)
+	return h
+}
+
+func (h *restartHTTP) readyJob() {
+	h.jobs.put(update.Job{Tag: downloadTag, State: update.StateReady, StartedAt: restartBaseTime.Add(-time.Hour)})
+}
+
+func (h *restartHTTP) post(t *testing.T, userId uint32, tokenVersion uint32, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	return h.request(t, http.MethodPost, restartPath, userId, tokenVersion, body)
+}
+
+func (h *restartHTTP) postAsOwner(t *testing.T, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	return h.post(t, updateOwnerId, 2, body)
+}
+
+func (h *restartHTTP) request(t *testing.T, method string, target string, userId uint32, tokenVersion uint32, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(method, target, strings.NewReader(body))
+	if userId != 0 {
+		_, tokenString, err := h.token.Encode(map[string]any{"user_id": userId, "token_version": tokenVersion})
+		if err != nil {
+			t.Fatal(err)
+		}
+		req.AddCookie(&http.Cookie{Name: "jwt", Value: tokenString})
+	}
+	rec := httptest.NewRecorder()
+	h.router.ServeHTTP(rec, req)
+	return rec
+}
+
+func (h *restartHTTP) getAs(t *testing.T, userId uint32) *httptest.ResponseRecorder {
+	t.Helper()
+	tokenVersion := uint32(0)
+	if userId == updateOwnerId {
+		tokenVersion = 2
+	}
+	return h.request(t, http.MethodGet, "/update", userId, tokenVersion, "")
+}
+
+func (h *restartHTTP) markerBytes() ([]byte, bool) {
+	content, err := os.ReadFile(h.markerPath)
+	return content, err == nil
+}
+
+func (h *restartHTTP) seedResult(t *testing.T, result update.Result) {
+	t.Helper()
+	if err := h.resultFiles.Write(result); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func (h *restartHTTP) assertNoMarkerAndResultKept(t *testing.T, resultKept bool) {
+	t.Helper()
+	if _, found := h.markerBytes(); found {
+		t.Error("no marker may be written")
+	}
+	if _, found := h.resultFiles.Read(); found != resultKept {
+		t.Errorf("result present = %v, want %v", found, resultKept)
+	}
+}
+
+func TestRestartHTTP(t *testing.T) {
+	t.Run("Request an update restart, happy path", func(t *testing.T) {
+		for name, body := range map[string]string{"no body": "", "kind update": `{"kind":"update"}`} {
+			t.Run(name, func(t *testing.T) {
+				h := newRestartHTTP(t)
+				h.readyJob()
+				h.seedResult(t, update.Result{Outcome: update.OutcomeRolledBack, Kind: update.RestartKindUpdate, Tag: downloadTag, StartedAt: restartBaseTime.Add(-time.Hour), FinishedAt: finishedAt(restartBaseTime.Add(-time.Hour))})
+
+				rec := h.postAsOwner(t, body)
+
+				if rec.Code != http.StatusAccepted {
+					t.Fatalf("status = %d: %s", rec.Code, rec.Body.String())
+				}
+				status := decodeUpdateBody(t, rec)
+				assertUpdateKeys(t, status)
+				if status["state"] != "restarting" || status["started_at"] != "2026-09-30T09:50:00Z" || status["error"] != nil || status["finished_at"] != nil {
+					t.Errorf("status = %v", status)
+				}
+				marker, err := h.markers.Read()
+				if err != nil || marker.Kind != "update" || marker.Tag != downloadTag || marker.RequestedBy != updateOwnerId || !marker.RequestedAt.Equal(restartBaseTime) {
+					t.Errorf("marker = %+v, err = %v", marker, err)
+				}
+				if _, found := h.resultFiles.Read(); found {
+					t.Error("update-result.json must be deleted first")
+				}
+				entries, _ := os.ReadDir(h.dataDir)
+				if len(entries) != 1 {
+					t.Errorf("only the marker may exist in the data directory, got %d entries", len(entries))
+				}
+				asAdmin := decodeUpdateBody(t, h.getAs(t, updateAdminId))
+				if asAdmin["state"] != "restarting" || asAdmin["can_apply"] != false {
+					t.Errorf("admin view = %v", asAdmin)
+				}
+			})
+		}
+	})
+
+	t.Run("Request a plain restart", func(t *testing.T) {
+		for name, body := range map[string]string{"no body": "", "kind restart": `{"kind":"restart"}`, "empty object": `{}`} {
+			t.Run(name, func(t *testing.T) {
+				h := newRestartHTTP(t)
+
+				rec := h.postAsOwner(t, body)
+
+				marker, err := h.markers.Read()
+				if rec.Code != http.StatusAccepted || err != nil || marker.Kind != "restart" || marker.Tag != "" {
+					t.Fatalf("status = %d, marker = %+v, err = %v", rec.Code, marker, err)
+				}
+				if decodeUpdateBody(t, h.getAs(t, updateOwnerId))["state"] != "restarting" {
+					t.Error("GET must report restarting")
+				}
+			})
+		}
+	})
+
+	t.Run("The kind must match the state", func(t *testing.T) {
+		cases := []struct {
+			name    string
+			prepare func(*restartHTTP)
+			kind    string
+		}{
+			{"no job ready (idle) with update", func(*restartHTTP) {}, "update"},
+			{"a job failed with update", func(h *restartHTTP) {
+				h.jobs.put(update.Job{Tag: downloadTag, State: update.StateFailed, Error: "download"})
+			}, "update"},
+			{"a job ready with restart", func(h *restartHTTP) { h.readyJob() }, "restart"},
+		}
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				h := newRestartHTTP(t)
+				h.seedResult(t, update.Result{Outcome: update.OutcomeFailed, StartedAt: restartBaseTime, FinishedAt: finishedAt(restartBaseTime)})
+				tc.prepare(h)
+				jobBefore, _ := h.jobs.Load()
+
+				rec := h.postAsOwner(t, `{"kind":"`+tc.kind+`"}`)
+
+				jobAfter, _ := h.jobs.Load()
+				if rec.Code != http.StatusConflict || jobAfter != jobBefore {
+					t.Errorf("status = %d", rec.Code)
+				}
+				h.assertNoMarkerAndResultKept(t, true)
+			})
+		}
+	})
+
+	t.Run("Restart site never installs an update another owner just made ready", func(t *testing.T) {
+		h := newRestartHTTP(t)
+		h.readyJob()
+
+		rec := h.postAsOwner(t, `{"kind":"restart"}`)
+
+		if rec.Code != http.StatusConflict {
+			t.Fatalf("status = %d", rec.Code)
+		}
+		h.assertNoMarkerAndResultKept(t, false)
+		if job, found := h.jobs.Load(); !found || job.State != update.StateReady {
+			t.Error("the ready job must stay ready")
+		}
+		if decodeUpdateBody(t, h.getAs(t, updateOwnerId))["state"] != "ready" {
+			t.Error("the card must read Ready to install after the reload")
+		}
+	})
+
+	t.Run("A bad body is a 400", func(t *testing.T) {
+		for _, body := range []string{`{"kind":"upgrade"}`, `{"kind":""}`, `{"kind":7}`, `{"kind":"update"`, `not json`} {
+			t.Run(body, func(t *testing.T) {
+				h := newRestartHTTP(t)
+				h.readyJob()
+				h.seedResult(t, update.Result{Outcome: update.OutcomeFailed})
+
+				rec := h.postAsOwner(t, body)
+
+				if rec.Code != http.StatusBadRequest || rec.Body.String() != apperr.BodyErrorMessage+"\n" {
+					t.Errorf("status = %d body = %q", rec.Code, rec.Body.String())
+				}
+				h.assertNoMarkerAndResultKept(t, true)
+			})
+		}
+	})
+
+	t.Run("POST is guarded like the other system routes", func(t *testing.T) {
+		cases := []struct {
+			name         string
+			userId       uint32
+			tokenVersion uint32
+			status       int
+			body         string
+		}{
+			{"no jwt cookie", 0, 0, http.StatusUnauthorized, ""},
+			{"a stale token version", updateOwnerId, 1, http.StatusUnauthorized, apperr.UnauthorizedErrorMessage + "\n"},
+			{"an unverified owner", updateUnverifiedOwner, 0, http.StatusForbidden, apperr.VerificationRequiredErrorMessage + "\n"},
+			{"an admin", updateAdminId, 0, http.StatusForbidden, apperr.OwnerRequiredErrorMessage + "\n"},
+			{"an admin with a bad body", updateAdminId, 0, http.StatusForbidden, apperr.OwnerRequiredErrorMessage + "\n"},
+		}
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				h := newRestartHTTP(t)
+				h.seedResult(t, update.Result{Outcome: update.OutcomeFailed})
+				body := ""
+				if strings.Contains(tc.name, "bad body") {
+					body = "not json"
+				}
+
+				rec := h.post(t, tc.userId, tc.tokenVersion, body)
+
+				if rec.Code != tc.status || (tc.body != "" && rec.Body.String() != tc.body) {
+					t.Errorf("status = %d body = %q", rec.Code, rec.Body.String())
+				}
+				h.assertNoMarkerAndResultKept(t, true)
+			})
+		}
+	})
+
+	t.Run("The checks run in the documented order", func(t *testing.T) {
+		h := newRestartHTTP(t)
+		h.helper.installed = false
+
+		if rec := h.postAsOwner(t, "not json"); rec.Code != http.StatusBadRequest {
+			t.Errorf("a bad body with can_apply off = %d, want 400", rec.Code)
+		}
+		if rec := h.postAsOwner(t, `{"kind":"update"}`); rec.Code != http.StatusConflict {
+			t.Errorf("can_apply off with a mismatching kind = %d, want 409", rec.Code)
+		}
+	})
+
+	t.Run("Restart is refused with 409", func(t *testing.T) {
+		cases := []struct {
+			name    string
+			prepare func(*restartHTTP, *testing.T)
+		}{
+			{"can_apply is false (no update-helper.json)", func(h *restartHTTP, _ *testing.T) { h.helper.installed = false }},
+			{"the job state is downloading", func(h *restartHTTP, _ *testing.T) {
+				h.jobs.put(update.Job{Tag: downloadTag, State: update.StateDownloading})
+			}},
+			{"the job state is verifying", func(h *restartHTTP, _ *testing.T) {
+				h.jobs.put(update.Job{Tag: downloadTag, State: update.StateVerifying})
+			}},
+			{"a marker is already pending", func(h *restartHTTP, t *testing.T) {
+				if err := h.markers.Write(update.RestartRequest{Kind: "restart", RequestedAt: restartBaseTime, RequestedBy: 9}); err != nil {
+					t.Fatal(err)
+				}
+			}},
+			{"the result file reads running (helper at work)", func(h *restartHTTP, t *testing.T) {
+				h.seedResult(t, update.Result{Outcome: update.OutcomeRunning, Kind: "update", StartedAt: restartBaseTime.Add(-30 * time.Second)})
+			}},
+		}
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				h := newRestartHTTP(t)
+				tc.prepare(h, t)
+				markerBefore, markerExisted := h.markerBytes()
+				resultBefore, resultExisted := os.ReadFile(h.resultPath)
+
+				rec := h.postAsOwner(t, "")
+
+				markerAfter, markerExistsNow := h.markerBytes()
+				resultAfter, resultExistsNow := os.ReadFile(h.resultPath)
+				if rec.Code != http.StatusConflict {
+					t.Fatalf("status = %d", rec.Code)
+				}
+				if markerExisted != markerExistsNow || string(markerBefore) != string(markerAfter) || (resultExisted == nil) != (resultExistsNow == nil) || string(resultBefore) != string(resultAfter) {
+					t.Error("the existing marker and result must be untouched and no new marker written")
+				}
+			})
+		}
+	})
+
+	t.Run("Two restarts at once write one marker", func(t *testing.T) {
+		h := newRestartHTTP(t)
+		var wait sync.WaitGroup
+		codes := make([]int, 2)
+		for i, userId := range []uint32{updateOwnerId, updateSecondOwner} {
+			wait.Add(1)
+			go func() {
+				defer wait.Done()
+				tokenVersion := uint32(0)
+				if userId == updateOwnerId {
+					tokenVersion = 2
+				}
+				codes[i] = h.post(t, userId, tokenVersion, "").Code
+			}()
+		}
+		wait.Wait()
+
+		accepted, refused := 0, 0
+		for _, code := range codes {
+			switch code {
+			case http.StatusAccepted:
+				accepted++
+			case http.StatusConflict:
+				refused++
+			}
+		}
+		entries, _ := os.ReadDir(h.dataDir)
+		if accepted != 1 || refused != 1 || len(entries) != 1 {
