feat: choose updates and restart this device first#23870

@@ -0,0 +1,379 @@
+import {
+  EnvironmentId,
+  ProviderDriverKind,
+  ProviderInstanceId,
+  ServerSelfUpdateCapability,
+} from "@t3tools/contracts";
+import * as Schema from "effect/Schema";
+
+const Item = Schema.Struct({
+  key: Schema.String,
+  kind: Schema.Literals(["app", "server", "provider"]),
+  environmentId: EnvironmentId,
+  label: Schema.String,
+  fromVersion: Schema.NullOr(Schema.String),
+  targetVersion: Schema.String,
+  driver: Schema.NullOr(ProviderDriverKind),
+  instanceId: Schema.NullOr(ProviderInstanceId),
+  continueThreads: Schema.Boolean,
+  status: Schema.Literals(["pending", "claimed", "done", "failed", "skipped", "unknown"]),
+  claimId: Schema.NullOr(Schema.String),
+  message: Schema.NullOr(Schema.String),
+  retryRequested: Schema.optionalKey(Schema.Boolean),
+  selfUpdate: Schema.optionalKey(ServerSelfUpdateCapability),
+});
+export type UpdatePlanItem = typeof Item.Type;
+
+export const UpdateExecutionPlan = Schema.Struct({
+  schemaVersion: Schema.Literal(1),
+  id: Schema.String,
+  primaryEnvironmentId: Schema.NullOr(EnvironmentId),
+  sourceVersion: Schema.String,
+  createdAt: Schema.Number,
+  phase: Schema.Literals(["local", "awaiting-local", "servers", "providers", "paused", "complete"]),
+  pausedReason: Schema.NullOr(
+    Schema.Literals([
+      "later",
+      "download-failed",
+      "install-refused",
+      "wrong-version",
+      "not-applied",
+      "expired",
+      "storage",
+      "unknown",
+    ]),
+  ),
+  items: Schema.Array(Item),
+});
+export type UpdateExecutionPlan = typeof UpdateExecutionPlan.Type;
+
+export interface UpdatePlanStore {
+  read(): Promise<UpdateExecutionPlan | null>;
+  change(
+    update: (plan: UpdateExecutionPlan | null) => UpdateExecutionPlan | null,
+  ): Promise<UpdateExecutionPlan | null>;
+}
+
+export type ItemResolution =
+  | { readonly status: "ready" }
+  | { readonly status: "wait" }
+  | { readonly status: "done" | "skipped" | "failed" | "unknown"; readonly message?: string };
+
+export interface UpdatePlanPorts {
+  readonly claimId: string;
+  readonly recoveringClaims?: boolean;
+  readonly appVersion: string;
+  readonly now: () => number;
+  readonly ready: (plan: UpdateExecutionPlan) => boolean;
+  readonly notAppliedVersion: () => string | null;
+  readonly resolve: (item: UpdatePlanItem, recovering: boolean) => ItemResolution;
+  readonly download: (item: UpdatePlanItem) => Promise<boolean>;
+  readonly waitForMaintenance: () => Promise<void>;
+  readonly maintenanceReady: () => boolean;
+  readonly countdown: () => Promise<boolean>;
+  readonly install: (item: UpdatePlanItem) => Promise<boolean>;
+  readonly execute: (item: UpdatePlanItem) => Promise<ItemResolution>;
+}
+
+const UPDATE_PLAN_MAX_AGE_MS = 60 * 60 * 1000;
+
+export const exactUpdateVersion = (a: string, b: string) =>
+  a.replace(/^v/, "") === b.replace(/^v/, "");
+
+export async function runUpdatePlan(store: UpdatePlanStore, ports: UpdatePlanPorts): Promise<void> {
+  const initial = await store.read();
+  if (!initial || initial.phase === "paused" || initial.phase === "complete") return;
+  const change = (update: (plan: UpdateExecutionPlan) => UpdateExecutionPlan) =>
+    store.change((plan) => (plan?.id === initial.id ? update(plan) : plan));
+  const pause = (reason: NonNullable<UpdateExecutionPlan["pausedReason"]>) =>
+    change((plan) => ({
+      ...plan,
+      phase: "paused",
+      pausedReason: reason,
+    }));
+  if (
+    ports.now() < initial.createdAt ||
+    ports.now() - initial.createdAt >= UPDATE_PLAN_MAX_AGE_MS
+  ) {
+    await pause("expired");
+    return;
+  }
+  if (!ports.ready(initial)) return;
+  if (
+    initial.items.some(
+      (item) =>
