@maudecode/talaria-web 1.18.0 → 1.20.0

package/dist/tools/update-notifications.js

@@ -1,8 +1,21 @@
-import { existsSync, mkdirSync, readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
-import { atomicWriteSecretJson } from '../fs/atomic.js';
-const PHASES = new Set(['applying', 'awaiting_confirmation', 'restarting', 'succeeded', 'blocked', 'failed', 'unknown']);
+import { readDocument } from '../sessions/storage/document.js';
+import { str } from '../util.js';
+export function updateNotificationOwner(session) {
+    const authType = str(session?.auth_type).trim();
+    if (authType === 'oidc') {
+        const issuer = str(session?.oidc_issuer).trim();
+        const subject = typeof session?.oidc_subject === 'string' ? session.oidc_subject : '';
+        if (issuer && subject.trim())
+            return `oidc:${createHash('sha256').update(JSON.stringify([issuer, subject]), 'utf8').digest('hex')}`;
+        const token = str(session?.token).trim();
+        if (token)
+            return `oidc-session:${createHash('sha256').update(JSON.stringify([token]), 'utf8').digest('hex')}`;
+    }
+    const username = str(session?.username).trim();
+    return username ? `${authType || 'auth'}:${username}` : 'local-owner';
+}
+const PHASES = new Set(['applying', 'awaiting_confirmation', 'waiting_for_idle', 'restarting', 'verifying', 'succeeded', 'blocked', 'failed', 'unknown']);
 const REVISION = /^[a-f0-9]{40}$/;
 const PER_SCOPE_LIMIT = 50;
 const GLOBAL_LIMIT = 500;
@@ -10,52 +23,130 @@ export const FRONTEND_BUILD = /^[a-f0-9]{64}$/;
 export const TAB_ID = /^[A-Za-z0-9_-]{8,64}$/;
 export const WEB_REFRESH_KIND = 'web_refresh';
 export const WEB_REFRESH_ACTION = 'reload';
+/** TAL-953: restart the gateway now instead of waiting for its running work to finish. */
+export const GATEWAY_RESTART_NOW = 'restart_gateway_now';
+const GATEWAY_RESTART_NOW_ACTION = { id: GATEWAY_RESTART_NOW, label: 'Restart now', style: 'destructive', acknowledges: false };
 /** A closed tab stops checking in; its refresh notice is dropped once unseen this long. An open tab recreates it on its next check. */
 const TAB_TTL_MS = 60 * 60 * 1000;
-const copy = (row) => ({
-    id: row.id, kind: row.kind, target: row.target, phase: row.phase, severity: row.severity,
-    persistent: row.persistent, requires_acknowledgement: row.requires_acknowledgement, actions: row.actions,
-    destination: row.destination,
-    title: row.title, message: row.message, created_at: row.created_at, updated_at: row.updated_at, read_at: row.read_at,
-    acknowledged_at: row.acknowledged_at, acknowledged_action_id: row.acknowledged_action_id,
-    verified_revision: row.verified_revision, verified_version: row.verified_version, detail: row.detail,
-    unread: row.read_at === null,
-    active: row.kind === 'update' && ['applying', 'restarting'].includes(row.phase),
-    requires_interaction: row.requires_acknowledgement && row.acknowledged_at === null,
-    can_dismiss: isDismissible(row),
-});
+const FAILED_MESSAGE = 'The update could not be completed.';
+const STEP_IDS = new Set(['install', 'web_restart', 'ready', 'gateway_wait', 'gateway_restart', 'agent_ready']);
+/** Phases in which an update the user started presents its Updating dialog to every tab that can see it. */
+const PRESENTING = new Set(['applying', 'restarting', 'verifying']);
+const TERMINAL_FAILURE = new Set(['failed', 'blocked', 'unknown']);
+/** TAL-953: the waiting gateway restart's message, with the running task count once one is known. */
+const gatewayWaitingMessage = (tasks) => tasks > 0
+    ? `Waiting for ${String(tasks)} running gateway task${tasks === 1 ? '' : 's'} to finish before restarting the gateway.`
+    : 'Waiting for running gateway tasks to finish before restarting the gateway.';
 const wording = (target, phase) => {
     const name = target === 'webui' ? 'Talaria Web' : 'Hermes Agent';
     const messages = {
         applying: `Installing the selected ${name} update.`,
         awaiting_confirmation: 'This Hermes Agent revision needs confirmation before it can be installed.',
-        restarting: target === 'webui' ? 'The update is installed. Talaria Web is restarting.' : 'The update is installed. Hermes Agent is restarting.',
+        waiting_for_idle: gatewayWaitingMessage(0),
+        restarting: target === 'webui' ? 'The update is installed. Talaria Web is restarting.' : 'The update is installed. The messaging gateway is restarting.',
+        verifying: 'The update is installed. Checking that Hermes Agent responds.',
         succeeded: `${name} was updated successfully.`,
         blocked: 'The update is waiting for active work to finish.',
-        failed: 'The update could not be completed. Open System settings for details.',
+        failed: FAILED_MESSAGE,
         unknown: 'The connection closed before completion could be verified. Check the installed version before trying again.',
     };
     return { title: `${name} update`, message: messages[phase] };
 };
+const RELOAD_IN_DIALOG = { id: WEB_REFRESH_ACTION, label: 'Reload', style: 'primary', acknowledges: false };
+/** Release tags name versions as `web-v1.2.3`; the dialog shows `1.2.3`. */
+const shownVersion = (version) => version ? ` ${version.replace(/^web-(?:exp-)?v/, '')}` : '';
+/** TAL-1138: the step an update is on, or null once it succeeded. `webPending`: its Talaria Web restart has not happened yet. */
+function currentStep(row, webPending) {
+    if (TERMINAL_FAILURE.has(row.phase))
+        return row.failed_step ?? 'install';
+    if (row.phase === 'succeeded')
+        return null;
+    if (row.phase === 'restarting')
+        return row.target === 'webui' ? 'web_restart' : 'gateway_restart';
+    if (row.phase === 'waiting_for_idle')
+        return webPending ? 'web_restart' : 'gateway_wait';
+    if (row.phase === 'verifying')
+        return webPending ? 'web_restart' : 'agent_ready';
+    return 'install';
+}
+/**
+ * TAL-1138: the update's steps as the Updating dialog lists them. Web: Installing, Restarting Talaria Web, Ready.
