dsh-autorestart 0.8.3 → 0.8.5

package/client.js

@@ -379,6 +379,27 @@
     'settings.backup.size': '备份大小',
     'settings.backup.withPlugins': '（含已装插件）',
     'settings.backup.withoutPlugins': '（不含已装插件）',
+    // WHAT a copy is (user decision, 2026-10-30). Only a proven copy may be
+    // rolled back to, so the identity is said in plain words on every row.
+    'settings.backup.kindLabel': '身份',
+    'settings.backup.kind.known-good': '安全份',
+    'settings.backup.kind.snapshot': '本次快照',
+    'settings.backup.kind.unknown': '旧备份（未验证）',
+    'settings.backup.version': '版本 {v}',
+    'settings.backup.identityHint': '备份有两种身份：①「安全份」——启动成功后验证过的那一份，出问题只会回滚安全份；第一次安装时会自动生成一份。②「本次快照」——每次重启前刚拍的，还没验证过；旧备份（未验证）和它都不会被自动回滚。两类合计最多保留 {n} 份，超出删最旧的那份（安全份不会被删）。手动回退会先二次确认，然后会自动重启。',
+    // THE MANUAL ROLLBACK (user decision, 2026-10-30): the user may know better
+    // than "the newest proven copy", so ANY copy can be restored — but only
+    // after a card that says which one, what it replaces, and that a restart
+    // follows.
+    'settings.backup.rollback': '回退到这一份',
+    'settings.backup.rollbackConfirmTitle': '确定回退到这一份？',
+    'settings.backup.rollbackConfirmBody': '会把 {time} 的那份备份还原到现在——**当前状态会被它覆盖**（覆盖前会先自动存一份当前快照，所以这次回退还能再退回来）。',
+    'settings.backup.rollbackConfirmRestart': '还原完成后会自动重启一次；重启期间这个页面会断开，回来后接着用。',
+    'settings.backup.rollbackConfirmYes': '确认回退',
+    'settings.backup.rollbackConfirmNo': '取消',
+    'settings.backup.rollbackBusy': '正在回退…',
+    'settings.backup.rollbackDone': '已回退，正在重启…',
+    'settings.backup.rollbackFailed': '回退没成功：{message}',
     'settings.groups.report': '报告问题',
     'settings.groups.rescue': '出事了怎么办',
     'settings.rescue.hint': 'DSH 打不开的时候，用下面这两个脚本救自己（都不用 DSH 跑起来）。',
@@ -497,6 +518,12 @@
     'restart.overlay.size': '{done} / {total}',
     'restart.overlay.sizeDone': '{done}',
     'restart.overlay.restarting': '正在重启…',
+    // THE HONEST CARD (user report, 2026-10-30): a restart that was interrupted
+    // by a new conversation said "正在重启…" for 25 s, which was not true. It now
+    // says what actually happened — and it may stay, because it IS the truth.
+    'restart.overlay.deferred': '有新会话在跑，重启已暂缓',
+    'restart.overlay.deferredNote': '等它结束会自动继续 · 已等 {count} 个会话',
+    'restart.overlay.deferredNoteZero': '等它结束会自动继续',
     'restart.overlay.back': '已回来',
   }
 
@@ -728,6 +755,26 @@
     'settings.backup.size': 'Backup size',
     'settings.backup.withPlugins': '(plugins included)',
     'settings.backup.withoutPlugins': '(plugins excluded)',
+    // WHAT a copy is (user decision, 2026-10-30). Only a proven copy may be
+    // rolled back to, so the identity is said in plain words on every row.
+    'settings.backup.kindLabel': 'Identity',
+    'settings.backup.kind.known-good': 'Known good',
+    'settings.backup.kind.snapshot': "This restart's snapshot",
+    'settings.backup.kind.unknown': 'Old backup (unverified)',
+    'settings.backup.version': 'version {v}',
+    'settings.backup.identityHint': 'A backup has one of two identities: ① “known good” — the copy a boot has proven; when something breaks, only a known-good copy is rolled back, and the first install creates one automatically. ② “this restart\'s snapshot” — taken right before every restart and not proven yet; old backups (unverified) and that snapshot are never rolled back automatically. At most {n} copies are kept together (the oldest goes first; a known-good copy is never deleted). A manual rollback asks for confirmation first, then restarts automatically.',
+    // THE MANUAL ROLLBACK (user decision, 2026-10-30): any copy can be restored
+    // — but only after a card that says which one, what it replaces, and that
+    // a restart follows.