+        item.kind === "server" &&
+        (item.status === "unknown" ||
+          (initial.phase === "providers" &&
+            (item.status === "pending" || item.status === "claimed"))),
+    )
+  ) {
+    await pause("unknown");
+    return;
+  }
+  const settle = (item: UpdatePlanItem, result: ItemResolution) => {
+    if (result.status === "wait" || result.status === "ready") return Promise.resolve(null);
+    return change((plan) => {
+      const matches = (current: UpdatePlanItem) =>
+        current.key === item.key &&
+        current.status === item.status &&
+        current.claimId === item.claimId;
+      if (!plan.items.some(matches)) return plan;
+      return {
+        ...plan,
+        ...(item.kind === "server" &&
+        result.status === "unknown" &&
+        plan.phase !== "paused" &&
+        plan.phase !== "complete"
+          ? { phase: "paused" as const, pausedReason: "unknown" as const }
+          : {}),
+        items: plan.items.map((current) =>
+          matches(current)
+            ? { ...current, status: result.status, message: result.message ?? null }
+            : current,
+        ),
+      };
+    });
+  };
+  const releaseUndispatched = (item: UpdatePlanItem) =>
+    change((plan) => {
+      const matches = (current: UpdatePlanItem) =>
+        current.key === item.key &&
+        current.status === "claimed" &&
+        current.claimId === ports.claimId &&
+        current.claimId === item.claimId;
+      if (!plan.items.some(matches)) return plan;
+      return {
+        ...plan,
+        ...(item.kind === "app" && plan.phase === "awaiting-local"
+          ? { phase: "local" as const }
+          : {}),
+        items: plan.items.map((current) =>
+          matches(current) ? { ...current, status: "pending", claimId: null } : current,
+        ),
+      };
+    });
+  const claim = async (item: UpdatePlanItem) => {
+    let claimed = false;
+    await change((plan) => ({
+      ...plan,
+      items: plan.items.map((current) => {
+        if (
+          plan.phase !== initial.phase ||
+          current.key !== item.key ||
+          current.status !== "pending"
+        )
+          return current;
+        claimed = true;
+        return { ...current, status: "claimed", claimId: ports.claimId };
+      }),
+    }));
+    return claimed ? { ...item, status: "claimed" as const, claimId: ports.claimId } : null;
+  };
+  const app = initial.items.find((item) => item.kind === "app");
+  if (app?.status === "done" && !exactUpdateVersion(ports.appVersion, app.targetVersion)) return;
+  if (
+    (!app || app.status === "skipped") &&
+    !exactUpdateVersion(ports.appVersion, initial.sourceVersion) &&
+    !initial.items.some(
+      (item) =>
+        item.kind === "server" &&
+        item.environmentId === initial.primaryEnvironmentId &&
+        exactUpdateVersion(ports.appVersion, item.targetVersion),
+    )
+  ) {
+    await pause("wrong-version");
+    return;
+  }
+  if (initial.phase === "awaiting-local") {
+    if (!app || app.claimId === ports.claimId) return;
+    if (ports.notAppliedVersion() === app.targetVersion) {
+      await pause("not-applied");
+      return;
+    }
+    if (exactUpdateVersion(ports.appVersion, initial.sourceVersion)) return;
+    if (!exactUpdateVersion(ports.appVersion, app.targetVersion)) {
+      await pause("wrong-version");
+      return;
+    }
+    await settle(app, { status: "done" });
+    await change((plan) =>
+      plan.phase === "awaiting-local" ? { ...plan, phase: "servers" } : plan,
+    );
+    return runUpdatePlan(store, ports);
+  }
+  if (initial.phase === "local") {
+    if (!app) return;
+    if (app.status === "claimed") {
+      if (app.claimId !== ports.claimId && ports.recoveringClaims) await pause("unknown");

