fix: make online updates recoverable

release: 1.2.3
fix: remove update page mock controls
2026-09-05 14:56:15 +08:00 · 2026-09-05 10:31:29 +08:00 · 2026-09-05 10:22:25 +08:00 · 2026-09-05 10:08:49 +08:00 · 2026-09-05 09:39:10 +08:00 · 2026-09-05 09:04:09 +08:00
26 changed files with 17063 additions and 1372 deletions
@@ -31,6 +31,8 @@ TALLYNOTE_INSTALL_PREFIX=./
 TALLYNOTE_UPDATE_METADATA_URL=https://git.awaioi.com/api/v1/repos/awaioi/TallyNote/releases/latest
 TALLYNOTE_UPDATE_ALLOWED_HOSTS=git.awaioi.com
 TALLYNOTE_UPDATE_MAX_MB=512
+# Per-request timeout for update metadata, checksums, signatures, and archives.
+TALLYNOTE_UPDATE_TIMEOUT_SECONDS=30
 # SHA-256 is always required. Detached Ed25519 signatures are optional; set
 # this to true only when a root-managed public key is configured below.
 TALLYNOTE_UPDATE_REQUIRE_SIGNATURE=false
@@ -30,7 +30,9 @@ jobs:
      - name: Verify tag and test gate
        run: |
          set -euo pipefail
-          test "$(node -p 'require("./package.json").version')" = "${GITHUB_REF_NAME#v}"
+          target_version="${GITHUB_REF_NAME#v}"
+          package_version="$(node -p 'require("./package.json").version')"
+          test "$package_version" = "$target_version"
          pnpm install --frozen-lockfile
          pnpm check
          # better-sqlite3 is a native addon; a single Vitest worker avoids a
@@ -0,0 +1,256 @@
+{
+  "schema_version": 1,
+  "diagram_type": "workflow",
+  "meta": {
+    "title": "TallyNote 平滑更新与应用内直连下载流程",
+    "subtitle": "告别外部守护等待 · 应用进程直连流式下载 · 原子热切换",
+    "output": "artifacts/tallynote-update-workflow.html",
+    "animation": "trace",
+    "quality_profile": "showcase",
+    "views": [
+      {
+        "id": "stream-download",
+        "label": "应用内流式下载",
+        "focus": [
+          "ui_render",
+          "stream_worker",
+          "verify_sha"
+        ],
+        "note": "Web 进程 0 延时直连 Gitea 流式拉取并比对哈希，彻底废除外部 systemd.path 调度等待。"
+      },
+      {
+        "id": "atomic-switch",
+        "label": "原子切换与秒级恢复",
+        "focus": [
+          "ui_ready",
+          "atomic_switch",
+          "health_probe",
+          "ui_refreshed"
+        ],
+        "note": "包就绪后秒级原子切换 current 软链接，30s 倒计时探活自动无缝恢复。"
+      }
+    ]
+  },
+  "lanes": [
+    {
+      "id": "ui",
+      "label": "管理控制台 (前端 UI)"
+    },
+    {
+      "id": "app",
+      "label": "Web 应用后端 (Node.js)"
+    },
+    {
+      "id": "system",
+      "label": "系统底层与运行时 (Linux / systemd)"
+    },
+    {
+      "id": "git",
+      "label": "Gitea 官方源 (HTTPS)"
+    }
+  ],
+  "phases": [
+    {
+      "id": "phase_check",
+      "label": "版本发现",
+      "fromCol": 0,
+      "toCol": 1
+    },
+    {
+      "id": "phase_download",
+      "label": "直连下载与校验",
+      "fromCol": 2,
+      "toCol": 3,
+      "variant": "emphasis"
+    },
+    {
+      "id": "phase_apply",
+      "label": "原子切换与自愈",
+      "fromCol": 4,
+      "toCol": 5,
+      "variant": "dashed"
+    }
+  ],
+  "groups": [
+    {
+      "id": "grp_stream",
+      "label": "应用内直接流式拉取 (无外部阻塞)",
+      "lane": "app",
+      "fromCol": 2,
+      "toCol": 3,
+      "variant": "emphasis"
+    }
+  ],
+  "mainPath": [
+    "ui_check",
+    "api_check",
+    "git_source",
+    "ui_render",
+    "stream_worker",
+    "verify_sha",
+    "ui_ready",
+    "atomic_switch",
+    "health_probe",
+    "ui_refreshed"
+  ],
+  "nodes": [
+    {
+      "id": "ui_check",
+      "lane": "ui",
+      "col": 0,
+      "type": "frontend",
+      "label": "检查更新",
+      "sublabel": "点击查询新版"
+    },
+    {
+      "id": "api_check",
+      "lane": "app",
+      "col": 0,
+      "type": "backend",
+      "label": "查询 Release",
+      "sublabel": "只读接口校验",
+      "tag": "只读"
+    },
+    {
+      "id": "git_source",
+      "lane": "git",
+      "col": 1,
+      "type": "external",
+      "label": "Gitea 官方源",
+      "sublabel": "返回最新元数据",
+      "tag": "HTTPS"
+    },
+    {
+      "id": "ui_render",
+      "lane": "ui",
+      "col": 1,
+      "type": "frontend",
+      "label": "版本看板呈现",
+      "sublabel": "日志与升级入口"
+    },
+    {
+      "id": "stream_worker",
+      "lane": "app",
+      "col": 2,
+      "type": "backend",
+      "label": "流式拉取",
+      "sublabel": "应用直连下载",
+      "tag": "实时进度"
+    },
+    {
+      "id": "verify_sha",
+      "lane": "app",
+      "col": 3,
+      "type": "security",
+      "label": "SHA-256 校验",
+      "sublabel": "比对并解压",
+      "tag": "完整性"
+    },
+    {
+      "id": "ui_ready",
+      "lane": "ui",
+      "col": 3,
+      "type": "frontend",
+      "label": "确认重启",
+      "sublabel": "更新包已就绪"
+    },
+    {
+      "id": "atomic_switch",
+      "lane": "system",
+      "col": 4,
+      "type": "cloud",
+      "label": "原子切换",
+      "sublabel": "切换软链接重载"
+    },
+    {
+      "id": "health_probe",
+      "lane": "app",
+      "col": 5,
+      "type": "backend",
+      "label": "健康探测探针",
+      "sublabel": "轮询探活至 200"
+    },
+    {
+      "id": "ui_refreshed",
+      "lane": "ui",
+      "col": 5,
+      "type": "frontend",
+      "label": "平滑上线刷新",
+      "sublabel": "自动进入新版本"
+    }
+  ],
+  "edges": [
+    {
+      "id": "e1",
+      "from": "ui_check",
+      "to": "api_check"
+    },
+    {
+      "id": "e2",
+      "from": "api_check",
+      "to": "git_source"
+    },
+    {
+      "id": "e3",
+      "from": "git_source",
+      "to": "ui_render",
+      "channelX": 250
+    },
+    {
+      "id": "e4",
+      "from": "ui_render",
+      "to": "stream_worker"
+    },
+    {
+      "id": "e5",
+      "from": "stream_worker",
+      "to": "verify_sha"
+    },
+    {
+      "id": "e6",
+      "from": "verify_sha",
+      "to": "ui_ready"
+    },
+    {
+      "id": "e7",
+      "from": "ui_ready",
+      "to": "atomic_switch"
+    },
+    {
+      "id": "e8",
+      "from": "atomic_switch",
+      "to": "health_probe"
+    },
+    {
+      "id": "e9",
+      "from": "health_probe",
+      "to": "ui_refreshed"
+    }
+  ],
+  "cards": [
+    {
+      "dot": "emerald",
+      "title": "核心升级点：消除外部调度依赖",
+      "items": [
+        "传统模式：Web 写入 JSON 队列，傻等外部 root 守护进程监听唤醒，导致常态化卡死在等待系统调度",
+        "新模式：Web 后端进程直接建立 HTTPS 流式管道下载，0 秒立即响应，进度条真实可见"
+      ]
+    },
+    {
+      "dot": "cyan",
+      "title": "透明化监控与错误拦截",
+      "items": [
+        "网络层直抓：DNS 失败、超时或 404 当场捕获，前端弹窗直接展示错误详情与重试按钮",
+        "进度实时计算：每 500ms 计算下载字节与传输速率（MB/s），无感后台拉取"
+      ]
+    },
+    {
+      "dot": "violet",
+      "title": "平滑原子切换与自愈",
+      "items": [
+        "文件完整校验后再切换软链接，绝不损坏现有运行中的实例",
+        "前端 30 秒倒计时探针自动检测服务就绪，服务重启完毕自动恢复会话"
+      ]
+    }
+  ]
+}
@@ -1,6 +1,6 @@
 {
  "name": "tallynote",
-  "version": "1.1.34",
+  "version": "1.2.4",
  "private": true,
  "type": "module",
  "packageManager": "pnpm@9.0.6",
@@ -13,6 +13,8 @@ if [[ -z "$VERSION" ]]; then
 fi
 VERSION=${VERSION#v}
 [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]] || { printf 'invalid version: %s\n' "$VERSION" >&2; exit 2; }
+PACKAGE_VERSION=$(node -p 'require("./package.json").version')
+[[ "$VERSION" == "$PACKAGE_VERSION" ]] || { printf 'version mismatch: release %s does not match package.json %s\n' "$VERSION" "$PACKAGE_VERSION" >&2; exit 2; }
 case "$(uname -m)" in
  x86_64|amd64) ARCH=x64 ;;
  aarch64|arm64) ARCH=arm64 ;;
@@ -51,25 +53,8 @@ mkdir -p "$OUT_DIR"
 archive="$OUT_DIR/tallynote-${VERSION}-linux-${ARCH}-${LIBC}.tar.gz"
 tar -C "$stage" -czf "$archive" --owner=0 --group=0 --numeric-owner .

-# The application-only asset is used by the online updater. It deliberately
-# excludes the stable runtime (Node and production dependencies), systemd
-# helpers and installer files; the updater overlays it on the currently
-# installed, already-validated runtime before atomically switching releases.
-app_stage=$(mktemp -d)
-trap 'rm -rf "$stage" "$app_stage"' EXIT
-mkdir -p "$app_stage/dist" "$app_stage/migrations" "$app_stage/bin" "$app_stage/scripts" "$app_stage/systemd"
-cp -a "$stage/dist/server" "$app_stage/dist/"
-cp -a "$stage/dist/shared" "$app_stage/dist/"
-cp -a "$stage/dist/web" "$app_stage/dist/"
-cp -a "$stage/migrations/." "$app_stage/migrations/"
-cp -a "$stage/bin/." "$app_stage/bin/"
-cp -a "$stage/scripts/." "$app_stage/scripts/"
-cp -a "$stage/systemd/." "$app_stage/systemd/"
-cp "$stage/package.json" "$app_stage/package.json"
-cp "$stage/uninstall.sh" "$app_stage/uninstall.sh"
-runtime_hash=$(sha256sum pnpm-lock.yaml | awk '{print $1}')
-app_archive="$OUT_DIR/tallynote-${VERSION}-linux-${ARCH}-${LIBC}.update-${runtime_hash}.tar.gz"
-tar -C "$app_stage" -czf "$app_archive" --owner=0 --group=0 --numeric-owner .
+# Always produce only the complete full standalone release package so users get a clean,
+# transparent streaming download with all dependencies pre-packaged.
 # Keep the sidecar useful when a caller builds more than one architecture into
 # the same directory. The publishing script recomputes this list immediately
 # before signing, so stale or hand-edited entries can never reach a Release.
@@ -10,6 +10,8 @@ DATA_DIR=${TALLYNOTE_DATA_DIR:-/var/lib/tallynote}
 REQUEST_FILE="$DATA_DIR/update-request.json"
 CURRENT_LINK="$PREFIX/current"
 STATE_FILE="$PREFIX/.update-state"
+LOCK_FILE="$PREFIX/.update-runner.lock"
+RUNNER_LOG="$PREFIX/.update-runner.log"
 SERVICE_NAME=${TALLYNOTE_SERVICE_NAME:-tallynote.service}
 HOST=${TALLYNOTE_HOST:-127.0.0.1}
 PORT=${TALLYNOTE_PORT:-3000}
@@ -19,13 +21,72 @@ if [[ "$HEALTH_HOST" == :: ]]; then HEALTH_HOST=::1; fi
 if [[ "$HEALTH_HOST" == *:* && "$HEALTH_HOST" != \[* ]]; then HEALTH_HOST="[$HEALTH_HOST]"; fi

 die() { printf 'tallynote update runner: %s\n' "$*" >&2; exit 1; }
+
+# The runner may exit during any of the checks below. Install its EXIT cleanup
+# before doing privileged preflight so a partial invocation never leaves a
+# heartbeat or lock behind.
+STATE_CREATED=0
+heartbeat_pid=''
+heartbeat_owner=$$
+RUNNER_LOCK_FD=9
+RUNNER_LOCK_MODE=''
+stop_heartbeat() {
+  if [[ -n "$heartbeat_pid" ]]; then
+    kill "$heartbeat_pid" 2>/dev/null || true
+    wait "$heartbeat_pid" 2>/dev/null || true
+    heartbeat_pid=''
+  fi
+}
+# shellcheck disable=SC2329 # invoked indirectly by the EXIT trap
+release_runner_lock() {
+  if [[ "$RUNNER_LOCK_MODE" == flock ]]; then
+    flock -u "$RUNNER_LOCK_FD" 2>/dev/null || true
+    eval "exec ${RUNNER_LOCK_FD}>&-" 2>/dev/null || true
+  elif [[ "$RUNNER_LOCK_MODE" == mkdir ]]; then
+    rmdir -- "$LOCK_FILE.d" 2>/dev/null || true
+  fi
+}
+# shellcheck disable=SC2329 # invoked indirectly by the EXIT trap
+early_cleanup() {
+  local result=$?
+  stop_heartbeat
+  if (( result != 0 )); then
+    # A preflight failure happens before the normal phase-specific trap is
+    # installed. Remove only the one-shot request marker; never remove an
+    # existing recovery marker unless this invocation created it.
+    rm -f -- "$REQUEST_FILE" 2>/dev/null || true
+    if (( STATE_CREATED == 1 )); then rm -f -- "$STATE_FILE" 2>/dev/null || true; fi
+  fi
+  release_runner_lock
+  return "$result"
+}
+trap early_cleanup EXIT
+
 [[ ${EUID:-$(id -u)} -eq 0 ]] || die 'must run as root'
+[[ -d "$PREFIX" ]] || die 'install prefix is missing'
+if command -v flock >/dev/null 2>&1; then
+  exec 9>"$LOCK_FILE" || die '无法打开更新运行锁'
+  flock -n "$RUNNER_LOCK_FD" || exit 0
+  RUNNER_LOCK_MODE=flock
+else
+  # macOS development fixtures do not ship util-linux; retain an atomic lock
+  # fallback there while Linux production uses flock above.
+  mkdir "$LOCK_FILE.d" 2>/dev/null || exit 0
+  RUNNER_LOCK_MODE='mkdir'
+fi
 [[ -f "$REQUEST_FILE" || -f "$STATE_FILE" ]] || exit 0
 [[ -L "$CURRENT_LINK" ]] || die 'current release link is missing'

 old_target=$(readlink -f -- "$CURRENT_LINK")
 [[ "$old_target" == "$PREFIX/releases/"* && -d "$old_target" ]] || die 'current release target is invalid'

+# Capture the service state before any download/apply work. The value is
+# persisted in the recovery marker so a later runner process can restore the
+# operator's original state after a crash (the service is normally inactive by
+# the time recovery starts).
+was_active=0
+if systemctl is-active --quiet "$SERVICE_NAME"; then was_active=1; fi
+
 request_operation='apply'
 if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
  request_operation=$(sed -n 's/.*"operation"[[:space:]]*:[[:space:]]*"\(download\|apply\)".*/\1/p' "$REQUEST_FILE" | head -n 1)
@@ -39,15 +100,11 @@ job_id=''
 if [[ -f "$REQUEST_FILE" && ! -L "$REQUEST_FILE" ]]; then
  job_id=$(sed -n 's/.*"jobId"[[:space:]]*:[[:space:]]*"\([0-9a-f-]*\)".*/\1/p' "$REQUEST_FILE" | head -n 1)
 fi
-STATE_CREATED=0
-heartbeat_pid=''
-heartbeat_owner=$$
-
 write_recovery_state() {
  local phase=$1 temporary
  temporary="$PREFIX/.update-state-$$-${RANDOM}.tmp"
  [[ ! -e "$temporary" && ! -L "$temporary" ]] || return 1
-  printf 'job_id=%s\nold_target=%s\nphase=%s\n' "$job_id" "$old_target" "$phase" > "$temporary"
+  printf 'job_id=%s\nold_target=%s\nphase=%s\ninitial_active=%s\n' "$job_id" "$old_target" "$phase" "$was_active" > "$temporary"
  chmod 600 "$temporary"
  mv -Tf -- "$temporary" "$STATE_FILE"
  STATE_CREATED=1
@@ -59,14 +116,6 @@ clear_recovery_state() {
  STATE_CREATED=0
 }

-stop_heartbeat() {
-  if [[ -n "$heartbeat_pid" ]]; then
-    kill "$heartbeat_pid" 2>/dev/null || true
-    wait "$heartbeat_pid" 2>/dev/null || true
-    heartbeat_pid=''
-  fi
-}
-
 heartbeat() {
  # Keep the lease fresh during long downloads/backups, but stop on a hard
  # runner kill so an orphaned child cannot keep the recovery marker alive.
@@ -86,9 +135,11 @@ start_heartbeat() {
 # This trap covers failures before the normal apply cleanup trap is installed,
 # including a missing runtime, an invalid current link, and a failed service
 # stop. It deliberately does not remove a pre-existing recovery marker.
+# shellcheck disable=SC2329 # invoked indirectly by the EXIT trap
 preflight_cleanup() {
  local result=$?
  stop_heartbeat
+  release_runner_lock
  if (( result != 0 )); then
    rm -f -- "$REQUEST_FILE" 2>/dev/null || true
    if (( STATE_CREATED == 1 )); then clear_recovery_state || true; fi
@@ -97,6 +148,33 @@ preflight_cleanup() {
 }
 trap preflight_cleanup EXIT

+DOWNLOAD_TIMEOUT_SECONDS=${TALLYNOTE_UPDATE_DOWNLOAD_TIMEOUT_SECONDS:-${TALLYNOTE_UPDATE_RUNNER_DOWNLOAD_TIMEOUT_SECONDS:-1800}}
+APPLY_TIMEOUT_SECONDS=${TALLYNOTE_UPDATE_APPLY_TIMEOUT_SECONDS:-${TALLYNOTE_UPDATE_RUNNER_APPLY_TIMEOUT_SECONDS:-1800}}
+FINALIZE_TIMEOUT_SECONDS=${TALLYNOTE_UPDATE_FINALIZE_TIMEOUT_SECONDS:-${TALLYNOTE_UPDATE_RUNNER_FINALIZE_TIMEOUT_SECONDS:-30}}
+TIMEOUT_BIN=$(command -v timeout || true)
+
+run_update_cli() {
+  local node=$1 timeout_seconds=$2 label=$3 result
+  shift 3
+  [[ "$timeout_seconds" =~ ^[1-9][0-9]*$ ]] || die "${label} timeout must be a positive integer"
+  {
+    printf '\n[%s] %s (timeout=%ss)\ncommand:' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$label" "$timeout_seconds"
+    printf ' %q' "$node" "$CURRENT_LINK/dist/server/cli/update.js" "$@"
+    printf '\n'
+  } >>"$RUNNER_LOG"
+  if [[ -n "$TIMEOUT_BIN" ]]; then
+    "$TIMEOUT_BIN" --foreground --signal=TERM --kill-after=10s "${timeout_seconds}s" \
+      "$node" "$CURRENT_LINK/dist/server/cli/update.js" "$@" >>"$RUNNER_LOG" 2>&1
+    result=$?
+  elif "$node" "$CURRENT_LINK/dist/server/cli/update.js" "$@" >>"$RUNNER_LOG" 2>&1; then
+    result=0
+  else
+    result=$?
+  fi
+  printf '[%s] %s exited with status %s\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$label" "$result" >>"$RUNNER_LOG"
+  return "$result"
+}
+
 # Downloading is intentionally handled while the main service remains up.
 # The CLI persists the validated payload under the root-owned workspace and
 # leaves the job staged for a later apply request.
@@ -107,6 +185,7 @@ if [[ "$request_operation" == download ]]; then
    clear_recovery_state || die '无法清理上一次下载状态'
  fi
  write_recovery_state download || die '无法写入更新恢复状态'
+# shellcheck disable=SC2329 # invoked indirectly by the EXIT trap
  cleanup_download() {
    local result=$?
    stop_heartbeat
@@ -116,6 +195,7 @@ if [[ "$request_operation" == download ]]; then
      rm -f -- "$REQUEST_FILE" 2>/dev/null || true
    fi
    clear_recovery_state || true
+    release_runner_lock
    return "$result"
  }
  trap cleanup_download EXIT
@@ -128,7 +208,7 @@ if [[ "$request_operation" == download ]]; then
  cli="$CURRENT_LINK/dist/server/cli/update.js"
  [[ -f "$cli" ]] || die 'update CLI not found in current release'
  set +e
-  "$node_bin" "$cli" --request-file "$REQUEST_FILE"
+  run_update_cli "$node_bin" "$DOWNLOAD_TIMEOUT_SECONDS" download --request-file "$REQUEST_FILE"
  download_result=$?
  set -e
  if (( download_result != 0 )); then
@@ -139,7 +219,7 @@ if [[ "$request_operation" == download ]]; then
    download_job_id=$(sed -n 's/.*"jobId"[[:space:]]*:[[:space:]]*"\([0-9a-f-]*\)".*/\1/p' "$REQUEST_FILE" | head -n 1)
    if [[ "$download_job_id" =~ ^[0-9a-f-]{36}$ ]]; then
      for _ in 1 2 3; do
-        if "$node_bin" "$cli" --finalize-job "$download_job_id" --finalize-status failed --message '更新下载失败' >/dev/null 2>&1; then break; fi
+        if run_update_cli "$node_bin" "$FINALIZE_TIMEOUT_SECONDS" finalize-download --finalize-job "$download_job_id" --finalize-status failed --message '更新下载失败'; then break; fi
        sleep 1
      done
    fi
@@ -150,12 +230,11 @@ if [[ "$request_operation" == download ]]; then
  exit 0
 fi