+			t.Errorf("codes = %v, entries = %d", codes, len(entries))
+		}
+	})
+
+	t.Run("The marker cannot be written", func(t *testing.T) {
+		assertFailure := func(t *testing.T, h *restartHTTP) {
+			t.Helper()
+			jobBefore, _ := h.jobs.Load()
+			rec := h.postAsOwner(t, "")
+			jobAfter, _ := h.jobs.Load()
+			if rec.Code != http.StatusInternalServerError || rec.Body.String() != "Internal server error\n" {
+				t.Errorf("status = %d body = %q", rec.Code, rec.Body.String())
+			}
+			if strings.Contains(rec.Body.String(), h.dataDir) || jobAfter != jobBefore {
+				t.Error("no path may leak and the job record must not change")
+			}
+		}
+
+		t.Run("a directory sits where the marker goes", func(t *testing.T) {
+			h := newRestartHTTP(t)
+			h.readyJob()
+			if err := os.Mkdir(h.markerPath, 0o755); err != nil {
+				t.Fatal(err)
+			}
+			assertFailure(t, h)
+			if info, err := os.Stat(h.markerPath); err != nil || !info.IsDir() {
+				t.Error("the directory must stay")
+			}
+		})
+
+		t.Run("the data directory is not writable", func(t *testing.T) {
+			if runtime.GOOS == "windows" || os.Geteuid() == 0 {
+				t.Skip("directory permissions are not enforced here")
+			}
+			h := newRestartHTTP(t)
+			if err := os.Chmod(h.dataDir, 0o500); err != nil {
+				t.Fatal(err)
+			}
+			defer os.Chmod(h.dataDir, 0o700)
+			assertFailure(t, h)
+			if _, found := h.markerBytes(); found {
+				t.Error("no marker may exist")
+			}
+		})
+	})
+
+	t.Run("GET derives the state from the files and never changes them", func(t *testing.T) {
+		finished := restartBaseTime.Add(-10 * time.Second)
+		cases := []struct {
+			name     string
+			files    func(*restartHTTP, *testing.T)
+			state    string
+			errKind  any
+			finished any
+		}{
+			{"a marker is present", func(h *restartHTTP, t *testing.T) {
+				_ = h.markers.Write(update.RestartRequest{Kind: "restart", RequestedAt: restartBaseTime.Add(-time.Second)})
+			}, "restarting", nil, nil},
+			{"result running written 30 s ago", func(h *restartHTTP, t *testing.T) {
+				h.seedResult(t, update.Result{Outcome: "running", Kind: "update", Tag: downloadTag, StartedAt: restartBaseTime.Add(-30 * time.Second)})
+			}, "restarting", nil, nil},
+			{"result running written 6 minutes ago, no marker", func(h *restartHTTP, t *testing.T) {
+				h.seedResult(t, update.Result{Outcome: "running", Kind: "update", Tag: downloadTag, StartedAt: restartBaseTime.Add(-6 * time.Minute), FinishedAt: &finished})
+			}, "failed", "install", "2026-09-30T09:49:50Z"},
+			{"result succeeded, kind update, tag equal to the running version", func(h *restartHTTP, t *testing.T) {
+				h.seedResult(t, update.Result{Outcome: "succeeded", Kind: "update", Tag: updateRunning, StartedAt: restartBaseTime.Add(-time.Minute), FinishedAt: &finished})
+			}, "succeeded", nil, "2026-09-30T09:49:50Z"},
+			{"result succeeded, kind update, tag older than the running one", func(h *restartHTTP, t *testing.T) {
+				h.seedResult(t, update.Result{Outcome: "succeeded", Kind: "update", Tag: "v2.1.0-beta", StartedAt: restartBaseTime.Add(-time.Minute), FinishedAt: &finished})
+			}, "idle", nil, "2026-09-30T09:49:50Z"},
+			{"result succeeded, kind restart", func(h *restartHTTP, t *testing.T) {
+				h.seedResult(t, update.Result{Outcome: "succeeded", Kind: "restart", StartedAt: restartBaseTime.Add(-time.Minute), FinishedAt: &finished})
+			}, "idle", nil, "2026-09-30T09:49:50Z"},
+			{"result rolled_back", func(h *restartHTTP, t *testing.T) {
+				h.seedResult(t, update.Result{Outcome: "rolled_back", Kind: "update", Tag: downloadTag, StartedAt: restartBaseTime.Add(-time.Minute), FinishedAt: &finished})
+			}, "failed", "rolled_back", "2026-09-30T09:49:50Z"},
+			{"result failed", func(h *restartHTTP, t *testing.T) {
+				h.seedResult(t, update.Result{Outcome: "failed", Kind: "update", Tag: downloadTag, StartedAt: restartBaseTime.Add(-time.Minute), FinishedAt: &finished})
+			}, "failed", "install", "2026-09-30T09:49:50Z"},
+			{"no marker, no result", func(*restartHTTP, *testing.T) {}, "idle", nil, nil},
+			{"a corrupt result file", func(h *restartHTTP, t *testing.T) {
+				if err := os.WriteFile(h.resultPath, []byte("{not json"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			}, "idle", nil, nil},
+		}
+		for _, tc := range cases {
+			t.Run(tc.name, func(t *testing.T) {
+				h := newRestartHTTP(t)
+				tc.files(h, t)
+				before := snapshotDirectory(t, h.dataDir)
+
+				first := h.getAs(t, updateAdminId)
+				second := h.getAs(t, updateAdminId)
+
+				body := decodeUpdateBody(t, first)
+				assertUpdateKeys(t, body)
+				if first.Body.String() != second.Body.String() {
+					t.Error("two GETs must answer identically")
+				}
+				if body["state"] != tc.state || body["error"] != tc.errKind || body["finished_at"] != tc.finished {
+					t.Errorf("state = %v, error = %v, finished_at = %v", body["state"], body["error"], body["finished_at"])
+				}
+				if after := snapshotDirectory(t, h.dataDir); !equalSnapshots(before, after) {
+					t.Errorf("a GET changed the data directory: %v -> %v", before, after)
+				}
+			})
+		}
+	})
+
+	t.Run("After a successful update the status is consistent", func(t *testing.T) {
+		h := newRestartHTTP(t)
+		h.seedResult(t, update.Result{Outcome: "succeeded", Kind: "update", Tag: updateRunning, StartedAt: restartBaseTime.Add(-time.Minute), FinishedAt: finishedAt(restartBaseTime)})
+		h.store.result.Latest = updateRunning
+
+		body := decodeUpdateBody(t, h.getAs(t, updateOwnerId))
+
+		if body["state"] != "succeeded" || body["available"] != false || body["current"] != updateRunning || body["finished_at"] == nil {
+			t.Errorf("body = %v", body)
+		}
+	})
+}
+
+type directorySnapshot map[string]string
+
+func snapshotDirectory(t *testing.T, directory string) directorySnapshot {
+	t.Helper()
+	snapshot := directorySnapshot{}
+	entries, err := os.ReadDir(directory)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		info, _ := entry.Info()
+		content, _ := os.ReadFile(filepath.Join(directory, entry.Name()))
+		snapshot[entry.Name()] = string(content) + "|" + info.ModTime().String()
+	}
+	return snapshot
+}
+
+func equalSnapshots(a, b directorySnapshot) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for name, value := range a {
+		if b[name] != value {
+			return false
+		}
+	}
+	return true
+}
+
+func TestRestartResultLivesUntilTheNextJob(t *testing.T) {
+	t.Run("The result lives until the next job", func(t *testing.T) {
+		rig := newDownloadRig(t)
+		h := newDownloadHTTP(t, rig)
+		rig.results.put(update.Result{Outcome: update.OutcomeRolledBack, Kind: update.RestartKindUpdate, Tag: downloadTag, StartedAt: restartBaseTime, FinishedAt: finishedAt(restartBaseTime)})
+
+		before := decodeUpdateBody(t, h.sendAs(t, http.MethodGet, "/update", updateOwnerId))
+		rec := h.sendAs(t, http.MethodPost, downloadPath, updateOwnerId)
+		ready := waitForHTTPState(t, h, "ready", "failed")
+
+		if before["state"] != "failed" || before["error"] != "rolled_back" || before["finished_at"] == nil {
+			t.Errorf("before = %v", before)
+		}
+		if rec.Code != http.StatusAccepted || rig.results.deletes != 1 || rig.results.found {
+			t.Errorf("status = %d, deletes = %d", rec.Code, rig.results.deletes)
+		}
+		assertUpdateKeys(t, ready)
+		if ready["state"] != "ready" || ready["error"] != nil || ready["finished_at"] != nil {
+			t.Errorf("ready = %v", ready)
+		}
+	})
+
+	t.Run("A download is refused while a restart is pending", func(t *testing.T) {
+		rig := newDownloadRig(t)
+		h := newDownloadHTTP(t, rig)
+		rig.requests.present = true
+		rig.results.put(update.Result{Outcome: update.OutcomeRunning, StartedAt: restartBaseTime})
+
+		rec := h.sendAs(t, http.MethodPost, downloadPath, updateOwnerId)
+
+		if rec.Code != http.StatusConflict || rig.results.deletes != 0 || rig.fetcher.totalCalls() != 0 {
+			t.Errorf("status = %d", rec.Code)
+		}
+	})
+}
+
+func TestHealthzIsUnchanged(t *testing.T) {
+	t.Run("Healthz is unchanged", func(t *testing.T) {
+		container := &api.UseCases{Token: jwtauth.New("HS256", []byte("test-secret"), nil)}
+		router := api.InitRoutes(container, config.Settings{Environment: "production"})
+
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/healthz", nil))
+
+		if rec.Code != http.StatusOK || rec.Body.String() != "ok" {
+			t.Errorf("status = %d body = %q", rec.Code, rec.Body.String())
+		}
+		for name := range rec.Header() {
+			if strings.Contains(strings.ToLower(name), "version") {
+				t.Errorf("unexpected header %s", name)
+			}
+		}
+	})
+}
+
+func TestRunningInfoFileAtStartup(t *testing.T) {
+	t.Run("The server writes update-running.json at startup", func(t *testing.T) {
+		directory := t.TempDir()
+		path := filepath.Join(directory, update.RunningInfoFileName)
+		store := infraUpdate.NewJSONRunningInfoStore(path)
+		first := &fakeClock{now: restartBaseTime}
+
+		if err := useCases.NewRecordRunningInfoUseCase(store, "v2.3.0-beta", 111, first.Now).Record(); err != nil {
+			t.Fatal(err)
+		}
+		content, _ := os.ReadFile(path)
+		var written map[string]any
+		_ = json.Unmarshal(content, &written)
+		if written["version"] != "v2.3.0-beta" || written["pid"] != float64(111) || written["started_at"] != "2026-09-30T09:50:00Z" || len(written) != 3 {
+			t.Errorf("file = %s", content)
+		}
+
+		later := &fakeClock{now: restartBaseTime.Add(time.Minute)}
+		if err := useCases.NewRecordRunningInfoUseCase(store, "v2.3.0-beta", 222, later.Now).Record(); err != nil {
+			t.Fatal(err)
+		}
+		info, found := store.Read()
+		if !found || info.Pid != 222 || !info.StartedAt.Equal(later.now) {
+			t.Errorf("a second start must replace the file: %+v", info)
+		}
+		if entries, _ := os.ReadDir(directory); len(entries) != 1 {
+			t.Errorf("the temporary file must be renamed away, got %d entries", len(entries))
+		}
+	})
+
+	t.Run("a write error is returned and nothing panics", func(t *testing.T) {
+		store := infraUpdate.NewJSONRunningInfoStore(filepath.Join(t.TempDir(), "missing", update.RunningInfoFileName))
+
+		err := useCases.NewRecordRunningInfoUseCase(store, "v2.3.0-beta", 1, time.Now).Record()
+
+		if err == nil {
+			t.Error("the error must reach the startup code")
+		}
+	})
+
+	t.Run("the file is not served by any route", func(t *testing.T) {
+		container := &api.UseCases{Token: jwtauth.New("HS256", []byte("test-secret"), nil)}
+		router := api.InitRoutes(container, config.Settings{Environment: "production"})
+
+		for _, target := range []string{"/update-running.json", "/v1/update-running.json", "/static/uploadedImages/update-running.json"} {
+			rec := httptest.NewRecorder()
+			router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, target, nil))
+			if rec.Code == http.StatusOK && strings.Contains(rec.Body.String(), "pid") {
+				t.Errorf("%s served the file", target)
+			}
+		}
+	})
+}

