model: update requests carry an ID so a stale result can't answer a new request

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

model/model.go

@@ -41,10 +41,10 @@ type Edge struct {
 	LastSeen   time.Time `json:"lastSeen"`
 
 	// Version is the release the program reports (e.g. v0.1.5). AutoUpdate says whether it may update
-	// itself; only then will it act on UpdateRequested. UpdateMsg is the outcome of the last requested update.
+	// itself; only then will it act on an update request (UpdateID). UpdateMsg is the outcome of the last requested update.
 	Version    string `json:"version,omitempty"`
 	AutoUpdate bool   `json:"autoUpdate,omitempty"`
-	UpdateRequested bool   `json:"updateRequested,omitempty"`
+	UpdateID   string `json:"updateId,omitempty"` // set while an update requested by an administrator is pending
 	UpdateMsg  string `json:"updateMsg,omitempty"`
 }
 
@@ -65,10 +65,10 @@ type Site struct {
 	PublicKey string `json:"publicKey,omitempty"` // WireGuard public key, reported by the agent
 
 	// Version is the release the program reports (e.g. v0.1.5). AutoUpdate says whether it may update
-	// itself; only then will it act on UpdateRequested. UpdateMsg is the outcome of the last requested update.
+	// itself; only then will it act on an update request (UpdateID). UpdateMsg is the outcome of the last requested update.
 	Version    string `json:"version,omitempty"`
 	AutoUpdate bool   `json:"autoUpdate,omitempty"`
-	UpdateRequested bool   `json:"updateRequested,omitempty"`
+	UpdateID   string `json:"updateId,omitempty"` // set while an update requested by an administrator is pending
 	UpdateMsg  string `json:"updateMsg,omitempty"`
 }
 
@@ -230,7 +230,7 @@ type EdgeConfig struct {
 	Local      []string  `json:"local"`    // site IDs the edge dials directly on its own machine
 	AcmeEmail  string    `json:"acmeEmail"`
 	AcmeStages bool      `json:"acmeStaging"`
-	Update     bool      `json:"update,omitempty"` // an administrator asked this edge to update itself now
+	UpdateID   string    `json:"updateId,omitempty"` // an administrator asked this edge to update itself now; echoed back in its report
 
 	MailEgress []MailPolicy `json:"mailEgress"`
 }
@@ -306,7 +306,8 @@ type EdgeReport struct {
 	MailChecks map[string]MailCheck     `json:"mailChecks"` // by mail-egress ID
 	Version    string                   `json:"version,omitempty"`
 	AutoUpdate bool                     `json:"autoUpdate,omitempty"`
-	UpdateMsg  string                   `json:"updateMsg,omitempty"` // outcome of the last requested update
+	UpdateMsg  string                   `json:"updateMsg,omitempty"` // outcome of the update asked for by UpdateID
+	UpdateID   string                   `json:"updateId,omitempty"`
 }
 
 // EdgeRef tells a site where to dial.
@@ -324,7 +325,7 @@ type SiteConfig struct {
 	SiteID   string    `json:"siteId"`
 	TunnelIP string    `json:"tunnelIp"` // this site's WireGuard address
 	Edges    []EdgeRef `json:"edges"`
-	Update   bool      `json:"update,omitempty"` // an administrator asked this agent to update itself now
+	UpdateID string    `json:"updateId,omitempty"` // an administrator asked this agent to update itself now; echoed back in its report
 
 	MailEgress []MailSpec `json:"mailEgress"`
 }
@@ -338,6 +339,7 @@ type SiteReport struct {
 	Version    string            `json:"version,omitempty"`
 	AutoUpdate bool              `json:"autoUpdate,omitempty"`
 	UpdateMsg  string            `json:"updateMsg,omitempty"`
+	UpdateID   string            `json:"updateId,omitempty"`
 }
 
 // HostMatches reports whether host matches an exact name or a "*.example.com" pattern.