+    'settings.backup.rollback': 'Roll back to this copy',
+    'settings.backup.rollbackConfirmTitle': 'Roll back to this copy?',
+    'settings.backup.rollbackConfirmBody': 'The backup from {time} will be restored over the current state — **what you have now is replaced** (a snapshot of it is taken first, so this rollback can be undone).',
+    'settings.backup.rollbackConfirmRestart': 'A restart follows automatically; this page disconnects during it and works again afterwards.',
+    'settings.backup.rollbackConfirmYes': 'Roll back',
+    'settings.backup.rollbackConfirmNo': 'Cancel',
+    'settings.backup.rollbackBusy': 'Rolling back…',
+    'settings.backup.rollbackDone': 'Rolled back — restarting…',
+    'settings.backup.rollbackFailed': 'The rollback did not work: {message}',
     'settings.groups.report': 'Report a problem',
     'settings.groups.rescue': 'If DSH will not start',
     'settings.rescue.hint': 'When DSH does not come up, these two scripts rescue it for you (neither of them needs DSH running).',
@@ -837,6 +884,9 @@
     'restart.overlay.size': '{done} / {total}',
     'restart.overlay.sizeDone': '{done}',
     'restart.overlay.restarting': 'Restarting…',
+    'restart.overlay.deferred': 'A conversation just started — restart postponed',
+    'restart.overlay.deferredNote': 'It will retry automatically when idle · {count} waiting',
+    'restart.overlay.deferredNoteZero': 'It will retry automatically when idle',
     'restart.overlay.back': 'Back again',
   }
 
@@ -2090,6 +2140,34 @@
     return Math.round(value) + ' B'
   }
 
+  /**
+   * WHAT A COPY IS — the identity word of the interface.
+   *
+   * Only a copy a boot has PROVEN may be rolled back to ("安全份" / known-good).
+   * The snapshot of a restart is not proven yet ("本次快照"), and a copy without
+   * an identity file was written before the identity layer ("旧备份（未验证）").
+   * An unknown word is shown as unproven on purpose: never claim more than the
+   * copy itself says.
+   *
+   * @param {string|null|undefined} kind
+   * @returns {'known-good'|'snapshot'|'unknown'}
+   */
+  function backupKindKey(kind) {
+    if (kind === 'known-good') return 'known-good'
+    if (kind === 'snapshot') return 'snapshot'
+    return 'unknown'
+  }
+
+  /**
+   * The version a copy was proven with, or an empty string when it carries none.
+   *
+   * @param {object|null|undefined} item one backup of the state payload
+   * @returns {string}
+   */
+  function backupVersionOf(item) {
+    return item && typeof item.version === 'string' && item.version !== '' ? item.version : ''
+  }
+
   /**
    * The local time of one backup, to the minute.
    *
@@ -2192,6 +2270,134 @@
    * @param {Function} [translator]
    * @returns {string}
    */
+  /**
+   * HOW LONG THE "RESTART POSTPONED" CARD STAYS ON SCREEN (milliseconds).
+   *
+   * THE REPORT (user, 2026-10-30): "after the interruption I still have a lot of
+   * work to do — a card hovering for ever is in the way". The postponed card is an
+   * ANNOUNCEMENT, not a progress bar: it says what happened for four seconds and
+   * then folds away, while the capsule keeps saying "pending restart · waiting for
+   * N sessions". A NEW postponement (a new stage timestamp) announces itself again.
+   *
+   * The stages that really are running ('snapshotting', 'restarting') are not
+   * affected: they stay while the work lasts.
+   */
+  const RESTART_DEFERRED_CARD_MS = 4000
+
+  /**
+   * HOW LONG A STAGE MAY GO UNMENTIONED BEFORE THE CARD STOPS TRUSTING IT.
+   *
+   * WHY (user report, 2026-10-29): a restart was postponed (a conversation
+   * became active again) right after the copy, and the card kept saying
+   * "DSH 重启前备份中" for ever — the stage on disk had not been brought back to
+   * 'waiting'. The Host is fixed, but the interface must not be able to hang on
+   * a stale stage either: a stage is evidence only while it keeps being
+   * refreshed.