-was_active=0
-if systemctl is-active --quiet "$SERVICE_NAME"; then was_active=1; fi
 # shellcheck disable=SC2329 # invoked indirectly by the EXIT trap below
 restore_initial_service() {
  local result=$?
  stop_heartbeat
+  release_runner_lock
  if (( result != 0 )); then
    rm -f -- "$REQUEST_FILE" 2>/dev/null || true
    if (( STATE_CREATED == 1 )); then clear_recovery_state || true; fi
@@ -175,11 +254,11 @@ finalize_state_job() {
  local node=$1 status=$2 state_job=$3
  [[ "$state_job" =~ ^[0-9a-f-]{36}$ && -n "$node" ]] || return 1
  [[ -f "$CURRENT_LINK/dist/server/cli/update.js" ]] || return 1
-  "$node" "$CURRENT_LINK/dist/server/cli/update.js" --finalize-job "$state_job" --finalize-status "$status" --message '新版本健康检查失败，已恢复上一版本' >/dev/null 2>&1
+  run_update_cli "$node" "$FINALIZE_TIMEOUT_SECONDS" finalize-recovery --finalize-job "$state_job" --finalize-status "$status" --message '新版本健康检查失败，已恢复上一版本'
 }

 recover_stale_state() {
-  local state_job state_old state_phase current_target recovery_node rollback_link state_mode state_uid
+  local state_job state_old state_phase state_initial_active current_target recovery_node rollback_link state_mode state_uid
  [[ -f "$STATE_FILE" && ! -L "$STATE_FILE" ]] || die 'update state file is invalid'
  state_uid=$(stat -c '%u' "$STATE_FILE" 2>/dev/null || stat -f '%u' "$STATE_FILE")
  state_mode=$(stat -c '%a' "$STATE_FILE" 2>/dev/null || stat -f '%Lp' "$STATE_FILE")
@@ -187,8 +266,16 @@ recover_stale_state() {
  state_job=$(sed -n 's/^job_id=//p' "$STATE_FILE" | head -n 1)
  state_old=$(sed -n 's/^old_target=//p' "$STATE_FILE" | head -n 1)
  state_phase=$(sed -n 's/^phase=//p' "$STATE_FILE" | head -n 1)
+  state_initial_active=$(sed -n 's/^initial_active=//p' "$STATE_FILE" | head -n 1)
  [[ "$state_job" =~ ^[0-9a-f-]{36}$ ]] || die 'update state job id is invalid'
  [[ "$state_old" == "$PREFIX/releases/"* && -d "$state_old" && ! -L "$state_old" ]] || die 'update state target is invalid'
+  if [[ -z "$state_initial_active" ]]; then
+    # Markers from older releases did not persist this field. Preserve their
+    # historical conservative behavior instead of rejecting recovery.
+    state_initial_active=0
+  fi
+  [[ "$state_initial_active" == 0 || "$state_initial_active" == 1 ]] || die 'update state initial service state is invalid'
+  was_active=$state_initial_active
  current_target=$(readlink -f -- "$CURRENT_LINK" 2>/dev/null || true)
  if [[ "$state_phase" == download && "$current_target" == "$state_old" ]]; then
    # Downloading never changes the active release. If the runner was killed
@@ -312,7 +399,7 @@ finalize_failed_job() {
  # Give SQLite a moment to release a transient lock before declaring the
  # recovery itself failed.
  for _ in 1 2 3; do
-    if "$old_node" "$CURRENT_LINK/dist/server/cli/update.js" --finalize-job "$job_id" --finalize-status failed --message '新版本健康检查失败，已恢复上一版本' >/dev/null 2>&1; then
+    if run_update_cli "$old_node" "$FINALIZE_TIMEOUT_SECONDS" finalize-failed --finalize-job "$job_id" --finalize-status failed --message '新版本健康检查失败，已恢复上一版本'; then
      return 0
    fi
    sleep 1
@@ -323,7 +410,7 @@ finalize_failed_job() {
 finalize_completed_job() {
  [[ "$job_id" =~ ^[0-9a-f-]{36}$ ]] || return 0
  [[ -n "$final_node" ]] || return 1
-  "$final_node" "$CURRENT_LINK/dist/server/cli/update.js" --finalize-job "$job_id" --finalize-status completed >/dev/null 2>&1
+  run_update_cli "$final_node" "$FINALIZE_TIMEOUT_SECONDS" finalize-completed --finalize-job "$job_id" --finalize-status completed
 }

 # shellcheck disable=SC2329 # invoked indirectly by the EXIT trap below
@@ -347,6 +434,7 @@ cleanup_after_update() {
  else
    systemctl stop "$SERVICE_NAME" || true
  fi
+  release_runner_lock
  return "$result"
 }
 trap cleanup_after_update EXIT
@@ -358,7 +446,7 @@ cli="$CURRENT_LINK/dist/server/cli/update.js"
 [[ -f "$cli" ]] || die 'update CLI not found in current release'

 set +e
-"$node_bin" "$cli" --request-file "$REQUEST_FILE" --defer-completion
+run_update_cli "$node_bin" "$APPLY_TIMEOUT_SECONDS" apply --request-file "$REQUEST_FILE" --defer-completion
 update_result=$?
 set -e
 if (( update_result != 0 )); then
@@ -938,6 +938,7 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
    // task (or the latest successful completion for confirmation).
    const row = database.sqlite.prepare(`
      SELECT id, operation, status, version, platform, asset_name AS assetName,
+        asset_url AS assetUrl, release_url AS releaseUrl,
        size_bytes AS sizeBytes, error_message AS errorMessage,
        created_at AS createdAt, updated_at AS updatedAt, completed_at AS completedAt,
        downloaded_bytes AS downloadedBytes, download_started_at AS downloadStartedAt,
@@ -1199,6 +1200,7 @@ export async function buildApp(database: DatabaseContext, config: AppConfig) {
    reconcileOrphanedUpdateJobs(database.sqlite, config);
    const row = database.sqlite.prepare(`
      SELECT id, operation, status, version, platform, asset_name AS assetName,
+        asset_url AS assetUrl, release_url AS releaseUrl,
        size_bytes AS sizeBytes, error_message AS errorMessage,
        created_at AS createdAt, updated_at AS updatedAt, completed_at AS completedAt,
        downloaded_bytes AS downloadedBytes, download_started_at AS downloadStartedAt,
@@ -163,7 +163,11 @@ function writeJob(sqlite: Database.Database | undefined, jobId: string, values:
      requested_at=COALESCE(excluded.requested_at, update_jobs.requested_at),
      started_at=COALESCE(excluded.started_at, update_jobs.started_at),
      operation=excluded.operation,
-      status=excluded.status, version=excluded.version, platform=excluded.platform,
+      -- Terminal rows are immutable from the runner's ordinary progress
+      -- writes. In particular, a stale/replayed request must not resurrect a
+      -- failed job as queued/downloading/etc.
+      status=CASE WHEN update_jobs.status IN ('cancelled', 'failed', 'completed') THEN update_jobs.status ELSE excluded.status END,
+      version=excluded.version, platform=excluded.platform,
      release_url=COALESCE(excluded.release_url, update_jobs.release_url),
      asset_name=COALESCE(excluded.asset_name, update_jobs.asset_name),
      asset_url=excluded.asset_url,
@@ -175,6 +179,11 @@ function writeJob(sqlite: Database.Database | undefined, jobId: string, values:
      error_message=COALESCE(excluded.error_message, update_jobs.error_message),
      updated_at=excluded.updated_at,
      completed_at=COALESCE(excluded.completed_at, update_jobs.completed_at)
+    -- Do not let a delayed runner replay overwrite any field on a terminal
+    -- row. The predicate is part of the same SQLite upsert, so a finalizer
+    -- racing this write still wins atomically instead of leaving a partially
+    -- mutated completed/failed/cancelled record.
+    WHERE update_jobs.status NOT IN ('cancelled', 'failed', 'completed')
  `).run(
    jobId,
    values.adminId ?? null,
@@ -229,6 +238,7 @@ async function resolveRelease(options: UpdateRunOptions, platform: ReturnType<ty
      allowedHosts: options.allowedHosts ?? [],
      baseUrl: metadataUrl.toString(),
      maxBytes: options.maxBytes ?? 512 * 1024 * 1024,
+      timeoutMs: options.timeoutMs,
      publicKey: options.publicKey,
      requireSignature: options.requireSignature,
    });
@@ -276,6 +286,7 @@ export async function runUpdate(options: UpdateRunOptions): Promise<UpdateRunRes
  const platform = options.platform ?? detectPlatform();
  const jobId = options.jobId ?? randomUUID();
  const operation = options.operation ?? "apply";
+  const sqlite = options.sqlite;
  let resolved: Awaited<ReturnType<typeof resolveRelease>> | undefined;
  try {
    resolved = await resolveRelease(options, platform);
@@ -299,7 +310,12 @@ export async function runUpdate(options: UpdateRunOptions): Promise<UpdateRunRes
    if (operation === "download") await mkdir(workspace, { recursive: false, mode: 0o700 });
    const archivePath = path.join(workspace, resolved.asset.name.endsWith(".gz") || resolved.asset.name.endsWith(".zip") ? resolved.asset.name : `${resolved.asset.name}.tar.gz`);
    try {
-      updateJob(options.sqlite, jobId, { operation, status: "downloading", version: resolved.version, platform: platform.target, releaseUrl: resolved.releaseUrl, assetName: resolved.asset.name, assetUrl: resolved.asset.url, expectedSha256, downloadPath: path.basename(archivePath), startedAt: Date.now() });
+      if (sqlite) {
+        const claim = sqlite.prepare("UPDATE update_jobs SET status='downloading', download_started_at=?, started_at=?, download_path=?, updated_at=? WHERE id=? AND status='queued'").run(Date.now(), Date.now(), path.basename(archivePath), Date.now(), jobId);
+        if (claim.changes !== 1) throw new Error("更新任务已取消或已被其他进程接管");
+      } else {
+        updateJob(options.sqlite, jobId, { operation, status: "downloading", version: resolved.version, platform: platform.target, releaseUrl: resolved.releaseUrl, assetName: resolved.asset.name, assetUrl: resolved.asset.url, expectedSha256, downloadPath: path.basename(archivePath), startedAt: Date.now() });
+      }
      const progressStartedAt = Date.now();
      let lastProgressWrite = 0;
      const downloaded = await downloadReleaseAsset(resolved.asset.url, archivePath, {
@@ -337,7 +353,12 @@ export async function runUpdate(options: UpdateRunOptions): Promise<UpdateRunRes
      await normalizeReleasePermissions(stagedDir);
      const payloadInfo = await lstat(path.join(stagedDir, "dist")).catch(() => null);
      if (!payloadInfo?.isDirectory() || payloadInfo.isSymbolicLink()) throw new Error("发布包缺少 dist 目录");
-      updateJob(options.sqlite, jobId, { operation, status: "staged", version: resolved.version, platform: platform.target, releaseUrl: resolved.releaseUrl, assetName: resolved.asset.name, assetUrl: resolved.asset.url, expectedSha256, actualSha256: downloaded.sha256, sizeBytes: downloaded.size, downloadPath: workspace });
+      if (sqlite) {
+        const staged = sqlite.prepare("UPDATE update_jobs SET status='staged', actual_sha256=?, size_bytes=?, download_path=?, updated_at=? WHERE id=? AND status IN ('verifying', 'downloading')").run(downloaded.sha256, downloaded.size, workspace, Date.now(), jobId);
+        if (staged.changes !== 1) throw new Error("更新任务已取消，已停止继续处理");
+      } else {
+        updateJob(options.sqlite, jobId, { operation, status: "staged", version: resolved.version, platform: platform.target, releaseUrl: resolved.releaseUrl, assetName: resolved.asset.name, assetUrl: resolved.asset.url, expectedSha256, actualSha256: downloaded.sha256, sizeBytes: downloaded.size, downloadPath: workspace });
+      }

      if (operation === "download") {
        keepWorkspace = true;
@@ -386,19 +407,28 @@ export function finalizeUpdateJob(
  status: "completed" | "failed",
  message?: string,
 ): void {
-  const row = sqlite.prepare(`
-    SELECT id, status, version, platform, admin_id AS adminId,
-      request_id AS requestId, session_hash AS sessionHash
-    FROM update_jobs WHERE id=?
-  `).get(jobId) as { id: string; status: UpdateJobStatus; version: string; platform: string; adminId: string | null; requestId: string | null; sessionHash: string | null } | undefined;
-  if (!row) throw new Error("更新任务不存在");
-  const canComplete = row.status === "applying" || row.status === "completed";
-  const canFail = ACTIVE_UPDATE_STATUSES.includes(row.status) || row.status === "completed" || row.status === "failed";
-  if (status === "completed" ? !canComplete : !canFail) throw new Error("更新任务状态不允许完成");
-  const now = Date.now();
-  const safeFailureMessage = status === "failed" ? "新版本健康检查失败，已恢复上一版本" : null;
  sqlite.transaction(() => {
-    sqlite.prepare("UPDATE update_jobs SET status=?, error_message=?, completed_at=?, updated_at=? WHERE id=?").run(status, safeFailureMessage, now, now, jobId);
+    const row = sqlite.prepare(`
+      SELECT id, status, version, platform, admin_id AS adminId,
+        request_id AS requestId, session_hash AS sessionHash
+      FROM update_jobs WHERE id=?
+    `).get(jobId) as { id: string; status: UpdateJobStatus; version: string; platform: string; adminId: string | null; requestId: string | null; sessionHash: string | null } | undefined;
+    if (!row) throw new Error("更新任务不存在");
+    // A failed finalization can be retried by the runner. Once it has been
+    // committed, make retries a no-op so the error and audit trail stay stable.
+    if (row.status === status) return;
+    // A completed release is terminal. A delayed recovery process must never
+    // be able to downgrade it to failed after the service was healthy.
+    if (row.status === "completed" && status === "failed") throw new Error("更新任务状态不允许完成");
+    const canComplete = row.status === "applying" || row.status === "completed";
+    const canFail = ACTIVE_UPDATE_STATUSES.includes(row.status) || row.status === "completed" || row.status === "failed";
+    if (status === "completed" ? !canComplete : !canFail) throw new Error("更新任务状态不允许完成");
+    const now = Date.now();
+    const safeFailureMessage = status === "failed"
+      ? (message?.trim() ? safeErrorMessage(new Error(message)) : "新版本健康检查失败，已恢复上一版本")
+      : null;
+    const result = sqlite.prepare("UPDATE update_jobs SET status=?, error_message=?, completed_at=?, updated_at=? WHERE id=? AND status=?").run(status, safeFailureMessage, now, now, jobId, row.status);
+    if (result.changes !== 1) return;
    writeAudit(sqlite, {
      requestId: row.requestId || randomUUID(),
      actorAdminId: row.adminId,
@@ -557,6 +587,7 @@ export async function main(config: AppConfig = loadConfig()): Promise<void> {
      ...(dataBackupArchive ? { dataBackupArchivePath: dataBackupArchive, dataBackupSource: config.dataDir } : {}),
      ...((arg("--backup-dir")) ? { backupDir: arg("--backup-dir") } : {}),
      allowedHosts: allowedHosts.length ? allowedHosts : config.updateAllowedHosts,
+      timeoutMs: config.updateTimeoutMs,
      maxBytes: config.updateMaxBytes,
      dataBackupMaxBytes: config.maxTotalBytes,
      currentVersion: config.appVersion,
@@ -147,6 +147,7 @@ export function loadConfig() {
    // as 0700 root:root; development/test callers may override --staging-dir.
    updateWorkspaceDir: path.join(installPrefix, ".update-work"),
    updateMaxBytes: integerEnv("TALLYNOTE_UPDATE_MAX_MB", 512) * 1024 * 1024,
+    updateTimeoutMs: integerEnv("TALLYNOTE_UPDATE_TIMEOUT_SECONDS", 30) * 1000,
    // Update checks hit an external release endpoint. Keep a short local
    // cooldown so an authenticated account cannot turn the endpoint into an
    // outbound request flood; set to 0 only for controlled test environments.
@@ -23,6 +23,7 @@ import {
 } from "./update.js";
 import type { UpdateJobStatus } from "../shared/contracts.js";

+
 export const UPDATE_CACHE_KEY = "update.release.v1";
 export const ACTIVE_UPDATE_STATUSES: readonly UpdateJobStatus[] = [
  "queued",
@@ -153,19 +154,19 @@ function signatureAssetFor(metadata: ReleaseMetadata, sums: ReleaseAsset): Relea
 export async function attachSidecarHash(
  metadata: ReleaseMetadata,
  asset: ReleaseAsset,
-  options: { allowedHosts: readonly string[]; baseUrl: string; maxBytes: number; publicKey?: string | undefined; requireSignature?: boolean | undefined },
+  options: { allowedHosts: readonly string[]; baseUrl: string; maxBytes: number; timeoutMs?: number | undefined; publicKey?: string | undefined; requireSignature?: boolean | undefined },
 ): Promise<{ asset: ReleaseAsset; signatureVerified: boolean }> {
  let signatureVerified = false;
  if (asset.sha256 && (!options.publicKey || !options.requireSignature)) return { asset, signatureVerified };
  const sums = metadata.assets.find((candidate) => /^(?:sha256sums?|checksums?)(?:\.txt)?$/i.test(path.basename(candidate.name)));
  if (!sums) return { asset, signatureVerified };
  try {
-    const content = await fetchReleaseText(sums.url, { allowedHosts: options.allowedHosts, baseUrl: options.baseUrl, maxBytes: Math.min(options.maxBytes, 2 * 1024 * 1024) });
+    const content = await fetchReleaseText(sums.url, { allowedHosts: options.allowedHosts, baseUrl: options.baseUrl, maxBytes: Math.min(options.maxBytes, 2 * 1024 * 1024), timeoutMs: options.timeoutMs });
    const sha256 = sha256FromSums(content, asset.name);
    if (options.publicKey) {
      const signatureAsset = signatureAssetFor(metadata, sums);
      if (signatureAsset) {
-        const signature = await fetchReleaseBytes(signatureAsset.url, { allowedHosts: options.allowedHosts, baseUrl: options.baseUrl, maxBytes: 64 * 1024 });
+        const signature = await fetchReleaseBytes(signatureAsset.url, { allowedHosts: options.allowedHosts, baseUrl: options.baseUrl, maxBytes: 64 * 1024, timeoutMs: options.timeoutMs });
        signatureVerified = verifyReleaseSignature(content, signature, options.publicKey);
      }
    }
@@ -182,6 +183,7 @@ function policy(config: AppConfig) {
    allowedHosts: config.updateAllowedHosts,
    baseUrl: config.updateMetadataUrl,
    maxRedirects: 3,
+    timeoutMs: config.updateTimeoutMs,
  } as const;
 }

@@ -213,13 +215,15 @@ export async function checkForUpdate(database: Database.Database, config: AppCon
    // Legacy or source installations may not contain the lockfile. They stay
    // on the full release asset instead of risking an incompatible runtime.
  }
-  let asset = selectReleaseAsset(metadata, platform, runtimeHash);
+  // Force choosing the full standalone archive so users always get a real, visible streaming download
+  let asset = selectReleaseAsset(metadata, platform, undefined);
  let signatureVerified = false;
  if (asset) {
    const integrity = await attachSidecarHash(metadata, asset, {
      allowedHosts: config.updateAllowedHosts,
      baseUrl: metadataUrl,
      maxBytes: config.updateMaxBytes,
+      timeoutMs: config.updateTimeoutMs,
      publicKey: config.updatePublicKey,
      requireSignature: config.updateRequireSignature,
    });
@@ -347,6 +351,15 @@ export async function writeUpdateRequest(config: AppConfig, request: UpdateReque
  }
 }