@@ -0,0 +1,56 @@
+import type { ServerProvider } from "@t3tools/contracts";
+import type { Atom, AtomRegistry } from "effect/reactivity";
+
+export interface HostedMaintenanceSnapshot {
+  readonly ready: boolean;
+  readonly machines: readonly {
+    readonly hostedByThisApp: boolean;
+    readonly connected: boolean;
+    readonly sessionReady: boolean;
+    readonly providers: readonly Pick<ServerProvider, "updateState">[];
+  }[];
+}
+
+export function isHostedMaintenanceReady(snapshot: HostedMaintenanceSnapshot): boolean {
+  const hosted = snapshot.machines.filter((machine) => machine.hostedByThisApp);
+  return (
+    snapshot.ready &&
+    hosted.length > 0 &&
+    hosted.every(
+      (machine) =>
+        machine.connected &&
+        machine.sessionReady &&
+        machine.providers.every(
+          (provider) =>
+            provider.updateState?.status !== "queued" && provider.updateState?.status !== "running",
+        ),
+    )
+  );
+}
+
+export function waitForHostedMaintenance(
+  registry: AtomRegistry.AtomRegistry,
+  source: Atom.Atom<HostedMaintenanceSnapshot>,
+): Promise<void> {
+  return new Promise((resolve, reject) => {
+    let unsubscribe = () => {};
+    const inspect = () => {
+      const snapshot = registry.get(source);
+      const hosted = snapshot.machines.filter((machine) => machine.hostedByThisApp);
+      if (
+        !snapshot.ready ||
+        hosted.length === 0 ||

@@ -323,15 +280,430 @@ export function DesktopUpdateLaunchNotice() {
 
   useEffect(() => {
     if (notAppliedVersion === null || notifiedNotAppliedVersion === notAppliedVersion) return;
-    notifiedNotAppliedVersion = notAppliedVersion;
-    toastManager.add(
-      stackedThreadToast({
-        type: "error",
-        title: "Update did not apply",
-        description: `T3 Code is still on ${APP_VERSION}. Install ${notAppliedVersion} again from the update button.`,
-      }),
-    );
+    void updatePlanStore()
+      .then((store) => store.read())
+      .then((plan) => {
+        if (
+          plan?.items.some(
+            (item) => item.kind === "app" && item.targetVersion === notAppliedVersion,
+          )
+        )
+          return;
+        if (
+          ownedNotAppliedVersion === notAppliedVersion ||
+          notifiedNotAppliedVersion === notAppliedVersion
+        )
+          return;
+        notifiedNotAppliedVersion = notAppliedVersion;
+        toastManager.add(
+          stackedThreadToast({
+            type: "error",
+            title: "Update did not apply",
+            description: `T3 Code is still on ${APP_VERSION}. Install ${notAppliedVersion} again from the update button.`,
+          }),
+        );
+      })
+      .catch(() => {});
   }, [notAppliedVersion]);
 