+   */
+  const RESTART_STAGE_STALE_MS = 15000
+  // While files are being copied the Host refreshes the stage on every progress
+  // tick, so ten silent seconds mean the copy is no longer reporting — either it
+  // is over or nobody is copying any more. A 'restarting' stage has no progress
+  // of its own and only has to stay inside the stale window above.
+  const RESTART_SNAPSHOT_FRESH_MS = 10000
+
+  /**
+   * THE TWO CADENCES OF THE SHARED POLL (milliseconds).
+   *
+   * 2 s is right for a page that merely shows whether a restart is pending: a
+   * pending restart sits there for minutes. While a restart is MOVING, though,
+   * the stage can flip at any moment (a conversation starts, the host postpones
+   * the restart, the card has to change its words) — and 2 s of the wrong word is
+   * exactly what the owner complained about. So the cadence follows the state.
+   */
+  const POLL_MS = 2000
+  const POLL_FAST_MS = 500
+
+  /**
+   * IS A RESTART MOVING RIGHT NOW?
+   *
+   * 'waiting' counts as well: the restart is requested and the gate may open (or
+   * a conversation may appear) at any moment — that is exactly when the card must
+   * change its words within a second.
+   *
+   * @param {object|null} info the state payload of the Host
+   * @returns {boolean}
+   */
+  function isRestartMoving(info) {
+    if (!info || typeof info !== 'object') return false
+    if (info.pendingRestart !== true) return false
+    const stage = info.restartPhase
+    const phase = stage && typeof stage.phase === 'string' ? stage.phase : ''
+    return phase === 'waiting' || phase === 'snapshotting' || phase === 'restarting'
+  }
+
+  /**
+   * The cadence the CURRENT state asks for.
+   *
+   * @param {object|null} info the state payload of the Host
+   * @returns {number} milliseconds
+   */
+  function pollIntervalFor(info) {
+    return isRestartMoving(info) ? POLL_FAST_MS : POLL_MS
+  }
+
+  /**
+   * Is the page on screen? A hidden tab has nobody to tell, so it must not spin
+   * (and it asks once more as soon as it is visible again).
+   *
+   * @returns {boolean}
+   */
+  function isPageVisible() {
+    if (typeof document === 'undefined' || !document) return true
+    if (document.hidden === true) return false
+    if (typeof document.visibilityState === 'string') return document.visibilityState !== 'hidden'
+    return true
+  }
+
+  /**
+   * IS THE RESTART POSTPONED BY A CONVERSATION? (the Host says so in `reason`)
+   *
+   * A postponed restart is a stage of 'waiting' with a reason that starts with
+   * "deferred:" (see the Host's deferRestartStage). That state is NOT an activity,
+   * so it is drawn differently: the card names the interruption and promises the
+   * retry, and the word "正在重启" never appears for it.
+   *
+   * @param {object|null} stage the `restartPhase` of the state route
+   * @returns {boolean}
+   */
+  function isRestartStageDeferred(stage) {
+    if (!stage || typeof stage !== 'object') return false
+    if (stage.phase !== 'waiting') return false
+    return typeof stage.reason === 'string' && stage.reason.indexOf('deferred:') === 0
+  }
+
+  /**
+   * Is the reported stage still something the card may draw?
+   *
+   * The card is an ALARM about something happening right now: 'snapshotting'
+   * (files are being copied) or 'restarting' (the host is going down). A stage
+   * that nobody refreshed for 15 s (10 s for a copy, which refreshes on every
+   * file) describes something that is not happening any more, and drawing it
+   * would leave a card hanging — exactly the bug to avoid. The pill keeps
+   * telling the user the restart is still pending; the card simply stops
+   * claiming progress.
+   *
+   * @param {object|null} stage the `restartPhase` of the state route
+   * @param {number} now
+   * @returns {boolean}
+   */
+  function isRestartStageLive(stage, now) {
+    const phase = stage && typeof stage.phase === 'string' ? stage.phase : ''
+    if (phase !== 'snapshotting' && phase !== 'restarting') return false
+    const at = stage && Number.isFinite(Number(stage.at)) ? Number(stage.at) : null
+    // No timestamp at all: the stage cannot be trusted to describe "now".