+ * Agent: Installing, Restarting Talaria Web, Waiting for gateway tasks (only once the gateway was busy), Restarting
+ * gateway, Agent responding. An update that finished without restarting anything lists only the steps it ran.
+ */
+function updateSteps(row, webPending) {
+    if (row.kind !== 'update' || !row.target)
+        return [];
+    const current = currentStep(row, webPending);
+    const undecided = ['applying', 'awaiting_confirmation'].includes(row.phase);
+    // Each restart step needs its own evidence: a scheduled Web restart, or a gateway restart under way or recorded.
+    const webRestarts = undecided || row.web_restart_boot !== null || current === 'web_restart';
+    const gatewayRestarts = undecided || ['waiting_for_idle', 'restarting'].includes(row.phase) || row.gateway_baseline !== null || current === 'gateway_wait' || current === 'gateway_restart';
+    const succeeded = row.phase === 'succeeded';
+    const tasks = row.gateway_tasks ?? 0;
+    const plan = row.target === 'webui'
+        ? [['install', 'Installing'], ...(webRestarts ? [['web_restart', 'Restarting Talaria Web']] : []), ['ready', succeeded ? `Talaria Web${shownVersion(row.verified_version)} is ready` : 'Ready']]
+        : [
+            ['install', 'Installing'],
+            ...(webRestarts ? [['web_restart', 'Restarting Talaria Web']] : []),
+            ...(row.gateway_tasks !== null || current === 'gateway_wait' ? [['gateway_wait', tasks > 0 ? `Waiting for ${String(tasks)} gateway task${tasks === 1 ? '' : 's'}` : 'Waiting for gateway tasks']] : []),
+            ...(gatewayRestarts ? [['gateway_restart', 'Restarting gateway']] : []),
+            ['agent_ready', succeeded ? `Hermes Agent${shownVersion(row.verified_version)} is running` : 'Agent responding'],
+        ];
+    const at = current === null ? plan.length : plan.findIndex(([id]) => id === current);
+    return plan.map(([id, label], index) => ({ id, label, state: index < at ? 'done' : index > at ? 'pending' : TERMINAL_FAILURE.has(row.phase) ? 'failed' : 'active' }));
+}
 export class UpdateNotificationStore {
+    documents;
     now;
-    rows;
-    file;
+    rows = [];
+    revision = null;
+    writes = Promise.resolve();
     /** Last check-in per tab refresh notice; kept in memory so polling never rewrites the store. */
     tabSeen = new Map();
     loadedAt;
-    constructor(stateDir, now = () => new Date()) {
+    /** This server process; an update whose Web restart another process scheduled has restarted Web. */
+    boot = randomUUID();
+    constructor(documents, now = () => new Date()) {
+        this.documents = documents;
         this.now = now;
-        this.file = resolve(stateDir, 'update-notifications.json');
-        this.rows = this.load();
         this.loadedAt = this.now().valueOf();
     }
+    async initialize() { this.rows = await this.load(); }
+    /** Startup warnings outlive any chat or Agent. Repeats retain read/dismissal state until the full text changes. */
+    async agentWarning(scope, key, notice) {
+        const row = this.rows.find((entry) => entry.kind === 'agent_warning' && entry.notice_key === key && entry.owner === scope.owner && entry.profile === scope.profile);
+        if (!notice) {
+            if (!row)
+                return;
+            this.rows = this.rows.filter((entry) => entry !== row);
+            return this.save();
+        }
+        const message = safeText(notice.text, '', 500);
+        if (!message)
+            return;
+        const textHash = createHash('sha256').update(notice.text).digest('hex');
+        const severity = notice.level === 'error' ? 'critical' : notice.level === 'warn' ? 'warning' : 'info';
+        if (!row) {
+            await this.createRow(scope, { kind: 'agent_warning', target: 'agent', phase: 'active', severity, persistent: true, title: 'Agent warning', message }, { notice_key: key, notice_text_hash: textHash });
+            return;
+        }
+        row.updated_at = this.now().toISOString();
+        if (row.notice_text_hash !== textHash) {
+            row.message = message;
+            row.severity = severity;
+            row.notice_text_hash = textHash;
+            row.read_at = null;
+            row.dismissed_at = null;
+        }
+        await this.save();
+    }
     /**
      * Compare the frontend build a tab loaded with the build this server now serves. A mismatch keeps one
      * persistent, tab-scoped refresh notice per tab; a match resolves and removes it. Unknown builds change nothing.
