fix(updater): mark a stale pending-verification verified on its own

If the status is still pending-verification once the boot health check
is over and Etherpad is already running the target version, the update
worked. Record it as verified when the status is read or the version
check runs, instead of asking the admin to acknowledge it. Acknowledge
now only shows for a pending verification of another version, where
the update didn't take.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V4cYEvi9Y4BTPntnkV9tzh

Author: JohnMcLear

admin/src/pages/UpdatePage.tsx

@@ -137,11 +137,14 @@ export const UpdatePage = () => {
     && !us.lockHeld
     && !upToDate;
   const showCancel = status === 'preflight' || status === 'draining' || status === 'scheduled';
-  // pending-verification is included so a status stuck there after the
-  // server is back up can be cleared (#8412); the server refuses while the
-  // boot health check is still armed.
+  // A stuck pending-verification for the version that is running resolves
+  // itself server-side (#8412). One for another version means the update
+  // didn't take, so let the admin clear it.
+  const pendingTag = status === 'pending-verification'
+    ? (us.execution as {targetTag: string}).targetTag : null;
   const showAcknowledge = status === 'preflight-failed' || status === 'rolled-back' ||
-    status === 'rollback-failed' || status === 'pending-verification';
+    status === 'rollback-failed' ||
+    (pendingTag != null && pendingTag.replace(/^v/, '') !== us.currentVersion);
 
   // Optional-chain the execution lookup: some integration-test stubs of
   // /admin/update/status omit Tier 2/3 fields entirely (see

doc/admin/updates.md

@@ -154,7 +154,7 @@ Etherpad applies an update by **exiting with code 75** so a process supervisor r
 | `pnpm install` or `pnpm run build:ui` fails | `rolled-back` | Same as above. The lockfile and SHA are restored. |
 | `/health` doesn't come up within `rollbackHealthCheckSeconds` | `rolled-back` | Same — RollbackHandler restores the previous SHA + lockfile and exits 75 again. |
 | The new version crashes at boot more than twice (`bootCount > 2`) | `rolled-back` | Crash-loop guard kicks in regardless of the health-check timer. |
-| Status stays on `pending-verification` although the server is up and serving | `pending-verification` | Click **Acknowledge** to return to `idle`; Apply is refused until then. |
+| Status stays on `pending-verification` although the server is up and serving | `verified` or `pending-verification` | If the running version is the target, the status changes to `verified` on its own. If not, the update didn't take: click **Acknowledge** to return to `idle`. |
 | Rollback itself fails (e.g., `pnpm install` errors restoring old lockfile) | `rollback-failed` | **Manual intervention required.** The admin banner switches to a strong red alert. Restore the install by hand, then click **Acknowledge** to clear the lock and re-allow Tier 2 attempts. |
 
 ### Endpoints

src/node/hooks/express/updateStatus.ts

@@ -4,7 +4,7 @@ import path from 'node:path';
 import {LRUCache} from 'lru-cache';
 import {ArgsExpressType} from '../../types/ArgsExpressType';
 import settings, {getEpVersion} from '../../utils/Settings';
-import {getDetectedInstallMethod, stateFilePath} from '../../updater';
+import {getDetectedInstallMethod, resolveStalePendingVerification, stateFilePath} from '../../updater';
 import {evaluatePolicy} from '../../updater/UpdatePolicy';
 import {isMinorOrMoreBehind} from '../../updater/versionCompare';
 import {loadState} from '../../updater/state';
@@ -166,7 +166,7 @@ export const expressCreateServer = (
       if (!user) return res.status(401).send('Authentication required');
       if (!user.is_admin) return res.status(403).send('Forbidden');
     }
-    const state = await loadState(stateFilePath());
+    const state = await resolveStalePendingVerification();
     const current = getEpVersion();
     const installMethod = getDetectedInstallMethod();
     const policy = state.latest

src/node/updater/index.ts

@@ -57,6 +57,33 @@ export const getCurrentState = (): Promise<UpdateState> => loadState(stateFilePa
 export const isVerificationArmed = (): boolean =>
   bootRollbackInFlight || pendingVerification?.armed === true;
 
+/**
+ * A `pending-verification` that is still there once the boot health check is
+ * over can't resolve on its own. If this process is already running the
+ * target version the update worked, so record it as verified instead of
+ * making the admin clear it by hand (#8412). Returns the current state.
+ */
+export const resolveStalePendingVerification = async (): Promise<UpdateState> => {
+  const state = await getCurrentState();
+  const exec = state.execution;
+  if (exec.status !== 'pending-verification' || isVerificationArmed() ||
+      exec.targetTag.replace(/^v/, '') !== getEpVersion()) {
+    return state;
+  }
+  const at = new Date().toISOString();
+  const verified: UpdateState = {
+    ...state,
+    execution: {status: 'verified', targetTag: exec.targetTag, verifiedAt: at},
+    lastResult: {
+      targetTag: exec.targetTag, fromSha: exec.fromSha, outcome: 'verified', reason: null, at,
+    },
+    bootCount: 0,
+  };
+  await saveState(stateFilePath(), verified);
+  logger.info(`updater: ${exec.targetTag} is running; marked the stale pending verification as verified`);
+  return verified;
+};
+
 export const getDetectedInstallMethod = () => detectedMethod;
 
 /**
@@ -136,7 +163,7 @@ const performCheck = async (): Promise<void> => {
     // getCurrentState() can throw on a non-ENOENT fs error from loadState();
     // it must run inside the try/finally so checkInFlight is always cleared,
     // otherwise a one-time permission error permanently disables polling.
-    const before = await getCurrentState();
+    const before = await resolveStalePendingVerification();
     const result = await checkLatestRelease({
       fetcher: realFetcher,
       prevEtag: before.lastEtag,

src/tests/backend/specs/updateActions.ts

@@ -220,6 +220,30 @@ describe(__filename, function () {
     });
   });
 
+  describe('stale pending-verification (#8412)', function () {
+    const pending = (targetTag: string) => saveState(statePath(), {
+      ...EMPTY_STATE,
+      execution: {
+        status: 'pending-verification', targetTag, fromSha: 'x', deadlineAt: '2026-05-08T00:01:00Z',
+      },
+      bootCount: 1,
+    });
+
+    it('marks it verified when the running version is the target', async () => {
+      const {getEpVersion} = require('../../../node/utils/Settings');
+      await pending(`v${getEpVersion()}`);
+      const status = await agent.get('/admin/update/status').expect(200);
+      assert.equal(status.body.execution.status, 'verified');
+      assert.equal(status.body.lastResult.outcome, 'verified');
+    });
+
+    it('leaves it for the admin when another version is running', async () => {
+      await pending('v99.0.0');
+      const status = await agent.get('/admin/update/status').expect(200);
+      assert.equal(status.body.execution.status, 'pending-verification');
+    });
+  });
+
   describe('version check vs. state written by other paths (#8412)', function () {
     let origFetch: typeof globalThis.fetch;
     beforeEach(() => {