+    if (at === null || at <= 0) return false
+    const age = Math.max(0, now - at)
+    if (age > RESTART_STAGE_STALE_MS) return false
+    if (phase === 'restarting') return true
+    return age <= RESTART_SNAPSHOT_FRESH_MS
+  }
+
   function restartOverlayTitle(stage, translator) {
     const phase = stage && typeof stage === 'object' && typeof stage.phase === 'string' ? stage.phase : ''
     if (!isRestartOverlayPhase(phase)) return ''
@@ -2275,6 +2481,19 @@
     // The stage of a restart on the two surfaces that have room for it: the
     // composer row (one short line) and the centred overlay (the detail).
     isRestartOverlayPhase,
+    // Is the reported stage still worth a card? (a stale stage cannot hang it)
+    isRestartStageLive,
+    isRestartStageDeferred,
+    RESTART_DEFERRED_CARD_MS,
+    // The cadence of the shared poll: fast while a restart is moving, and no
+    // polling at all in a hidden tab.
+    isRestartMoving,
+    pollIntervalFor,
+    isPageVisible,
+    POLL_MS,
+    POLL_FAST_MS,
+    RESTART_STAGE_STALE_MS,
+    RESTART_SNAPSHOT_FRESH_MS,
     restartPillStageText,
     restartOverlayTitle,
     // The size with the unit that fits it ("92 KB", "156 MB"): a hosted profile
@@ -2316,6 +2535,8 @@
       const ROUTE_PREFIX = HEALTH_URL.split('?')[0].replace(/\/[^/]*$/, '')
       const DEFAULT_PARK_URL = ROUTE_PREFIX + '/park'
       const DEFAULT_CANCEL_URL = ROUTE_PREFIX + '/cancel'
+      // The route of the MANUAL ROLLBACK (restore ONE copy the user picked).
+      const DEFAULT_ROLLBACK_URL = ROUTE_PREFIX + '/rollback-to'
       // The route that persists the one-time install choice.
       const DEFAULT_CHOICE_URL = ROUTE_PREFIX + '/choice'
       // The browser-side record of the one-time install choice. The prompt is
@@ -2329,7 +2550,8 @@
        * the fallback for a Host that is older than the supervisor.
        */
       const DEFAULT_SUPERVISOR_URL = '/__dsh_autorestart/supervisor'
-      const POLL_MS = 2000
+      // The cadence lives with the state it follows (see POLL_MS/POLL_FAST_MS
+      // above): the shared poll speeds up while a restart is moving.
       // The brand accent (blue-purple). The pending-restart marker is a brand
       // signal, not a warning: no warning/yellow token is used here.
       const BRAND = 'var(--dsw-alias-brand-primary, #5b8def)'
@@ -2405,11 +2627,15 @@
         info: null,
         listeners: new Set(),
         timer: null,
+        // The cadence the current timer was armed with (0 = not armed).
+        interval: 0,
         inFlight: false,
         controller: null,
         // When the pending state was FIRST observed, so the details panel can
         // say how long this session has been waiting.
         pendingSince: null,
+        // The visibility listener is bound once, on the first subscriber.
+        visibilityBound: false,
       }
 
       function notifyListeners() {
@@ -2442,8 +2668,63 @@
         }
       }
 
+      /**
+       * (Re-)arm the shared timer with the cadence the state asks for.
+       *
+       * THE CADENCE IS RE-DECIDED AFTER EVERY ANSWER: a restart that starts makes
+       * the next tick 500 ms away, a restart that ends puts it back to 2 s, and a
+       * hidden page is not polled at all (an interval in a background tab only
+       * spends battery — it asks once as soon as it is visible again).
+       *
+       * Re-arming only happens when the cadence really changed, so the ticks stay
+       * evenly spaced and never pile up.
+       */
+      function armPoll() {
+        if (stateStore.listeners.size === 0) return
+        const wanted = isPageVisible() ? pollIntervalFor(stateStore.info) : 0
+        if (wanted === 0) {
+          if (stateStore.timer !== null) {
+            clearInterval(stateStore.timer)
+            stateStore.timer = null
+          }
+          stateStore.interval = 0
+          return
+        }
+        if (stateStore.timer !== null && stateStore.interval === wanted) return
+        if (stateStore.timer !== null) clearInterval(stateStore.timer)
+        stateStore.interval = wanted
+        stateStore.timer = setInterval(() => {
+          pollOnce().then(armPoll)
+        }, wanted)
+      }
+
+      /**
+       * Ask once more as soon as the page is back on screen.