test/update_restart_usecase_test.go

@@ -0,0 +1,317 @@
+package test
+
+import (
+	"RenewCMS/internal/domain/update"
+	"RenewCMS/internal/infrastructure/useCases"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+)
+
+var restartBaseTime = time.Date(2026, 9, 30, 9, 50, 0, 0, time.UTC)
+
+type restartRig struct {
+	store    *fakeUpdateStore
+	jobs     *fakeJobStore
+	helper   *fakeHelperDetector
+	results  *fakeResultStore
+	requests *fakeRestartRequestStore
+	clock    *fakeClock
+	request  *useCases.RequestRestartUseCase
+	status   *useCases.GetUpdateStatusUseCase
+}
+
+func newRestartRig(running string) *restartRig {
+	rig := &restartRig{
+		store:    &fakeUpdateStore{result: newStoredUpdateResult(), found: true},
+		jobs:     &fakeJobStore{},
+		helper:   &fakeHelperDetector{installed: true},
+		results:  &fakeResultStore{},
+		requests: &fakeRestartRequestStore{},
+		clock:    &fakeClock{now: restartBaseTime},
+	}
+	rig.request = useCases.NewRequestRestartUseCase(rig.store, rig.jobs, rig.helper, rig.results, rig.requests, running, rig.clock.Now)
+	rig.status = useCases.NewGetUpdateStatusUseCase(rig.store, rig.jobs, rig.helper, rig.results, rig.requests, running, rig.clock.Now)
+	return rig
+}
+
+func (r *restartRig) readyJob() {
+	r.jobs.put(update.Job{Tag: downloadTag, State: update.StateReady, StartedAt: restartBaseTime.Add(-time.Hour)})
+}
+
+func finishedAt(at time.Time) *time.Time {
+	return &at
+}
+
+func TestRequestRestartUseCase(t *testing.T) {
+	t.Run("a ready job gives an update marker with the tag and the requester", func(t *testing.T) {
+		rig := newRestartRig(updateRunning)
+		rig.readyJob()
+		rig.results.put(update.Result{Outcome: update.OutcomeRolledBack})
+
+		status, err := rig.request.Request(updateOwnerId, "")
+
+		if err != nil {
+			t.Fatal(err)
+		}
+		marker, markerErr := rig.requests.Read()
+		if markerErr != nil || marker.Kind != update.RestartKindUpdate || marker.Tag != downloadTag || marker.RequestedBy != updateOwnerId || !marker.RequestedAt.Equal(restartBaseTime) {
+			t.Errorf("marker = %+v, err = %v", marker, markerErr)
+		}
+		if status.State != update.StateRestarting || status.StartedAt == nil || !status.StartedAt.Equal(marker.RequestedAt) || !status.CanApply {
+			t.Errorf("status = %+v", status)
+		}
+		if rig.results.deletes != 1 || rig.results.found {
+			t.Errorf("the result must be deleted first: deletes = %d", rig.results.deletes)
+		}
+	})
+
+	t.Run("no ready job gives a plain restart marker without a tag", func(t *testing.T) {
+		for name, prepare := range map[string]func(*restartRig){
+			"idle": func(*restartRig) {},
+			"failed job": func(r *restartRig) {
+				r.jobs.put(update.Job{Tag: downloadTag, State: update.StateFailed, Error: "download"})
+			},
+			"rolled back": func(r *restartRig) {
+				r.results.put(update.Result{Outcome: update.OutcomeRolledBack, Kind: update.RestartKindUpdate})
+			},
+		} {
+			t.Run(name, func(t *testing.T) {
+				rig := newRestartRig(updateRunning)
+				prepare(rig)
+
+				status, err := rig.request.Request(updateOwnerId, update.RestartKindRestart)
+
+				marker, _ := rig.requests.Read()
+				if err != nil || marker.Kind != update.RestartKindRestart || marker.Tag != "" || status.State != update.StateRestarting {
+					t.Errorf("err = %v, marker = %+v, status = %+v", err, marker, status)
+				}
+			})
+		}
+	})
+
+	t.Run("a kind that does not match the state is refused and nothing changes", func(t *testing.T) {
+		cases := map[string]struct {
+			prepare func(*restartRig)
+			kind    string
+		}{
+			"update without a ready job": {func(*restartRig) {}, update.RestartKindUpdate},
+			"update after a failed job":  {func(r *restartRig) { r.jobs.put(update.Job{Tag: downloadTag, State: update.StateFailed}) }, update.RestartKindUpdate},
+			"restart with a ready job":   {func(r *restartRig) { r.readyJob() }, update.RestartKindRestart},
+		}
+		for name, tc := range cases {
+			t.Run(name, func(t *testing.T) {
+				rig := newRestartRig(updateRunning)
+				rig.results.put(update.Result{Outcome: update.OutcomeFailed})
+				tc.prepare(rig)
+				jobBefore, _ := rig.jobs.Load()
+
+				_, err := rig.request.Request(updateOwnerId, tc.kind)
+
+				if !errors.Is(err, update.ErrRestartKindMismatch) {
+					t.Fatalf("err = %v", err)
+				}
+				jobAfter, _ := rig.jobs.Load()
+				if rig.requests.writes != 0 || rig.results.deletes != 0 || !rig.results.found || jobAfter != jobBefore {
+					t.Error("nothing may change on a mismatch")
+				}
+			})
+		}
+	})
+
+	t.Run("a restart is refused while it cannot or must not run", func(t *testing.T) {
+		cases := map[string]struct {
+			prepare func(*restartRig)
+			want    error
+		}{
+			"no helper":      {func(r *restartRig) { r.helper.installed = false }, update.ErrNotPrepared},
+			"downloading":    {func(r *restartRig) { r.jobs.put(update.Job{State: update.StateDownloading}) }, update.ErrJobInProgress},
+			"verifying":      {func(r *restartRig) { r.jobs.put(update.Job{State: update.StateVerifying}) }, update.ErrJobInProgress},
+			"marker pending": {func(r *restartRig) { r.requests.present = true }, update.ErrRestartPending},
+			"helper at work": {func(r *restartRig) {
+				r.results.put(update.Result{Outcome: update.OutcomeRunning, StartedAt: restartBaseTime.Add(-time.Minute)})
+			}, update.ErrRestartPending},
+		}
+		for name, tc := range cases {
+			t.Run(name, func(t *testing.T) {
+				rig := newRestartRig(updateRunning)
+				tc.prepare(rig)
+				resultBefore, foundBefore := rig.results.Read()
+				writesBefore := rig.requests.writes
+
+				_, err := rig.request.Request(updateOwnerId, "")
+
+				resultAfter, foundAfter := rig.results.Read()
+				if !errors.Is(err, tc.want) || rig.requests.writes != writesBefore || resultAfter != resultBefore || foundAfter != foundBefore || rig.results.deletes != 0 {
+					t.Errorf("err = %v", err)
+				}
+			})
+		}
+	})
+
+	t.Run("a stale running result does not block a new restart", func(t *testing.T) {
+		rig := newRestartRig(updateRunning)
+		rig.results.put(update.Result{Outcome: update.OutcomeRunning, StartedAt: restartBaseTime.Add(-6 * time.Minute)})
+
+		_, err := rig.request.Request(updateOwnerId, "")
+
+		if err != nil || rig.requests.writes != 1 {
+			t.Errorf("err = %v, writes = %d", err, rig.requests.writes)
+		}
+	})
+
+	t.Run("a marker write error is returned and leaves the job alone", func(t *testing.T) {
+		rig := newRestartRig(updateRunning)
+		rig.readyJob()
+		rig.requests.writeErr = errors.New("disk full at /var/lib/renewcms")
+		jobBefore, _ := rig.jobs.Load()
+
+		_, err := rig.request.Request(updateOwnerId, "")
+
+		jobAfter, _ := rig.jobs.Load()
+		if err == nil || errors.Is(err, update.ErrRestartKindMismatch) || rig.requests.present || jobAfter != jobBefore {
+			t.Errorf("err = %v", err)
+		}
+	})
+
+	t.Run("two simultaneous requests write one marker", func(t *testing.T) {
+		rig := newRestartRig(updateRunning)
+		var wait sync.WaitGroup
+		errs := make([]error, 2)
+		for i := range errs {
+			wait.Add(1)
+			go func() {
+				defer wait.Done()
+				_, errs[i] = rig.request.Request(uint32(i+1), "")
+			}()
+		}
+		wait.Wait()
+
+		accepted, refused := 0, 0
+		for _, err := range errs {
+			switch {
+			case err == nil:
+				accepted++
+			case errors.Is(err, update.ErrRestartPending):
+				refused++
+			}
+		}
+		if accepted != 1 || refused != 1 || rig.requests.writes != 1 {
+			t.Errorf("accepted = %d, refused = %d, writes = %d", accepted, refused, rig.requests.writes)
+		}
+	})
+}
+
+func (f *fakeResultStore) put(result update.Result) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.result = result
+	f.found = true
+}
+
+func TestUpdateStatusFromFiles(t *testing.T) {
+	running := updateRunning
+	started := restartBaseTime.Add(-30 * time.Second)
+	finished := restartBaseTime.Add(-10 * time.Second)
+	cases := []struct {
+		name     string
+		marker   bool
+		result   *update.Result
+		corrupt  bool
+		state    string
+		errKind  string
+		finished *time.Time
+	}{
+		{"a marker is present", true, nil, false, "restarting", "", nil},
+		{"a marker wins over a finished result", true, &update.Result{Outcome: update.OutcomeFailed, StartedAt: started, FinishedAt: &finished}, false, "restarting", "", &finished},
+		{"result running written 30 s ago", false, &update.Result{Outcome: update.OutcomeRunning, StartedAt: started}, false, "restarting", "", nil},
+		{"result running just under 5 minutes", false, &update.Result{Outcome: update.OutcomeRunning, StartedAt: restartBaseTime.Add(-5*time.Minute + time.Second)}, false, "restarting", "", nil},
+		{"result running for 5 minutes, no marker", false, &update.Result{Outcome: update.OutcomeRunning, StartedAt: restartBaseTime.Add(-5 * time.Minute), FinishedAt: &finished}, false, "failed", "install", &finished},
+		{"result running written 6 minutes ago, no marker", false, &update.Result{Outcome: update.OutcomeRunning, StartedAt: restartBaseTime.Add(-6 * time.Minute), FinishedAt: &finished}, false, "failed", "install", &finished},
+		{"succeeded update with the running tag", false, &update.Result{Outcome: update.OutcomeSucceeded, Kind: update.RestartKindUpdate, Tag: running, StartedAt: started, FinishedAt: &finished}, false, "succeeded", "", &finished},
+		{"succeeded update with an older tag", false, &update.Result{Outcome: update.OutcomeSucceeded, Kind: update.RestartKindUpdate, Tag: "v2.1.0-beta", StartedAt: started, FinishedAt: &finished}, false, "idle", "", &finished},
+		{"succeeded plain restart", false, &update.Result{Outcome: update.OutcomeSucceeded, Kind: update.RestartKindRestart, StartedAt: started, FinishedAt: &finished}, false, "idle", "", &finished},
+		{"rolled back", false, &update.Result{Outcome: update.OutcomeRolledBack, Kind: update.RestartKindUpdate, Tag: "v2.3.0-beta", StartedAt: started, FinishedAt: &finished}, false, "failed", "rolled_back", &finished},
+		{"failed", false, &update.Result{Outcome: update.OutcomeFailed, Kind: update.RestartKindUpdate, StartedAt: started, FinishedAt: &finished}, false, "failed", "install", &finished},
+		{"no marker, no result", false, nil, false, "idle", "", nil},
+		{"a corrupt result file", false, nil, true, "idle", "", nil},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rig := newRestartRig(running)
+			rig.requests.present = tc.marker
+			if tc.marker {
+				rig.requests.request = update.RestartRequest{Kind: update.RestartKindRestart, RequestedAt: started}
+			}
+			if tc.result != nil {
+				rig.results.put(*tc.result)
+			}
+			if tc.marker || tc.result != nil {
+				rig.jobs.put(update.Job{Tag: downloadTag, State: update.StateReady, StartedAt: started})
+			}
+
+			first := rig.status.GetStatus(true)
+			second := rig.status.GetStatus(true)
+
+			if first.State != tc.state || (tc.errKind == "") != (first.Error == nil) || (first.Error != nil && *first.Error != tc.errKind) {
+				t.Errorf("state = %q, error = %v", first.State, first.Error)
+			}
+			if (tc.finished == nil) != (first.FinishedAt == nil) || (tc.finished != nil && !first.FinishedAt.Equal(*tc.finished)) {
+				t.Errorf("finished_at = %v", first.FinishedAt)
+			}
+			if first.Progress != nil && tc.state != "ready" {
+				t.Errorf("progress = %v", first.Progress)
+			}
+			if first.State != second.State || rig.results.deletes != 0 || rig.requests.deletes != 0 || rig.results.writes != nil || rig.requests.writes != 0 {
+				t.Error("GET must not change anything")
+			}
+		})
+	}
+
+	t.Run("without any file a ready job is reported as ready", func(t *testing.T) {
+		rig := newRestartRig(running)
+		rig.readyJob()
+
+		status := rig.status.GetStatus(true)
+
+		if status.State != update.StateReady || status.FinishedAt != nil {
+			t.Errorf("status = %+v", status)
+		}
+	})
+
+	t.Run("after a successful update nothing is available and current is the new version", func(t *testing.T) {
+		rig := newRestartRig(downloadTag)
+		rig.results.put(update.Result{Outcome: update.OutcomeSucceeded, Kind: update.RestartKindUpdate, Tag: downloadTag, StartedAt: started, FinishedAt: &finished})
+
+		status := rig.status.GetStatus(true)
+
+		if status.State != update.StateSucceeded || status.Available || status.Current != downloadTag || status.FinishedAt == nil {
+			t.Errorf("status = %+v", status)
+		}
+	})
+}
+
+func TestRecordRunningInfoUseCase(t *testing.T) {
+	t.Run("it writes the version, the pid and the start instant", func(t *testing.T) {
+		store := &fakeRunningInfoStore{}
+		clock := &fakeClock{now: restartBaseTime}
+
+		err := useCases.NewRecordRunningInfoUseCase(store, "v2.3.0-beta", 4242, clock.Now).Record()
+
+		want := update.RunningInfo{Version: "v2.3.0-beta", Pid: 4242, StartedAt: restartBaseTime}
+		if err != nil || len(store.writes) != 1 || store.writes[0] != want {
+			t.Errorf("err = %v, writes = %+v", err, store.writes)
+		}
+	})
+
+	t.Run("a write error is returned, not raised", func(t *testing.T) {
+		store := &fakeRunningInfoStore{writeErr: errors.New("read-only file system")}
+
+		err := useCases.NewRecordRunningInfoUseCase(store, "v2.3.0-beta", 1, time.Now).Record()
+
+		if err == nil {
+			t.Error("the error must be returned so the startup code can log it")
+		}
+	})
+}