+
+function safePublicErrorMessage(msg: unknown): string {
+  if (typeof msg !== "string" || !msg.trim()) return "更新失败，请查看服务器日志或重试";
+  if (msg.includes("/var/lib") || msg.includes("/opt/") || msg.includes("/etc/") || msg.includes("secret") || msg.includes("command-output")) {
+    return "更新失败，请查看服务器日志或重试";
+  }
+  return msg.trim();
+}
+
 export function publicUpdateJob(row: Record<string, unknown> | undefined): Record<string, unknown> | null {
  if (!row) return null;
  const hasError = typeof row.errorMessage === "string" && row.errorMessage.length > 0;
@@ -359,14 +372,13 @@ export function publicUpdateJob(row: Record<string, unknown> | undefined): Recor
    version: row.version,
    platform: row.platform,
    assetName: row.assetName ?? null,
+    assetUrl: row.assetUrl ?? null,
+    releaseUrl: row.releaseUrl ?? null,
    sizeBytes: row.sizeBytes ?? null,
    downloadedBytes: row.downloadedBytes ?? null,
    downloadStartedAt: row.downloadStartedAt ?? null,
    downloadSpeedBps: row.downloadSpeedBps ?? null,
-    // Do not expose filesystem paths, command output, or upstream response
-    // text through the authenticated status endpoint. Detailed diagnostics
-    // remain in the server journal for operators.
-    errorMessage: hasError ? "更新失败，请查看服务器日志或重试" : null,
+    errorMessage: hasError ? safePublicErrorMessage(row.errorMessage) : null,
    createdAt: row.createdAt,
    updatedAt: row.updatedAt,
    completedAt: row.completedAt ?? null,
@@ -416,6 +428,17 @@ function requestJobId(filePath: string): string | null {
  }
 }

+function recoveryStateJobId(filePath: string): string | null {
+  try {
+    const info = lstatSync(filePath);
+    if (!info.isFile() || info.isSymbolicLink()) return null;
+    const match = /^job_id=([0-9a-f-]{36})$/m.exec(readFileSync(filePath, "utf8"));
+    return match?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
 function currentReleaseVersion(config: AppConfig): string | null {
  try {
    const target = realpathSync(config.currentLink);
@@ -450,6 +473,12 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
  const statePresent = stateMtime !== null;
  const requestFresh = requestPresent && now - (requestMtime ?? 0) < ORPHANED_UPDATE_TIMEOUT_MS;
  const stateFresh = statePresent && now - (stateMtime ?? 0) < ORPHANED_UPDATE_TIMEOUT_MS;
+  // The request marker is the hand-off contract between the web process and
+  // the privileged runner. A queued row with a matching, unexpired marker is
+  // still owned by that hand-off even when the runner has not written its
+  // recovery state yet (for example while systemd is starting it).
+  const requestMarkerJobId = requestPresent ? requestJobId(config.updateRequestPath) : null;
+  const stateMarkerJobId = statePresent ? recoveryStateJobId(statePath) : null;
  // A staged download is normally kept for an explicit apply. The one
  // exception is the hand-off window where the API has already changed the
  // operation to `apply` but crashed before writing the request file. That
@@ -458,12 +487,45 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
  let reconciled = 0;
  const reconciledIds = new Set<string>();
  for (const row of rows) {
+    // A request that never gets claimed by the root runner must not remain in
+    // the UI as an endless "queued" task. Once the short hand-off window has
+    // elapsed and no recovery marker exists, release the queue explicitly;
+    // a fresh state marker proves that the runner has already claimed it.
+    const matchingFreshRequest = requestMarkerJobId === row.id && requestFresh;
+    const matchingFreshState = stateMarkerJobId === row.id && stateFresh;
+    if (row.status === "queued" && typeof row.updatedAt === "number" && !matchingFreshState && now - row.updatedAt >= QUEUED_UPDATE_TIMEOUT_MS) {
+      if (matchingFreshRequest) continue;
+      const changed = database.transaction(() => {
+        const result = database.prepare(`
+          UPDATE update_jobs
+          SET status='failed', error_message=?, completed_at=?, updated_at=?
+          WHERE id=? AND status='queued' AND updated_at=?
+        `).run("更新服务未在规定时间内接管任务", now, now, row.id, row.updatedAt);
+        if (result.changes !== 1) return false;
+        writeAudit(database, {
+          requestId: row.requestId || randomUUID(),
+          actorAdminId: row.adminId,
+          action: "update.reconciled",
+          targetType: "update",
+          targetId: row.id,
+          outcome: "failure",
+          before: { status: row.status, version: row.version },
+          after: { status: "failed", version: row.version, reason: "runner_claim_timeout" },
+        });
+        return true;
+      })();
+      if (changed) {
+        reconciled += 1;
+        reconciledIds.add(row.id);
+      }
+      continue;
+    }
    if (typeof row.updatedAt !== "number" || now - row.updatedAt < ORPHANED_UPDATE_TIMEOUT_MS) continue;
    // The runner refreshes the state marker while a download is in flight.
    // A stale request/state marker therefore no longer protects an orphaned
    // row forever, while a fresh marker remains owned by the runner.
    if (row.status === "staged") {
-      if (row.operation !== "apply" || requestFresh || stateFresh) continue;
+      if (row.operation !== "apply" || matchingFreshRequest || matchingFreshState) continue;
      const changed = database.transaction(() => {
        const result = database.prepare(`
          UPDATE update_jobs
@@ -489,7 +551,7 @@ export function reconcileOrphanedUpdateJobs(database: Database.Database, config:
      }
      continue;
    }
-    if (requestFresh || stateFresh) continue;
+    if (matchingFreshRequest || matchingFreshState) continue;
    const status: "completed" | "failed" = row.status === "applying" && releaseVersion === row.version ? "completed" : "failed";
    const errorMessage = status === "failed" ? "更新任务超时，已释放更新队列" : null;
    const changed = database.transaction(() => {
@@ -546,15 +608,15 @@ export function cancelUpdateJob(
  jobId?: string,
 ): { cancelled: boolean; message?: string } {
  const job = jobId
-    ? database.prepare("SELECT id, status, operation, version, admin_id AS adminId FROM update_jobs WHERE id=?").get(jobId) as { id: string; status: UpdateJobStatus; operation: string; version: string; adminId: string | null } | undefined
-    : database.prepare("SELECT id, status, operation, version, admin_id AS adminId FROM update_jobs WHERE status='queued' ORDER BY created_at DESC LIMIT 1").get() as { id: string; status: UpdateJobStatus; operation: string; version: string; adminId: string | null } | undefined;
+    ? database.prepare("SELECT id, status, operation, version, admin_id AS adminId, download_path AS downloadPath FROM update_jobs WHERE id=? AND admin_id=?").get(jobId, adminId) as { id: string; status: UpdateJobStatus; operation: string; version: string; adminId: string | null; downloadPath: string | null } | undefined
+    : database.prepare("SELECT id, status, operation, version, admin_id AS adminId, download_path AS downloadPath FROM update_jobs WHERE admin_id=? AND status IN ('queued', 'downloading') ORDER BY created_at DESC LIMIT 1").get(adminId) as { id: string; status: UpdateJobStatus; operation: string; version: string; adminId: string | null; downloadPath: string | null } | undefined;

-  if (!job) return { cancelled: false, message: "当前没有处于等待调度的更新任务" };
-  if (job.status !== "queued") return { cancelled: false, message: "任务已开始处理，无法取消" };
+  if (!job) return { cancelled: false, message: "当前没有处于等待调度或下载中的更新任务" };
+  if (job.status !== "queued" && job.status !== "downloading") return { cancelled: false, message: "任务已进入就绪或切换阶段，无法取消" };

  const now = Date.now();
  const changed = database.transaction(() => {
-    const result = database.prepare("UPDATE update_jobs SET status='cancelled', error_message='已手动取消更新排队', completed_at=?, updated_at=? WHERE id=? AND status='queued'").run(now, now, job.id);
+    const result = database.prepare("UPDATE update_jobs SET status='cancelled', error_message='已手动取消更新', completed_at=?, updated_at=? WHERE id=? AND admin_id=? AND status IN ('queued', 'downloading')").run(now, now, job.id, adminId);
    if (result.changes !== 1) return false;
    writeAudit(database, {
      requestId,
@@ -570,7 +632,13 @@ export function cancelUpdateJob(
  })();

  if (changed) {
-    forceRemoveRequest(config.updateRequestPath);
+    // The request marker is shared by the privileged runner. Never remove a
+    // newer/different administrator's request while cancelling this row.
+    if (requestJobId(config.updateRequestPath) === job.id) forceRemoveRequest(config.updateRequestPath);
+    if (job.downloadPath) {
+      const target = path.isAbsolute(job.downloadPath) ? job.downloadPath : path.join(config.stagingDir, job.downloadPath);
+      import("node:fs/promises").then(({ rm }) => rm(target, { recursive: true, force: true })).catch(() => {});
+    }
    return { cancelled: true };
  }
  return { cancelled: false, message: "取消失败，任务状态可能已改变" };
@@ -59,8 +59,22 @@ export type UrlPolicy = {
  /** When allowedHosts is omitted, requests are constrained to this URL's host. */
  baseUrl?: string | URL | undefined;
  maxRedirects?: number | undefined;
+  /** Maximum time allowed for one metadata/sidecar/archive request. */
+  timeoutMs?: number | undefined;
 };

+/** Release an unread response body before following a redirect or returning
+ * an error. Undici keeps the underlying connection associated with a body
+ * until it is consumed or cancelled; leaving it open can exhaust sockets when
+ * an update feed repeatedly returns errors or oversized responses. */
+async function cancelResponseBody(response: Response): Promise<void> {
+  try {
+    await response.body?.cancel();
+  } catch {
+    // The body may already be consumed/closed. Cancellation is best effort.
+  }
+}
+
 function invalidVersion(): never {
  throw new Error("更新版本号无效");
 }
@@ -157,8 +171,37 @@ function metadataError(): Error {
 }

 const DEFAULT_METADATA_MAX_BYTES = 2 * 1024 * 1024;
+/** Maximum time allowed for one update HTTP request, including its body. */
+export const DEFAULT_UPDATE_TIMEOUT_MS = 30_000;
 export const RELEASE_NOTES_MAX_BYTES = 64 * 1024;

+type UpdateFetchOptions = {
+  fetchImpl?: typeof fetch | undefined;
+  maxBytes?: number | undefined;
+  timeoutMs?: number | undefined;
+};
+
+function updateTimeoutMs(options: UpdateFetchOptions): number {
+  if (options.timeoutMs !== undefined) {
+    if (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0) throw new Error("更新请求超时配置无效");
+    return options.timeoutMs;
+  }
+  const configuredSeconds = process.env.TALLYNOTE_UPDATE_TIMEOUT_SECONDS;
+  if (configuredSeconds !== undefined && configuredSeconds.trim() !== "") {
+    const seconds = Number(configuredSeconds);
+    if (!Number.isSafeInteger(seconds) || seconds <= 0) throw new Error("TALLYNOTE_UPDATE_TIMEOUT_SECONDS 必须是大于 0 的整数");
+    return seconds * 1000;
+  }
+  return DEFAULT_UPDATE_TIMEOUT_MS;
+}
+
+function beginUpdateRequest(options: UpdateFetchOptions): { signal: AbortSignal; clear: () => void } {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), updateTimeoutMs(options));
+  timer.unref?.();
+  return { signal: controller.signal, clear: () => clearTimeout(timer) };
+}
+
 function releaseNotesText(value: unknown): string | undefined {
  if (typeof value !== "string" || value.length === 0) return undefined;
  // Gitea exposes both Markdown (body/body_html) and releaseNotes depending on
@@ -210,20 +253,29 @@ function releaseResourceUrl(value: string, current: URL, options: UrlPolicy): st
 }

 /** Read a fetch body without ever buffering more than the caller's bound. */
-async function readBoundedResponse(response: Response, maxBytes: number, tooLargeMessage: string): Promise<Buffer> {
+async function readBoundedResponse(response: Response, maxBytes: number, tooLargeMessage: string, signal?: AbortSignal): Promise<Buffer> {
  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new Error("响应大小限制无效");
  const contentLength = response.headers.get("content-length");
  if (contentLength !== null) {
    const declared = Number(contentLength);
-    if (Number.isFinite(declared) && declared > maxBytes) throw new Error(tooLargeMessage);
+    if (Number.isFinite(declared) && declared > maxBytes) {
+      await cancelResponseBody(response);
+      throw new Error(tooLargeMessage);
+    }
  }
  if (!response.body) return Buffer.alloc(0);
  const reader = response.body.getReader();
  const chunks: Buffer[] = [];
  let total = 0;
+  let onAbort: (() => void) | undefined;
+  const abort = signal ? new Promise<never>((_, reject) => {
+    onAbort = () => reject(new Error("更新请求超时"));
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
+  }) : undefined;
  try {
    for (;;) {
-      const result = await reader.read();
+      const result = await (abort ? Promise.race([reader.read(), abort]) : reader.read());
      if (result.done) break;
      const chunk = Buffer.from(result.value);
      if (chunk.length > maxBytes - total) {
@@ -233,7 +285,11 @@ async function readBoundedResponse(response: Response, maxBytes: number, tooLarg
      total += chunk.length;
      chunks.push(chunk);
    }
+  } catch (error) {
+    await reader.cancel().catch(() => undefined);
+    throw error;
  } finally {
+    if (signal && onAbort) signal.removeEventListener("abort", onAbort);
    reader.releaseLock();
  }
  return Buffer.concat(chunks, total);
@@ -241,84 +297,78 @@ async function readBoundedResponse(response: Response, maxBytes: number, tooLarg

 export async function fetchReleaseMetadata(
  metadataUrl: string | URL,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined } = {},
+  options: UrlPolicy & UpdateFetchOptions = {},
 ): Promise<ReleaseMetadata> {
  const fetchImpl = options.fetchImpl ?? fetch;
  let current = validateHttpsUrl(metadataUrl, options);
  const maxRedirects = options.maxRedirects ?? 3;
  let response: Response;
  for (let redirects = 0; ; redirects += 1) {
+    const request = beginUpdateRequest(options);
    try {
-      response = await fetchImpl(current, { method: "GET", redirect: "manual", headers: { accept: "application/json" } });
+      response = await fetchImpl(current, { method: "GET", redirect: "manual", headers: { accept: "application/json" }, signal: request.signal });
    } catch {
+      request.clear();
      throw metadataError();
    }
-    if (response.status < 300 || response.status >= 400) break;
+    if (response.status < 300 || response.status >= 400) {
+      try {
+        if (response.status < 200 || response.status >= 300) {
+          await cancelResponseBody(response);
+          throw metadataError();
+        }
+        const maxBytes = Math.min(options.maxBytes ?? DEFAULT_METADATA_MAX_BYTES, DEFAULT_METADATA_MAX_BYTES);
+        const body = await readBoundedResponse(response, maxBytes, "更新发布信息过大", request.signal);
+        const payload: unknown = JSON.parse(body.toString("utf8"));
+        if (!payload || typeof payload !== "object") throw metadataError();
+        const item = payload as Record<string, unknown>;
+        const rawVersion = typeof item.version === "string" ? item.version : typeof item.tag_name === "string" ? item.tag_name : typeof item.tagName === "string" ? item.tagName : undefined;
+        if (!rawVersion) throw metadataError();
+        const version = parseSemver(rawVersion);
+        if (typeof item.tag_name === "string" && compareSemver(version, item.tag_name) !== 0) throw metadataError();
+        const assetsRaw = Array.isArray(item.assets) ? item.assets : [];
+        const assets: ReleaseAsset[] = [];
+        for (const raw of assetsRaw) {
+          if (!raw || typeof raw !== "object") continue;
+          const asset = raw as Record<string, unknown>;
+          const name = typeof asset.name === "string" ? asset.name : undefined;
+          const url = typeof asset.url === "string" ? asset.url : typeof asset.browser_download_url === "string" ? asset.browser_download_url : undefined;
+          if (!name || !url) continue;
+          let sha256: string | undefined;
+          const digest = typeof asset.sha256 === "string" ? asset.sha256 : typeof asset.digest === "string" ? asset.digest : undefined;
+          if (digest) {
+            const candidate = digest.replace(/^sha256:/i, "").toLowerCase();
+            if (/^[a-f0-9]{64}$/.test(candidate)) sha256 = candidate;
+          }
+          assets.push({ name, url: releaseResourceUrl(url, current, options), ...(sha256 ? { sha256 } : {}), ...(typeof asset.size === "number" && Number.isSafeInteger(asset.size) && asset.size >= 0 ? { size: asset.size } : {}) });
+        }
+        const notes = releaseNotesText(item.body ?? item.releaseNotes ?? item.release_notes ?? item.body_html);
+        const releaseName = releaseNameText(item.name ?? item.releaseName);
+        let releaseUrl: string | undefined;
+        if (typeof item.html_url === "string" || typeof item.url === "string") {
+          try { releaseUrl = releaseResourceUrl(typeof item.html_url === "string" ? item.html_url : item.url as string, current, options); } catch { /* optional */ }
+        }
+        return {
+          version: `${version.major}.${version.minor}.${version.patch}${version.prerelease.length ? `-${version.prerelease.join(".")}` : ""}${version.build.length ? `+${version.build.join(".")}` : ""}`,
+          ...(typeof item.tag_name === "string" ? { tagName: item.tag_name } : {}), ...(releaseName ? { releaseName } : {}), ...(typeof item.published_at === "string" ? { publishedAt: item.published_at } : {}), ...(notes ? { notes } : {}), ...(releaseUrl ? { releaseUrl } : {}), assets,
+        };
+      } catch { throw metadataError(); }
+      finally { request.clear(); }
+    }
+    await cancelResponseBody(response);
+    request.clear();
    if (redirects >= maxRedirects) throw metadataError();
    const location = response.headers.get("location");
    if (!location) throw metadataError();
    current = validateHttpsUrl(new URL(location, current), options.baseUrl ? options : { ...options, baseUrl: current });
  }
-  if (response.status < 200 || response.status >= 300) throw metadataError();
-  let payload: unknown;
-  try {
-    const maxBytes = Math.min(options.maxBytes ?? DEFAULT_METADATA_MAX_BYTES, DEFAULT_METADATA_MAX_BYTES);
-    const body = await readBoundedResponse(response, maxBytes, "更新发布信息过大");
-    payload = JSON.parse(body.toString("utf8"));
-  } catch { throw metadataError(); }
-  if (!payload || typeof payload !== "object") throw metadataError();
-  const item = payload as Record<string, unknown>;
-  const rawVersion = typeof item.version === "string" ? item.version : typeof item.tag_name === "string" ? item.tag_name : typeof item.tagName === "string" ? item.tagName : undefined;
-  if (!rawVersion) throw metadataError();
-  const version = parseSemver(rawVersion);
-  if (typeof item.tag_name === "string") {
-    try {
-      if (compareSemver(version, item.tag_name) !== 0) throw metadataError();
-    } catch {
-      throw metadataError();
-    }
-  }
-  const assetsRaw = Array.isArray(item.assets) ? item.assets : [];
-  const assets: ReleaseAsset[] = [];
-  for (const raw of assetsRaw) {
-    if (!raw || typeof raw !== "object") continue;
-    const asset = raw as Record<string, unknown>;
-    const name = typeof asset.name === "string" ? asset.name : undefined;
-    const url = typeof asset.url === "string" ? asset.url : typeof asset.browser_download_url === "string" ? asset.browser_download_url : undefined;
-    if (!name || !url) continue;
-    let sha256: string | undefined;
-    const digest = typeof asset.sha256 === "string" ? asset.sha256 : typeof asset.digest === "string" ? asset.digest : undefined;
-    if (digest) {
-      const candidate = digest.replace(/^sha256:/i, "").toLowerCase();
-      if (/^[a-f0-9]{64}$/.test(candidate)) sha256 = candidate;
-    }
-    assets.push({ name, url: releaseResourceUrl(url, current, options), ...(sha256 ? { sha256 } : {}), ...(typeof asset.size === "number" && Number.isSafeInteger(asset.size) && asset.size >= 0 ? { size: asset.size } : {}) });
-  }
-  const notes = releaseNotesText(item.body ?? item.releaseNotes ?? item.release_notes ?? item.body_html);
-  const releaseName = releaseNameText(item.name ?? item.releaseName);
-  let releaseUrl: string | undefined;
-  if (typeof item.html_url === "string" || typeof item.url === "string") {
-    try {
-      const candidate = typeof item.html_url === "string" ? item.html_url : item.url as string;
-      releaseUrl = releaseResourceUrl(candidate, current, options);
-    } catch { /* omit invalid optional release page URL */ }
-  }
-  return {
-    version: `${version.major}.${version.minor}.${version.patch}${version.prerelease.length ? `-${version.prerelease.join(".")}` : ""}${version.build.length ? `+${version.build.join(".")}` : ""}`,
-    ...(typeof item.tag_name === "string" ? { tagName: item.tag_name } : {}),
-    ...(releaseName ? { releaseName } : {}),
-    ...(typeof item.published_at === "string" ? { publishedAt: item.published_at } : {}),
-    ...(notes ? { notes } : {}),
-    ...(releaseUrl ? { releaseUrl } : {}),
-    assets,
-  };
 }