+       *
+       * A hidden tab stops polling; coming back must not wait for the next tick of
+       * a timer that was stopped, so the visibility event polls immediately and
+       * then re-arms the cadence.
+       */
+      function bindVisibility() {
+        if (stateStore.visibilityBound) return
+        if (typeof document === 'undefined' || !document || typeof document.addEventListener !== 'function') return
+        stateStore.visibilityBound = true
+        document.addEventListener('visibilitychange', () => {
+          if (stateStore.listeners.size === 0) return
+          if (!isPageVisible()) {
+            armPoll()
+            return
+          }
+          pollOnce().then(armPoll)
+          armPoll()
+        })
+      }
+
       async function pollOnce() {
+        // ONE REQUEST AT A TIME: a slow answer must never stack up a queue.
         if (stateStore.inFlight) return
+        // Nobody is looking at a hidden tab; the next visible moment asks.
+        if (!isPageVisible()) return
         stateStore.inFlight = true
         try {
           const response = await fetch(HEALTH_URL, {
@@ -2482,8 +2763,9 @@
         stateStore.listeners.add(listener)
         if (stateStore.listeners.size === 1) {
           stateStore.controller = new AbortController()
-          pollOnce()
-          stateStore.timer = setInterval(pollOnce, POLL_MS)
+          bindVisibility()
+          pollOnce().then(armPoll)
+          armPoll()
         }
         return () => {
           stateStore.listeners.delete(listener)
@@ -2492,6 +2774,7 @@
               clearInterval(stateStore.timer)
               stateStore.timer = null
             }
+            stateStore.interval = 0
             if (stateStore.controller) {
               stateStore.controller.abort()
               stateStore.controller = null
@@ -2688,6 +2971,17 @@
         return DEFAULT_CANCEL_URL
       }
 
+      /**
+       * The route that restores ONE backup the user picked (the manual
+       * rollback): the one the Host sent with the state payload, or the derived
+       * default. It never carries a path — only a backup NAME goes in the body.
+       */
+      function rollbackUrlFor(info) {
+        const sent = info && typeof info.rollbackUrl === 'string' ? info.rollbackUrl.trim() : ''
+        if (sent.startsWith('/')) return sent
+        return DEFAULT_ROLLBACK_URL
+      }
+
       /**
        * Whether the one-time install prompt may be shown.
        *
@@ -3817,13 +4111,58 @@
         // on right now", the state file alone does not.
         const pending = Boolean(info && info.pendingRestart === true)
         // THE ONLY TWO STAGES THAT ARE "SOMETHING IS REALLY HAPPENING": the
-        // snapshot is being written, or the host is on its way out.
-        const running = pending && (phase === 'snapshotting' || phase === 'restarting')
+        // snapshot is being written, or the host is on its way out — AND the
+        // stage must still be fresh. A stage nobody refreshed (the restart was
+        // postponed and the Host did not say so) cannot leave a card on screen
+        // for ever; the pill still says the restart is pending.
+        const running = pending && isRestartStageLive(stage, Date.now())
 
         useEffect(() => {
           if (running) setSawRunning(true)
         }, [running])
 
+        // THE POSTPONED CARD IS AN ANNOUNCEMENT, NOT A PROGRESS BAR (user report,
+        // 2026-10-30): "after the interruption I still have a lot of work to do — a
+        // card hovering for ever is in the way". It says what happened for four
+        // seconds and then folds away; the capsule keeps saying the restart is
+        // pending. A NEW postponement (a new stage timestamp) announces itself
+        // again. Hooks live up here, with the others, because they must run on
+        // every render — including the renders that draw nothing.
+        const deferredKey = pending && isRestartStageDeferred(stage)
+          ? (Number.isFinite(Number(stage.at)) ? Number(stage.at) : 0)
+          : null
+        const [announcedKey, setAnnouncedKey] = useState(null)
+        const [folded, setFolded] = useState(false)
+
+        useEffect(() => {
+          if (deferredKey === null) {
+            if (announcedKey !== null) {
+              setAnnouncedKey(null)
+              setFolded(false)
+            }
+            return undefined
+          }
+          if (announcedKey === deferredKey) return undefined
+          setAnnouncedKey(deferredKey)
+          setFolded(false)
+          return undefined
+        }, [deferredKey, announcedKey])
+
+        // The four seconds of THIS announcement.
