fix: recover stuck update queue

server/update-service.ts

@@ -1,4 +1,4 @@
-import { lstatSync, realpathSync, unlinkSync } from "node:fs";
+import { lstatSync, realpathSync, readFileSync, unlinkSync } from "node:fs";
 import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { createPublicKey, randomUUID, verify as verifySignature } from "node:crypto";
@@ -385,6 +385,17 @@ function removeExpiredRequest(filePath: string, now: number): void {
   }
 }
 
+function requestJobId(filePath: string): string | null {
+  try {
+    const info = lstatSync(filePath);
+    if (!info.isFile() || info.isSymbolicLink()) return null;
+    const value = JSON.parse(readFileSync(filePath, "utf8")) as { jobId?: unknown };
+    return typeof value.jobId === "string" && /^[0-9a-f-]{36}$/.test(value.jobId) ? value.jobId : null;
+  } catch {
+    return null;
+  }
+}
+
 function currentReleaseVersion(config: AppConfig): string | null {
   try {
     const target = realpathSync(config.currentLink);
@@ -425,6 +436,7 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
   // row is still safe to retry and must not block the queue forever.
   const releaseVersion = currentReleaseVersion(config);
   let reconciled = 0;
+  const reconciledIds = new Set<string>();
   for (const row of rows) {
     if (typeof row.updatedAt !== "number" || now - row.updatedAt < ORPHANED_UPDATE_TIMEOUT_MS) continue;
     // The runner refreshes the state marker while a download is in flight.
@@ -451,7 +463,10 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
         });
         return true;
       })();
-      if (changed) reconciled += 1;
+      if (changed) {
+        reconciled += 1;
+        reconciledIds.add(row.id);
+      }
       continue;
     }
     if (requestFresh || stateFresh) continue;
@@ -476,7 +491,10 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
       });
       return true;
     })();
-    if (changed) reconciled += 1;
+    if (changed) {
+      reconciled += 1;
+      reconciledIds.add(row.id);
+    }
   }
   // Prevent a stale request from being replayed after its DB row has been
   // marked failed. The path is fixed by the server configuration and the
@@ -484,7 +502,17 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
   // A download runner refreshes the state marker while it is still using the
   // request. Keep the request until that lease also expires; otherwise a
   // long download can lose its job id and fail to finalize its row.
-  if (!stateFresh && (!requestPresent || (requestMtime !== null && now - requestMtime >= ORPHANED_UPDATE_TIMEOUT_MS))) {
+  const queuedRequestId = requestPresent ? requestJobId(config.updateRequestPath) : null;
+  const queuedRequest = queuedRequestId ? rows.find((row) => row.id === queuedRequestId) : undefined;
+  const requestStillNeeded = Boolean(
+    queuedRequest
+      && ACTIVE_UPDATE_STATUSES.includes(queuedRequest.status)
+      && !reconciledIds.has(queuedRequest.id)
+      && !(queuedRequest.status === "staged" && queuedRequest.operation === "download"),
+  );
+  if (!stateFresh
+    && (!requestPresent || (requestMtime !== null && now - requestMtime >= ORPHANED_UPDATE_TIMEOUT_MS))
+    && !requestStillNeeded) {
     removeExpiredRequest(config.updateRequestPath, now);
   }
   return reconciled;