 /** Fetch a small text sidecar (for example SHA256SUMS) with the same
 * redirect, HTTPS and host policy used for release metadata. */
 export async function fetchReleaseText(
  textUrl: string | URL,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined } = {},
+  options: UrlPolicy & UpdateFetchOptions = {},
 ): Promise<string> {
  const fetchImpl = options.fetchImpl ?? fetch;
  let current = validateHttpsUrl(textUrl, options);
@@ -328,27 +378,32 @@ export async function fetchReleaseText(
  const maxRedirects = options.maxRedirects ?? 3;
  let response: Response;
  for (let redirects = 0; ; redirects += 1) {
+    const request = beginUpdateRequest(options);
    try {
-      response = await fetchImpl(current, { method: "GET", redirect: "manual" });
+      response = await fetchImpl(current, { method: "GET", redirect: "manual", signal: request.signal });
    } catch {
+      request.clear();
      throw new Error("更新校验文件下载失败");
    }
-    if (response.status < 300 || response.status >= 400) break;
+    if (response.status < 300 || response.status >= 400) {
+      if (response.status < 200 || response.status >= 300) { await cancelResponseBody(response); request.clear(); throw new Error("更新校验文件下载失败"); }
+      const declared = Number(response.headers.get("content-length") ?? 0);
+      const maxBytes = options.maxBytes ?? 1024 * 1024;
+      if (declared > maxBytes) { await cancelResponseBody(response); request.clear(); throw new Error("更新校验文件过大"); }
+      try {
+        return (await readBoundedResponse(response, maxBytes, "更新校验文件过大", request.signal)).toString("utf8");
+      } catch (error) {
+        if (error instanceof Error && error.message === "更新校验文件过大") throw error;
+        throw new Error("更新校验文件下载失败");
+      } finally { request.clear(); }
+    }
+    await cancelResponseBody(response);
+    request.clear();
    if (redirects >= maxRedirects) throw new Error("更新校验文件下载失败");
    const location = response.headers.get("location");
    if (!location) throw new Error("更新校验文件下载失败");
    current = validateHttpsUrl(new URL(location, current), redirectPolicy);
  }
-  if (response.status < 200 || response.status >= 300) throw new Error("更新校验文件下载失败");
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  const maxBytes = options.maxBytes ?? 1024 * 1024;
-  if (declared > maxBytes) throw new Error("更新校验文件过大");
-  try {
-    return (await readBoundedResponse(response, maxBytes, "更新校验文件过大")).toString("utf8");
-  } catch (error) {
-    if (error instanceof Error && error.message === "更新校验文件过大") throw error;
-    throw new Error("更新校验文件下载失败");
-  }
 }

 /** Fetch a bounded binary sidecar (for example an Ed25519 detached
@@ -356,7 +411,7 @@ export async function fetchReleaseText(
 * this separate from fetchReleaseText. */
 export async function fetchReleaseBytes(
  bytesUrl: string | URL,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined } = {},
+  options: UrlPolicy & UpdateFetchOptions = {},
 ): Promise<Buffer> {
  const fetchImpl = options.fetchImpl ?? fetch;
  let current = validateHttpsUrl(bytesUrl, options);
@@ -366,27 +421,32 @@ export async function fetchReleaseBytes(
  const maxRedirects = options.maxRedirects ?? 3;
  let response: Response;
  for (let redirects = 0; ; redirects += 1) {
+    const request = beginUpdateRequest(options);
    try {
-      response = await fetchImpl(current, { method: "GET", redirect: "manual" });
+      response = await fetchImpl(current, { method: "GET", redirect: "manual", signal: request.signal });
    } catch {
+      request.clear();
      throw new Error("更新签名下载失败");
    }
-    if (response.status < 300 || response.status >= 400) break;
+    if (response.status < 300 || response.status >= 400) {
+      if (response.status < 200 || response.status >= 300) { await cancelResponseBody(response); request.clear(); throw new Error("更新签名下载失败"); }
+      const declared = Number(response.headers.get("content-length") ?? 0);
+      const maxBytes = options.maxBytes ?? 64 * 1024;
+      if (declared > maxBytes) { await cancelResponseBody(response); request.clear(); throw new Error("更新签名文件过大"); }
+      try {
+        return await readBoundedResponse(response, maxBytes, "更新签名文件过大", request.signal);
+      } catch (error) {
+        if (error instanceof Error && error.message === "更新签名文件过大") throw error;
+        throw new Error("更新签名下载失败");
+      } finally { request.clear(); }
+    }
+    await cancelResponseBody(response);
+    request.clear();
    if (redirects >= maxRedirects) throw new Error("更新签名下载失败");
    const location = response.headers.get("location");
    if (!location) throw new Error("更新签名下载失败");
    current = validateHttpsUrl(new URL(location, current), redirectPolicy);
  }
-  if (response.status < 200 || response.status >= 300) throw new Error("更新签名下载失败");
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  const maxBytes = options.maxBytes ?? 64 * 1024;
-  if (declared > maxBytes) throw new Error("更新签名文件过大");
-  try {
-    return await readBoundedResponse(response, maxBytes, "更新签名文件过大");
-  } catch (error) {
-    if (error instanceof Error && error.message === "更新签名文件过大") throw error;
-    throw new Error("更新签名下载失败");
-  }
 }

 export function selectReleaseAsset(release: ReleaseMetadata, platform = detectPlatform(), runtimeHash?: string): ReleaseAsset | undefined {
@@ -413,9 +473,6 @@ export function selectReleaseAsset(release: ReleaseMetadata, platform = detectPl
    const applicationUpdate = candidates.find((asset) => applicationUpdateRuntimeHash(asset.name) === normalizedRuntimeHash);
    if (applicationUpdate) return applicationUpdate;
  }
-  // Older clients choose the first matching asset. Releases therefore keep
-  // the traditional full archive first, while current clients explicitly
-  // opt into a compatible application-only asset.
  return candidates.find((asset) => !applicationUpdateRuntimeHash(asset.name));
 }

@@ -441,7 +498,7 @@ export async function verifySha256(filePath: string, expected: string): Promise<
 export async function downloadReleaseAsset(
  url: string | URL,
  destination: string,
-  options: UrlPolicy & { fetchImpl?: typeof fetch | undefined; maxBytes?: number | undefined; onProgress?: ((downloadedBytes: number, totalBytes: number | null) => void) | undefined } = {},
+  options: UrlPolicy & UpdateFetchOptions & { onProgress?: ((downloadedBytes: number, totalBytes: number | null) => void) | undefined } = {},
 ): Promise<{ size: number; sha256: string }> {
  const fetchImpl = options.fetchImpl ?? fetch;
  let current = validateHttpsUrl(url, options);
@@ -451,22 +508,32 @@ export async function downloadReleaseAsset(
  const maxRedirects = options.maxRedirects ?? 3;
  let response: Response;
  for (let redirects = 0; ; redirects += 1) {
+    const request = beginUpdateRequest(options);
    try {
-      response = await fetchImpl(current, { method: "GET", redirect: "manual" });
+      response = await fetchImpl(current, { method: "GET", redirect: "manual", signal: request.signal });
    } catch {
+      request.clear();
      throw new Error("更新文件下载失败");
    }
-    if (response.status < 300 || response.status >= 400) break;
+    if (response.status < 300 || response.status >= 400) { request.clear(); break; }
+    await cancelResponseBody(response);
+    request.clear();
    if (redirects >= maxRedirects) throw new Error("更新文件下载失败");
    const location = response.headers.get("location");
    if (!location) throw new Error("更新文件下载失败");
    current = validateHttpsUrl(new URL(location, current), redirectPolicy);
  }
-  if (response.status < 200 || response.status >= 300 || !response.body) throw new Error("更新文件下载失败");
+  if (response.status < 200 || response.status >= 300 || !response.body) {
+    await cancelResponseBody(response);
+    throw new Error("更新文件下载失败");
+  }
  const declared = Number(response.headers.get("content-length") ?? 0);
  const totalBytes = Number.isSafeInteger(declared) && declared > 0 ? declared : null;
  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
-  if (declared > maxBytes) throw new Error("更新文件超过大小限制");
+  if (declared > maxBytes) {
+    await cancelResponseBody(response);
+    throw new Error("更新文件超过大小限制");
+  }
  await mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
  const temporary = `${destination}.part-${randomUUID()}`;
  let size = 0;
@@ -478,8 +545,10 @@ export async function downloadReleaseAsset(
    hash.update(chunk);
    callback(null, chunk);
  } });
+  const request = beginUpdateRequest(options);
  try {
-    await pipeline(Readable.fromWeb(response.body as import("node:stream/web").ReadableStream), meter, createWriteStream(temporary, { flags: "wx", mode: 0o600 }));
+    const source = Readable.fromWeb(response.body as import("node:stream/web").ReadableStream, { signal: request.signal });
+    await pipeline(source, meter, createWriteStream(temporary, { flags: "wx", mode: 0o600 }));
    const fd = await open(temporary, "r");
    await fd.sync();
    await fd.close();
@@ -487,6 +556,8 @@ export async function downloadReleaseAsset(
  } catch (error) {
    await import("node:fs/promises").then(({ rm }) => rm(temporary, { force: true })).catch(() => undefined);
    throw error instanceof Error && error.message.startsWith("更新文件") ? error : new Error("更新文件下载失败");
+  } finally {
+    request.clear();
  }
  return { size, sha256: hash.digest("hex") };
 }
@@ -107,7 +107,7 @@ export const updateApplySchema = z.object({

 export const updateDownloadSchema = z.object({
  version: z.string().trim().regex(/^v?(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/),
-  confirm: z.literal(true),
+  confirm: z.boolean().default(true).optional(),
 }).strict();

 export type ApiError = {
@@ -1,8 +1,5 @@
 [Unit]
 Description=TallyNote privileged release updater
-After=network-online.target
-Wants=network-online.target
-
 [Service]
 Type=oneshot
 User=root
@@ -11,10 +8,12 @@ WorkingDirectory=/opt/tallynote/current
 EnvironmentFile=-/etc/tallynote/tallynote.env
 ExecStart=/usr/local/libexec/tallynote-update-runner
 Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin
+# The runner consumes queued requests immediately and applies its own bounded
+# phase timeouts while keeping full CLI diagnostics in the runner log.
 # Downloads, archive validation and data backups can exceed systemd's 90s
 # default start timeout on a slower server. Keep one update job alive long
 # enough to finish or reach its own health-check/recovery path.
-TimeoutStartSec=30min
+TimeoutStartSec=32min
 NoNewPrivileges=true
 # Keep the updater compatible with the same Node/libuv interface discovery
 # path while retaining an explicit socket-family allowlist.
@@ -9,6 +9,7 @@ TALLYNOTE_TIMEZONE=Asia/Shanghai
 TALLYNOTE_UPDATE_STRATEGY=systemd
 TALLYNOTE_UPDATE_METADATA_URL=https://git.awaioi.com/api/v1/repos/awaioi/TallyNote/releases/latest
 TALLYNOTE_UPDATE_ALLOWED_HOSTS=git.awaioi.com
+TALLYNOTE_UPDATE_TIMEOUT_SECONDS=30
 TALLYNOTE_UPDATE_REQUIRE_SIGNATURE=false
 TALLYNOTE_UPDATE_CHECK_COOLDOWN_SECONDS=60
 TALLYNOTE_UPDATE_DOWNLOAD_COOLDOWN_SECONDS=15
@@ -59,10 +59,10 @@ describe("更新 API", () => {

  function mockRelease() {
    const digest = "c".repeat(64);
-    const asset = `tallynote-1.2.0-${detectPlatform().target}-glibc.tar.gz`;
+    const asset = `tallynote-1.3.0-${detectPlatform().target}-glibc.tar.gz`;
    globalThis.fetch = (async (input: string | URL) => input.toString().endsWith("SHA256SUMS")
      ? new Response(`${digest}  ${asset}\n`, { status: 200 })
-      : new Response(JSON.stringify({ tag_name: "v1.2.0", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: asset, browser_download_url: `https://updates.example/${asset}` }] }), { status: 200 })) as typeof fetch;
+      : new Response(JSON.stringify({ tag_name: "v1.3.0", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: asset, browser_download_url: `https://updates.example/${asset}` }] }), { status: 200 })) as typeof fetch;
  }

  it("检查 release、创建受保护请求文件并拒绝重复任务", async () => {
@@ -70,7 +70,7 @@ describe("更新 API", () => {
    mockRelease();
    const checked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
    expect(checked.statusCode).toBe(200);
-    expect(checked.json().latest).toMatchObject({ version: "1.2.0", compatible: true, integrityReady: true, isNewer: true });
+    expect(checked.json().latest).toMatchObject({ version: "1.3.0", compatible: true, integrityReady: true, isNewer: true });
    expect(checked.headers["cache-control"]).toBe("no-store");
    const tooSoon = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
    expect(tooSoon.statusCode).toBe(429);
@@ -82,15 +82,15 @@ describe("更新 API", () => {
    const otherChecked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: otherSession.cookies, "x-csrf-token": otherSession.csrf }, payload: {} });
    expect(otherChecked.statusCode).toBe(200);

-    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
+    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.3.0", confirm: true } });
    expect(applied.statusCode).toBe(202);
    const jobId = applied.json().job.id as string;
    const request = JSON.parse(readFileSync(config.updateRequestPath, "utf8")) as { jobId: string; expectedSha256: string; currentLink: string };
-    expect(request).toMatchObject({ jobId, version: "1.2.0", expectedSha256: "c".repeat(64), currentLink: config.currentLink });
+    expect(request).toMatchObject({ jobId, version: "1.3.0", expectedSha256: "c".repeat(64), currentLink: config.currentLink });
    expect(statSync(config.updateRequestPath).mode & 0o777).toBe(0o600);

    mockRelease();
-    const duplicate = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
+    const duplicate = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.3.0", confirm: true } });
    expect(duplicate.statusCode).toBe(409);
    expect(duplicate.json().error.code).toBe("UPDATE_IN_PROGRESS");
    const status = await app.inject({ method: "GET", url: "/api/update/status", headers: { cookie: session.cookies } });
@@ -104,10 +104,10 @@ describe("更新 API", () => {
    mockRelease();
    const checked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
    expect(checked.statusCode).toBe(200);
-    const downloaded = await app.inject({ method: "POST", url: "/api/update/download", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
+    const downloaded = await app.inject({ method: "POST", url: "/api/update/download", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.3.0", confirm: true } });
    expect(downloaded.statusCode).toBe(202);
    const downloadJobId = downloaded.json().job.id as string;
-    expect(downloaded.json().job).toMatchObject({ operation: "download", status: "queued", version: "1.2.0" });
+    expect(downloaded.json().job).toMatchObject({ operation: "download", status: "queued", version: "1.3.0" });
    const downloadRequest = JSON.parse(readFileSync(config.updateRequestPath, "utf8")) as { jobId: string; operation: string };
    expect(downloadRequest).toMatchObject({ jobId: downloadJobId, operation: "download" });
    expect(database.sqlite.prepare("SELECT operation, status FROM update_jobs WHERE id=?").get(downloadJobId)).toEqual({ operation: "download", status: "queued" });
@@ -116,21 +116,21 @@ describe("更新 API", () => {
    const stagedId = randomUUID();
    const now = Date.now();
    database.sqlite.prepare(`INSERT INTO update_jobs(id, admin_id, session_hash, request_id, requested_at, operation, status, version, platform, release_url, asset_name, asset_url, expected_sha256, actual_sha256, download_path, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'download', 'staged', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-      .run(stagedId, (await database.sqlite.prepare("SELECT id FROM admins WHERE username=?").get("update-staged") as { id: string }).id, "session", "staged-request", now, "1.2.0", detectPlatform().target, config.updateMetadataUrl, "release.tar.gz", "https://updates.example/release.tar.gz", "c".repeat(64), "c".repeat(64), path.join(config.dataDir, "staged-workspace"), now, now);
-    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { jobId: stagedId, version: "1.2.0", confirm: true } });
+      .run(stagedId, (await database.sqlite.prepare("SELECT id FROM admins WHERE username=?").get("update-staged") as { id: string }).id, "session", "staged-request", now, "1.3.0", detectPlatform().target, config.updateMetadataUrl, "release.tar.gz", "https://updates.example/release.tar.gz", "c".repeat(64), "c".repeat(64), path.join(config.dataDir, "staged-workspace"), now, now);
+    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { jobId: stagedId, version: "1.3.0", confirm: true } });
    expect(applied.statusCode).toBe(202);
    expect(applied.json().job).toMatchObject({ id: stagedId, operation: "apply", status: "staged" });
    expect(database.sqlite.prepare("SELECT operation, status FROM update_jobs WHERE id=?").get(stagedId)).toEqual({ operation: "apply", status: "staged" });
    const applyRequest = JSON.parse(readFileSync(config.updateRequestPath, "utf8")) as { jobId: string; operation: string; assetUrl: string; expectedSha256: string };
    expect(applyRequest).toMatchObject({ jobId: stagedId, operation: "apply", assetUrl: "https://updates.example/release.tar.gz", expectedSha256: "c".repeat(64) });
-    const duplicate = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { jobId: stagedId, version: "1.2.0", confirm: true } });
+    const duplicate = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { jobId: stagedId, version: "1.3.0", confirm: true } });
    expect(duplicate.statusCode).toBe(409);
    expect(duplicate.json().error.code).toBe("UPDATE_IN_PROGRESS");
  });

  it("缺少确认或未启用 systemd 时不接受更新", async () => {
    const session = await login();
-    const invalid = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0" } });
+    const invalid = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.3.0" } });
    expect(invalid.statusCode).toBe(400);
    process.env.TALLYNOTE_UPDATE_STRATEGY = "disabled";
    const disabledConfig = loadConfig();
@@ -152,7 +152,7 @@ describe("更新 API", () => {
    mockRelease();
    const checked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
    expect(checked.statusCode).toBe(200);
-    expect(checked.json().latest).toMatchObject({ version: "1.2.0", isNewer: true });
+    expect(checked.json().latest).toMatchObject({ version: "1.3.0", isNewer: true });
  });

  it("更新任务只对发起管理员可见，并隐藏内部错误详情", async () => {
@@ -161,7 +161,7 @@ describe("更新 API", () => {
    mockRelease();
    const checked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: owner.cookies, "x-csrf-token": owner.csrf }, payload: {} });
    expect(checked.statusCode).toBe(200);
-    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: owner.cookies, "x-csrf-token": owner.csrf }, payload: { version: "1.2.0", confirm: true } });
+    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: owner.cookies, "x-csrf-token": owner.csrf }, payload: { version: "1.3.0", confirm: true } });
    expect(applied.statusCode).toBe(202);
    const jobId = applied.json().job.id as string;
    database.sqlite.prepare("UPDATE update_jobs SET error_message=? WHERE id=?").run("/var/lib/tallynote/secret-command-output", jobId);
@@ -176,10 +176,46 @@ describe("更新 API", () => {
    expect(ownDetail.json().job.errorMessage).toBe("更新失败，请查看服务器日志或重试");
  });