   return null;
 }
+
+const rendererClaimId = randomUUID();
+let desktopNotAppliedVersion: string | null = null;
+let coordinatorRunning = false;
+let coordinatorAgain = false;
+let recoveryPlanId: string | null = null;
+const executingItems = new Set<string>();
+let displayedPlanId: string | null = null;
+let storageStopped = false;
+
+function planReady(plan: UpdateExecutionPlan): boolean {
+  if (storageStopped) return false;
+  const snapshot = appAtomRegistry.get(updateOptionsSnapshotAtom);
+  if (!snapshot.ready || snapshot.primaryEnvironmentId !== plan.primaryEnvironmentId) return false;
+  if (plan.primaryEnvironmentId === null) return true;
+  return snapshot.machines.some(
+    (machine) =>
+      machine.environmentId === plan.primaryEnvironmentId &&
+      machine.connected &&
+      machine.sessionReady &&
+      machine.serverConfig?.environment.environmentId === plan.primaryEnvironmentId,
+  );
+}
+
+const planItemResolver = createUpdatePlanItemResolver(
+  () => appAtomRegistry.get(updateOptionsSnapshotAtom),
+  () => {
+    void wakeUpdatePlan();
+  },
+);
+const resolvePlanItem = planItemResolver.resolve;
+
+export function waitForHostedMaintenance(): Promise<void> {
+  return waitForHostedMaintenanceInRegistry(appAtomRegistry, updateOptionsSnapshotAtom);
+}
+
+const planPorts: UpdatePlanPorts = {
+  claimId: rendererClaimId,
+  appVersion: APP_VERSION,
+  now: Date.now,
+  ready: planReady,
+  notAppliedVersion: () => desktopNotAppliedVersion,
+  resolve: resolvePlanItem,
+  download: (item) =>
+    window.desktopBridge
+      ? downloadUpdateForPlan(window.desktopBridge, item.targetVersion)
+      : Promise.resolve(false),
+  waitForMaintenance: waitForHostedMaintenance,
+  maintenanceReady: () => isHostedMaintenanceReady(appAtomRegistry.get(updateOptionsSnapshotAtom)),
+  countdown: () => waitForUpdateRestart(5_000),
+  install: async (item) => {
+    if (!window.desktopBridge) return false;
+    try {
+      const result = await window.desktopBridge.installUpdate(item.targetVersion);
+      return (
+        result.accepted &&
+        !(result.state.status === "error" && result.state.errorContext === "install")
+      );
+    } catch {
+      return false;
+    }
+  },
+  execute: async (item) => {
+    executingItems.add(item.key);
+    try {
+      const latest = resolvePlanItem(item, false);
+      if (latest.status !== "ready") return latest;
+      if (item.kind === "server") {
+        const machine = appAtomRegistry
+          .get(updateOptionsSnapshotAtom)
+          .machines.find((machine) => machine.environmentId === item.environmentId)!;
+        const target = collectServerUpdateTargets(
+          [machine],
+          item.targetVersion,
+          item.retryRequested === true,
+        ).targets[0];
+        if (!target) return { status: "skipped", message: "T3 update is no longer available" };
+        const result = await runAtomCommand(
+          appAtomRegistry,
+          serverEnvironment.updateServer,
+          {
+            environmentId: item.environmentId,
+            input: {
+              targetVersion: item.targetVersion,
+              ...(item.continueThreads &&
+              target.threadContinuation &&
+              target.continueThreadsAfterServerUpdate
+                ? { continueRunningThreads: true }
+                : {}),
+            },
+          },
+          { reportFailure: false },
+        );
+        if (result._tag === "Success") return { status: "done" };
+        return {
+          status: isAtomCommandInterrupted(result) ? "unknown" : "failed",
+          message: String(squashAtomCommandFailure(result)),
+        };
+      }
+      if (!item.driver || !item.instanceId)
+        return { status: "skipped", message: "Provider identity is missing" };
+      const result = await runAtomCommand(