      */
-    syncTabBuild(scope, loadedBuild, currentBuild) {
-        this.pruneClosedTabs();
+    async syncTabBuild(scope, loadedBuild, currentBuild) {
+        await this.pruneClosedTabs();
         const tab = scope.tab && TAB_ID.test(scope.tab) ? scope.tab : null;
         const loaded = loadedBuild && FRONTEND_BUILD.test(loadedBuild) ? loadedBuild : null;
         const current = currentBuild && FRONTEND_BUILD.test(currentBuild) ? currentBuild : null;
@@ -67,11 +158,20 @@ export class UpdateNotificationStore {
             if (existing) {
                 this.rows = this.rows.filter((row) => row !== existing);
                 this.tabSeen.delete(existing.id);
-                this.save();
+                await this.save();
             }
             return state;
         }
         state.refresh_required = true;
+        // TAL-1138: the Web update this tab started offers Reload in its own Updating dialog instead.
+        if (this.rows.some((row) => this.isVisible(row, scope) && this.reloadsInDialog(row, tab, true))) {
+            if (existing) {
+                this.rows = this.rows.filter((row) => row !== existing);
+                this.tabSeen.delete(existing.id);
+                await this.save();
+            }
+            return state;
+        }
         const stamp = this.now().toISOString();
         if (existing) {
             this.tabSeen.set(existing.id, this.now().valueOf());
@@ -79,7 +179,7 @@ export class UpdateNotificationStore {
                 existing.expected_identity = current;
                 existing.updated_at = stamp;
                 existing.read_at = null;
-                this.save();
+                await this.save();
             }
             state.notification_id = existing.id;
             return state;
@@ -93,35 +193,126 @@ export class UpdateNotificationStore {
             created_at: stamp, updated_at: stamp, read_at: null, acknowledged_at: null,
             acknowledged_action_id: null, verified_revision: null, verified_version: null, detail: null,
             performed_action_ids: [], dismissed_at: null, expected_identity: current, tab_id: tab, watchers: [],
+            web_restart_boot: null, gateway_tasks: null, gateway_baseline: null, failed_step: null,
         };
         if (!this.hasProtectedCapacity(row))
             return state;
         this.rows.push(row);
         this.tabSeen.set(row.id, this.now().valueOf());
-        this.save();
+        await this.save();
         state.notification_id = row.id;
         return state;
     }
-    begin(scope, target) {
+    async begin(scope, target) {
         const text = wording(target, 'applying');
-        const created = this.create(scope, {
+        const created = (await this.create(scope, {
             kind: 'update', target, phase: 'applying', ...text,
             destination: { key: 'settings.system', label: 'Open System settings' },
             visibility: 'server',
-        });
-        this.watch(scope, created.id);
+        }));
+        await this.watch(scope, created.id);
         return created;
     }
+    /** A retained notice still needs loaded-readiness verification after native debt clears. */
+    hasPendingAgentRecovery() {
+        const row = this.rows.findLast((entry) => entry.kind === 'agent_recovery');
+        return row !== undefined && row.phase !== 'succeeded';
+    }
+    /** Recovery has its own row, so it can never rewrite the initiating update's failed outcome. */
+    async agentRecovery(state) {
+        if (state.phase === 'idle')
+            return;
+        const phase = state.phase === 'complete' ? 'succeeded' : state.phase === 'running' ? 'applying' : 'blocked';
+        const title = 'Hermes Agent recovery';
+        const message = state.phase === 'complete' ? 'Hermes Agent is usable again. The original update result is unchanged.'
+            : state.phase === 'running' ? 'Recovering Hermes Agent after an interrupted update.'
+                : state.phase === 'waiting' ? 'Hermes Agent recovery will retry automatically.' : 'Hermes Agent recovery needs attention.';
+        const row = this.rows.findLast((entry) => entry.kind === 'agent_recovery');
+        if (!row) {
+            await this.create({ owner: '*', profile: 'default', serverOwner: true }, {
+                kind: 'agent_recovery', target: 'agent', phase, title, message, visibility: 'server',
+                severity: state.phase === 'blocked' ? 'warning' : 'info',
+            });
+            return this.agentRecovery(state);
+        }
+        if (row.phase === phase && row.message === message && row.detail === safeDetail(state.detail))
+            return;
+        row.phase = phase;
+        row.title = title;
+        row.message = message;
+        row.detail = safeDetail(state.detail);
+        row.severity = state.phase === 'blocked' ? 'warning' : 'info';
+        row.updated_at = this.now().toISOString();
+        row.dismissed_at = null;
+        row.read_at = null;
+        await this.save();
+    }
+    /**
+     * A question the server asks about one profile (TAL-1274), seen by every server owner while that profile is active. Its
+     * open row is refreshed in place; null withdraws it once nothing asks it any more. An answered row stays as history.