+  it("取消任务按管理员隔离，并只删除匹配任务的请求文件", async () => {
+    const owner = await login("cancel-owner");
+    const other = await login("cancel-other");
+    const ownerId = (database.sqlite.prepare("SELECT id FROM admins WHERE username=?").get("cancel-owner") as { id: string }).id;
+    const otherId = (database.sqlite.prepare("SELECT id FROM admins WHERE username=?").get("cancel-other") as { id: string }).id;
+    const now = Date.now();
+    const ownerJobId = randomUUID();
+    const otherJobId = randomUUID();
+    const insert = database.sqlite.prepare(`
+      INSERT INTO update_jobs(id, admin_id, operation, status, version, platform, asset_url, created_at, updated_at)
+      VALUES (?, ?, 'download', 'queued', '1.3.0', ?, 'https://updates.example/update.tar.gz', ?, ?)
+    `);
+    insert.run(ownerJobId, ownerId, detectPlatform().target, now, now);
+    insert.run(otherJobId, otherId, detectPlatform().target, now + 1, now + 1);
+    await import("node:fs/promises").then(({ writeFile }) => writeFile(config.updateRequestPath, JSON.stringify({ jobId: otherJobId }), { encoding: "utf8", mode: 0o600 }));
+
+    const ownerCancel = await app.inject({
+      method: "POST", url: "/api/update/cancel",
+      headers: { origin: config.publicOrigin, cookie: owner.cookies, "x-csrf-token": owner.csrf },
+      payload: { jobId: ownerJobId },
+    });
+    expect(ownerCancel.statusCode).toBe(200);
+    expect((database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(ownerJobId) as { status: string }).status).toBe("cancelled");
+    expect((database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(otherJobId) as { status: string }).status).toBe("queued");
+    expect(existsSync(config.updateRequestPath)).toBe(true);
+
+    const otherCancel = await app.inject({
+      method: "POST", url: "/api/update/cancel",
+      headers: { origin: config.publicOrigin, cookie: other.cookies, "x-csrf-token": other.csrf },
+      payload: {},
+    });
+    expect(otherCancel.statusCode).toBe(200);
+    expect((database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(otherJobId) as { status: string }).status).toBe("cancelled");
+    expect(existsSync(config.updateRequestPath)).toBe(false);
+  });
+
  it("应用前重新校验失败时写入失败审计", async () => {
    const session = await login("update-audit");
    globalThis.fetch = (async () => new Response("upstream unavailable", { status: 503 })) as typeof fetch;
-    const response = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
+    const response = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.3.0", confirm: true } });
    expect(response.statusCode).toBe(502);
    // A failed upstream check must not reserve the per-admin cooldown; an
    // operator can retry immediately after fixing the release endpoint.
@@ -190,11 +226,151 @@ describe("更新 API", () => {
    const audit = database.sqlite.prepare("SELECT outcome FROM audit_events WHERE action='update.apply_requested' ORDER BY id DESC LIMIT 1").get() as { outcome: string } | undefined;
    expect(audit?.outcome).toBe("failure");
  });
+
+  it("下载请求交由 systemd runner 接管，并保留可查询的排队状态", async () => {
+    const { createSafeArchive } = await import("../server/update.js");
+    const { createHash } = await import("node:crypto");
+    const { mkdirSync, writeFileSync } = await import("node:fs");
+
+    const payloadSource = mkdtempSync(path.join(tmpdir(), "tallynote-test-payload-"));
+    mkdirSync(path.join(payloadSource, "dist"), { recursive: true });
+    writeFileSync(path.join(payloadSource, "dist", "server.js"), "console.log(1);");
+    const archivePath = path.join(tmpdir(), `tallynote-archive-${randomUUID()}.tar.gz`);
+    await createSafeArchive(payloadSource, archivePath);
+
+    const archiveBytes = readFileSync(archivePath);
+    const digest = createHash("sha256").update(archiveBytes).digest("hex");
+    const assetName = `tallynote-1.3.0-${detectPlatform().target}-glibc.tar.gz`;
+
+    globalThis.fetch = (async (input: string | URL) => {
+      const url = input.toString();
+      if (url.endsWith("SHA256SUMS")) {
+        return new Response(`${digest}  ${assetName}\n`, { status: 200 });
+      }
+      if (url.endsWith(assetName)) {
+        return new Response(archiveBytes, { status: 200, headers: { "content-length": String(archiveBytes.length) } });
+      }
+      return new Response(JSON.stringify({
+        tag_name: "v1.3.0",
+        assets: [
+          { name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" },
+          { name: assetName, browser_download_url: `https://updates.example/${assetName}` }
+        ]
+      }), { status: 200 });
+    }) as typeof fetch;
+
+    const session = await login("update-inprocess");
+    const checked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
+    expect(checked.statusCode).toBe(200);
+
+    const downloaded = await app.inject({ method: "POST", url: "/api/update/download", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.3.0", confirm: true } });
+    expect(downloaded.statusCode).toBe(202);
+    const downloadJobId = downloaded.json().job.id as string;
+
+    const stagedRow = database.sqlite.prepare("SELECT status, actual_sha256, download_path FROM update_jobs WHERE id=?").get(downloadJobId) as any;
+    expect(stagedRow?.status).toBe("queued");
+    expect(stagedRow?.actual_sha256).toBeNull();
+    expect(stagedRow?.download_path).toBeNull();
+
+    const statusRes = await app.inject({ method: "GET", url: "/api/update/status", headers: { cookie: session.cookies } });
+    expect(statusRes.statusCode).toBe(200);
+    expect(statusRes.json().job).toMatchObject({
+      id: downloadJobId,
+      status: "queued",
+      operation: "download",
+      assetName,
+      assetUrl: `https://updates.example/${assetName}`,
+    });
+
+    rmSync(payloadSource, { recursive: true, force: true });
+    rmSync(archivePath, { force: true });
+  });
+
+
+  it("管理员可取消 systemd 下载任务并清理请求文件", async () => {
+    const { createSafeArchive } = await import("../server/update.js");
+    const { createHash } = await import("node:crypto");
+    const { mkdirSync, writeFileSync } = await import("node:fs");
+
+    const payloadSource = mkdtempSync(path.join(tmpdir(), "tallynote-cancel-payload-"));
+    mkdirSync(path.join(payloadSource, "dist"), { recursive: true });
+    writeFileSync(path.join(payloadSource, "dist", "server.js"), "console.log(1);");
+    const archivePath = path.join(tmpdir(), `tallynote-cancel-${randomUUID()}.tar.gz`);
+    await createSafeArchive(payloadSource, archivePath);
+
+    const archiveBytes = readFileSync(archivePath);
+    const digest = createHash("sha256").update(archiveBytes).digest("hex");
+    const assetName = `tallynote-1.3.0-${detectPlatform().target}-glibc.tar.gz`;
+
+    // Mock a slow stream
+    let fetchAborted = false;
+    globalThis.fetch = (async (input: string | URL, init?: any) => {
+      const url = input.toString();
+      if (url.endsWith("SHA256SUMS")) {
+        return new Response(`${digest}  ${assetName}\n`, { status: 200 });
+      }
+      if (url.endsWith(assetName)) {
+        init?.signal?.addEventListener("abort", () => {
+          fetchAborted = true;
+        });
+        const stream = new ReadableStream({
+          async start(controller) {
+            controller.enqueue(archiveBytes.slice(0, 50));
+            // Simulate hanging network until aborted
+            await new Promise((resolve) => {
+              if (init?.signal?.aborted) return resolve(undefined);
+              init?.signal?.addEventListener("abort", () => resolve(undefined));
+            });
+            controller.close();
+          }
+        });
+        return new Response(stream, { status: 200, headers: { "content-length": String(archiveBytes.length) } });
+      }
+      return new Response(JSON.stringify({
+        tag_name: "v1.3.0",
+        assets: [
+          { name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" },
+          { name: assetName, browser_download_url: `https://updates.example/${assetName}` }
+        ]
+      }), { status: 200 });
+    }) as typeof fetch;
+
+    const session = await login("update-cancel-inprocess");
+    await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
+
+    const downloaded = await app.inject({ method: "POST", url: "/api/update/download", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.3.0", confirm: true } });
+    const downloadJobId = downloaded.json().job.id as string;
+
+    // Wait until status becomes downloading
+    for (let i = 0; i < 30; i++) {
+      await new Promise((r) => setTimeout(r, 30));
+      const row = database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(downloadJobId) as any;
+      if (row?.status === "downloading") break;
+    }
+
+    const cancelRes = await app.inject({
+      method: "POST",
+      url: "/api/update/cancel",
+      headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf },
+      payload: { jobId: downloadJobId }
+    });
+
+    expect(cancelRes.statusCode).toBe(200);
+    expect(cancelRes.json().success).toBe(true);
+
+    const cancelledRow = database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(downloadJobId) as any;
+    expect(cancelledRow?.status).toBe("cancelled");
+    expect(fetchAborted).toBe(false);
+
+    rmSync(payloadSource, { recursive: true, force: true });
+    rmSync(archivePath, { force: true });
+  });
+
  it("管理员可主动取消排队中的更新任务并清理请求文件", async () => {
    const session = await login("update-cancel");
    mockRelease();
    await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
-    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.2.0", confirm: true } });
+    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.3.0", confirm: true } });
    expect(applied.statusCode).toBe(202);
    expect(existsSync(config.updateRequestPath)).toBe(true);

@@ -40,23 +40,23 @@ describe("更新安全工具", () => {
    expect(isNewerVersion("1.0.0", "1.0.0-beta.1")).toBe(false);
    expect(detectPlatform("linux", "x86_64").target).toBe("linux-x64");
    const release = {
-      version: "1.2.0",
+      version: "1.3.0",
      assets: [
-        { name: "tallynote-1.2.0-linux-arm64-glibc.tar.gz", url: "https://updates.example/arm" },
-        { name: "tallynote-1.2.0-linux-x64-glibc.tar.gz", url: "https://updates.example/x64" },
+        { name: "tallynote-1.3.0-linux-arm64-glibc.tar.gz", url: "https://updates.example/arm" },
+        { name: "tallynote-1.3.0-linux-x64-glibc.tar.gz", url: "https://updates.example/x64" },
      ],
    };
    expect(selectReleaseAsset(release, detectPlatform("linux", "x86_64"))?.name).toContain("linux-x64");
-    expect(selectReleaseAsset({ version: "1.2.0", assets: [{ name: "tallynote-1.2.0-linux-arm64-glibc.tar.gz", url: "https://updates.example/arm" }] }, detectPlatform("linux", "x86_64"))).toBeUndefined();
+    expect(selectReleaseAsset({ version: "1.3.0", assets: [{ name: "tallynote-1.3.0-linux-arm64-glibc.tar.gz", url: "https://updates.example/arm" }] }, detectPlatform("linux", "x86_64"))).toBeUndefined();
    expect(() => validateHttpsUrl("http://updates.example/x64", { allowedHosts: ["updates.example"] })).toThrow();
    expect(() => sanitizeAssetName("../release.tar.gz")).toThrow();
  });

  it("优先选择运行时匹配的轻量更新包，并对旧客户端保留完整包回退", () => {
    const runtimeHash = runtimeHashFromLockfile("lockfile-v1\n");
-    const full = { name: "tallynote-1.2.0-linux-x64-glibc.tar.gz", url: "https://updates.example/full" };
-    const app = { name: `tallynote-1.2.0-linux-x64-glibc.update-${runtimeHash}.tar.gz`, url: "https://updates.example/app" };
-    const release = { version: "1.2.0", assets: [full, app] };
+    const full = { name: "tallynote-1.3.0-linux-x64-glibc.tar.gz", url: "https://updates.example/full" };
+    const app = { name: `tallynote-1.3.0-linux-x64-glibc.update-${runtimeHash}.tar.gz`, url: "https://updates.example/app" };
+    const release = { version: "1.3.0", assets: [full, app] };
    expect(applicationUpdateRuntimeHash(app.name)).toBe(runtimeHash);
    expect(selectReleaseAsset(release, detectPlatform("linux", "x86_64"), runtimeHash)).toEqual(app);
    expect(selectReleaseAsset(release, detectPlatform("linux", "x86_64"))).toEqual(full);
@@ -102,12 +102,12 @@ describe("更新安全工具", () => {
    globalThis.fetch = (async (input: string | URL) => {
      const url = input.toString();
      if (url.endsWith("/latest")) {
-        return new Response(JSON.stringify({ tag_name: "v1.2.0", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: "app-linux-x64.tar.gz", browser_download_url: "https://updates.example/app-linux-x64.tar.gz" }] }), { status: 200, headers: { "content-type": "application/json" } });
+        return new Response(JSON.stringify({ tag_name: "v1.3.0", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: "app-linux-x64.tar.gz", browser_download_url: "https://updates.example/app-linux-x64.tar.gz" }] }), { status: 200, headers: { "content-type": "application/json" } });
      }
      return new Response(`${digest}  app-linux-x64.tar.gz\n`, { status: 200 });
    }) as typeof fetch;
    const metadata = await fetchReleaseMetadata("https://updates.example/latest", { allowedHosts: ["updates.example"] });
-    expect(metadata.version).toBe("1.2.0");
+    expect(metadata.version).toBe("1.3.0");
    expect((await fetchReleaseText("https://updates.example/SHA256SUMS", { allowedHosts: ["updates.example"] })).trim()).toContain(digest);
  });

@@ -253,22 +253,22 @@ describe("更新安全工具", () => {
      const jobId = randomUUID();
      database = openDatabase(config);
      const now = Date.now();
-      const assetName = `tallynote-1.2.0-${detectPlatform().target}.tar.gz`;
+      const assetName = `tallynote-1.3.0-${detectPlatform().target}.tar.gz`;
      database.sqlite.prepare(`
        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url,
          expected_sha256, created_at, updated_at, requested_at)
-        VALUES (?, 'apply', 'queued', '1.2.0', ?, ?, ?, ?, ?, ?)
+        VALUES (?, 'apply', 'queued', '1.3.0', ?, ?, ?, ?, ?, ?)
      `).run(jobId, detectPlatform().target, "https://updates.example/" + assetName, digest, now, now, now);
      globalThis.fetch = (async (input: string | URL) => {
        const url = input.toString();
-        if (url.endsWith("/latest")) return new Response(JSON.stringify({ tag_name: "v1.2.0", assets: [{ name: assetName, browser_download_url: `https://updates.example/${assetName}` }, { name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }] }));
+        if (url.endsWith("/latest")) return new Response(JSON.stringify({ tag_name: "v1.3.0", assets: [{ name: assetName, browser_download_url: `https://updates.example/${assetName}` }, { name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }] }));
        if (url.endsWith("SHA256SUMS")) return new Response(`${digest}  ${assetName}\n`);
        return new Response(bytes, { headers: { "content-length": String(bytes.length) } });
      }) as typeof fetch;

      await runUpdate({
        metadataUrl: config.updateMetadataUrl,
-        version: "1.2.0",
+        version: "1.3.0",
        currentVersion: config.appVersion,
        currentDir: config.currentLink,
        stagingDir: path.join(root, "staging"),
@@ -286,8 +286,27 @@ describe("更新安全工具", () => {
      expect(await readFile(path.join(config.currentLink, "dist", "marker"), "utf8")).toBe("new");
      const row = database.sqlite.prepare("SELECT operation, status FROM update_jobs WHERE id=?").get(jobId);
      expect(row).toEqual({ operation: "apply", status: "applying" });
-      finalizeUpdateJob(database.sqlite, jobId, "failed");
-      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed" });
+      finalizeUpdateJob(database.sqlite, jobId, "failed", "健康检查失败（自定义）");
+      expect(database.sqlite.prepare("SELECT status, error_message AS errorMessage FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed", errorMessage: "健康检查失败（自定义）" });
+      finalizeUpdateJob(database.sqlite, jobId, "failed", "第二次 finalize 不应覆盖原消息");
+      expect(database.sqlite.prepare("SELECT status, error_message AS errorMessage FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed", errorMessage: "健康检查失败（自定义）" });
+      expect(database.sqlite.prepare("SELECT COUNT(*) AS count FROM audit_events WHERE action='update.failed' AND target_id=?").get(jobId)).toEqual({ count: 1 });
+      const defaultJobId = randomUUID();
+      database.sqlite.prepare(`
+        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
+        VALUES (?, 'apply', 'applying', '1.3.0', ?, ?, ?, ?)
+      `).run(defaultJobId, detectPlatform().target, "https://updates.example/" + assetName, now, now);
+      finalizeUpdateJob(database.sqlite, defaultJobId, "failed", "");
+      expect(database.sqlite.prepare("SELECT error_message AS errorMessage FROM update_jobs WHERE id=?").get(defaultJobId)).toEqual({ errorMessage: "新版本健康检查失败，已恢复上一版本" });
+      const completedJobId = randomUUID();
+      database.sqlite.prepare(`
+        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
+        VALUES (?, 'apply', 'completed', '1.3.0', ?, ?, ?, ?)
+      `).run(completedJobId, detectPlatform().target, "https://updates.example/" + assetName, now, now);
+      finalizeUpdateJob(database.sqlite, completedJobId, "completed");
+      expect(database.sqlite.prepare("SELECT COUNT(*) AS count FROM audit_events WHERE action='update.completed' AND target_id=?").get(completedJobId)).toEqual({ count: 0 });
+      expect(() => finalizeUpdateJob(database.sqlite, completedJobId, "failed", "不能降级已完成任务")).toThrow("更新任务状态不允许完成");
+      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(completedJobId)).toEqual({ status: "completed" });
    } finally {
      globalThis.fetch = previousFetch;
      if (database) database.sqlite.close();
@@ -323,10 +342,10 @@ describe("更新安全工具", () => {
      const applyingId = randomUUID();
      const stagedId = randomUUID();
      const stagedApplyId = randomUUID();
-      insert.run(queuedId, "apply", "queued", "1.2.0", "linux-x64", "https://updates.example/queued.tar.gz", staleAt, staleAt);
+      insert.run(queuedId, "apply", "queued", "1.3.0", "linux-x64", "https://updates.example/queued.tar.gz", staleAt, staleAt);
      insert.run(applyingId, "apply", "applying", config.appVersion, "linux-x64", "https://updates.example/applying.tar.gz", staleAt, staleAt);
-      insert.run(stagedId, "download", "staged", "1.2.0", "linux-x64", "https://updates.example/staged.tar.gz", staleAt, staleAt);
-      insert.run(stagedApplyId, "apply", "staged", "1.2.0", "linux-x64", "https://updates.example/staged-apply.tar.gz", staleAt, staleAt);
+      insert.run(stagedId, "download", "staged", "1.3.0", "linux-x64", "https://updates.example/staged.tar.gz", staleAt, staleAt);
+      insert.run(stagedApplyId, "apply", "staged", "1.3.0", "linux-x64", "https://updates.example/staged-apply.tar.gz", staleAt, staleAt);
      const now = Date.now();
      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(3);
      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(queuedId)).toEqual({ status: "failed" });
@@ -362,7 +381,7 @@ describe("更新安全工具", () => {
      const jobId = randomUUID();
      database.sqlite.prepare(`
        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
-        VALUES (?, 'download', 'downloading', '1.2.0', 'linux-x64', ?, ?, ?)
+        VALUES (?, 'download', 'downloading', '1.3.0', 'linux-x64', ?, ?, ?)
      `).run(jobId, "https://updates.example/download.tar.gz", staleAt, staleAt);
      await writeFile(config.updateRequestPath, JSON.stringify({ jobId, operation: "download" }));
      const statePath = path.join(config.installPrefix, ".update-state");
@@ -385,7 +404,7 @@ describe("更新安全工具", () => {
    }
  });

-  it("队列任务有新请求标记时可被重新检查，标记过期后才回收", async () => {
+  it("队列任务有匹配请求标记时保留到租约过期，过期后才回收", async () => {
    const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-queued-marker-"));
    let database: ReturnType<typeof openDatabase> | undefined;
    try {
@@ -406,15 +425,17 @@ describe("更新安全工具", () => {
      const jobId = randomUUID();
      database.sqlite.prepare(`
        INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
-        VALUES (?, 'apply', 'queued', '1.2.0', 'linux-x64', ?, ?, ?)
+        VALUES (?, 'apply', 'queued', '1.3.0', 'linux-x64', ?, ?, ?)
      `).run(jobId, "https://updates.example/queued.tar.gz", staleAt, staleAt);
      await writeFile(config.updateRequestPath, JSON.stringify({ jobId, operation: "apply" }));
      const now = Date.now();
      await utimes(config.updateRequestPath, new Date(now), new Date(now));

