From ce4baacd47e04eaf72191b373b401e1afa0dafea Mon Sep 17 00:00:00 2001
From: Veillax <126523099+Veillax@users.noreply.github.com>
Date: Mon, 26 Oct 2026 16:58:36 -0600
Subject: [PATCH] model: update requests carry an ID so a stale result can't
 answer a new request

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 model/model.go | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/model/model.go b/model/model.go
index 00d00d2..af61672 100644
--- a/model/model.go
+++ b/model/model.go
@@ -41,11 +41,11 @@ type Edge struct {
 	LastSeen   time.Time `json:"lastSeen"`
 
 	// Version is the release the program reports (e.g. v0.1.5). AutoUpdate says whether it may update
-	// itself; only then will it act on UpdateRequested. UpdateMsg is the outcome of the last requested update.
-	Version         string `json:"version,omitempty"`
-	AutoUpdate      bool   `json:"autoUpdate,omitempty"`
-	UpdateRequested bool   `json:"updateRequested,omitempty"`
-	UpdateMsg       string `json:"updateMsg,omitempty"`
+	// itself; only then will it act on an update request (UpdateID). UpdateMsg is the outcome of the last requested update.
+	Version    string `json:"version,omitempty"`
+	AutoUpdate bool   `json:"autoUpdate,omitempty"`
+	UpdateID   string `json:"updateId,omitempty"` // set while an update requested by an administrator is pending
+	UpdateMsg  string `json:"updateMsg,omitempty"`
 }
 
 // Site is a bamboo agent: a private network that holds the real services.
@@ -65,11 +65,11 @@ type Site struct {
 	PublicKey string `json:"publicKey,omitempty"` // WireGuard public key, reported by the agent
 
 	// Version is the release the program reports (e.g. v0.1.5). AutoUpdate says whether it may update
-	// itself; only then will it act on UpdateRequested. UpdateMsg is the outcome of the last requested update.
-	Version         string `json:"version,omitempty"`
-	AutoUpdate      bool   `json:"autoUpdate,omitempty"`
-	UpdateRequested bool   `json:"updateRequested,omitempty"`
-	UpdateMsg       string `json:"updateMsg,omitempty"`
+	// itself; only then will it act on an update request (UpdateID). UpdateMsg is the outcome of the last requested update.
+	Version    string `json:"version,omitempty"`
+	AutoUpdate bool   `json:"autoUpdate,omitempty"`
+	UpdateID   string `json:"updateId,omitempty"` // set while an update requested by an administrator is pending
+	UpdateMsg  string `json:"updateMsg,omitempty"`
 }
 
 // Domain is a base domain an org owns. Hostnames of web/tls mappings must sit under one.
@@ -230,7 +230,7 @@ type EdgeConfig struct {
 	Local      []string  `json:"local"`    // site IDs the edge dials directly on its own machine
 	AcmeEmail  string    `json:"acmeEmail"`
 	AcmeStages bool      `json:"acmeStaging"`
-	Update     bool      `json:"update,omitempty"` // an administrator asked this edge to update itself now
+	UpdateID   string    `json:"updateId,omitempty"` // an administrator asked this edge to update itself now; echoed back in its report
 
 	MailEgress []MailPolicy `json:"mailEgress"`
 }
@@ -306,7 +306,8 @@ type EdgeReport struct {
 	MailChecks map[string]MailCheck     `json:"mailChecks"` // by mail-egress ID
 	Version    string                   `json:"version,omitempty"`
 	AutoUpdate bool                     `json:"autoUpdate,omitempty"`
-	UpdateMsg  string                   `json:"updateMsg,omitempty"` // outcome of the last requested update
+	UpdateMsg  string                   `json:"updateMsg,omitempty"` // outcome of the update asked for by UpdateID
+	UpdateID   string                   `json:"updateId,omitempty"`
 }
 
 // EdgeRef tells a site where to dial.
@@ -324,7 +325,7 @@ type SiteConfig struct {
 	SiteID   string    `json:"siteId"`
 	TunnelIP string    `json:"tunnelIp"` // this site's WireGuard address
 	Edges    []EdgeRef `json:"edges"`
-	Update   bool      `json:"update,omitempty"` // an administrator asked this agent to update itself now
+	UpdateID string    `json:"updateId,omitempty"` // an administrator asked this agent to update itself now; echoed back in its report
 
 	MailEgress []MailSpec `json:"mailEgress"`
 }
@@ -338,6 +339,7 @@ type SiteReport struct {
 	Version    string            `json:"version,omitempty"`
 	AutoUpdate bool              `json:"autoUpdate,omitempty"`
 	UpdateMsg  string            `json:"updateMsg,omitempty"`
+	UpdateID   string            `json:"updateId,omitempty"`
 }
 
 // HostMatches reports whether host matches an exact name or a "*.example.com" pattern.