test/update_test.go

@@ -154,7 +154,7 @@ func TestReleaseNotesStripInlineMarkdown(t *testing.T) {
 
 func TestGetUpdateStatusUseCase(t *testing.T) {
 	t.Run("never checked", func(t *testing.T) {
-		status := useCases.NewGetUpdateStatusUseCase(&fakeUpdateStore{}, &fakeJobStore{}, &fakeHelperDetector{}, "v2.2.0-beta").GetStatus(true)
+		status := newUpdateStatusUseCase(&fakeUpdateStore{}, &fakeJobStore{}, &fakeHelperDetector{}, "v2.2.0-beta").GetStatus(true)
 
 		if status.Current != "v2.2.0-beta" || status.Latest != "" || status.Available {
 			t.Errorf("status = %+v", status)
@@ -170,7 +170,7 @@ func TestGetUpdateStatusUseCase(t *testing.T) {
 	t.Run("stored result", func(t *testing.T) {
 		store := &fakeUpdateStore{result: newStoredUpdateResult(), found: true}
 
-		status := useCases.NewGetUpdateStatusUseCase(store, &fakeJobStore{}, &fakeHelperDetector{}, "v2.2.0-beta").GetStatus(true)
+		status := newUpdateStatusUseCase(store, &fakeJobStore{}, &fakeHelperDetector{}, "v2.2.0-beta").GetStatus(true)
 
 		if status.Latest != "v2.3.0-beta" || !status.Available || status.CanApply || status.State != update.StateIdle {
 			t.Errorf("status = %+v", status)
@@ -185,7 +185,7 @@ func TestGetUpdateStatusUseCase(t *testing.T) {
 
 	t.Run("dev build never reports an update", func(t *testing.T) {
 		store := &fakeUpdateStore{result: newStoredUpdateResult(), found: true}
-		if useCases.NewGetUpdateStatusUseCase(store, &fakeJobStore{}, &fakeHelperDetector{}, "dev").GetStatus(true).Available {
+		if newUpdateStatusUseCase(store, &fakeJobStore{}, &fakeHelperDetector{}, "dev").GetStatus(true).Available {
 			t.Error("a dev build must not report an update")
 		}
 	})

web/src/components/RestartOverlay.vue

@@ -0,0 +1,104 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import AppLogo from '@/components/AppLogo.vue'
+import type { RestartKind } from '@/composables/useUpdate'
+import { formatStartedAt, formatStartedWithAge } from '@/lib/updateFormat'
+
+const LOGO_SIZE = 26
+
+const props = defineProps<{
+	kind: RestartKind | null
+	version: string
+	startedAt: string
+	slow: boolean
+	now: number
+}>()
+
+const emit = defineEmits<{
+	reload: []
+}>()
+
+const copy = computed(() => {
+	if (props.slow) {
+		return {
+			title: 'Still restarting',
+			text: 'This is taking longer than usual. Keep this page open. It reloads on its own when the site is back, or you can reload it now.',
+		}
+	}
+	if (props.kind === 'update') {
+		return {
+			title: `Installing version ${props.version}`,
+			text: 'Your site is restarting with the new version. This takes about 10 seconds. This page reloads on its own when the site is back.',
+		}
+	}
+	return {
+		title: 'Restarting your site',
+		text: 'This takes about 10 seconds. This page reloads on its own when the site is back.',
+	}
+})
+
+const meta = computed(() =>
+	props.slow
+		? formatStartedWithAge(props.startedAt, new Date(props.now))
+		: formatStartedAt(props.startedAt),
+)
+</script>
+
+<template>
+	<div
+		role="status"
+		data-testid="restart-overlay"
+		class="fixed inset-0 z-70 flex items-center justify-center bg-muted p-6"
+	>
+		<div class="flex w-full max-w-110 flex-col items-start gap-4">
+			<AppLogo :size="LOGO_SIZE" />
+			<div class="flex flex-col gap-1.5">
+				<h2 class="text-xl/7.5 font-semibold text-highlighted" data-testid="restart-title">
+					{{ copy.title }}
+				</h2>
+				<span class="text-base/5.5 text-pretty text-toned" data-testid="restart-text">{{
+					copy.text
+				}}</span>
+			</div>
+			<div
+				role="progressbar"
+				aria-label="Restarting"
+				class="h-1 w-full overflow-hidden bg-accented"
+			>
+				<div class="restart-bar h-1 w-7/20 bg-primary" />
+			</div>
+			<span class="text-xs text-muted" data-testid="restart-meta">{{ meta }}</span>
+			<UButton
+				v-if="slow"
+				color="neutral"
+				variant="outline"
+				class="h-11 gap-1.5 border border-accented bg-default px-3.5 text-highlighted ring-0 md:h-8"
+				@click="emit('reload')"
+			>
+				Reload page
+			</UButton>
+		</div>
+	</div>
+</template>
+
+<style scoped>
+.restart-bar {
+	margin-left: 30%;
+	animation: restart-slide 1.6s ease-in-out infinite alternate;
+}
+
+@media (prefers-reduced-motion: reduce) {
+	.restart-bar {
+		animation: none;
+	}
+}
+
+@keyframes restart-slide {
+	from {
+		margin-left: 0;
+	}
+	to {
+		margin-left: 65%;
+	}
+}
+</style>

web/src/components/UpdatesCard.vue

@@ -4,17 +4,19 @@ import ReleaseNotes from '@/components/ReleaseNotes.vue'
 import ServerCommand from '@/components/ServerCommand.vue'
 import UpdateProgress from '@/components/UpdateProgress.vue'
 import UpdateStatusBlock, { type UpdateTone } from '@/components/UpdateStatusBlock.vue'
-import type { UpdateStatus } from '@/composables/useUpdate'
+import type { RestartKind, UpdateStatus } from '@/composables/useUpdate'
 import type { UserRole } from '@/composables/useApi'
 import type { UpdateApplyPhase, UpdateCheckPhase } from '@/stores/update'
 import {
 	ENABLE_BROWSER_UPDATES_COMMAND,
 	VERIFYING_ANNOUNCEMENT,
+	browserUpdatesDocsUrl,
 	displayVersion,
 	downloadAnnouncement,
 	formatDownloadProgress,
 	formatLastChecked,
 	formatReleased,
+	formatUpdatedAt,
 } from '@/lib/updateFormat'
 
 type ApplyView =
@@ -24,9 +26,10 @@ type ApplyView =
 	| 'ready'
 	| 'download-failed'
 	| 'verification-failed'
+	| 'rolled-back'
 	| 'limited'
 