+      // The DB row is old, but the request marker is fresh and names this
+      // exact job. Keep it queued while systemd has a chance to consume it.
      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(0);
      expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "queued" });
-      expect(await stat(config.updateRequestPath)).toBeTruthy();
+      await expect(stat(config.updateRequestPath)).resolves.toBeTruthy();

      const expiredNow = now + ORPHANED_UPDATE_TIMEOUT_MS + 1;
      expect(reconcileOrphanedUpdateJobs(database.sqlite, config, expiredNow)).toBe(1);
@@ -492,17 +513,17 @@ describe("更新元数据缓存", () => {
    prepareDataDirectories(config);
    const database = openDatabase(config);
    const digest = "b".repeat(64);
-    const platformAsset = `tallynote-1.2.0-${detectPlatform().target}-glibc.tar.gz`;
+    const platformAsset = `tallynote-1.3.0-${detectPlatform().target}-glibc.tar.gz`;
    const sums = `${digest}  ${platformAsset}\n`;
    const signature = sign(null, Buffer.from(sums), privateKey);
    globalThis.fetch = (async (input: string | URL) => input.toString().endsWith("SHA256SUMS.sig")
      ? new Response(signature)
      : input.toString().endsWith("SHA256SUMS")
      ? new Response(sums)
-      : new Response(JSON.stringify({ tag_name: "v1.2.0", published_at: "2026-08-28T00:00:00Z", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: "SHA256SUMS.sig", browser_download_url: "https://updates.example/SHA256SUMS.sig" }, { name: platformAsset, browser_download_url: `https://updates.example/${platformAsset}` }] }), { status: 200 })) as typeof fetch;
+      : new Response(JSON.stringify({ tag_name: "v1.3.0", published_at: "2026-08-28T00:00:00Z", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: "SHA256SUMS.sig", browser_download_url: "https://updates.example/SHA256SUMS.sig" }, { name: platformAsset, browser_download_url: `https://updates.example/${platformAsset}` }] }), { status: 200 })) as typeof fetch;
    try {
      const result = await checkForUpdate(database.sqlite, config);
-      expect(result.latest).toMatchObject({ version: "1.2.0", compatible: true, integrityReady: true, signatureReady: true, isNewer: true });
+      expect(result.latest).toMatchObject({ version: "1.3.0", compatible: true, integrityReady: true, signatureReady: true, isNewer: true });
      const cached = database.sqlite.prepare("SELECT value FROM system_settings WHERE key='update.release.v1'").get() as { value: string };
      expect(JSON.parse(cached.value).asset.sha256).toBe(digest);
    } finally {
@@ -0,0 +1,39 @@
+import type { ReactNode } from "react";
+
+export function BeamBar({
+  className = "",
+  width = 140,
+  height = 4,
+}: {
+  className?: string;
+  width?: number | string;
+  height?: number;
+}) {
+  return (
+    <div
+      className={`tn-beam-bar ${className}`}
+      style={{ width, height }}
+      role="progressbar"
+      aria-label="加载中"
+    />
+  );
+}
+
+export function BeamLoading({
+  text,
+  className = "",
+  width,
+}: {
+  text?: ReactNode;
+  className?: string;
+  width?: number | string;
+}) {
+  return (
+    <div className={`tn-beam-loading ${className}`} role="status" aria-live="polite">
+      <BeamBar width={width} />
+      {text && <span className="tn-beam-text">{text}</span>}
+    </div>
+  );
+}
+
+export default BeamLoading;
@@ -1,3 +1,4 @@
+import { BeamLoading } from "./components/BeamLoading";
 import { lazy, Suspense, useCallback, useEffect, useRef, useState } from "react";
 import { createRoot, type Root } from "react-dom/client";
 import "tdesign-react/es/_util/react-19-adapter";
@@ -10,12 +11,12 @@ import { setAppTimezone } from "./utils/date";
 import { AppLayout } from "./layouts";
 import { DEFAULT_ROUTE_ID, isRouteId, routeIdFromPath, routePath, routeTitle, type RouteId } from "./router";
 import { LoginPage, ChangePasswordPage } from "./pages/auth";
-const ExpensesPage = lazy(() => import("./pages/expenses"));
-const DashboardPage = lazy(() => import("./pages/dashboard"));
-const TrashPage = lazy(() => import("./pages/trash").then(module => ({ default: module.TrashPage })));
-const AdminsPage = lazy(() => import("./pages/admins").then(module => ({ default: module.AdminsPage })));
-const AuditPage = lazy(() => import("./pages/audit").then(module => ({ default: module.AuditPage })));
-const UpdatePage = lazy(() => import("./pages/update").then(module => ({ default: module.UpdatePage })));
+import ExpensesPage from "./pages/expenses";
+import DashboardPage from "./pages/dashboard";
+import { TrashPage } from "./pages/trash";
+import { AdminsPage } from "./pages/admins";
+import { AuditPage } from "./pages/audit";
+import { UpdatePage } from "./pages/update";
 import { UnsavedChangesProvider, useUnsavedActions } from "./contexts/UnsavedChanges";
 import { useDialogAccessibility } from "./hooks/useDialogAccessibility";
 import "./styles/theme.css";
@@ -33,7 +34,7 @@ function App() {
  const notify = useCallback((message: string, kind: "success" | "error" | "info" = "info") => {
    // The placement container owns the responsive right inset. Keeping the
    // item offset at zero avoids pushing narrow-screen notices off canvas.
-    const options = { content: message, duration: 4200, placement: "top-right" as const, offset: [0, 76] as [number, number], zIndex: 5000 };
+    const options = { content: message, duration: 4200, placement: "top-right" as const, offset: [24, 76] as [number, number], zIndex: 6000 };
    const show = kind === "success" ? NotificationPlugin.success : kind === "error" ? NotificationPlugin.error : NotificationPlugin.info;
    void show(options);
  }, []);
@@ -87,7 +88,7 @@ function App() {
  // Keep the login form mounted for those requests so the user sees the
  // button's busy state instead of losing the entire form to a bootstrap
  // spinner. `bootstrapRequestId` is only set by the initial session check.
-  if (isSessionBootstrapping(session)) return <main className="tn-auth-shell" role="status" aria-live="polite"><Loading text="正在进入系统…" /></main>;
+  if (isSessionBootstrapping(session)) return <main className="tn-auth-shell" role="status" aria-live="polite"><BeamLoading text="正在进入系统…" /></main>;
  if (session.status === "error") return <main className="tn-auth-shell"><div className="tn-auth-panel"><h1 className="tn-page-title">无法连接服务</h1><p className="tn-page-subtitle">{session.error || "服务暂时无法连接，请稍后重试或检查网络状态。"}</p><Button theme="primary" onClick={() => void dispatch(bootstrapSession())}>重新连接</Button></div></main>;
  if (!session.admin) return <LoginPage
    notice={session.initialized ? undefined : "系统尚未初始化管理员账号，请联系系统管理员完成初始配置后登录。"}
@@ -104,7 +105,7 @@ function App() {
    : page === "audit" ? <AuditPage timezone={session.timezone} />
    : <UpdatePage timezone={session.timezone} notify={notify} />;

-  return <AppLayout activeId={page} adminName={session.admin.displayName} adminUsername={session.admin.username} onNavigate={onNavigate} onLogout={onLogout} onOpenPassword={() => { if (!passwordOpen) requestDiscard(() => setPasswordOpen(true)); }}><Suspense fallback={<main className="tn-page-loading" role="status" aria-live="polite"><Loading text="页面加载中…" /></main>}><div key={passwordOpen ? "password" : page} className="tn-page-transition">{content}</div></Suspense></AppLayout>;
+  return <AppLayout activeId={page} adminName={session.admin.displayName} adminUsername={session.admin.username} onNavigate={onNavigate} onLogout={onLogout} onOpenPassword={() => { if (!passwordOpen) requestDiscard(() => setPasswordOpen(true)); }}><Suspense fallback={<main className="tn-page-loading" role="status" aria-live="polite"><BeamLoading text="页面加载中…" /></main>}><div key={passwordOpen ? "password" : page} className="tn-page-transition">{content}</div></Suspense></AppLayout>;
 }

 function RouteErrorPage() {
@@ -1,3 +1,4 @@
+import { BeamLoading, BeamBar } from "../components/BeamLoading";
 import type { ReactNode } from "react";
 import { AlertCircle, Loader2 } from "lucide-react";
 import { Alert, Button, Card, Loading, Space, Tag } from "tdesign-react";
@@ -26,10 +27,10 @@ export function AsyncState({ loading, error, empty, onRetry, children }: {
  onRetry?: () => void;
  children: ReactNode;
 }) {
-  if (loading && empty) return <div className="tn-empty" role="status" aria-live="polite"><Loading text="加载中…" /></div>;
+  if (loading && empty) return <div className="tn-empty" role="status" aria-live="polite"><BeamLoading text="数据加载中…" /></div>;
  if (error && empty) return <div className="tn-empty" role="alert"><AlertCircle size={28} /><p>{error}</p>{onRetry && <Button variant="outline" onClick={onRetry}>重试</Button>}</div>;
  return <>
-    {loading && <div className="tn-inline-loading" role="status"><Loader2 size={15} className="tn-spin" aria-hidden="true" />正在同步…</div>}
+    {loading && <div className="tn-inline-loading" role="status"><BeamBar className="tn-beam-bar-sm" /> 正在同步…</div>}
    {error && <ErrorBanner message={error} onRetry={onRetry} />}
    {empty || children}
  </>;
@@ -1,3 +1,4 @@
+import { BeamLoading } from "../../components/BeamLoading";
 import { useEffect, useMemo, useRef, useState } from "react";
 import { AlertCircle, ChevronLeft, ChevronRight, RefreshCw } from "lucide-react";
 import { Alert, Button, Card, DatePicker, Empty, Loading, Space, Statistic, Table, Tag, Tooltip } from "tdesign-react";
@@ -17,6 +18,8 @@ echarts.use([LineChart, GridComponent, LegendComponent, TooltipComponent, Canvas
 type Props = { timezone?: string; onNavigate?: (id: RouteId, search?: string) => void };
 type ExpenseResult = { items: Expense[]; summary: { count: number; amountCents: number } };

+let dashboardCache: { month: string; unreimbursed: ExpenseResult; reimbursed: ExpenseResult } | null = null;
+
 function prefersReducedMotion(): boolean {
  return typeof window !== "undefined" && typeof window.matchMedia === "function"
    ? window.matchMedia("(prefers-reduced-motion: reduce)").matches
@@ -28,11 +31,12 @@ export default function DashboardPage({ timezone = "Asia/Shanghai", onNavigate }
  const rawMonthParam = searchParams.get("month");
  const defaultMonth = monthNow(timezone);
  const month = rawMonthParam && /^\d{4}-(0[1-9]|1[0-2])$/.test(rawMonthParam) ? rawMonthParam : defaultMonth;
-  const [unreimbursed, setUnreimbursed] = useState<ExpenseResult>({ items: [], summary: { count: 0, amountCents: 0 } });
-  const [reimbursed, setReimbursed] = useState<ExpenseResult>({ items: [], summary: { count: 0, amountCents: 0 } });
-  const [loading, setLoading] = useState(true);
+  const isCached = dashboardCache?.month === month;
+  const [unreimbursed, setUnreimbursed] = useState<ExpenseResult>(() => (isCached ? dashboardCache!.unreimbursed : { items: [], summary: { count: 0, amountCents: 0 } }));
+  const [reimbursed, setReimbursed] = useState<ExpenseResult>(() => (isCached ? dashboardCache!.reimbursed : { items: [], summary: { count: 0, amountCents: 0 } }));
+  const [loading, setLoading] = useState(() => !isCached);
  const [error, setError] = useState("");
-  const [loadedMonth, setLoadedMonth] = useState<string | null>(null);
+  const [loadedMonth, setLoadedMonth] = useState<string | null>(() => (isCached ? month : null));
  const requestSequence = useRef(0);
  const [reducedMotion, setReducedMotion] = useState(prefersReducedMotion);

@@ -74,6 +78,7 @@ export default function DashboardPage({ timezone = "Asia/Shanghai", onNavigate }
      setUnreimbursed(pending);
      setReimbursed(done);
      setLoadedMonth(month);
+      dashboardCache = { month, unreimbursed: pending, reimbursed: done };
    } catch (caught) {
      if (sequence === requestSequence.current) setError((caught as Error).message);
    } finally {
@@ -140,7 +145,7 @@ export default function DashboardPage({ timezone = "Asia/Shanghai", onNavigate }
      <div className="tn-page-actions"><div className="tn-dashboard-actions"><div className="tn-dashboard-month-control"><Tooltip content="上个月"><Button variant="outline" shape="square" onClick={() => shiftMonth(-1)} aria-label="上个月" icon={<ChevronLeft size={16} />} /></Tooltip><DatePicker className="tn-dashboard-month" mode="month" format="YYYY-MM" value={month} onChange={(value: any) => { const next = String(value || "").slice(0, 7); if (/^\d{4}-\d{2}$/.test(next)) setDashboardMonth(next); }} inputProps={{ "aria-label": "仪表盘月份" } as any} /><Tooltip content="下个月"><Button variant="outline" shape="square" onClick={() => shiftMonth(1)} aria-label="下个月" icon={<ChevronRight size={16} />} /></Tooltip></div><div className="tn-dashboard-secondary-actions"><Button className="tn-dashboard-refresh" variant="outline" onClick={() => void load()} disabled={loading} icon={<RefreshCw size={15} />}>刷新</Button><Button className="tn-dashboard-view" theme="primary" onClick={() => onNavigate?.("expenses", expensesSearch)}>查看账目</Button></div></div></div>
    </div>
    {error && hasCurrentSnapshot && <Alert theme="error" icon={<AlertCircle size={16} />} message={`刷新失败：${error}。当前展示的是本月最近一次成功加载的数据。`} />}
-    {loading ? <div className="tn-empty" role="status" aria-live="polite"><Loading text="正在汇总本月数据…" /></div> : !hasCurrentSnapshot ? <div className="tn-empty" role="alert"><Alert theme="error" icon={<AlertCircle size={16} />} message={error || "暂时无法读取仪表盘数据"} /><Button variant="outline" onClick={() => void load()} icon={<RefreshCw size={15} />}>重新加载</Button></div> : <>
+    {loading && !hasCurrentSnapshot ? <div className="tn-empty" role="status" aria-live="polite"><BeamLoading text="正在汇总本月数据…" /></div> : !hasCurrentSnapshot ? <div className="tn-empty" role="alert"><Alert theme="error" icon={<AlertCircle size={16} />} message={error || "暂时无法读取仪表盘数据"} /><Button variant="outline" onClick={() => void load()} icon={<RefreshCw size={15} />}>重新加载</Button></div> : <>
      <div className="tn-dashboard-stats">
        <Card bordered className="tn-dashboard-stat tn-dashboard-stat-total"><Statistic title="本月总额" value={totalCents / 100} prefix="¥" decimalPlaces={2} /></Card>
        <Card bordered className="tn-dashboard-stat tn-dashboard-stat-count"><Statistic title="账目笔数" value={totalCount} suffix="笔" /></Card>
@@ -1,3 +1,4 @@
+import { BeamLoading } from "../../components/BeamLoading";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { AlertCircle, ArrowDownToLine, FileText, Image as ImageIcon, Loader2, Search, Settings, Trash2, X } from "lucide-react";
 import { Button, Dialog, Drawer, Loading, Space, Tag, Textarea, Tooltip } from "tdesign-react";
@@ -57,7 +58,7 @@ export default function ExpenseDetail({ expense, timezone = "Asia/Shanghai", onC
  const remove = async () => { if (!removeTarget) return; const requires = removeTarget.kind === "invoice" && detail.invoiceCount <= 1 && !detail.invoiceMissingReason?.trim(); if (requires && !removeReason.trim()) { setRemoveError("请填写无发票原因"); return; } setBusy(true); setRemoveError(""); try { const body: { version: number; invoiceMissingReason?: string } = { version: detail.version }; if (requires) body.invoiceMissingReason = removeReason.trim(); const result = await api<{ expense: Expense }>(`/api/attachments/${removeTarget.id}`, { method: "DELETE", body: JSON.stringify(body) }); setDetail(result.expense); setRemoveTarget(null); notify?.("附件已删除", "success"); onUpdated(); } catch (caught) { if (!recoverConflict(caught, setRemoveError)) setRemoveError((caught as Error).message); } finally { setBusy(false); } };
  return <>
    <Drawer className="tn-content-drawer tn-detail-drawer" placement="right" size="520px" visible destroyOnClose header="账目详情" onClose={onClose} footer={<Space><Button onClick={() => setAction("status")} disabled={busy}>{detail.status === "reimbursed" ? "标记未报销" : "标记已报销"}</Button><Button theme="danger" onClick={() => setAction("trash")} disabled={busy}><Trash2 size={15} />移入回收站</Button></Space>}>
-      {loading ? <div role="status" aria-live="polite"><Loading text="正在加载账目详情…" /></div> : error ? <div role="alert" className="expense-error"><AlertCircle size={16} />{error}<Button variant="text" onClick={load}>重试</Button></div> : <div className="expense-detail">
+      {loading ? <div className="tn-drawer-loading-wrap" role="status" aria-live="polite"><BeamLoading text="正在加载账目详情…" /></div> : error ? <div role="alert" className="expense-error"><AlertCircle size={16} />{error}<Button variant="text" onClick={load}>重试</Button></div> : <div className="expense-detail">
        <div className="expense-detail-head"><strong>{money(detail.amountCents)}</strong><Button variant="outline" onClick={() => onRequestEdit(detail)}><Settings size={15} />编辑</Button></div>
        <dl><div><dt>支付时间</dt><dd>{dateText(detail.paidAt, timezone)}</dd></div><div><dt>发票</dt><dd>{detail.invoiceCount > 0 ? `${detail.invoiceCount} 张` : detail.invoiceMissingReason ? <><Tag theme="warning">无发票</Tag>：{detail.invoiceMissingReason}</> : <Tag theme="danger">未说明</Tag>}</dd></div><div><dt>状态</dt><dd><Tag theme={detail.status === "reimbursed" ? "success" : "warning"}>{detail.status === "reimbursed" ? "已报销" : "未报销"}</Tag></dd></div><div><dt>备注</dt><dd>{detail.note || "无"}</dd></div></dl>
        <h3>附件 <small>{detail.attachments?.length || 0}</small></h3><div className="expense-attachments">{(detail.attachments || []).map(a => { const protectsLastProof = a.kind === "payment_proof" && detail.paymentProofCount <= 1; return <div className="expense-attachment" key={a.id}><span title={a.originalName}>{a.mimeType.startsWith("image/") ? <ImageIcon size={16} /> : <FileText size={16} />} {a.originalName}<small>{formatBytes(a.sizeBytes)}</small></span><Space>{a.previewable && <Tooltip content="预览附件" placement="left"><Button variant="text" shape="circle" onClick={() => setPreview(a)} aria-label={`预览 ${a.originalName}`}><Search size={15} /></Button></Tooltip>}<Tooltip content="下载附件" placement="left"><Button variant="text" shape="circle" onClick={() => { window.location.href = `/api/attachments/${a.id}/content?download=1`; }} aria-label={`下载 ${a.originalName}`}><ArrowDownToLine size={15} /></Button></Tooltip><Tooltip content={protectsLastProof ? "至少保留一张付款凭证" : "删除附件"} placement="left"><Button variant="text" shape="circle" theme="danger" disabled={protectsLastProof} onClick={() => { setRemoveReason(""); setRemoveError(""); setRemoveTarget(a); }} aria-label={protectsLastProof ? `不可删除最后一张付款凭证 ${a.originalName}` : `删除 ${a.originalName}`}><Trash2 size={14} /></Button></Tooltip></Space></div>; })}</div>
@@ -1,3 +1,4 @@
+import { BeamLoading } from "../../components/BeamLoading";
 import React, { useEffect, useMemo, useRef, useState } from "react";
 import { AlertCircle, ChevronLeft, ChevronRight, ClipboardList, FileDown, FileText, Pencil, Plus, RefreshCw, Search, Trash2, X } from "lucide-react";
 import { Button, Checkbox, DatePicker, Dialog, Loading, Radio, Space, Table, Tag, Tooltip } from "tdesign-react";
@@ -9,6 +10,8 @@ import AccessibleInput from "../../components/AccessibleInput";
 import { dateText, money, monthNow } from "./date";
 import type { Expense, Notify } from "./types";

+let expensesCache: { key: string; items: Expense[]; summary: { count: number; amountCents: number } } | null = null;
+
 type Props = { timezone?: string; notify?: Notify; sessionKey?: string };
 const EXPORT_JOB_STORAGE_KEY = "tallynote.exportJobId";