+        useEffect(() => {
+          if (announcedKey === null || folded) return undefined
+          const timer = setTimeout(() => setFolded(true), RESTART_DEFERRED_CARD_MS)
+          return () => clearTimeout(timer)
+        }, [announcedKey, folded])
+
+        // A POSTPONED RESTART IS NOT A RUNNING ONE (user report, 2026-10-30): when
+        // the Host says the restart went back to waiting because a conversation
+        // started, the card says exactly that. It is drawn AT ONCE (a fresh
+        // postponement must not wait for a second render) and the hook above
+        // records which postponement has been announced, so its four seconds can
+        // run out; every new stage timestamp resets the clock.
+        const postponed = deferredKey !== null && !folded
+
         // "已回来" is a MOMENT, not a state: 1.5s and then the card is gone.
         useEffect(() => {
           if (phase !== 'back') {
@@ -3834,8 +4173,9 @@
           return () => clearTimeout(timer)
         }, [phase])
 
-        // THE CARD IS ONLY DRAWN WHILE SOMETHING IS REALLY IN PROGRESS.
-        const visible = running || (phase === 'back' && sawRunning && !backGone)
+        // THE CARD IS ONLY DRAWN WHILE SOMETHING IS REALLY IN PROGRESS — or while
+        // the restart is honestly postponed.
+        const visible = running || postponed || (phase === 'back' && sawRunning && !backGone)
         if (!visible) return null
 
         const progress = stage.progress && typeof stage.progress === 'object' ? stage.progress : null
@@ -3845,11 +4185,32 @@
           ? Math.max(0, Math.min(100, Math.round(Number(progress.percent))))
           : null
 
-        const title = restartOverlayTitle(stage, t)
+        // The postponed card wins over everything else: even a stage that still
+        // says 'restarting' in the same render is downgraded here, so the old word
+        // can never survive a single frame once the Host said "deferred".
+        const deferredCount = postponed ? waitingTaskCount(info, info && Array.isArray(info.blockedBy) ? info.blockedBy : []) : 0
+        const title = postponed
+          ? t('restart.overlay.deferred')
+          : restartOverlayTitle(stage, t)
 
         let bar = null
         let detail = null
-        if (phase === 'snapshotting') {
+        if (postponed) {
+          // A second, smaller line: what happens next, and how many conversations
+          // are in the way (the same number the capsule shows).
+          detail = h(
+            'p',
+            { className: 'dsh-autorestart-restart-overlay__size' },
+            h(
+              'span',
+              { 'data-dsh-autorestart-restart-overlay-deferred': 'true' },
+              deferredCount > 0
+                ? fill(t('restart.overlay.deferredNote'), { count: deferredCount })
+                : t('restart.overlay.deferredNoteZero'),
+            ),
+          )
+        }
+        if (!postponed && phase === 'snapshotting') {
           // The numbers are the ones the copy loop really measured; when there is
           // no measurement yet, the card shows no number at all (an invented
           // progress bar is worse than none). The unit fits the size, so a 92 KB
@@ -3894,6 +4255,9 @@
             'aria-live': 'polite',
             'data-dsh-autorestart-restart-overlay': 'true',
             'data-dsh-autorestart-restart-overlay-phase': phase,
+            // WHAT THE CARD SAYS, independent of the Host phase: a postponed
+            // restart is drawn from 'waiting'.
+            'data-dsh-autorestart-restart-overlay-card': postponed ? 'deferred' : phase,
           },
           h(
             'p',
@@ -4906,6 +5270,37 @@
         '  line-height:18px;',
         '  color:var(--dsw-alias-label-secondary);',
         '}',
+        // WHAT a copy is (user decision, 2026-10-30): the identity is the first
+        // thing read on a row, so it sits on its own line and is not muted.