+     */
+    async profileQuestion(profile, kind, input) {
+        const open = this.rows.find((row) => row.kind === kind && row.owner === '*' && row.profile === profile && row.acknowledged_at === null);
+        if (!input) {
+            if (!open)
+                return;
+            this.rows = this.rows.filter((row) => row !== open);
+            return this.save();
+        }
+        if (!open) {
+            await this.create({ owner: '*', profile, serverOwner: true }, { ...input, kind, requiresAcknowledgement: true });
+            return;
+        }
+        const message = safeText(input.message, '', 500);
+        const detail = safeDetail(input.detail);
+        if (!message || (open.message === message && open.detail === detail))
+            return;
+        open.message = message;
+        open.detail = detail;
+        open.updated_at = this.now().toISOString();
+        open.read_at = null;
+        await this.save();
+    }
+    /** Drop all profile-scoped state, including dismissed warning identities, when a profile is deleted. */
+    async forgetProfile(profile) {
+        const kept = this.rows.filter((row) => !(row.visibility === 'profile' && row.profile === profile));
+        if (kept.length === this.rows.length)
+            return;
+        this.rows = kept;
+        await this.save();
+    }
+    /** The open question `id` of `kind` this scope sees, or null. */
+    openQuestion(scope, id, kind) {
+        const row = this.visible(scope, id);
+        return row?.kind === kind && row.owner === '*' && row.acknowledged_at === null ? this.publish(row, scope.tab) : null;
+    }
+    /** Record the answer to an open question: its outcome replaces the question, which then leaves only Dismiss. */
+    async answerQuestion(scope, id, kind, actionId, outcome) {
+        const row = this.visible(scope, id);
+        if (row?.kind !== kind || row.owner !== '*' || row.acknowledged_at !== null || !row.actions.some((action) => action.id === actionId))
+            return null;
+        const stamp = this.now().toISOString();
+        Object.assign(row, {
+            phase: 'succeeded', severity: 'info', message: safeText(outcome, row.message, 500), detail: null, actions: [],
+            updated_at: stamp, read_at: row.read_at ?? stamp, acknowledged_at: stamp, acknowledged_action_id: actionId,
+            performed_action_ids: [...row.performed_action_ids, actionId],
+        });
+        await this.save();
+        return this.publish(row, scope.tab);
+    }
     /** Let the requesting tab follow an update operation it started or rejoined. Watchers live as long as the record; only a server owner's Update click adds one. */
-    watch(scope, id) {
+    async watch(scope, id) {
         const tab = scope.tab && TAB_ID.test(scope.tab) ? scope.tab : null;
         const row = this.rows.find((entry) => entry.id === id && entry.kind === 'update' && this.isVisible(entry, scope));
         if (!tab || !row)
             return;
         row.watchers = [...row.watchers.filter((watcher) => watcher.tab !== tab), { tab, at: this.now().toISOString() }];
-        this.save();
+        await this.save();
+    }
+    async create(scope, input) {
+        return this.publish(await this.createRow(scope, input));
     }
-    create(scope, input) {
+    async createRow(scope, input, notice = {}) {
         const kind = safeToken(input.kind, '');
         const phase = safeToken(input.phase, '');
         const title = safeText(input.title, '', 160);
@@ -134,60 +325,117 @@ export class UpdateNotificationStore {
         const stamp = this.now().toISOString();
         const row = {
             id: randomUUID(), owner: scope.owner.slice(0, 256), profile: scope.profile.slice(0, 64), visibility: input.visibility ?? 'profile',
-            kind, target: input.target ?? null, phase, severity: input.severity ?? 'info',
+            ...notice, kind, target: input.target ?? null, phase, severity: input.severity ?? 'info',
             persistent: input.requiresAcknowledgement === true || input.persistent === true,
             requires_acknowledgement: input.requiresAcknowledgement === true, actions,
             destination: safeDestination(input.destination), title, message,
             created_at: stamp, updated_at: stamp, read_at: null, acknowledged_at: null,
-            acknowledged_action_id: null, verified_revision: null, verified_version: null, detail: null,
+            acknowledged_action_id: null, verified_revision: null, verified_version: null, detail: safeDetail(input.detail),
             performed_action_ids: [], dismissed_at: null, expected_identity: null, tab_id: null, watchers: [],
+            web_restart_boot: null, gateway_tasks: null, gateway_baseline: null, failed_step: null,
         };
         if (!this.hasProtectedCapacity(row))
             throw new Error('Update notification protected capacity reached');
         this.rows.push(row);
-        this.save();
-        return copy(row);
+        await this.save();
+        return row;
     }
     activeUpdate(scope, target) {
-        const row = [...this.rows].reverse().find((entry) => this.isVisible(entry, scope) && entry.kind === 'update' && entry.target === target && ['applying', 'awaiting_confirmation', 'restarting'].includes(entry.phase));
-        return row ? copy(row) : null;
+        const row = [...this.rows].reverse().find((entry) => this.isVisible(entry, scope) && entry.kind === 'update' && entry.target === target && ['applying', 'awaiting_confirmation', 'restarting', 'verifying'].includes(entry.phase));
+        return row ? this.publish(row) : null;
     }
-    transition(id, phase, expectedIdentity, verifiedIdentity, detail) {
+    async transition(id, phase, expectedIdentity, verifiedIdentity, detail) {
         const row = this.rows.find((entry) => entry.id === id);
         if (!row)
             return null;
         const phaseChanged = row.phase !== phase;
+        // TAL-1138: a failure keeps the step it stopped at, so the dialog marks that step failed.