@@ -29,9 +32,14 @@ export default function ExpensesPage({ timezone: timezoneProp = "Asia/Shanghai",
  const query = rawQuery.slice(0, 200);
  const rawMissingInvoice = searchParams.get("missingInvoice");
  const missingInvoice = searchParams.get("missingInvoice") === "true";
-  const [queryDraft, setQueryDraft] = useState(query);
-  const [items, setItems] = useState<Expense[]>([]); const [summary, setSummary] = useState({ count: 0, amountCents: 0 }); const [loading, setLoading] = useState(false); const [error, setError] = useState(""); const [loadedFilterKey, setLoadedFilterKey] = useState<string | null>(null); const [selectedKeys, setSelectedKeys] = useState<string[]>([]); const [drawer, setDrawer] = useState<"new" | "detail" | "edit" | null>(null); const [selected, setSelected] = useState<Expense | null>(null); const [includeManifest, setIncludeManifest] = useState(false); const [exporting, setExporting] = useState<string | null>(() => savedExportJob(exportStorageKey)); const [exportIssue, setExportIssue] = useState(""); const [trashTarget, setTrashTarget] = useState<Expense | null>(null); const [trashing, setTrashing] = useState(false); const sequence = useRef(0); const exportStarting = useRef(false);
  const filterKey = `${month}|${status}|${query}|${missingInvoice ? "1" : "0"}`;
+  const isCached = expensesCache?.key === filterKey;
+  const [queryDraft, setQueryDraft] = useState(query);
+  const [items, setItems] = useState<Expense[]>(() => (isCached ? expensesCache!.items : []));
+  const [summary, setSummary] = useState(() => (isCached ? expensesCache!.summary : { count: 0, amountCents: 0 }));
+  const [loading, setLoading] = useState(() => !isCached);
+  const [error, setError] = useState("");
+  const [loadedFilterKey, setLoadedFilterKey] = useState<string | null>(() => (isCached ? filterKey : null)); const [selectedKeys, setSelectedKeys] = useState<string[]>([]); const [drawer, setDrawer] = useState<"new" | "detail" | "edit" | null>(null); const [selected, setSelected] = useState<Expense | null>(null); const [includeManifest, setIncludeManifest] = useState(false); const [exporting, setExporting] = useState<string | null>(() => savedExportJob(exportStorageKey)); const [exportIssue, setExportIssue] = useState(""); const [trashTarget, setTrashTarget] = useState<Expense | null>(null); const [trashing, setTrashing] = useState(false); const sequence = useRef(0); const exportStarting = useRef(false);
  useEffect(() => {
    const params = new URLSearchParams(searchParams);
    let changed = false;
@@ -54,8 +62,8 @@ export default function ExpensesPage({ timezone: timezoneProp = "Asia/Shanghai",
    if (next.missingInvoice ?? missingInvoice) params.set("missingInvoice", "true"); else params.delete("missingInvoice");
    setSearchParams(params);
  };
-  const load = async () => { const s = ++sequence.current; const requestedKey = filterKey; setLoading(true); setError(""); try { const result = await api<{ items: Expense[]; summary: typeof summary }>(`/api/expenses?month=${month}&status=${status}&query=${encodeURIComponent(query)}&missingInvoice=${missingInvoice}`); if (s === sequence.current) { setItems(result.items); setSummary(result.summary); setLoadedFilterKey(requestedKey); setSelectedKeys(keys => keys.filter(k => result.items.some(x => x.id === k))); } } catch (e) { if (s === sequence.current) { setItems([]); setSummary({ count: 0, amountCents: 0 }); setLoadedFilterKey(null); setError((e as Error).message); } } finally { if (s === sequence.current) setLoading(false); } };
-  useEffect(() => { setSelectedKeys([]); setItems([]); setSummary({ count: 0, amountCents: 0 }); setLoadedFilterKey(null); void load(); }, [filterKey]);
+  const load = async () => { const s = ++sequence.current; const requestedKey = filterKey; setLoading(true); setError(""); try { const result = await api<{ items: Expense[]; summary: typeof summary }>(`/api/expenses?month=${month}&status=${status}&query=${encodeURIComponent(query)}&missingInvoice=${missingInvoice}`); if (s === sequence.current) { setItems(result.items); setSummary(result.summary); setLoadedFilterKey(requestedKey); setSelectedKeys(keys => keys.filter(k => result.items.some(x => x.id === k))); expensesCache = { key: requestedKey, items: result.items, summary: result.summary }; } } catch (e) { if (s === sequence.current) { setItems([]); setSummary({ count: 0, amountCents: 0 }); setLoadedFilterKey(null); setError((e as Error).message); } } finally { if (s === sequence.current) setLoading(false); } };
+  useEffect(() => { setSelectedKeys([]); if (expensesCache?.key !== filterKey) { setItems([]); setSummary({ count: 0, amountCents: 0 }); setLoadedFilterKey(null); } void load(); }, [filterKey]);
  const selectedTotal = useMemo(() => items.filter(i => selectedKeys.includes(i.id)).reduce((sum, i) => sum + i.amountCents, 0), [items, selectedKeys]);
  const shiftMonth = (delta: number) => { const [rawYear, rawMonthNumber] = month.split("-").map(Number); const y = rawYear || new Date().getFullYear(); const m = rawMonthNumber || 1; const d = new Date(y, m - 1 + delta, 1); updateFilters({ month: `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}` }); };
  const rememberExportJob = (jobId: string | null) => {
@@ -124,7 +132,7 @@ export default function ExpensesPage({ timezone: timezoneProp = "Asia/Shanghai",
    <div className="tn-summary expenses-summary"><span>{summary.count} 笔</span><strong>{money(summary.amountCents)}</strong>{selectedKeys.length > 0 && <><span>已选 {selectedKeys.length} 笔，共 {money(selectedTotal)}</span><Button variant="text" onClick={() => setSelectedKeys([])}>清除选择</Button></>}</div>
    {exportIssue && <div className="tn-export-status" role="status"><RefreshCw size={15} className="spin" /><span>{exportIssue}</span><Button variant="text" onClick={() => { setExportIssue(""); rememberExportJob(null); }}>关闭提示</Button></div>}
    {error && <div className="expense-error" role="alert"><AlertCircle size={16} />{error}<Button variant="text" onClick={() => void load()}>重试</Button></div>}
-    {error ? null : !dataReady || (loading && !items.length) ? <div className="tn-empty" role="status" aria-live="polite"><Loading text="加载中…" /></div> : !items.length ? emptyState : <div className="tn-table-wrap" role="region" aria-label="账目列表，可横向滚动查看更多列"><Table rowKey="id" data={items} columns={columns as any} selectedRowKeys={selectedKeys} onSelectChange={(keys: any[]) => setSelectedKeys(keys as string[])} hover stripe /></div>}
+    {error ? null : (!items.length && (loading || !dataReady)) ? <div className="tn-empty" role="status" aria-live="polite"><BeamLoading text="正在加载账目列表…" /></div> : !items.length ? emptyState : <div className="tn-table-wrap" role="region" aria-label="账目列表，可横向滚动查看更多列"><Table rowKey="id" data={items} columns={columns as any} selectedRowKeys={selectedKeys} onSelectChange={(keys: any[]) => setSelectedKeys(keys as string[])} hover stripe /></div>}
    {drawer === "new" && <ExpenseDrawer timezone={timezone} onClose={() => setDrawer(null)} onSaved={load} notify={notify} />}{drawer === "edit" && selected && <ExpenseDrawer timezone={timezone} expense={selected} onClose={() => setDrawer(null)} onSaved={load} notify={notify} />}{drawer === "detail" && selected && <ExpenseDetail timezone={timezone} expense={selected} onClose={() => setDrawer(null)} onUpdated={load} onRequestEdit={e => { setSelected(e); setDrawer("edit"); }} notify={notify} />}
    {trashTarget && <Dialog width="540px" visible header="移入回收站？" confirmBtn={{ content: "移入回收站", theme: "danger", loading: trashing, disabled: trashing }} cancelBtn="取消" onClose={() => { if (!trashing) setTrashTarget(null); }} onConfirm={() => void moveToTrash()} onCancel={() => { if (!trashing) setTrashTarget(null); }}>确认将“{trashTarget.note || `${dateText(trashTarget.paidAt, timezone)}的账目`}”移入回收站？移入后将不在正常列表中展示，关联附件将完整保留，可随时恢复。</Dialog>}
  </div>;
@@ -1,283 +0,0 @@
-export type MockScenario =
-  | "latest"          // 已是最新
-  | "available"       // 发现新版本（待下载）
-  | "downloading_30"  // 下载中 30%
-  | "downloading_85"  // 下载中 85% + 高速
-  | "staged"          // 下载完成已校验，待立即更新
-  | "backing_up"      // 正在备份数据
-  | "applying"        // 正在原子切换并重启中（倒计时）
-  | "completed"       // 更新完成
-  | "failed_verify"   // 完整性校验失败
-  | "disabled";       // 手动模式未配置源
-
-export interface MockUpdateState {
-  info: any;
-  title: string;
-  description: string;
-}
-
-export const MOCK_SCENARIOS: Record<MockScenario, MockUpdateState> = {
-  latest: {
-    title: "版本健康（已是最新）",
-    description: "展示当前运行版本已是最新，各项指标正常，无待处理任务",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.22",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 600_000,
-      latest: {
-        version: "1.1.22",
-        tagName: "v1.1.22",
-        releaseName: "v1.1.22 稳定版",
-        publishedAt: new Date(Date.now() - 3600_000 * 24).toISOString(),
-        compatible: true,
-        integrityReady: true,
-        signatureReady: true,
-        isNewer: false,
-        assetName: "tallynote-1.1.22-linux-x64-glibc.tar.gz",
-        assetSize: 120540160,
-        notes: "### TallyNote 1.1.22\n\n- 优化反向代理下登录兼容性\n- 增强安全审计与防重放机制\n- 前端组件性能深度优化",
-      },
-      job: null,
-    },
-  },
-  available: {
-    title: "发现新版本（待下载）",
-    description: "检查到官方发布了更高版本，显示更新日志与文件校验信息，可点击下载",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.22",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 60_000,
-      latest: {
-        version: "1.1.23",
-        tagName: "v1.1.23",
-        releaseName: "v1.1.23 重大更新",
-        publishedAt: new Date(Date.now() - 1800_000).toISOString(),
-        compatible: true,
-        integrityReady: true,
-        signatureReady: true,
-        isNewer: true,
-        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
-        assetSize: 121000000,
-        notes: "### TallyNote 1.1.23\n\n- 【新功能】系统更新中心全面重构，支持动态速率流光进度条与平滑重启倒计时\n- 【交互】优化抽屉展开动效与手机端自适应导航\n- 【安全】发布包支持双重 Ed25519 签名与 SHA-256 清单交叉校验",
-      },
-      job: null,
-    },
-  },
-  downloading_30: {
-    title: "下载更新中（进度 38%）",
-    description: "展示真实下载速率、已下载字节数与动态流光进度条",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.22",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 120_000,
-      latest: {
-        version: "1.1.23",
-        tagName: "v1.1.23",
-        compatible: true,
-        integrityReady: true,
-        signatureReady: true,
-        isNewer: true,
-        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
-        assetSize: 121000000,
-      },
-      job: {
-        id: "mock-job-001",
-        operation: "download",
-        status: "downloading",
-        version: "1.1.23",
-        platform: "x64/glibc",
-        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
-        sizeBytes: 121000000,
-        downloadedBytes: 46200000,
-        downloadStartedAt: Date.now() - 10000,
-        downloadSpeedBps: 8800000, // 8.4 MB/s
-        createdAt: Date.now() - 10000,
-        updatedAt: Date.now(),
-      },
-    },
-  },
-  downloading_85: {
-    title: "下载冲刺中（进度 88%）",
-    description: "高速冲刺状态，即将触发 SHA-256 校验",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.22",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 120_000,
-      latest: {
-        version: "1.1.23",
-        tagName: "v1.1.23",
-        compatible: true,
-        integrityReady: true,
-        signatureReady: true,
-        isNewer: true,
-        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
-        assetSize: 121000000,
-      },
-      job: {
-        id: "mock-job-002",
-        operation: "download",
-        status: "downloading",
-        version: "1.1.23",
-        platform: "x64/glibc",
-        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
-        sizeBytes: 121000000,
-        downloadedBytes: 106480000,
-        downloadStartedAt: Date.now() - 15000,
-        downloadSpeedBps: 12500000, // 11.9 MB/s
-        createdAt: Date.now() - 15000,
-        updatedAt: Date.now(),
-      },
-    },
-  },
-  staged: {
-    title: "下载完成（待立即应用）",
-    description: "更新包与签名均已校验就绪，随时可以安全点击【立即更新】",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.22",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 120_000,
-      latest: {
-        version: "1.1.23",
-        tagName: "v1.1.23",
-        compatible: true,
-        integrityReady: true,
-        signatureReady: true,
-        isNewer: true,
-        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
-        assetSize: 121000000,
-        notes: "### TallyNote 1.1.23\n\n- 更新包已完整解压检验通过，具备升级条件。",
-      },
-      job: {
-        id: "mock-job-003",
-        operation: "download",
-        status: "staged",
-        version: "1.1.23",
-        platform: "x64/glibc",
-        assetName: "tallynote-1.1.23-linux-x64-glibc.tar.gz",
-        sizeBytes: 121000000,
-        downloadedBytes: 121000000,
-        createdAt: Date.now() - 60000,
-        updatedAt: Date.now() - 5000,
-      },
-    },
-  },
-  backing_up: {
-    title: "数据备份中（更新保护）",
-    description: "正在为系统数据生成安全快照备份",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.22",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 120_000,
-      latest: { version: "1.1.23", tagName: "v1.1.23", compatible: true, integrityReady: true, signatureReady: true, isNewer: true },
-      job: {
-        id: "mock-job-004",
-        operation: "apply",
-        status: "backing_up",
-        version: "1.1.23",
-        platform: "x64/glibc",
-        createdAt: Date.now() - 20000,
-        updatedAt: Date.now() - 2000,
-      },
-    },
-  },
-  applying: {
-    title: "服务平滑重启中（倒计时中）",
-    description: "已安全切换版本，服务正在热重启并检验状态",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.22",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 120_000,
-      latest: { version: "1.1.23", tagName: "v1.1.23", compatible: true, integrityReady: true, signatureReady: true, isNewer: true },
-      job: {
-        id: "mock-job-005",
-        operation: "apply",
-        status: "applying",
-        version: "1.1.23",
-        platform: "x64/glibc",
-        applyQueuedAt: Date.now() - 12000,
-        restartWindowSeconds: 30,
-        restartDeadline: Date.now() + 18000,
-        createdAt: Date.now() - 25000,
-        updatedAt: Date.now() - 2000,
-      },
-    },
-  },
-  completed: {
-    title: "更新成功完成",
-    description: "新版本健康检查通过，已平滑无感升级至最新",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.23",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 30_000,
-      latest: { version: "1.1.23", tagName: "v1.1.23", compatible: true, integrityReady: true, signatureReady: true, isNewer: false },
-      job: {
-        id: "mock-job-006",
-        operation: "apply",
-        status: "completed",
-        version: "1.1.23",
-        platform: "x64/glibc",
-        completedAt: Date.now() - 10000,
-        createdAt: Date.now() - 45000,
-        updatedAt: Date.now() - 10000,
-      },
-    },
-  },
-  failed_verify: {
-    title: "更新失败状态（安全拦截）",
-    description: "模拟签名不匹配或发布包篡改时的安全拦截展示与错误提示",
-    info: {
-      configured: true,
-      strategy: "systemd",
-      currentVersion: "1.1.22",
-      platform: { target: "x64/glibc", os: "linux", arch: "x64" },
-      checkedAt: Date.now() - 120_000,
-      latest: {
-        version: "1.1.23",
-        tagName: "v1.1.23",
-        compatible: true,
-        integrityReady: false,
-        signatureReady: false,
-        isNewer: true,
-      },
-      job: {
-        id: "mock-job-007",
-        operation: "download",
-        status: "failed",
-        version: "1.1.23",
-        platform: "x64/glibc",
-        errorMessage: "发布包 SHA-256 校验与清单不一致，系统已自动阻断并保护原有数据。",
-        createdAt: Date.now() - 30000,
-        updatedAt: Date.now() - 5000,
-      },
-    },
-  },
-  disabled: {
-    title: "手动源码模式",
-    description: "未启用后台守护时的更新提示与引导说明",
-    info: {
-      configured: false,
-      strategy: "disabled",
-      currentVersion: "1.1.22",
-      platform: { target: "macOS/darwin", os: "darwin", arch: "arm64" },
-      checkedAt: Date.now() - 3600_000,
-      latest: null,
-      job: null,
-    },
-  },
-};
@@ -100,11 +100,149 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
 .tn-route-error-panel { width: min(420px, 100%); padding: 30px; border: 1px solid var(--tn-border); border-radius: 4px; background: var(--tn-surface); box-shadow: 0 14px 36px rgba(11, 58, 136, .08); }
 .tn-route-error-panel h1 { margin: 0; color: var(--tn-text); font-size: 22px; }
 .tn-route-error-panel p { margin: 10px 0 20px; color: var(--tn-text-secondary); overflow-wrap: anywhere; }
-.t-notification { width: min(360px, calc(100vw - 32px)); max-width: calc(100vw - 32px); border: 1px solid var(--tn-border); border-left-width: 1px; border-radius: 4px; box-shadow: 0 10px 26px rgba(11, 58, 136, .14); }
-/* TDesign mounts this wrapper directly under body. Keep one viewport inset
-   at every breakpoint so notices remain fully visible while the page resizes. */
-.t-notification__show--top-right { right: 16px; }
-.t-notification__content { color: var(--tn-text); }
+/* ============================================================
+   Toast 样式四：柔和语义双层卡片 (Soft Tinted Card / 严格水平对齐)
+   ============================================================ */
+.t-notification {
+  width: min(380px, calc(100vw - 32px)) !important;
+  max-width: calc(100vw - 32px) !important;
+  border-radius: 6px !important;
+  padding: 12px 16px !important;
+  box-shadow: 0 10px 25px -4px rgba(15, 23, 42, 0.08), 0 4px 10px -2px rgba(15, 23, 42, 0.04) !important;
+  display: flex !important;
+  align-items: center !important;
+  gap: 10px !important;
+  box-sizing: border-box !important;
+  transition: all 0.22s cubic-bezier(0.16, 1, 0.3, 1) !important;
+}
+.t-notification__show--top-right {
+  top: 76px !important;
+  right: 24px !important;
+  z-index: 6000 !important;
+}
+@media (max-width: 768px) {
+  .t-notification__show--top-right {
+    top: 16px !important;
+    right: 16px !important;
+    left: 16px !important;
+    width: auto !important;
+  }
+}
+.tn-modal-error-banner {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 11px 16px;
+  margin-bottom: 16px;
+  border-radius: 6px;
+  background: #fef2f2;
+  border: 1px solid #fecaca;
+  color: #991b1b;
+  font-size: 13.5px;
+  font-weight: 500;
+  line-height: 1.4;
+}
+.tn-modal-error-banner svg {
+  flex-shrink: 0;
+  color: #dc2626;
+}
+
+/* 核心对齐修复：清除 TDesign 默认的 margin-top: 8px 导致的文字下沉不居中 */
+.t-notification__main {
+  flex: 1 !important;
+  display: flex !important;
+  flex-direction: column !important;
+  justify-content: center !important;
+  margin: 0 !important;
+  padding: 0 !important;
+  min-width: 0 !important;
+}
+.t-notification__content {
+  color: inherit !important;
+  font-size: 13.5px !important;
+  font-weight: 500 !important;
+  line-height: 1.4 !important;
+  margin: 0 !important;
+  padding: 0 !important;
+  display: block !important;
+  word-break: break-word !important;
+}
+.t-notification__icon {
+  margin: 0 !important;
+  padding: 0 !important;
+  width: 20px !important;
+  height: 20px !important;
+  display: flex !important;
+  align-items: center !important;
+  justify-content: center !important;
+  flex-shrink: 0 !important;
+  line-height: 1 !important;
+}
+.t-notification__icon .t-icon {
+  font-size: 18px !important;
+  width: 18px !important;
+  height: 18px !important;
+  display: block !important;
+  margin: 0 auto !important;
+}
+.t-notification__close {
+  display: flex !important;
+  align-items: center !important;
+  justify-content: center !important;
+  margin: 0 0 0 auto !important;
+  padding: 0 !important;
+  height: 20px !important;
+  width: 20px !important;
+  line-height: 1 !important;
+  color: inherit !important;
+  opacity: 0.55 !important;
+  cursor: pointer !important;
+  transition: opacity 0.15s ease !important;
+  flex-shrink: 0 !important;
+}
+.t-notification__close:hover {
+  opacity: 1 !important;
+}
+
+/* Success: 柔和薄荷浅绿 */
+.t-notification.t-is-success {
+  background: #f0fdf4 !important;
+  border: 1px solid #bbf7d0 !important;
+  color: #166534 !important;
+}
+.t-notification.t-is-success .t-notification__icon {
+  color: #16a34a !important;
+}
+
+/* Info: 柔和天空浅蓝 */
+.t-notification.t-is-info {
+  background: #eff6ff !important;
+  border: 1px solid #bfdbfe !important;
+  color: #1e40af !important;
+}
+.t-notification.t-is-info .t-notification__icon {
+  color: #2563eb !important;
+}
+
+/* Warning: 柔和金橙浅黄 */
+.t-notification.t-is-warning {
+  background: #fffbeb !important;
+  border: 1px solid #fde68a !important;
+  color: #92400e !important;
+}
+.t-notification.t-is-warning .t-notification__icon {
+  color: #d97706 !important;
+}
+
+/* Error: 柔和玫瑰浅红 */
+.t-notification.t-is-error {
+  background: #fef2f2 !important;
+  border: 1px solid #fecaca !important;
+  color: #991b1b !important;
+}
+.t-notification.t-is-error .t-notification__icon {
+  color: #dc2626 !important;
+}