+        appAtomRegistry,
+        serverEnvironment.updateProvider,
+        {
+          environmentId: item.environmentId,
+          input: { provider: item.driver, instanceId: item.instanceId },
+        },
+        { reportFailure: false },
+      );
+      if (result._tag === "Failure")
+        return {
+          status: isAtomCommandInterrupted(result) ? "unknown" : "failed",
+          message: String(squashAtomCommandFailure(result)),
+        };
+      const provider = result.value.providers.find(
+        (provider) => provider.driver === item.driver && provider.instanceId === item.instanceId,
+      );
+      return provider?.updateState?.status === "succeeded"
+        ? { status: "done" }
+        : {
+            status: "failed",
+            message: provider?.updateState?.message ?? "Provider update did not finish",
+          };
+    } finally {
+      executingItems.delete(item.key);
+    }
+  },
+};
+
+function showPlan(plan: UpdateExecutionPlan | null): void {
+  ownedNotAppliedVersion = plan?.items.find((item) => item.kind === "app")?.targetVersion ?? null;
+  if (!plan) {
+    planItemResolver.dispose();
+    if (displayedPlanId !== null) setUpdateEverythingRun(() => null);
+    displayedPlanId = null;
+    return;
+  }
+  displayedPlanId = plan.id;
+  const groups = new Map<EnvironmentId, UpdatePlanItem[]>();
+  for (const item of plan.items) {
+    if (item.kind === "app") continue;
+    const items = groups.get(item.environmentId) ?? [];
+    items.push(item);
+    groups.set(item.environmentId, items);
+  }
+  const app = plan.items.find((item) => item.kind === "app");
+  setUpdateEverythingRun((current) => ({
+    localVersion: app && app.status !== "skipped" ? app.targetVersion : null,
+    phase:
+      plan.phase === "awaiting-local"
+        ? "installing"
+        : current?.phase === "countdown" && plan.phase === "local"
+          ? "countdown"
+          : plan.phase,
+    pausedReason: plan.pausedReason,
+    restartAt: plan.phase === "local" ? (current?.restartAt ?? null) : null,
+    machines: [...groups.entries()].map(([environmentId, items]) => {
+      const server = items.find((item) => item.kind === "server");
+      const failures = items.filter(
+        (item) =>
+          item.status === "failed" || item.status === "unknown" || item.status === "skipped",
+      );
+      return {
+        environmentId,
+        label: items[0]!.label,
+        updatesProviders: items.some((item) => item.kind === "provider"),
+        server: server
+          ? {
+              environmentId,
+              serverLabel: server.label,
+              targetVersion: server.targetVersion,
+              selfUpdate: null,
+            }
+          : null,
+        handedOffVersion: null,
+        startedAt: plan.createdAt,
+        result: items.some((item) => item.status === "pending" || item.status === "claimed")
+          ? null
+          : failures.length > 0
+            ? "failed"
+            : "done",
+        failure: failures.map((item) => item.message ?? "Update skipped").join("\n") || null,
+      };
+    }),
+  }));
+}
+
+function storageFailure(error: unknown): void {
+  storageStopped = true;
+  setUpdateEverythingRun((run) => ({
+    localVersion: run?.localVersion ?? null,
+    machines: run?.machines ?? [],
+    phase: "paused",
+    pausedReason: "storage",
+    restartAt: null,
+  }));
+  toastManager.add(
+    stackedThreadToast({
+      type: "error",
+      title: "Update plan could not be saved",
+      description:
+        error instanceof Error
+          ? error.message
+          : "Storage is unavailable. No new updates will start.",
+    }),
+  );
+}
+
+async function wakeUpdatePlan(): Promise<void> {
+  if (storageStopped) return;
+  if (coordinatorRunning) {
+    coordinatorAgain = true;