+        if (!TERMINAL_FAILURE.has(phase))
+            row.failed_step = null;
+        else if (!TERMINAL_FAILURE.has(row.phase))
+            row.failed_step = currentStep(row, this.webPending(row)) ?? 'install';
+        if (row.kind === 'update' && row.target === 'webui' && phase === 'restarting')
+            row.web_restart_boot = this.boot;
         row.phase = phase;
         if (row.target)
             Object.assign(row, wording(row.target, phase));
+        if (phase === 'awaiting_confirmation')
+            row.message = safeText(detail, row.message, 500);
         row.updated_at = this.now().toISOString();
         if (phaseChanged)
             row.read_at = null;
         row.expected_identity = expectedIdentity?.trim().slice(0, 160) || null;
-        row.detail = phase === 'failed' || phase === 'blocked' || phase === 'succeeded' ? safeDetail(detail) : null;
+        row.detail = phase === 'applying' || phase === 'failed' || phase === 'blocked' || phase === 'succeeded' || phase === 'waiting_for_idle' || phase === 'verifying' ? safeDetail(detail) : null;
+        // The gateway restart is server-wide: every server owner sees the wait and can restart now, and a later update joins it.
+        if (row.kind === 'update' && phase === 'waiting_for_idle' && row.visibility === 'server')
+            row.owner = '*';
+        // Only a waiting gateway restart offers an action; entering the wait offers it afresh.
+        if (row.kind === 'update') {
+            row.actions = phase === 'waiting_for_idle' ? [GATEWAY_RESTART_NOW_ACTION] : [];
+            row.performed_action_ids = row.performed_action_ids.filter((action) => action !== GATEWAY_RESTART_NOW);
+        }
         if (verifiedIdentity) {
             row.verified_revision = typeof verifiedIdentity.revision === 'string' && REVISION.test(verifiedIdentity.revision) ? verifiedIdentity.revision : null;
             row.verified_version = safeText(verifiedIdentity.version, '', 80) || null;
         }
-        this.save();
-        return copy(row);
+        await this.save();
+        return this.publish(row);
+    }
+    /** TAL-953: update the waiting gateway restart's message as its running task count changes. */
+    async gatewayWaiting(id, tasks) {
+        const row = this.rows.find((entry) => entry.id === id && entry.kind === 'update' && entry.phase === 'waiting_for_idle');
+        const message = gatewayWaitingMessage(tasks);
+        const counted = tasks > 0 ? tasks : row?.gateway_tasks ?? null;
+        if (!row || (row.message === message && row.gateway_tasks === counted))
+            return;
+        row.message = message;
+        row.gateway_tasks = counted;
+        row.updated_at = this.now().toISOString();
+        await this.save();
+    }
+    /** TAL-1138: this Agent update scheduled a Talaria Web restart; its gateway steps follow the restarted server. */
+    async markWebRestart(id) {
+        const row = this.rows.find((entry) => entry.id === id && entry.kind === 'update');
+        if (!row || row.web_restart_boot === this.boot)
+            return;
+        row.web_restart_boot = this.boot;
+        row.updated_at = this.now().toISOString();
+        await this.save();
+    }
+    /** TAL-1138: the live gateway processes a restart must replace before the update's check can pass. */
+    async recordGatewayBaseline(id, baseline) {
+        const row = this.rows.find((entry) => entry.id === id && entry.kind === 'update');
+        if (!row)
+            return;
+        row.gateway_baseline = baseline.slice(0, 8).map((entry) => ({ ...entry }));
+        await this.save();
     }
-    list(scope) {
-        this.pruneClosedTabs();
+    /**
+     * TAL-953: gateway restarts still waiting for idle, and (TAL-1138) restarted gateways still being checked, newest
+     * first, with the profile each update ran under, so a restarted server resumes them.
+     */
+    pendingGatewayRestarts() {
+        return this.rows.filter((row) => row.kind === 'update' && (row.phase === 'waiting_for_idle' || row.phase === 'verifying'))
+            .sort((a, b) => b.created_at.localeCompare(a.created_at))
+            .map((row) => ({ id: row.id, profile: row.profile, detail: row.detail, phase: row.phase, baseline: row.gateway_baseline }));
+    }
+    /** `stale`: the requesting tab runs an older frontend build than the server serves (`syncTabBuild`'s comparison). */
+    async list(scope, stale = false) {
+        await this.pruneClosedTabs();
         const scoped = this.rows.filter((row) => this.isVisible(row, scope) && row.dismissed_at === null);
         const ordered = scoped.sort((a, b) => b.updated_at.localeCompare(a.updated_at));
         const protectedRows = ordered.filter(isProtected);
         const visible = [...protectedRows, ...ordered.filter((row) => !isProtected(row)).slice(0, Math.max(0, PER_SCOPE_LIMIT - protectedRows.length))]
             .sort((a, b) => b.updated_at.localeCompare(a.updated_at));
-        const notifications = visible.map(copy);
-        const clearableCount = scoped.filter(isDismissible).length;
         const tab = scope.tab && TAB_ID.test(scope.tab) ? scope.tab : null;
+        const notifications = visible.map((row) => this.publish(row, tab, stale));
+        const clearableCount = scoped.filter(isDismissible).length;
         const joinedAt = (row) => row.watchers.find((watcher) => watcher.tab === tab)?.at ?? '';
         const tabUpdate = tab ? this.rows.filter((row) => row.kind === 'update' && joinedAt(row) !== '' && this.isVisible(row, scope))
             .sort((a, b) => joinedAt(b).localeCompare(joinedAt(a)) || b.created_at.localeCompare(a.created_at))[0] : undefined;