 .tn-layout { width: 100%; height: 100%; min-height: 100vh; display: flex; flex-direction: row !important; background: var(--tn-page); overflow: hidden; }
 .tn-desktop-menu { position: relative; top: 0; z-index: 30; display: block; width: 232px; height: 100%; flex: 0 0 232px; min-height: 100%; overflow: hidden; border-right: 1px solid var(--tn-border); background: var(--tn-surface); transition: width .22s ease, flex-basis .22s ease, opacity .22s ease; }
@@ -201,7 +339,59 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
 .tn-action-group .t-button { color: var(--tn-text-secondary); }
 .tn-action-group .t-button:not(.t-button--theme-danger):hover { color: var(--tn-blue-700); background: var(--tn-blue-100); }
 .tn-action-group .t-button.t-button--theme-danger:hover { color: var(--tn-danger); background: #fff0f0; }
-.tn-empty { display: grid; min-height: 260px; place-items: center; align-content: center; gap: 10px; padding: 48px 20px; color: var(--tn-text-muted); text-align: center; }
+/* Absolutely Centered Loading and Empty States */
+.tn-empty {
+  display: flex !important;
+  flex-direction: column !important;
+  align-items: center !important;
+  justify-content: center !important;
+  min-height: max(380px, calc(100vh - 320px)) !important;
+  width: 100% !important;
+  height: 100% !important;
+  flex: 1 !important;
+  gap: 12px !important;
+  padding: 40px 20px !important;
+  color: var(--tn-text-muted) !important;
+  text-align: center !important;
+  box-sizing: border-box !important;
+}
+.expenses-page .tn-empty,
+.tn-dashboard-page .tn-empty,
+.tn-audit-table .tn-empty {
+  min-height: max(400px, calc(100vh - 300px)) !important;
+}
+.tn-detail-drawer .tn-empty,
+.tn-detail-drawer .t-drawer__body > div[role="status"] {
+  display: flex !important;
+  flex-direction: column !important;
+  align-items: center !important;
+  justify-content: center !important;
+  min-height: calc(100vh - 180px) !important;
+  height: 100% !important;
+  width: 100% !important;
+}
+.tn-auth-shell {
+  display: flex !important;
+  flex-direction: column !important;
+  align-items: center !important;
+  justify-content: center !important;
+  min-height: 100vh !important;
+  height: 100% !important;
+  padding: 24px !important;
+  background: var(--tn-page) !important;
+}
+.tn-page-loading {
+  display: flex !important;
+  flex-direction: column !important;
+  align-items: center !important;
+  justify-content: center !important;
+  min-height: calc(100vh - 120px) !important;
+  height: 100% !important;
+  width: 100% !important;
+  padding: 32px 20px !important;
+  color: var(--tn-text-muted) !important;
+  text-align: center !important;
+}
 .tn-page-loading { display: grid; min-width: 0; min-height: 100%; place-items: center; align-content: center; gap: 10px; padding: 32px 20px; color: var(--tn-text-muted); text-align: center; }
 .tn-empty p { margin: 0; color: var(--tn-text-secondary); }
 .tn-selection { display: flex; align-items: center; gap: 14px; padding: 10px 12px; margin: 10px 0; border-left: 3px solid var(--tn-success); background: #eff7f2; color: #24543f; }
@@ -339,7 +529,7 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
 .tn-dashboard-month-control .tn-dashboard-month { width: 148px; flex: 0 1 148px; }
 .tn-dashboard-secondary-actions .tn-dashboard-refresh, .tn-dashboard-secondary-actions .tn-dashboard-view { flex: 0 0 auto; }
 .tn-layout { animation: tn-app-enter .24s ease-out both; }
-.tn-page-transition { animation: tn-page-in .18s ease-out both; }
+.tn-page-transition { animation: tn-page-in .14s cubic-bezier(0.16, 1, 0.3, 1) both; will-change: opacity, transform; }
 .tn-page-actions .t-button { min-height: 36px; }
 .expenses-toolbar { display: flex; align-items: center; gap: 8px; }
 .expenses-toolbar .t-button--shape-square { width: 36px; height: 36px; min-width: 36px; min-height: 36px; }
@@ -406,7 +596,7 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
 .tn-spin, .spin { animation: tn-spin .9s linear infinite; }
@keyframes tn-spin { to { transform: rotate(360deg); } }

-@keyframes tn-page-in { from { opacity: 0; transform: translateY(4px); } to { opacity: 1; transform: translateY(0); } }
+@keyframes tn-page-in { from { opacity: 0.88; transform: translateY(2px); } to { opacity: 1; transform: translateY(0); } }
@keyframes tn-app-enter { from { opacity: 0; } to { opacity: 1; } }
@keyframes tn-auth-page-in { from { opacity: 0; transform: translateY(4px); } to { opacity: 1; transform: translateY(0); } }
 .t-dialog {
@@ -604,67 +794,14 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
 }
@media (prefers-reduced-motion: reduce) {
  *, *::before, *::after { animation-duration: .01ms !important; animation-iteration-count: 1 !important; transition-duration: .01ms !important; scroll-behavior: auto !important; }
+  /* Active loading indicators must retain continuous movement so users know tasks are progressing */
+  .tn-beam-bar::after, .tn-spin { animation-duration: 2s !important; animation-iteration-count: infinite !important; }
 }

 /* ==========================================================================
   TallyNote Update Center (Redesigned UI & Interactive Styles)
   ========================================================================== */

-/* Mock Console Controller */
-.tn-mock-console {
-  margin-bottom: 16px;
-  padding: 14px 18px;
-  background: #f8fbff;
-  border: 1px dashed var(--td-brand-color-3);
-  border-radius: 4px;
-}
-.tn-mock-console-header {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  flex-wrap: wrap;
-  gap: 8px;
-  margin-bottom: 12px;
-}
-.tn-mock-console-title {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  font-size: 13px;
-  color: var(--tn-navy-900);
-}
-.tn-mock-console-tip {
-  font-size: 12px;
-  color: var(--tn-text-secondary);
-}
-.tn-mock-scenario-chips {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 8px;
-}
-.tn-scenario-chip {
-  padding: 5px 11px;
-  font-size: 12px;
-  border: 1px solid var(--tn-border);
-  border-radius: 3px;
-  background: #ffffff;
-  color: var(--tn-text-secondary);
-  cursor: pointer;
-  transition: all 0.16s ease;
-}
-.tn-scenario-chip:hover {
-  border-color: var(--td-brand-color-4);
-  color: var(--td-brand-color);
-  background: var(--td-brand-color-1);
-}
-.tn-scenario-chip.active {
-  background: var(--td-brand-color);
-  border-color: var(--td-brand-color);
-  color: #ffffff;
-  font-weight: 600;
-  box-shadow: 0 2px 6px rgba(23, 92, 211, 0.2);
-}
-
 /* Update Page Actions */
 .tn-update-page-actions {
  display: flex;
@@ -679,35 +816,7 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
  gap: 14px;
  margin-bottom: 16px;
 }
-.tn-metric-card .t-card__body {
-  display: flex;
-  flex-direction: column;
-  justify-content: space-between;
-  padding: 16px 18px;
-  min-height: 104px;
-}
-.tn-metric-content {
-  width: 100%;
-}
-.tn-metric-label {
-  display: block;
-  font-size: 12px;
-  color: var(--tn-text-secondary);
-  margin-bottom: 4px;
-}
-.tn-metric-value {
-  font-size: 20px;
-  font-weight: 700;
-  color: var(--tn-navy-900);
-  font-family: "Plus Jakarta Sans Variable", sans-serif;
-  font-variant-numeric: tabular-nums;
-  line-height: 1.2;
-}
-.tn-metric-foot {
-  margin-top: 6px;
-  font-size: 12px;
-  color: var(--tn-text-muted);
-}
+

 /* Stepper Surface */
 .tn-stepper-surface {
@@ -1108,10 +1217,6 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
  .tn-update-metrics-grid {
    grid-template-columns: 1fr;
  }
-  .tn-mock-console-header {
-    flex-direction: column;
-    align-items: flex-start;
-  }
  .tn-release-header {
    flex-direction: column;
  }
@@ -1147,3 +1252,430 @@ input:focus-visible, textarea:focus-visible, select:focus-visible {
    justify-content: flex-start;
  }
 }
+
+
+/* System Update Console & Phase Styles */
+.tn-release-version-title {
+  margin: 4px 0 8px;
+  font-size: 20px;
+  font-weight: 700;
+  color: var(--tn-navy-900);
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+.tn-release-nickname {
+  font-size: 15px;
+  font-weight: 500;
+  color: var(--tn-text-secondary);
+}
+.tn-release-meta-row {
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  font-size: 13px;
+  color: var(--tn-text-secondary);
+  flex-wrap: wrap;
+}
+.tn-meta-item {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+.tn-meta-link {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  color: var(--td-brand-color);
+  text-decoration: none;
+}
+.tn-meta-link:hover {
+  text-decoration: underline;
+}
+
+/* In-Page Release Notes Container */
+.tn-release-notes-surface {
+  margin-bottom: 16px;
+  padding: 20px;
+}
+.tn-release-notes-box {
+  margin: 0;
+  padding: 16px 20px;
+  background: var(--tn-surface-alt, #f8fafc);
+  border: 1px solid var(--tn-border);
+  border-left: 3px solid var(--td-brand-color);
+  border-radius: 4px;
+}
+.tn-release-notes-content {
+  font-size: 13.5px;
+  color: var(--tn-text);
+  line-height: 1.7;
+  max-height: 380px;
+  overflow-y: auto;
+  scrollbar-width: thin;
+  scrollbar-color: var(--td-brand-color-3) transparent;
+}
+
+/* Upgrade Modal Phases */
+.tn-upgrade-phase-confirm {
+  padding: 12px 0;
+}
+.tn-confirm-phase-head {
+  display: flex;
+  align-items: flex-start;
+  gap: 16px;
+  margin-bottom: 16px;
+}
+.tn-confirm-phase-head h4 {
+  margin: 0 0 6px;
+  font-size: 17px;
+  font-weight: 600;
+  color: var(--tn-navy-900);
+}
+.tn-confirm-phase-head p {
+  margin: 0;
+  font-size: 13.5px;
+}
+.tn-upgrade-safety-tips {
+  background: rgba(23, 92, 211, 0.04);
+  border: 1px solid rgba(23, 92, 211, 0.15);
+  border-radius: 4px;
+  padding: 14px 16px;
+  font-size: 13px;
+  line-height: 1.8;
+  color: var(--tn-navy-900);
+  margin-bottom: 20px;
+}
+.tn-modal-actions-bar {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 12px;
+  margin-top: 20px;
+}
+.tn-staged-apply-box {
+  padding: 12px 0 4px;
+}
+.tn-staged-title {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 8px;
+  font-size: 15px;
+}
+.tn-upgrade-phase-completed {
+  padding: 24px 0 12px;
+}
+.tn-completed-banner {
+  display: flex;
+  align-items: center;
+  gap: 18px;
+  background: rgba(47, 125, 92, 0.06);
+  border: 1px solid rgba(47, 125, 92, 0.2);
+  border-radius: 4px;
+  padding: 18px 22px;
+  margin-bottom: 16px;
+}
+.tn-completed-banner h4 {
+  margin: 0 0 4px;
+  font-size: 18px;
+  font-weight: 600;
+  color: #1e6043;
+}
+.tn-completed-banner p {
+  margin: 0;
+  font-size: 13.5px;
+  color: var(--tn-text);
+}
+.tn-upgrade-phase-failed {
+  padding: 16px 0;
+}
+.tn-modal-footer-close {
+  display: flex;
+  justify-content: center;
+  margin-top: 18px;
+  border-top: 1px dashed var(--tn-border);
+  padding-top: 14px;
+}
+
+
+/* ============================================================
+   ASCII Layout Accurate Styles for Update Center
+   ============================================================ */
+
+/* 4 Metric Cards Grid - Strictly Fixed Height & Zero Layout Shift */
+.tn-metrics-grid {
+  display: grid;
+  grid-template-columns: repeat(4, 1fr);
+  gap: 16px;
+  margin-bottom: 20px;
+  align-items: start;
+}
+.tn-metric-card {
+  height: 104px !important;
+  min-height: 104px !important;
+  max-height: 104px !important;
+  box-sizing: border-box !important;
+  padding: 0 !important;
+  background: #ffffff;
+  border: 1px solid var(--tn-border);
+  border-radius: 4px;
+  overflow: hidden !important;
+}
+.tn-metric-card .t-card__body {
+  height: 100% !important;
+  box-sizing: border-box !important;
+  display: flex !important;
+  flex-direction: column !important;
+  justify-content: space-between !important;
+  padding: 14px 18px !important;
+}
+.tn-metric-label {
+  display: block;
+  font-size: 12.5px;
+  color: var(--tn-text-secondary);
+  line-height: 1;
+  margin: 0;
+}
+.tn-metric-value {
+  font-size: 20px;
+  font-weight: 700;
+  color: var(--tn-navy-900);
+  line-height: 1.2;
+  margin: 4px 0;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-variant-numeric: tabular-nums;
+}
+.tn-metric-card.tn-metric-date .tn-metric-value {
+  font-size: 16px !important;
+  font-weight: 600 !important;
+  line-height: 1.3 !important;
+}
+.tn-metric-foot {
+  font-size: 12px;
+  color: var(--tn-text-secondary);
+  height: 20px !important;
+  min-height: 20px !important;
+  max-height: 20px !important;
+  line-height: 20px;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  display: flex;
+  align-items: center;
+  margin: 0;
+}
+
+/* Container 5: Release Details (Exact ASCII: 2 rows, 3 columns) */
+.tn-ascii-release-container {
+  padding: 22px 24px;
+  margin-bottom: 20px;
+  background: #ffffff;
+  border: 1px solid var(--tn-border);
+  border-radius: 4px;
+}
+.tn-ascii-release-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 18px;
+  border-bottom: 1px solid #edf1f5;
+  padding-bottom: 12px;
+}
+.tn-ascii-release-title {
+  margin: 0;
+  font-size: 16px;
+  font-weight: 700;
+  color: var(--tn-navy-900);
+}
+.tn-ascii-info-grid {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 16px 24px;
+  margin-bottom: 24px;
+}
+.tn-ascii-info-item {
+  font-size: 13.5px;
+  color: var(--tn-text);
+  line-height: 1.6;
+}
+.tn-ascii-info-label {
+  color: var(--tn-text-secondary);
+  margin-right: 6px;
+}
+.tn-ascii-info-val {
+  font-weight: 600;
+  color: var(--tn-navy-900);
+}
+.tn-ascii-release-actions {
+  display: flex;
+  justify-content: flex-end;
+  border-top: 1px solid #edf1f5;
+  padding-top: 18px;
+}
+
+/* Container 6: In-page Release Notes Card */
+.tn-ascii-notes-container {
+  padding: 22px 24px;
+  margin-bottom: 24px;
+  background: #ffffff;
+  border: 1px solid var(--tn-border);
+  border-radius: 4px;
+}
+.tn-ascii-notes-head {
+  margin-bottom: 16px;
+  border-bottom: 1px solid #edf1f5;
+  padding-bottom: 12px;
+}
+.tn-ascii-notes-title {
+  margin: 0;
+  font-size: 16px;
+  font-weight: 700;
+  color: var(--tn-navy-900);
+}
+.tn-ascii-notes-body {
+  font-size: 13.5px;
+  color: var(--tn-text);
+  line-height: 1.75;
+  max-height: 420px;
+  overflow-y: auto;
+  padding-right: 8px;
+}
+
+/* Modal Inner Card matching ASCII */
+.tn-modal-card-box {
+  background: #f8fafc;
+  border: 1px solid var(--tn-border);
+  border-radius: 4px;
+  padding: 20px 24px;
+  margin: 16px 0;
+}
+.tn-modal-card-title {
+  font-size: 15px !important;
+  font-weight: 600 !important;
+  color: var(--tn-navy-900) !important;
+  margin-bottom: 14px !important;
+  display: flex !important;
+  align-items: center !important;
+  gap: 10px !important;
+  line-height: 1.4 !important;
+}
+.tn-modal-card-title svg {
+  flex-shrink: 0 !important;
+  display: block !important;
+}
+.tn-modal-metrics-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  margin-top: 14px;
+  font-size: 13px;
+  color: var(--tn-text-secondary);
+  padding-top: 12px;
+  border-top: 1px solid #eef2f6;
+}
+.tn-modal-metrics-item strong {
+  color: var(--tn-navy-900);
+  margin-left: 4px;
+}
+.tn-modal-info-note {
+  font-size: 12.5px;
+  color: var(--tn-text-secondary);
+  line-height: 1.6;
+  margin: 12px 0 16px;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+
+
+/* ============================================================
+   方案二：平滑极光光流条 (Beam Bar / Shimmer) 全局动效规范
+   ============================================================ */
+.tn-beam-loading {
+  display: flex !important;
+  flex-direction: column !important;
+  align-items: center !important;
+  justify-content: center !important;
+  gap: 14px !important;
+  padding: 40px 20px !important;
+  width: 100% !important;
+  height: 100% !important;
+  flex: 1 !important;
+  margin: auto !important;
+  text-align: center !important;
+}
+.tn-beam-bar {
+  width: 140px;
+  height: 5px;
+  background: var(--td-brand-color-1, #e8f0ff);
+  border-radius: 9999px;
+  overflow: hidden;
+  position: relative;
+  display: block;
+  margin: 0 auto;
+  box-shadow: inset 0 1px 2px rgba(23, 92, 211, 0.08);
+}
+.tn-beam-bar::after {
+  content: "";
+  position: absolute;
+  top: 0;
+  left: 0;
+  width: 50%;
+  height: 100%;
+  background: linear-gradient(90deg, rgba(23, 92, 211, 0) 0%, rgba(61, 123, 229, 0.95) 45%, var(--td-brand-color, #175cd3) 70%, rgba(23, 92, 211, 0) 100%);
+  box-shadow: 0 0 10px rgba(23, 92, 211, 0.55), 0 0 4px rgba(61, 123, 229, 0.9);
+  border-radius: 9999px;
+  animation: tn-beam-flow 1.4s cubic-bezier(0.4, 0, 0.2, 1) infinite;
+  will-change: transform;
+}
+
+.tn-beam-bar-sm {
+  width: 60px !important;
+  height: 3.5px !important;
+  display: inline-block !important;
+  vertical-align: middle;
+  margin: 0 6px !important;
+}
+.tn-beam-bar-sm::after {
+  width: 50%;
+  animation: tn-beam-flow 1.2s cubic-bezier(0.4, 0, 0.2, 1) infinite;
+}
+
+@keyframes tn-beam-flow {
+  0% { transform: translateX(-150%); }
+  100% { transform: translateX(280%); }
+}
+
+.tn-beam-text {
+  font-size: 13.5px;
+  color: var(--tn-navy-700, #344054);
+  font-weight: 500;
+  letter-spacing: 0.3px;
+}
+
+/* 彻底隐去 TDesign 默认圆环旋转圈圈，统一切换为沉稳光流 */
+.t-loading__gradient {
+  display: none !important;
+}
+.t-loading {
+  display: inline-flex !important;
+  flex-direction: column !important;
+  align-items: center !important;
+  justify-content: center !important;
+  gap: 12px !important;
+}
+
+.tn-drawer-loading-wrap {
+  min-height: max(420px, calc(100vh - 200px)) !important;
+  height: 100% !important;
+  width: 100% !important;
+  display: flex !important;
+  flex-direction: column !important;
+  align-items: center !important;
+  justify-content: center !important;
+}
Author	SHA1	Message	Date
Qiufeng	ed0b492461	fix: make online updates recoverable TallyNote release / linux-x64 (push) Successful in 7m45s Details	2026-09-05 14:56:15 +08:00
Qiufeng	a080f531cd	release: 1.2.3 TallyNote release / linux-x64 (push) Successful in 6m47s Details	2026-09-05 10:31:29 +08:00
Qiufeng	1e87f25c2b	fix: remove update page mock controls	2026-09-05 10:22:25 +08:00
Qiufeng	4c71861813	fix: prevent duplicate update submissions TallyNote release / linux-x64 (push) Successful in 6m47s Details	2026-09-05 10:08:49 +08:00
Qiufeng	3a9f809f46	fix: show update rate limits as toast TallyNote release / linux-x64 (push) Successful in 6m42s Details	2026-09-05 09:39:10 +08:00
Qiufeng	de45c4b20c	fix: keep release workflow runner-compatible TallyNote release / linux-x64 (push) Successful in 6m38s Details	2026-09-05 09:04:09 +08:00
Qiufeng	cc9e897260	fix: correct release workflow version gate	2026-09-05 09:02:48 +08:00
Qiufeng	620362823b	release: 1.2.0 TallyNote release / linux-x64 (push) Failing after 13s Details	2026-09-05 08:42:47 +08:00
Qiufeng	fa2fd94579	feat: 全量切换为完整安装包流式下载、彻底废除增量差分包、全流程实时进度可见 TallyNote release / linux-x64 (push) Successful in 7m51s Details	2026-09-04 22:58:24 +08:00
Qiufeng	05a679c2c8	fix: 补全第三步校验与准备场景卡片消除空白、优化增量文件就绪内核加速 TallyNote release / linux-x64 (push) Successful in 7m21s Details	2026-09-04 22:27:33 +08:00
Qiufeng	23e2f9c5e7	refactor: 移除安装包下载直链板块与代码块裸露链接、回归纯净专业看板布局 TallyNote release / linux-x64 (push) Successful in 7m14s Details	2026-09-04 21:29:11 +08:00
Qiufeng	484881b410	fix: 修复更新下载请求缺少确认参数导致报错、增加弹窗内嵌显式错误条、统一全站通知弹窗右上角对齐 TallyNote release / linux-x64 (push) Successful in 7m23s Details	2026-09-04 20:27:17 +08:00
Qiufeng	32f768c8ee	perf: 页面切换零延迟渲染、消除动态 chunk 加载白屏与二次 loading 闪烁、重构微滑淡入过渡 TallyNote release / linux-x64 (push) Failing after 9m14s Details	2026-09-04 17:29:52 +08:00
Qiufeng	db37406498	fix: 修复极光光流条未声明变量导致透明静止、重构流光动效为显式光晕与平滑位移 TallyNote release / linux-x64 (push) Successful in 20m31s Details	2026-09-04 17:14:40 +08:00
Qiufeng	2accca9a22	chore(release): 1.1.36 - 应用内流式直连下载、透明化直链与排队卡死彻底修复 TallyNote release / linux-x64 (push) Successful in 6m21s Details	2026-09-04 16:51:43 +08:00
Qiufeng	c791dc4915	chore(release): 1.1.35 - 系统更新看板化重构、消除弹窗抖动与排队卡死 TallyNote release / linux-x64 (push) Successful in 6m27s Details	2026-09-04 15:18:39 +08:00