-type ButtonAction = 'check' | 'update'
+type ButtonAction = 'check' | 'update' | 'restart'
 
 interface Block {
 	tone: UpdateTone
@@ -42,6 +45,7 @@ interface ActionButton {
 	primary: boolean
 	disabled: boolean
 	action: ButtonAction | null
+	restartKind?: RestartKind
 }
 
 interface ProgressView {
@@ -51,8 +55,15 @@ interface ProgressView {
 }
 
 const AVAILABLE_HINT = 'Takes about 2 minutes. Your site stays online.'
+const RESTART_HINT = 'Restart takes about 10 seconds. Your site is unavailable while it restarts.'
 const READY_HINT =
 	'Not now? Leave this page. The update waits here, and the banner on Home reminds you.'
+const LIMITED_BLOCK: Block = {
+	tone: 'info',
+	icon: 'i-lucide-info',
+	title: 'Too many tries',
+	text: 'Wait a moment before trying again.',
+}
 const ZERO_PROGRESS = { percent: 0, downloaded_bytes: 0, total_bytes: 0 }
 
 const props = defineProps<{
@@ -67,10 +78,22 @@ const props = defineProps<{
 const emit = defineEmits<{
 	check: []
 	update: []
+	restart: [kind: RestartKind]
 }>()
 
+const card = ref<HTMLElement | null>(null)
 const heading = ref<HTMLElement | null>(null)
 
+function focusHeading() {
+	heading.value?.focus()
+}
+
+function focusRestart() {
+	card.value?.querySelector<HTMLElement>('[data-testid="restart-button"]')?.focus()
+}
+
+defineExpose({ focusHeading, focusRestart })
+
 const isOwner = computed(() => props.role === 'owner')
 const newVersion = computed(() => displayVersion(props.status.latest))
 const lastChecked = computed(() =>
@@ -97,11 +120,18 @@ const applyView = computed<ApplyView | null>(() => {
 		return state
 	}
 	if (state === 'failed') {
-		return error === 'verification' ? 'verification-failed' : 'download-failed'
+		return failedView(error)
 	}
 	return available ? 'available' : null
 })
 
+function failedView(error: UpdateStatus['error']): ApplyView {
+	if (error === 'verification') {
+		return 'verification-failed'
+	}
+	return error === 'rolled_back' || error === 'install' ? 'rolled-back' : 'download-failed'
+}
+
 const isStarting = computed(() => props.applyPhase === 'starting')
 
 const downloadFailed = computed(() => applyView.value === 'download-failed' && !isStarting.value)
@@ -152,12 +182,14 @@ const applyBlocks = computed<Record<ApplyView, Block>>(() => ({
 		title: "We didn't use this update",
 		text: "The file didn't pass our safety check, so it was not installed. Nothing was changed. Try downloading it again. If this keeps happening, contact RenewCMS support.",
 	},
-	limited: {
-		tone: 'info',
-		icon: 'i-lucide-info',
-		title: 'Too many tries',
-		text: 'Wait a moment before trying again.',
+	'rolled-back': {
+		tone: 'warning',
+		icon: 'i-lucide-triangle-alert',
+		title: "The update didn't install",
+		text: 'RenewCMS put the previous version back, so your site is running as before. Nothing was lost.',
+		meta: 'What to do next: try again in a few minutes. If it fails again, ask whoever manages your server to check the update.',
 	},
+	limited: LIMITED_BLOCK,
 }))
 
 const progressView = computed<ProgressView | null>(() => {
@@ -186,7 +218,10 @@ const hint = computed(() => {
 	if (applyView.value === 'available') {
 		return AVAILABLE_HINT
 	}
-	return applyView.value === 'ready' ? READY_HINT : null
+	if (applyView.value === 'ready') {
+		return READY_HINT
+	}
+	return showRestartHint.value ? RESTART_HINT : null
 })
 
 function applyButton(view: ApplyView): ActionButton {
@@ -204,26 +239,13 @@ function applyButton(view: ApplyView): ActionButton {
 			label: 'Restart',
 			icon: 'i-lucide-power',
 			primary: true,
-			disabled: true,
-			action: null,
+			disabled: false,
+			action: 'restart',
+			restartKind: 'update',
 		}
 	}
 	if (view === 'limited') {
-		return props.retryActive
-			? {
-					label: `Try again in ${props.retryLabel}`,
-					icon: 'i-lucide-clock',
-					primary: false,
-					disabled: true,
-					action: null,
-				}
-			: {
-					label: 'Try again',
-					icon: 'i-lucide-rotate-cw',
-					primary: false,
-					disabled: false,
-					action: 'update',
-				}
+		return limitedButton('update')
 	}
 	if (view === 'available') {
 		return {
@@ -253,12 +275,7 @@ const block = computed<Block>(() => {
 		}
 	}
 	if (isOwner.value && props.phase === 'limited') {
-		return {
-			tone: 'info',
-			icon: 'i-lucide-info',
-			title: 'Too many tries',
-			text: 'Wait a moment before trying again.',
-		}
+		return LIMITED_BLOCK
 	}
 	if (isOwner.value && props.phase === 'failed') {
 		return {
@@ -272,6 +289,15 @@ const block = computed<Block>(() => {
 	if (applyView.value) {
 		return applyBlocks.value[applyView.value]
 	}
+	if (isDone.value) {
+		return {
+			tone: 'success',
+			icon: 'i-lucide-circle-check',
+			title: `You're on version ${displayVersion(props.status.current)}`,
+			text: 'The update is installed and your site is running again.',
+			meta: props.status.finished_at ? formatUpdatedAt(props.status.finished_at) : undefined,
+		}
+	}
 	if (props.status.available && isOwner.value) {
 		return {
 			tone: 'info',
@@ -299,6 +325,14 @@ const block = computed<Block>(() => {
 	}
 })
 
+const isDone = computed(() => props.status.state === 'succeeded')
+
+const isRestarting = computed(() => props.status.state === 'restarting')
+
+const restartAvailable = computed(
+	() => canApplyView.value && (props.status.state === 'idle' || isDone.value),
+)
+
 const showServerGuidance = computed(
 	() =>
 		isOwner.value &&
@@ -307,29 +341,64 @@ const showServerGuidance = computed(
 		props.phase === 'idle',
 )
 
-const actionButton = computed<ActionButton | null>(() => {
-	if (!isOwner.value) {
-		return null
+const plainRestartButton: ActionButton = {
+	label: 'Restart',
+	icon: 'i-lucide-power',
+	primary: false,
+	disabled: false,
+	action: 'restart',
+	restartKind: 'restart',
+}
+
+const actionButtons = computed<ActionButton[]>(() => {
+	if (!isOwner.value || isRestarting.value) {
+		return []
 	}
 	if (props.phase === 'checking') {
-		return {
+		return [
+			{
 				label: 'Checking…',
 				icon: 'i-lucide-loader-circle',
 				primary: false,
 				disabled: true,
 				action: null,
-		}
+			},
+		]
 	}
 	if (props.phase === 'failed') {
-		return {
+		return withPlainRestart({
 			label: 'Try again',
 			icon: 'i-lucide-rotate-cw',
 			primary: true,
 			disabled: false,
 			action: 'check',
-		}
+		})
 	}
 	if (props.phase === 'limited') {
+		return [limitedButton('check')]
+	}
+	if (applyView.value) {
+		return [applyButton(applyView.value)]
+	}
+	if (props.status.available && !isDone.value) {
+		return []
+	}
+	return withPlainRestart({
+		label: 'Check for updates',
+		icon: 'i-lucide-refresh-cw',
+		primary: false,
+		disabled: false,
+		action: 'check',
+	})
+})
+
+const showRestartHint = computed(() => actionButtons.value.includes(plainRestartButton))
+
+function withPlainRestart(button: ActionButton) {
+	return restartAvailable.value ? [button, plainRestartButton] : [button]
+}
+
+function limitedButton(action: ButtonAction): ActionButton {
 	return props.retryActive
 		? {
 				label: `Try again in ${props.retryLabel}`,
@@ -343,32 +412,20 @@ const actionButton = computed<ActionButton | null>(() => {
 				icon: 'i-lucide-rotate-cw',
 				primary: false,
 				disabled: false,
-					action: 'check',
+				action,
 			}
 }
-	if (applyView.value) {
-		return applyButton(applyView.value)
-	}
-	if (props.status.available) {
-		return null
-	}
-	return {
-		label: 'Check for updates',
-		icon: 'i-lucide-refresh-cw',
-		primary: false,
-		disabled: false,
-		action: 'check',
-	}
-})
 
-function onAction() {
-	const action = actionButton.value?.action
-	if (action === 'check') {
+function onAction(button: ActionButton) {
+	if (button.action === 'check') {
 		emit('check')
 	}
-	if (action === 'update') {
+	if (button.action === 'update') {
 		emit('update')
 	}
+	if (button.action === 'restart' && button.restartKind) {
+		emit('restart', button.restartKind)
+	}
 }
 
 const showNotes = computed(
@@ -390,6 +447,7 @@ const notes = computed(() => {
 
 <template>
 	<section
+		ref="card"
 		aria-labelledby="updates-h"
 		data-testid="updates-card"
 		class="flex flex-col gap-4 border border-default bg-default p-4 lg:p-5"
@@ -427,22 +485,25 @@ const notes = computed(() => {
 
 		<ServerCommand v-if="showServerGuidance" :line="ENABLE_BROWSER_UPDATES_COMMAND" />
 
-		<div v-if="actionButton" class="flex flex-col gap-2 md:flex-row md:items-center">
+		<div v-if="actionButtons.length" class="flex flex-col gap-2 md:flex-row md:items-center">
 			<UButton
-				:color="actionButton.primary ? 'primary' : 'neutral'"
-				:variant="actionButton.primary ? 'solid' : 'outline'"
-				:icon="actionButton.icon"
-				:disabled="actionButton.disabled"
+				v-for="button in actionButtons"
+				:key="button.label"
+				:data-testid="button.action === 'restart' ? 'restart-button' : undefined"
+				:color="button.primary ? 'primary' : 'neutral'"
+				:variant="button.primary ? 'solid' : 'outline'"
+				:icon="button.icon"
+				:disabled="button.disabled"
 				class="h-11 justify-center gap-1.5 px-3.5 md:h-8"
 				:class="
-					actionButton.primary
+					button.primary
 						? ''
 						: 'border border-accented bg-default text-highlighted ring-0'
 				"
 				:ui="{ leadingIcon: 'size-4' }"
-				@click="onAction"
+				@click="onAction(button)"
 			>
-				{{ actionButton.label }}
+				{{ button.label }}
 			</UButton>
 		</div>
 