-        return { scope_id: updateNotificationScopeId(scope), notifications, tab_update: tabUpdate ? copy(tabUpdate) : null, tab_joined_at: tabUpdate ? joinedAt(tabUpdate) : null, unread_count: visible.filter((row) => row.read_at === null).length, clearable_count: clearableCount, can_clear: clearableCount > 0 };
+        return { scope_id: updateNotificationScopeId(scope), notifications, tab_update: tabUpdate ? this.publish(tabUpdate, tab, stale) : null, tab_joined_at: tabUpdate ? joinedAt(tabUpdate) : null, unread_count: visible.filter((row) => row.read_at === null).length, clearable_count: clearableCount, can_clear: clearableCount > 0 };
     }
-    clear(scope) {
+    async clear(scope, stale = false) {
         const stamp = this.now().toISOString();
         let changed = false;
         for (const row of this.rows) {
@@ -197,40 +445,41 @@ export class UpdateNotificationStore {
             changed = true;
         }
         if (changed)
-            this.save();
-        return this.list(scope);
+            (await this.save());
+        return (await this.list(scope, stale));
     }
-    read(scope, id) {
+    async read(scope, id) {
         const row = this.visible(scope, id);
         if (!row)
             return null;
         if (row.read_at === null) {
             row.read_at = this.now().toISOString();
-            this.save();
+            (await this.save());
         }
-        return copy(row);
+        return this.publish(row);
     }
-    dismiss(scope, id) {
+    async dismiss(scope, id) {
         const row = this.rows.find((entry) => entry.id === id && this.isVisible(entry, scope));
         if (!row)
             return 'not_found';
-        if (row.requires_acknowledgement && row.acknowledged_at === null)
+        if (!isDismissible(row))
             return 'acknowledgement_required';
         if (row.dismissed_at === null) {
             const stamp = this.now().toISOString();
             row.dismissed_at = stamp;
             row.read_at ??= stamp;
-            this.save();
+            (await this.save());
         }
         return 'dismissed';
     }
-    action(scope, id, actionId) {
+    async action(scope, id, actionId) {
         const row = this.visible(scope, id);
-        const action = row?.actions.find((candidate) => candidate.id === actionId);
+        // A Reload in the Updating dialog is offered only while the tab is stale; the action itself never depends on it.
+        const action = row ? this.publish(row, scope.tab, true).actions.find((candidate) => candidate.id === actionId) : undefined;
         if (!row || !action)
             return null;
         if (row.performed_action_ids.includes(action.id))
-            return copy(row);
+            return this.publish(row, scope.tab, true);
         const stamp = this.now().toISOString();
         row.updated_at = stamp;
         row.read_at ??= stamp;
@@ -239,15 +488,15 @@ export class UpdateNotificationStore {
             row.acknowledged_at = stamp;
             row.acknowledged_action_id = action.id;
         }
-        this.save();
-        return copy(row);
+        await this.save();
+        return this.publish(row, scope.tab, true);
     }
-    cancelUpdate(scope, id) {
+    async cancelUpdate(scope, id) {
         const row = this.rows.find((entry) => entry.id === id && this.isVisible(entry, scope) && entry.kind === 'update');
         if (!row)
             return null;
         if (row.phase === 'blocked' && row.message === 'The update was cancelled before installation.')
-            return copy(row);
+            return this.publish(row);
         if (row.phase !== 'awaiting_confirmation')
             return null;
         const stamp = this.now().toISOString();
@@ -255,15 +504,25 @@ export class UpdateNotificationStore {
         row.message = 'The update was cancelled before installation.';
         row.updated_at = stamp;
         row.read_at ??= stamp;
-        this.save();
-        return copy(row);
+        await this.save();
+        return this.publish(row);
     }
-    reconcileInterruptedUpdates(currentWebIdentity, currentWebVersion = null) {
+    async reconcileInterruptedUpdates(currentWebIdentity, currentWebVersion = null) {
         let changed = false;
         for (const row of this.rows) {
+            if (row.kind === 'agent_recovery' && row.phase === 'applying') {
+                row.phase = 'unknown';
+                row.message = 'Agent recovery was interrupted. Current readiness has not been verified.';
+                row.severity = 'warning';
+                row.updated_at = this.now().toISOString();
+                row.read_at = null;
+                changed = true;
+                continue;
+            }
             if (row.kind !== 'update' || (row.target !== 'webui' && row.target !== 'agent') || !['applying', 'restarting'].includes(row.phase))
                 continue;
             const phase = row.target === 'webui' && row.phase === 'restarting' && currentWebIdentity && REVISION.test(currentWebIdentity) && row.expected_identity === currentWebIdentity ? 'succeeded' : 'unknown';
+            row.failed_step = phase === 'unknown' ? currentStep(row, false) ?? 'install' : null;
             row.phase = phase;
             Object.assign(row, wording(row.target, phase));
             row.updated_at = this.now().toISOString();
@@ -275,7 +534,44 @@ export class UpdateNotificationStore {
             changed = true;
         }
         if (changed)
-            this.save();
+            (await this.save());
+    }
+    /** TAL-1138: this update's Talaria Web restart is scheduled but has not happened yet. */
+    webPending(row) { return row.web_restart_boot === this.boot; }
+    /**
+     * TAL-1138: a Web update that `tab` started finished while the tab still runs the old build. The tab's Updating
+     * dialog offers Reload in place of the separate refresh notice; a later Web update takes that over.