+        '.dsh-autorestart-settings__backup-identity{',
+        '  display:flex;',
+        '  flex-wrap:wrap;',
+        '  gap:8px;',
+        '  align-items:baseline;',
+        '}',
+        '.dsh-autorestart-settings__backup-badge{',
+        '  font-size:13px;',
+        '  line-height:18px;',
+        '  font-weight:600;',
+        '  color:var(--dsw-alias-label-primary);',
+        '}',
+        '.dsh-autorestart-settings__backup-actions{',
+        '  display:flex;',
+        '  flex-wrap:wrap;',
+        '  gap:8px;',
+        '  align-items:baseline;',
+        '}',
+        // THE SECOND CONFIRMATION of a manual rollback: a block that stands
+        // apart from the list, because it is a question, not a fact.
+        '.dsh-autorestart-settings__confirm{',
+        '  display:flex;',
+        '  flex-direction:column;',
+        '  gap:6px;',
+        '  padding:10px 12px;',
+        '  border:1px solid var(--dsw-alias-border-l1);',
+        '  border-radius:8px;',
+        '  background:var(--dsw-alias-bg-l1);',
+        '}',
         // The folded "technical details": the command itself stays out of the
         // way until somebody asks for it.
         '.dsh-autorestart-settings__details{',
@@ -5417,6 +5812,13 @@
         // a fresh page starts closed, so nobody leaves technical text open by
         // accident.
         const [detailsOpen, setDetailsOpen] = useState(false)
+        // THE MANUAL ROLLBACK (user decision, 2026-10-30). Asking is a STATE,
+        // not a `window.confirm`: the card has to say WHICH copy, that the
+        // current state is replaced, and that a restart follows. `null` = nobody
+        // is asking, and only a confirmation ever calls the route.
+        const [rollbackAsk, setRollbackAsk] = useState(null)
+        const [rollbackBusy, setRollbackBusy] = useState(false)
+        const [rollbackNote, setRollbackNote] = useState('')
         const t = makeTranslate(props && typeof props.t === 'function' ? props.t : translate)
         // THE RECEIPT OF A SETTINGS CHANGE, on screen right now. It belongs to
         // THIS panel (it is not a window overlay), so it is read here and
@@ -5645,6 +6047,46 @@
          *
          * @param {object} changes the keys to write
          */
+        /**
+         * THE MANUAL ROLLBACK (user decision, 2026-10-30).
+         *
+         * It is ONLY ever called from the confirmation card: the button on a row
+         * opens the question, and nothing is posted until the user says yes. The
+         * route takes a backup NAME (never a path) and does the rest on the Host
+         * — save the current state, restore that copy, request a restart.
+         *
+         * @param {{ name?: string, atLocal?: string|null }|null} ask what the user picked
+         */
+        const rollbackTo = async (ask) => {
+          const name = ask && typeof ask.name === 'string' ? ask.name : ''
+          if (name === '' || rollbackBusy === true) return
+          setRollbackBusy(true)
+          setRollbackNote('')
+          try {
+            const response = await fetch(rollbackUrlFor(info), {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ name }),
+            })
+            const body = await response.json().catch(() => null)
+            if (!response.ok || !body || typeof body !== 'object' || body.ok !== true) {
+              const message = body && typeof body === 'object'
+                ? String(body.error || body.message || response.status)
+                : String(response.status)
+              setRollbackNote(fill(t('settings.backup.rollbackFailed'), { message }))
+              return
+            }
+            // The copy is back and a restart has been requested: the card goes
+            // away, and the panel says what is happening right now.
+            setRollbackAsk(null)
+            setRollbackNote(t('settings.backup.rollbackDone'))
+          } catch (failure) {
+            setRollbackNote(fill(t('settings.backup.rollbackFailed'), { message: describeError(failure) }))
+          } finally {
+            setRollbackBusy(false)
+          }
+        }
+
         const save = async (changes) => {
           if (busy) return
           setBusy(true)
@@ -5945,6 +6387,15 @@
                 { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'keep' },
                 fill(t('settings.backup.keep'), { n: backupsInfo.max }),
               ),
+              // WHAT THE TWO IDENTITIES MEAN (user decision, 2026-10-30): the
+              // words on the rows below are useless without the rule behind
+              // them — only a proven copy is ever rolled back, and a manual
+              // rollback asks before it restarts.
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'identity-hint' },
+                fill(t('settings.backup.identityHint'), { n: backupsInfo.max }),
+              ),
               backupItems.length === 0
                 ? h(
                     'span',
@@ -5959,6 +6410,35 @@
                   'data-dsh-autorestart-backup': 'item',
                   key: 'backup-' + index,
                 },
+                // WHAT THIS COPY IS — read first, because the identity decides
+                // whether this copy may be restored at all.