@@ -450,7 +511,7 @@ const notes = computed(() => {
 
 		<a
 			v-if="showServerGuidance && status.release_url"
-			:href="status.release_url"
+			:href="browserUpdatesDocsUrl(status.release_url)"
 			target="_blank"
 			rel="noopener noreferrer"
 			class="inline-flex items-center gap-1.5 self-start text-sm font-medium text-highlighted underline underline-offset-3"
@@ -458,5 +519,16 @@ const notes = computed(() => {
 			How to update
 			<UIcon name="i-lucide-arrow-up-right" class="size-3.5" />
 		</a>
+
+		<a
+			v-if="isDone && status.release_url"
+			:href="status.release_url"
+			target="_blank"
+			rel="noopener noreferrer"
+			class="inline-flex items-center gap-1.5 self-start text-sm font-medium text-highlighted underline underline-offset-3"
+		>
+			Read the release notes
+			<UIcon name="i-lucide-arrow-up-right" class="size-3.5" />
+		</a>
 	</section>
 </template>

web/src/composables/useUpdate.ts

@@ -21,7 +21,9 @@ export interface UpdateProgress {
 	total_bytes: number
 }
 
-export type UpdateErrorKind = 'download' | 'verification'
+export type UpdateErrorKind = 'download' | 'verification' | 'rolled_back' | 'install'
+
+export type RestartKind = 'update' | 'restart'
 
 export interface UpdateStatus {
 	current: string
@@ -35,6 +37,7 @@ export interface UpdateStatus {
 	progress: UpdateProgress | null
 	error: UpdateErrorKind | null
 	started_at: string | null
+	finished_at: string | null
 }
 
 export function useUpdate() {
@@ -52,5 +55,36 @@ export function useUpdate() {
 		return request<UpdateStatus>('/v1/system/update/download', { method: 'POST' })
 	}
 
-	return { getUpdateStatus, checkForUpdate, startUpdateDownload }
+	function requestRestart(kind: RestartKind): Promise<UpdateStatus> {
+		return request<UpdateStatus>('/v1/system/update/restart', {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			body: JSON.stringify({ kind }),
+		})
+	}
+
+	function pollUpdateStatus(): Promise<UpdateStatus> {
+		return request<UpdateStatus>('/v1/system/update', {
+			onUnauthorized: 'passthrough',
+			onForbidden: 'passthrough',
+		})
+	}
+
+	async function isSiteUp(): Promise<boolean> {
+		try {
+			const response = await fetch('/healthz', { cache: 'no-store' })
+			return response.status === 200
+		} catch {
+			return false
+		}
+	}
+
+	return {
+		getUpdateStatus,
+		checkForUpdate,
+		startUpdateDownload,
+		requestRestart,
+		pollUpdateStatus,
+		isSiteUp,
+	}
 }

web/src/lib/__tests__/updateFormat.spec.ts

@@ -1,11 +1,15 @@
 import { describe, expect, it } from 'vitest'
 import {
 	AUTO_CHECK_INTERVAL_MS,
+	browserUpdatesDocsUrl,
 	displayVersion,
 	downloadAnnouncement,
 	formatDownloadProgress,
 	formatLastChecked,
 	formatReleased,
+	formatStartedAt,
+	formatStartedWithAge,
+	formatUpdatedAt,
 	isCheckDue,
 } from '@/lib/updateFormat'
 
@@ -92,3 +96,42 @@ describe('downloadAnnouncement', () => {
 		expect(downloadAnnouncement('2.3.0-beta', percent)).toBe(expected)
 	})
 })
+
+describe('browserUpdatesDocsUrl', () => {
+	it('points the release url at the Browser updates section of the docs of the same repository', () => {
+		expect(
+			browserUpdatesDocsUrl('https://git.example/fsylvain/RenewCMS/releases/tag/v2.3.0-beta'),
+		).toBe(
+			'https://git.example/fsylvain/RenewCMS/src/branch/main/docs/deployment.md#browser-updates',
+		)
+	})
+
+	it('keeps a url it cannot interpret', () => {
+		expect(browserUpdatesDocsUrl('https://git.example/somewhere')).toBe(
+			'https://git.example/somewhere',
+		)
+		expect(browserUpdatesDocsUrl('not a url')).toBe('not a url')
+	})
+})
+
+describe('restart meta lines', () => {
+	const startedAt = '2026-09-30T09:51:00Z'
+
+	it('reads the start time', () => {
+		expect(formatStartedAt(startedAt)).toBe('Started at 09:51')
+	})
+
+	it('adds how long ago it was', () => {
+		expect(formatStartedWithAge(startedAt, new Date('2026-09-30T09:52:30Z'))).toBe(
+			'Started at 09:51 · 1 minute ago',
+		)
+	})
+
+	it.each([
+		['2026-09-30T09:52:00Z', 'Updated today at 09:52'],
+		['2026-09-29T18:12:00Z', 'Updated yesterday at 18:12'],
+		['2026-09-20T18:12:00Z', 'Updated 20 Sep 2026 at 18:12'],
+	])('reads the update time %s as %s', (iso, expected) => {
+		expect(formatUpdatedAt(iso, new Date('2026-09-30T10:00:00Z'))).toBe(expected)
+	})
+})

web/src/lib/reloadPage.ts

@@ -0,0 +1,3 @@
+export function reloadPage() {
+	window.location.reload()
+}

web/src/lib/restartMemory.ts

@@ -0,0 +1,47 @@
+import type { RestartKind } from '@/composables/useUpdate'
+
+export const RESTART_MEMORY_KEY = 'renewcms:update-restart'
+
+export interface RestartMemory {
+	kind: RestartKind
+	started_at: string
+}
+
+export function readRestartMemory(): RestartMemory | null {
+	try {
+		const raw = sessionStorage.getItem(RESTART_MEMORY_KEY)
+		if (raw === null) {
+			return null
+		}
+		const parsed = JSON.parse(raw) as Partial<RestartMemory>
+		const validKind = parsed.kind === 'update' || parsed.kind === 'restart'
+		return validKind && typeof parsed.started_at === 'string'
+			? { kind: parsed.kind as RestartKind, started_at: parsed.started_at }
+			: null
+	} catch {
+		return null
+	}
+}
+
+export function writeRestartMemory(memory: RestartMemory) {
+	try {
+		sessionStorage.setItem(RESTART_MEMORY_KEY, JSON.stringify(memory))
+	} catch {
+		return
+	}
+}
+
+export function clearRestartMemory() {
+	try {
+		sessionStorage.removeItem(RESTART_MEMORY_KEY)
+	} catch {
+		return
+	}
+}
+
+export function isLaterThan(candidate: string | null, reference: string) {
+	if (candidate === null) {
+		return false
+	}
+	return new Date(candidate).getTime() > new Date(reference).getTime()
+}

web/src/lib/updateFormat.ts

@@ -1,4 +1,4 @@
-import { formatAbsoluteDateFromIso } from '@/lib/relativeDate'
+import { formatAbsoluteDateFromIso, formatRelativeDate } from '@/lib/relativeDate'
 
 export const ENABLE_BROWSER_UPDATES_COMMAND = 'renewcms enable-browser-updates'
 export const AUTO_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000
@@ -15,7 +15,7 @@ function isSameLocalDay(a: Date, b: Date) {
 	)
 }
 
-function formatClock(date: Date) {
+export function formatClock(date: Date) {
 	const hours = String(date.getHours()).padStart(2, '0')
 	const minutes = String(date.getMinutes()).padStart(2, '0')
 	return `${hours}:${minutes}`
@@ -69,3 +69,37 @@ export function downloadAnnouncement(version: string, percent: number) {
 }
 
 export const VERIFYING_ANNOUNCEMENT = 'Checking the download'
+
+const BROWSER_UPDATES_DOCS_PATH = '/src/branch/main/docs/deployment.md#browser-updates'
+const RELEASES_SEGMENT = /^(.*)\/releases\//
+
+export function browserUpdatesDocsUrl(releaseUrl: string) {
+	try {
+		const url = new URL(releaseUrl)
+		const repository = RELEASES_SEGMENT.exec(url.pathname)
+		return repository ? `${url.origin}${repository[1]}${BROWSER_UPDATES_DOCS_PATH}` : releaseUrl
+	} catch {
+		return releaseUrl
+	}
+}
+
+export function formatStartedAt(iso: string) {
+	return `Started at ${formatClock(new Date(iso))}`
+}
+
+export function formatStartedWithAge(iso: string, now: Date = new Date()) {
+	return `${formatStartedAt(iso)} · ${formatRelativeDate(iso, now)}`
+}
+
+export function formatUpdatedAt(iso: string, now: Date = new Date()) {
+	const date = new Date(iso)
+	const yesterday = new Date(now)
+	yesterday.setDate(now.getDate() - 1)
+	if (isSameLocalDay(date, now)) {
+		return `Updated today at ${formatClock(date)}`
+	}
+	if (isSameLocalDay(date, yesterday)) {
+		return `Updated yesterday at ${formatClock(date)}`
+	}
+	return `Updated ${formatAbsoluteDateFromIso(iso)} at ${formatClock(date)}`
+}

web/src/stores/update.ts

@@ -1,7 +1,15 @@
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
 import { ApiError } from '@/composables/useApi'
-import { useUpdate, type UpdateStatus } from '@/composables/useUpdate'
+import { useUpdate, type RestartKind, type UpdateStatus } from '@/composables/useUpdate'
+import { displayVersion } from '@/lib/updateFormat'
+import { reloadPage } from '@/lib/reloadPage'
+import {
+	clearRestartMemory,
+	isLaterThan,
+	readRestartMemory,
+	writeRestartMemory,
+} from '@/lib/restartMemory'
 import { useSessionStore } from '@/stores/session'
 
 export type UpdateLoadState = 'idle' | 'loading' | 'ready' | 'error'
@@ -18,8 +26,20 @@ export type UpdateStartResult =
 	| 'conflict'
 	| 'busy'
 
+export type RestartRequestResult = 'started' | 'failed' | 'forbidden' | 'conflict' | 'unauthorized'
+
+export interface RestartRun {
+	kind: RestartKind | null
+	startedAt: string
+	version: string
+}
+
+export type RestartOutcome = 'updated' | 'rolled-back' | 'restarted'
+
 export const DISMISSED_VERSION_KEY = 'renewcms:update-dismissed'
 const DEFAULT_RETRY_SECONDS = 60
+const RESTART_POLL_INTERVAL_MS = 1000
+const RESTART_SLOW_AFTER_SECONDS = 60
 
 function readDismissedVersion() {
 	try {
@@ -50,8 +70,9 @@ export const useUpdateStore = defineStore('update', () => {
 	const isOwner = computed(() => session.session?.role === 'owner')
 	const available = computed(() => status.value?.available === true)
 	const showCue = computed(() => isOwner.value && available.value)
+	const restarting = computed(() => status.value?.state === 'restarting')
 	const bannerVisible = computed(
-		() => showCue.value && status.value?.latest !== dismissedVersion.value,
+		() => showCue.value && !restarting.value && status.value?.latest !== dismissedVersion.value,
 	)
 	const jobRunning = computed(
 		() =>
@@ -60,6 +81,13 @@ export const useUpdateStore = defineStore('update', () => {
 			(status.value.state === 'downloading' || status.value.state === 'verifying'),
 	)
 	const readyToInstall = computed(() => isOwner.value && status.value?.state === 'ready')
+	const restartRun = ref<RestartRun | null>(null)
+	const restartSlow = ref(false)
+	const restartNow = ref(Date.now())
+	let restartTimer: ReturnType<typeof setInterval> | null = null
+	let restartInFlight = false
+	let restartSilentSeconds = 0
+	let restartReloaded = false
 
 	function load() {
 		if (pendingLoad) {
@@ -165,6 +193,109 @@ export const useUpdateStore = defineStore('update', () => {
 		}
 	}
 