+     */
+    reloadsInDialog(row, tab, stale) {
+        if (!stale || !tab || row.kind !== 'update' || row.target !== 'webui' || row.phase !== 'succeeded' || !row.watchers.some((watcher) => watcher.tab === tab))
+            return false;
+        return !this.rows.some((other) => other !== row && other.kind === 'update' && other.target === 'webui' && other.created_at > row.created_at);
+    }
+    /** The record as clients see it; `tab` and `stale` (its loaded build is not the one served) decide the Reload in its dialog. */
+    publish(row, tab = null, stale = false) {
+        const webPending = this.webPending(row);
+        const reload = this.reloadsInDialog(row, tab, stale);
+        const presents = reload || (row.kind === 'update' && row.watchers.length > 0 && (PRESENTING.has(row.phase) || (row.phase === 'waiting_for_idle' && webPending)));
+        return {
+            id: row.id, kind: row.kind, target: row.target, phase: row.phase, severity: row.severity,
+            persistent: row.persistent, requires_acknowledgement: row.requires_acknowledgement,
+            // The Restart now action waits for the restarted Web server, which runs the gateway restart.
+            actions: reload ? [RELOAD_IN_DIALOG] : row.kind === 'update' && row.phase === 'waiting_for_idle' && webPending ? [] : row.actions,
+            destination: row.kind === 'update' && row.phase === 'failed' && row.destination?.key === 'settings.system' ? null : row.destination,
+            title: row.title,
+            // Old persisted failures still carry the obsolete guidance; correct only that generic copy.
+            message: row.kind === 'update' && row.phase === 'failed' && row.message === `${FAILED_MESSAGE} Open System settings for details.` ? FAILED_MESSAGE : row.message,
+            created_at: row.created_at, updated_at: row.updated_at, read_at: row.read_at,
+            acknowledged_at: row.acknowledged_at, acknowledged_action_id: row.acknowledged_action_id,
+            verified_revision: row.verified_revision, verified_version: row.verified_version, detail: row.detail,
+            unread: row.read_at === null,
+            active: ['update', 'agent_recovery'].includes(row.kind) && ['applying', 'restarting', 'verifying'].includes(row.phase),
+            requires_interaction: row.requires_acknowledgement && row.acknowledged_at === null,
+            can_dismiss: isDismissible(row),
+            steps: updateSteps(row, webPending),
+            presents_dialog: presents,
+            dialog_close: presents ? 'none' : row.kind !== 'update' ? 'close' : row.phase === 'waiting_for_idle' ? 'restart_later' : row.phase === 'succeeded' ? 'auto' : 'close',
+        };
     }
     visible(scope, id) {
         return this.rows.find((row) => row.id === id && this.isVisible(row, scope) && row.dismissed_at === null) ?? null;
@@ -285,13 +581,15 @@ export class UpdateNotificationStore {
             return row.tab_id === scope.tab && row.owner === scope.owner && row.profile === scope.profile;
         if (row.visibility === 'server')
             return scope.serverOwner === true && (row.owner === scope.owner || row.owner === '*');
+        if (row.owner === '*')
+            return scope.serverOwner === true && (row.profile === scope.profile || (row.profile === 'default' && scope.rootProfile === true));
         return row.owner === scope.owner && row.profile === scope.profile;
     }
     hasProtectedCapacity(row) {
         const peers = this.rows.filter((entry) => isProtected(entry) && isTabNotice(entry) === isTabNotice(row));
         return peers.filter((entry) => retentionBucket(entry) === retentionBucket(row)).length < PER_SCOPE_LIMIT && peers.length < GLOBAL_LIMIT;
     }
-    pruneClosedTabs() {
+    async pruneClosedTabs() {
         const cutoff = this.now().valueOf() - TAB_TTL_MS;
         const closed = this.rows.filter((row) => row.tab_id !== null && (this.tabSeen.get(row.id) ?? this.loadedAt) < cutoff);
         if (closed.length === 0)
@@ -299,13 +597,13 @@ export class UpdateNotificationStore {
         for (const row of closed)
             this.tabSeen.delete(row.id);
         this.rows = this.rows.filter((row) => !closed.includes(row));
-        this.save();
+        await this.save();
     }
-    load() {
-        if (!existsSync(this.file))
-            return [];
+    async load() {
         try {
-            const parsed = JSON.parse(readFileSync(this.file, 'utf8'));
+            const record = await readDocument(this.documents, 'update-notifications', 'update-notifications', { replaceInvalid: true });
+            this.revision = record?.revision ?? null;
+            const parsed = record?.value;
             if (!Array.isArray(parsed))
                 return [];
             return parsed.flatMap((value) => {
@@ -319,9 +617,11 @@ export class UpdateNotificationStore {
                     return [];
                 const kind = safeToken(row.kind, 'update');
                 const target = row.target === 'webui' || row.target === 'agent' ? row.target : null;
-                const phase = safeToken(row.phase, 'unknown');
+                // TAL-1138: `verifying` is stored as Stable's `restarting` plus a flag Stable ignores.