+                h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__backup-identity' },
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__backup-label' },
+                    t('settings.backup.kindLabel'),
+                  ),
+                  h(
+                    'span',
+                    {
+                      className: 'dsh-autorestart-settings__backup-badge',
+                      'data-dsh-autorestart-backup': 'kind',
+                    },
+                    t('settings.backup.kind.' + backupKindKey(item && item.kind)),
+                  ),
+                  backupVersionOf(item) === ''
+                    ? null
+                    : h(
+                      'span',
+                      {
+                        className: 'dsh-autorestart-settings__backup-note',
+                        'data-dsh-autorestart-backup': 'version',
+                      },
+                      fill(t('settings.backup.version'), { v: backupVersionOf(item) }),
+                    ),
+                ),
                 // WHEN it was taken. No timezone offset: what is shown is
                 // already the local clock of the machine that took the copy.
                 h(
@@ -5998,7 +6478,99 @@
                       : t('settings.backup.withoutPlugins'),
                   ),
                 ),
+                // ROLL BACK TO THIS COPY. The button only OPENS the question —
+                // the route is called from the confirmation card and nowhere
+                // else, so a click alone never restores anything.
+                h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__backup-actions' },
+                  h(
+                    'button',
+                    {
+                      type: 'button',
+                      className: 'dsh-autorestart-settings__button',
+                      disabled: busy === true || rollbackBusy === true,
+                      'data-dsh-autorestart-backup': 'rollback',
+                      'data-backup-name': item && typeof item.name === 'string' ? item.name : '',
+                      onClick: () => {
+                        setRollbackNote('')
+                        setRollbackAsk({
+                          name: item && typeof item.name === 'string' ? item.name : '',
+                          atLocal: item && typeof item.atLocal === 'string' ? item.atLocal : null,
+                        })
+                      },
+                    },
+                    t('settings.backup.rollback'),
+                  ),
+                ),
               )),
+              // THE SECOND CONFIRMATION OF A MANUAL ROLLBACK (user decision,
+              // 2026-10-30): it names the copy, says that the current state is
+              // replaced (and that it is saved first), and says that a restart
+              // follows. Nothing is posted until the confirm button is pressed.
+              rollbackAsk === null
+                ? null
+                : h(
+                  'div',
+                  {
+                    className: 'dsh-autorestart-settings__confirm',
+                    'data-dsh-autorestart-backup': 'rollback-confirm',
+                  },
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__label' },
+                    t('settings.backup.rollbackConfirmTitle'),
+                  ),
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'rollback-confirm-body' },
+                    fill(t('settings.backup.rollbackConfirmBody'), { time: formatBackupTime(rollbackAsk.atLocal) }),
+                  ),
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'rollback-confirm-restart' },
+                    t('settings.backup.rollbackConfirmRestart'),
+                  ),
+                  h(
+                    'div',
+                    { className: 'dsh-autorestart-settings__backup-actions' },
+                    h(
+                      'button',
+                      {
+                        type: 'button',
+                        className: 'dsh-autorestart-settings__button',
+                        disabled: rollbackBusy === true,
+                        'data-dsh-autorestart-backup': 'rollback-confirm-yes',
+                        onClick: () => void rollbackTo(rollbackAsk),
+                      },
+                      rollbackBusy === true
+                        ? t('settings.backup.rollbackBusy')
+                        : t('settings.backup.rollbackConfirmYes'),
+                    ),
+                    h(
+                      'button',
+                      {
+                        type: 'button',
+                        className: 'dsh-autorestart-settings__button',
+                        disabled: rollbackBusy === true,
+                        'data-dsh-autorestart-backup': 'rollback-confirm-no',
+                        onClick: () => {
+                          // Cancel: nothing was posted, nothing is restored.
+                          setRollbackAsk(null)
+                          setRollbackNote('')
+                        },
+                      },
+                      t('settings.backup.rollbackConfirmNo'),
+                    ),
+                  ),
+                ),
+              rollbackNote === ''
+                ? null
+                : h(
+                  'span',
+                  { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'rollback-note' },
+                  rollbackNote,
+                ),
               backupsInfo.dir === ''
                 ? null
                 : h(