+	async function requestRestart(kind: RestartKind): Promise<RestartRequestResult> {
+		const { requestRestart: sendRestart } = useUpdate()
+		try {
+			const next = await sendRestart(kind)
+			status.value = next
+			const startedAt = next.started_at ?? new Date().toISOString()
+			writeRestartMemory({ kind, started_at: startedAt })
+			beginRestart({ kind, startedAt, version: displayVersion(next.latest) })
+			return 'started'
+		} catch (error) {
+			return restartFailure(error)
+		}
+	}
+
+	function restartFailure(error: unknown): RestartRequestResult {
+		const outcomes: Record<number, RestartRequestResult> = {
+			401: 'unauthorized',
+			403: 'forbidden',
+			409: 'conflict',
+		}
+		return (error instanceof ApiError ? outcomes[error.status] : undefined) ?? 'failed'
+	}
+
+	function resumeRestart() {
+		if (!isOwner.value || restartRun.value || status.value?.state !== 'restarting') {
+			return
+		}
+		const remembered = readRestartMemory()
+		beginRestart({
+			kind: remembered?.kind ?? null,
+			startedAt: status.value.started_at ?? new Date().toISOString(),
+			version: displayVersion(status.value.latest),
+		})
+	}
+
+	function beginRestart(run: RestartRun) {
+		stopRestart()
+		restartRun.value = run
+		restartSlow.value = false
+		restartSilentSeconds = 0
+		restartReloaded = false
+		restartTimer = setInterval(watchRestart, RESTART_POLL_INTERVAL_MS)
+	}
+
+	function stopRestart() {
+		if (restartTimer !== null) {
+			clearInterval(restartTimer)
+			restartTimer = null
+		}
+		restartRun.value = null
+		restartSlow.value = false
+	}
+
+	async function watchRestart() {
+		if (restartInFlight || !restartRun.value) {
+			return
+		}
+		restartInFlight = true
+		const run = restartRun.value
+		const { isSiteUp, pollUpdateStatus } = useUpdate()
+		try {
+			const [siteUp, answer] = await Promise.all([
+				isSiteUp(),
+				pollUpdateStatus().catch(() => null),
+			])
+			settleRestartPoll(run, siteUp, answer)
+		} finally {
+			restartInFlight = false
+		}
+	}
+
+	function settleRestartPoll(run: RestartRun, siteUp: boolean, answer: UpdateStatus | null) {
+		restartNow.value = Date.now()
+		restartSilentSeconds = siteUp || answer ? 0 : restartSilentSeconds + 1
+		restartSlow.value = restartSilentSeconds >= RESTART_SLOW_AFTER_SECONDS
+		if (!siteUp || !answer || answer.state === 'restarting') {
+			return
+		}
+		if (isLaterThan(answer.finished_at, run.startedAt) && !restartReloaded) {
+			restartReloaded = true
+			reloadPage()
+		}
+	}
+
+	function settleRememberedRestart(): RestartOutcome | null {
+		const remembered = readRestartMemory()
+		const current = status.value
+		if (!remembered || !current || current.state === 'restarting') {
+			return null
+		}
+		if (!isLaterThan(current.finished_at, remembered.started_at)) {
+			return null
+		}
+		clearRestartMemory()
+		if (current.state === 'succeeded') {
+			return 'updated'
+		}
+		if (current.state === 'failed') {
+			return 'rolled-back'
+		}
+		return remembered.kind === 'restart' ? 'restarted' : null
+	}
+
 	function dismissBanner() {
 		if (status.value) {
 			dismissedVersion.value = status.value.latest
@@ -184,6 +315,14 @@ export const useUpdateStore = defineStore('update', () => {
 		bannerVisible,
 		jobRunning,
 		readyToInstall,
+		restarting,
+		restartRun,
+		restartSlow,
+		restartNow,
+		requestRestart,
+		resumeRestart,
+		stopRestart,
+		settleRememberedRestart,
 		load,
 		poll,
 		startDownload,

web/src/views/SettingsView.vue

@@ -1,28 +1,43 @@
 <script setup lang="ts">
-import { computed, onBeforeUnmount, onMounted, ref, watch } from 'vue'
-import { useToast } from '@nuxt/ui/composables'
+import { computed, nextTick, onBeforeUnmount, onMounted, ref, watch } from 'vue'
+import { useOverlay, useToast } from '@nuxt/ui/composables'
+import ConfirmDialog from '@/components/ConfirmDialog.vue'
 import DashboardShell from '@/components/DashboardShell.vue'
+import RestartOverlay from '@/components/RestartOverlay.vue'
 import UpdatesCard from '@/components/UpdatesCard.vue'
 import { ApiError } from '@/composables/useApi'
 import { useRetryAfter } from '@/composables/useRetryAfter'
 import { useSettings } from '@/composables/useSettings'
-import type { UpdateStatus } from '@/composables/useUpdate'
-import { isCheckDue } from '@/lib/updateFormat'
+import type { RestartKind, UpdateStatus } from '@/composables/useUpdate'
+import { reloadPage } from '@/lib/reloadPage'
+import { displayVersion, isCheckDue } from '@/lib/updateFormat'
 import { useSessionStore } from '@/stores/session'
-import { useUpdateStore } from '@/stores/update'
+import { useUpdateStore, type RestartOutcome, type RestartRequestResult } from '@/stores/update'
 
 const SKELETON_DELAY_MS = 150
 const POLL_INTERVAL_MS = 1000
 const UNREACHABLE_COPY = "Couldn't reach RenewCMS. Check your connection and try again."
+const RESTART_FAILED_COPY =
+	"Couldn't start the restart. Nothing was changed and your site is still running. Try again in a moment."
+const RESTART_WARNING =
+	"Your site will be unavailable for about 10 seconds. This page reloads on its own when the site is back. Save anything you're editing first."
+const PLAIN_RESTART_DIALOG = {
+	title: 'Restart the site?',
+	description: RESTART_WARNING,
+	confirmLabel: 'Restart site',
+	cancelLabel: 'Cancel',
+}
 
 type LoadState = 'loading' | 'ready' | 'error'
 
 const { getSettings } = useSettings()
 const toast = useToast()
+const overlay = useOverlay()
 const session = useSessionStore()
 const update = useUpdateStore()
 const retry = useRetryAfter()
 
+const updatesCard = ref<InstanceType<typeof UpdatesCard> | null>(null)
 const loadState = ref<LoadState>('loading')
 const version = ref('')
 const showSkeleton = ref(false)
@@ -74,6 +89,7 @@ function neverCheckedStatus(): UpdateStatus {
 		progress: null,
 		error: null,
 		started_at: null,
+		finished_at: null,
 	}
 }
 
@@ -142,6 +158,95 @@ async function onCheck() {
 	await reloadAfterRoleChange()
 }
 
+function installRestartDialog() {
+	const version = displayVersion(update.status?.latest ?? '')
+	return {
+		title: 'Restart to finish the update?',
+		description: `RenewCMS will install version ${version} and restart. ${RESTART_WARNING}`,
+		confirmLabel: 'Restart now',
+		cancelLabel: 'Restart later',
+	}
+}
+
+async function onRestart(kind: RestartKind) {
+	const attempt = { result: 'failed' as RestartRequestResult }
+	const dialog = kind === 'update' ? installRestartDialog() : PLAIN_RESTART_DIALOG
+	const confirmed = await overlay
+		.create(ConfirmDialog, {
+			props: {
+				...dialog,
+				pendingLabel: 'Restarting…',
+				tone: 'neutral',
+				action: async () => {
+					attempt.result = await update.requestRestart(kind)
+					if (attempt.result === 'failed') {
+						throw new Error(RESTART_FAILED_COPY)
+					}
+				},
+			},
+		})
+		.open()
+
+	if (attempt.result === 'started') {
+		return
+	}
+	if (!confirmed) {
+		await nextTick()
+		updatesCard.value?.focusRestart()
+		return
+	}
+	await settleRefusedRestart(attempt.result)
+}
+
+async function settleRefusedRestart(result: RestartRequestResult) {
+	if (result === 'forbidden') {
+		notifyOnlyOwner()
+		await reloadAfterRoleChange()
+		return
+	}
+	if (result !== 'conflict') {
+		return
+	}
+	await update.load()
+	if (update.jobRunning || update.restarting) {
+		toast.add({
+			color: 'info',
+			icon: 'i-lucide-info',
+			title: 'An update is already running',
+			description: 'Another owner started it. Progress shows here.',
+		})
+	}
+	update.resumeRestart()
+}
+
+const OUTCOME_TOASTS = {
+	updated: () => ({
+		color: 'success' as const,
+		icon: 'i-lucide-circle-check',
+		title: 'Update installed',
+		description: `RenewCMS is now on version ${displayVersion(update.status?.current ?? '')}.`,
+	}),
+	'rolled-back': () => ({
+		color: 'error' as const,
+		icon: 'i-lucide-circle-x',
+		title: "The update didn't install",
+		description: `Your site is back on ${update.status?.current ?? ''}.`,
+		duration: 0,
+	}),
+	restarted: () => ({
+		color: 'success' as const,
+		icon: 'i-lucide-circle-check',
+		title: 'Site restarted',
+		description: 'Your site is running again.',
+	}),
+}
+
+async function announceRestartOutcome(outcome: RestartOutcome) {
+	toast.add(OUTCOME_TOASTS[outcome]())
+	await nextTick()
+	updatesCard.value?.focusHeading()
+}
+
 const updateRequested = ref(false)
 let autoCheckHandled = false
 
@@ -198,17 +303,32 @@ watch(
 onMounted(async () => {
 	loadSettings()
 	await update.load()
+	update.resumeRestart()
+	const outcome = update.settleRememberedRestart()
+	if (outcome) {
+		await announceRestartOutcome(outcome)
+	}
 	updateRequested.value = true
 })
 onBeforeUnmount(() => {
 	clearSkeletonTimer()
 	stopPolling()
+	update.stopRestart()
 })
 </script>
 
 <template>
 	<DashboardShell>
-		<div class="flex max-w-164 flex-col gap-5">
+		<RestartOverlay
+			v-if="update.restartRun"
+			:kind="update.restartRun.kind"
+			:version="update.restartRun.version"
+			:started-at="update.restartRun.startedAt"
+			:slow="update.restartSlow"
+			:now="update.restartNow"
+			@reload="reloadPage"
+		/>
+		<div class="flex max-w-164 flex-col gap-5" :inert="update.restartRun !== null">
 			<div class="flex flex-col gap-0.5">
 				<h1 class="text-xl font-semibold text-highlighted">Settings</h1>
 				<p class="text-muted">Workspace information.</p>
@@ -262,6 +382,7 @@ onBeforeUnmount(() => {
 