+                const phase = row.phase === 'restarting' && row.verifying === true ? 'verifying' : safeToken(row.phase, 'unknown');
                 const fallback = target && PHASES.has(phase) ? wording(target, phase) : { title: 'Server notification', message: 'This server needs your attention.' };
                 return [{
+                        ...(typeof row.notice_key === 'string' ? { notice_key: row.notice_key, notice_text_hash: typeof row.notice_text_hash === 'string' ? row.notice_text_hash : '' } : {}),
                         id: row.id, owner: row.owner.slice(0, 256), profile: row.profile.slice(0, 64), visibility: row.visibility === 'profile' ? 'profile' : 'server', kind, target, phase,
                         severity: row.severity === 'critical' || row.severity === 'warning' ? row.severity : 'info',
                         persistent: row.persistent === true,
@@ -341,6 +641,10 @@ export class UpdateNotificationStore {
                         expected_identity: typeof row.expected_identity === 'string' ? row.expected_identity.slice(0, 160) : null,
                         tab_id: typeof row.tab_id === 'string' ? row.tab_id : null,
                         watchers: Array.isArray(row.watchers) ? row.watchers.flatMap((watcher) => isRecord(watcher) && typeof watcher.tab === 'string' && TAB_ID.test(watcher.tab) && typeof watcher.at === 'string' ? [{ tab: watcher.tab, at: watcher.at }] : []) : [],
+                        web_restart_boot: typeof row.web_restart_boot === 'string' ? row.web_restart_boot.slice(0, 64) : null,
+                        gateway_tasks: typeof row.gateway_tasks === 'number' && Number.isInteger(row.gateway_tasks) && row.gateway_tasks > 0 ? row.gateway_tasks : null,
+                        gateway_baseline: Array.isArray(row.gateway_baseline) ? row.gateway_baseline.slice(0, 8).flatMap((entry) => isRecord(entry) && typeof entry.dir === 'string' && typeof entry.pid === 'number' && Number.isInteger(entry.pid) && entry.pid > 0 && (entry.start_time === null || typeof entry.start_time === 'number') ? [{ dir: entry.dir, pid: entry.pid, start_time: entry.start_time }] : []) : null,
+                        failed_step: typeof row.failed_step === 'string' && STEP_IDS.has(row.failed_step) ? row.failed_step : null,
                     }];
             });
         }
@@ -349,7 +653,7 @@ export class UpdateNotificationStore {
         }
     }
     /** Tab refresh notices are bounded by `hasProtectedCapacity` and kept apart, so they never evict or block other notifications. */
-    save() {
+    async save() {
         const tabNotices = this.rows.filter(isTabNotice);
         const sorted = this.rows.filter((row) => !isTabNotice(row)).sort((a, b) => b.updated_at.localeCompare(a.updated_at));
         const protectedRows = sorted.filter(isProtected);
@@ -372,8 +676,19 @@ export class UpdateNotificationStore {
             kept.push(row);
         }
         this.rows = [...kept.reverse(), ...tabNotices];
-        mkdirSync(dirname(this.file), { recursive: true });
-        atomicWriteSecretJson(this.file, this.rows);
+        // TAL-1138 fields are written only once set, so records that never use them keep their stored bytes. A check in
+        // progress is stored as `restarting`, which the current Stable release counts as active and reconciles on startup.
+        const rows = structuredClone(this.rows).map(({ web_restart_boot, gateway_tasks, gateway_baseline, failed_step, ...row }) => ({
+            ...row,
+            ...(row.phase === 'verifying' ? { phase: 'restarting', verifying: true } : {}),
+            ...(web_restart_boot === null ? {} : { web_restart_boot }),
+            ...(gateway_tasks === null ? {} : { gateway_tasks }),
+            ...(gateway_baseline === null ? {} : { gateway_baseline }),
+            ...(failed_step === null ? {} : { failed_step }),
+        }));
+        const write = this.writes.catch(() => undefined).then(async () => { this.revision = await this.documents.put('update-notifications', 'update-notifications', rows, this.revision); });
+        this.writes = write;
+        await write;
     }
 }
 const safeToken = (value, fallback) => typeof value === 'string' && /^[a-z0-9][a-z0-9_-]{0,63}$/.test(value) ? value : fallback;
@@ -400,8 +715,11 @@ const safeDestination = (value) => {
     return key && label ? { key, label } : null;
 };
 const isTabNotice = (row) => row.tab_id !== null;
-const isDismissible = (row) => !row.requires_acknowledgement || row.acknowledged_at !== null;
-const isProtected = (row) => (row.requires_acknowledgement && row.acknowledged_at === null) || (row.kind === 'update' && ['applying', 'awaiting_confirmation', 'restarting'].includes(row.phase));
+/** A waiting gateway restart carries its Restart now action, so it stays until the restart runs. */
+const isWaitingGatewayRestart = (row) => row.kind === 'update' && row.phase === 'waiting_for_idle';
+const isDismissible = (row) => (!row.requires_acknowledgement || row.acknowledged_at !== null) && !isWaitingGatewayRestart(row);
+/** Warning identities, including dismissed rows, must survive ordinary history pruning. */
+const isProtected = (row) => row.kind === 'agent_warning' || (row.requires_acknowledgement && row.acknowledged_at === null) || (row.kind === 'update' && ['applying', 'awaiting_confirmation', 'waiting_for_idle', 'restarting', 'verifying'].includes(row.phase));
 const retentionBucket = (row) => `${row.owner}\u0000${row.visibility === 'server' ? '*' : row.profile}`;
 export const updateNotificationScopeId = (scope) => createHash('sha256').update(`${scope.owner}\u0000${scope.profile}\u0000${scope.serverOwner === true ? 'owner' : 'member'}`).digest('hex').slice(0, 24);
 //# sourceMappingURL=update-notifications.js.map