 			<UpdatesCard
 				v-if="updatesStatus"
+				ref="updatesCard"
 				:status="updatesStatus"
 				:role="session.session?.role"
 				:phase="updatesPhase"
@@ -270,6 +391,7 @@ onBeforeUnmount(() => {
 				:retry-active="retry.active.value"
 				@check="onCheck"
 				@update="onUpdate"
+				@restart="onRestart"
 			/>
 		</div>
 	</DashboardShell>

web/src/views/__tests__/HomeUpdateReady.spec.ts

@@ -8,7 +8,15 @@ import type { UpdateStatus } from '@/composables/useUpdate'
 import { DISMISSED_VERSION_KEY, useUpdateStore } from '@/stores/update'
 import { useSessionStore } from '@/stores/session'
 import HomeView from '../HomeView.vue'
-import { NEW_TAG, downloading, newerAvailable, ready, startable, verifying } from './updateTestKit'
+import {
+	NEW_TAG,
+	downloading,
+	newerAvailable,
+	ready,
+	restarting,
+	startable,
+	verifying,
+} from './updateTestKit'
 
 function mockResponse(status: number, body: unknown = null) {
 	return {
@@ -145,6 +153,22 @@ describe('Home banner, ready to install (owner)', () => {
 	})
 })
 
+describe('Home banner while restarting', () => {
+	it('shows no update banner and does not poll', async () => {
+		vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval'] })
+		await mountHome('owner', restarting())
+
+		expect(banner()).toBeNull()
+		const reads = () =>
+			vi.mocked(global.fetch).mock.calls.filter(([url]) => url === '/v1/system/update')
+		const readsAfterMount = reads().length
+		await vi.advanceTimersByTimeAsync(5000)
+
+		expect(reads()).toHaveLength(readsAfterMount)
+		vi.useRealTimers()
+	})
+})
+
 describe('Sidebar pill and mobile dot during a job', () => {
 	it.each([
 		{ name: 'downloading', status: downloading() },

web/src/views/__tests__/SettingsUpdateDownload.spec.ts

@@ -290,7 +290,7 @@ describe('Settings, owner, Verifying', () => {
 })
 
 describe('Settings, owner, Ready to install', () => {
-	it('shows the success block, a disabled Restart, the notes and the hint, and stops polling', async () => {
+	it('shows the success block, an enabled Restart, the notes and the hint, and stops polling', async () => {
 		useTimers()
 		await mountSettings({
 			role: 'owner',
@@ -310,18 +310,15 @@ describe('Settings, owner, Ready to install', () => {
 		)
 		expect(findButton("What's new in 2.3.0-beta")!.getAttribute('aria-expanded')).toBe('false')
 		const restart = findButton('Restart') as HTMLButtonElement
-		expect(restart.disabled).toBe(true)
+		expect(restart.disabled).toBe(false)
 
 		const readsBefore = callsTo(STATUS_PATH).length
-		restart.click()
-		await flushPromises()
 		await tick(3000)
 
 		expect(callsTo(STATUS_PATH)).toHaveLength(readsBefore)
 		expect(requestMock.mock.calls.map(([path]) => path)).not.toContain(
 			'/v1/system/update/restart',
 		)
-		expect(document.body.querySelector('[role="dialog"]')).toBeNull()
 	})
 })
 

web/src/views/__tests__/SettingsUpdates.spec.ts

@@ -11,7 +11,6 @@ import {
 	CHECK_PATH,
 	NEW_TAG,
 	NOTE_ITEMS,
-	RELEASE_URL,
 	RUNNING_VERSION,
 	STATUS_PATH,
 	findButton,
@@ -257,7 +256,9 @@ describe('Settings, owner, newer version, not prepared', () => {
 		const link = Array.from(updatesCard().querySelectorAll('a')).find(
 			(anchor) => anchor.textContent?.trim() === 'How to update',
 		)!
-		expect(link.getAttribute('href')).toBe(RELEASE_URL)
+		expect(link.getAttribute('href')).toBe(
+			'https://git.example/fsylvain/RenewCMS/src/branch/main/docs/deployment.md#browser-updates',
+		)
 		expect(link.getAttribute('target')).toBe('_blank')
 		expect(link.getAttribute('rel')).toContain('noopener')
 		expect(cardButtons()).toEqual(['Copy'])
@@ -441,7 +442,7 @@ describe('A check runs on the first open after 24 hours, for the owner only', ()
 	})
 })
 
-describe('No Update, Restart or progress element exists in this slice', () => {
+describe('No Update, Restart or progress element exists when the server is not prepared or for admins', () => {
 	it.each([
 		{ name: 'up to date', role: 'owner' as const, status: upToDate() },
 		{ name: 'not prepared', role: 'owner' as const, status: newerAvailable() },

web/src/views/__tests__/updateTestKit.ts

@@ -14,6 +14,7 @@ export const NOTE_ITEMS = [
 export const STATUS_PATH = '/v1/system/update'
 export const CHECK_PATH = '/v1/system/update/check'
 export const DOWNLOAD_PATH = '/v1/system/update/download'
+export const RESTART_PATH = '/v1/system/update/restart'
 
 export const BOARD_TOTAL_BYTES = 27262976
 export const BOARD_DONE_BYTES = 11534336
@@ -35,6 +36,7 @@ export function upToDate(overrides: Partial<UpdateStatus> = {}): UpdateStatus {
 		progress: null,
 		error: null,
 		started_at: null,
+		finished_at: null,
 		...overrides,
 	}
 }
@@ -94,3 +96,40 @@ export function ready(): UpdateStatus {
 export function failedWith(error: 'download' | 'verification'): UpdateStatus {
 	return startable({ state: 'failed', error, started_at: '2026-09-30T09:51:00Z' })
 }
+
+export const RESTART_STARTED_AT = '2026-09-30T09:51:00Z'
+export const RESTART_FINISHED_AT = '2026-09-30T09:52:00Z'
+
+export function restarting(): UpdateStatus {
+	return startable({ state: 'restarting', started_at: RESTART_STARTED_AT })
+}
+
+export function updateSucceeded(): UpdateStatus {
+	return upToDate({
+		current: NEW_TAG,
+		latest: NEW_TAG,
+		available: false,
+		can_apply: true,
+		state: 'succeeded',
+		started_at: RESTART_STARTED_AT,
+		finished_at: RESTART_FINISHED_AT,
+	})
+}
+
+export function rolledBack(error: 'rolled_back' | 'install' = 'rolled_back'): UpdateStatus {
+	return startable({
+		state: 'failed',
+		error,
+		started_at: RESTART_STARTED_AT,
+		finished_at: RESTART_FINISHED_AT,
+	})
+}
+
+export function plainRestartDone(): UpdateStatus {
+	return upToDate({
+		can_apply: true,
+		state: 'idle',
+		started_at: null,
+		finished_at: RESTART_FINISHED_AT,
+	})
+}

web/visual/states.ts

@@ -187,6 +187,7 @@ function updateStatusBody(overrides: Record<string, unknown> = {}) {
 		progress: null,
 		error: null,
 		started_at: null,
+		finished_at: null,
 		...overrides,
 	}
 }
@@ -248,6 +249,41 @@ function updateDownloading() {
 
 const updateCheckHangs: ApiMock = { status: 200, hang: true }
 
+const restartStartedAt = '2026-09-30T09:51:00'
+const restartFinishedAt = '2026-09-30T09:52:00'
+const restartMemoryKey = 'renewcms:update-restart'
+
+function restartApi(status: unknown, restart: ApiMock): Record<string, ApiMock> {
+	return { ...updateApi('owner', status), 'POST /v1/system/update/restart': restart }
+}
+
+function restartAccepted(status: Record<string, unknown>): ApiMock {
+	return { status: 202, body: { ...status, state: 'restarting', started_at: restartStartedAt } }
+}
+
+async function openRestartDialog(page: Page) {
+	await page.getByRole('button', { name: 'Restart', exact: true }).click()
+	await page.getByRole('alertdialog').waitFor()
+}
+
+function confirmRestart(label: string) {
+	return async (page: Page) => {
+		await openRestartDialog(page)
+		await page.getByRole('button', { name: label, exact: true }).click()
+	}
+}
+
+async function rememberRestartAndReload(page: Page) {
+	await page.evaluate(
+		([key, startedAt]) =>
+			sessionStorage.setItem(key!, JSON.stringify({ kind: 'update', started_at: startedAt })),
+		[restartMemoryKey, restartStartedAt],
+	)
+	await page.reload()
+	await page.getByText('Your site is back on v2.2.0-beta.').first().waitFor()
+	await page.mouse.move(0, 0)
+}
+
 function updateApi(
 	role: 'owner' | 'admin',
 	status: unknown,
@@ -2089,12 +2125,42 @@ export const visualStates: Record<string, Record<string, VisualState>> = {
 		Downloading: { path: '/settings', api: updateApi('owner', updateDownloading()) },
 		Verifying: { path: '/settings', api: updateApi('owner', updateJob('verifying')) },
 		'Ready to install': { path: '/settings', api: updateApi('owner', updateJob('ready')) },
-		'Restart: confirm': { path: '/settings', skip: 'pending' },
-		'Restart: request failed': { path: '/settings', skip: 'pending' },
-		'Restarting to install': { path: '/settings', skip: 'pending' },
-		'Restarting, taking longer': { path: '/settings', skip: 'pending' },
-		'Update done': { path: '/settings', skip: 'pending' },
-		'Update failed, rolled back': { path: '/settings', skip: 'pending' },
+		'Restart: confirm': {
+			path: '/settings',
+			api: restartApi(updateJob('ready'), { status: 500 }),
+			steps: openRestartDialog,
+		},
+		'Restart: request failed': {
+			path: '/settings',
+			api: restartApi(updateJob('ready'), { status: 500 }),
+			steps: async (page) => {
+				await confirmRestart('Restart now')(page)
+				await page.getByText("Couldn't start the restart").waitFor()
+				await page.mouse.move(0, 0)
+			},
+		},
+		'Restarting to install': {
+			path: '/settings',
+			api: restartApi(updateJob('ready'), restartAccepted(updateJob('ready'))),
+			steps: async (page) => {
+				await confirmRestart('Restart now')(page)
+				await page.getByText('Installing version 2.3.0').waitFor()
+			},
+		},
+		'Restarting, taking longer': { path: '/settings', skip: 'clock-sensitive' },
+		'Update done': { path: '/settings', skip: 'clock-sensitive' },
+		'Update failed, rolled back': {
+			path: '/settings',
+			api: updateApi(
+				'owner',
+				updateJob('failed', {
+					error: 'rolled_back',
+					started_at: restartStartedAt,
+					finished_at: restartFinishedAt,
+				}),
+			),
+			steps: rememberRestartAndReload,
+		},
 		'Download failed': {
 			path: '/settings',
 			api: updateApi('owner', updateJob('failed', { error: 'download' })),
@@ -2123,9 +2189,23 @@ export const visualStates: Record<string, Record<string, VisualState>> = {
 				await page.mouse.move(0, 0)
 			},
 		},
-		'Plain restart: confirm': { path: '/settings', skip: 'pending' },
-		'Plain restart: restarting': { path: '/settings', skip: 'pending' },
-		'Plain restart: done': { path: '/settings', skip: 'pending' },
+		'Plain restart: confirm': {
+			path: '/settings',
+			api: restartApi(updateStatusBody({ can_apply: true }), { status: 500 }),
+			steps: openRestartDialog,
+		},
+		'Plain restart: restarting': {
+			path: '/settings',
+			api: restartApi(
+				updateStatusBody({ can_apply: true }),
+				restartAccepted(updateStatusBody({ can_apply: true })),
+			),
+			steps: async (page) => {
+				await confirmRestart('Restart site')(page)
+				await page.getByText('Restarting your site').waitFor()
+			},
+		},
+		'Plain restart: done': { path: '/settings', skip: 'clock-sensitive' },
 		'Admin view': {
 			path: '/settings',
 			api: updateApi('admin', updateAvailable()),