@@ -344,34 +335,30 @@ function SidebarUpdateControl() {
       .finally(() => setIsActionPending(false));
   };
 
-  const runEverything = async () => {
-    const bridge = window.desktopBridge;
+  const runEverything = async (selection: ReadonlySet<string>) => {
     setIsConfirmingEverything(false);
     setIsActionPending(true);
-    const result = await settlePromise(() =>
-      everything.run({
-        ...(bridge && action === "download"
-          ? {
-              downloadLocal: (reportError) =>
-                downloadLocalUpdate(bridge, { notifyDownloaded: false, reportError }),
-            }
-          : {}),
-        ...(bridge && action !== "none"
-          ? { installLocal: (reportError) => installLocalUpdate(bridge, reportError) }
-          : {}),
+    const result = await settlePromise(() => everything.run(selection));
+    setIsActionPending(false);
+    if (result._tag === "Success") {
+      if (result.value.status === "busy") {
+        toastManager.add(
+          stackedThreadToast({
+            type: "info",
+            title: "Updates are already running in another window.",
+          }),
+        );
+      }
+      return;
+    }

@@ -323,15 +280,430 @@ export function DesktopUpdateLaunchNotice() {
 
   useEffect(() => {
     if (notAppliedVersion === null || notifiedNotAppliedVersion === notAppliedVersion) return;
-    notifiedNotAppliedVersion = notAppliedVersion;
-    toastManager.add(
-      stackedThreadToast({
-        type: "error",
-        title: "Update did not apply",
-        description: `T3 Code is still on ${APP_VERSION}. Install ${notAppliedVersion} again from the update button.`,
-      }),
-    );
+    void updatePlanStore()
+      .then((store) => store.read())
+      .then((plan) => {
+        if (
+          plan?.items.some(
+            (item) => item.kind === "app" && item.targetVersion === notAppliedVersion,
+          )
+        )
+          return;
+        if (
+          ownedNotAppliedVersion === notAppliedVersion ||
+          notifiedNotAppliedVersion === notAppliedVersion
+        )
+          return;
+        notifiedNotAppliedVersion = notAppliedVersion;
+        toastManager.add(
+          stackedThreadToast({
+            type: "error",
+            title: "Update did not apply",
+            description: `T3 Code is still on ${APP_VERSION}. Install ${notAppliedVersion} again from the update button.`,
+          }),
+        );
+      })
+      .catch(() => {});
   }, [notAppliedVersion]);
 
   return null;
 }
+
+const rendererClaimId = randomUUID();
+let desktopNotAppliedVersion: string | null = null;
+let coordinatorRunning = false;
+let coordinatorAgain = false;
+let recoveryPlanId: string | null = null;
+const executingItems = new Set<string>();
+let displayedPlanId: string | null = null;
+let storageStopped = false;
+
+function planReady(plan: UpdateExecutionPlan): boolean {
+  if (storageStopped) return false;
+  const snapshot = appAtomRegistry.get(updateOptionsSnapshotAtom);
+  if (!snapshot.ready || snapshot.primaryEnvironmentId !== plan.primaryEnvironmentId) return false;
+  if (plan.primaryEnvironmentId === null) return true;
+  return snapshot.machines.some(
+    (machine) =>
+      machine.environmentId === plan.primaryEnvironmentId &&
+      machine.connected &&
+      machine.sessionReady &&
+      machine.serverConfig?.environment.environmentId === plan.primaryEnvironmentId,
+  );
+}
+
+const planItemResolver = createUpdatePlanItemResolver(
+  () => appAtomRegistry.get(updateOptionsSnapshotAtom),
+  () => {
+    void wakeUpdatePlan();
+  },
+);
+const resolvePlanItem = planItemResolver.resolve;
+
+export function waitForHostedMaintenance(): Promise<void> {
+  return waitForHostedMaintenanceInRegistry(appAtomRegistry, updateOptionsSnapshotAtom);
+}

@@ -0,0 +1,399 @@
+import {
+  EnvironmentId,
+  ProviderDriverKind,
+  ProviderInstanceId,
+  ServerSelfUpdateCapability,
+} from "@t3tools/contracts";
+import * as Schema from "effect/Schema";
+
+const Item = Schema.Struct({
+  key: Schema.String,
+  kind: Schema.Literals(["app", "server", "provider"]),
+  environmentId: EnvironmentId,
+  label: Schema.String,
+  fromVersion: Schema.NullOr(Schema.String),
+  targetVersion: Schema.String,
+  driver: Schema.NullOr(ProviderDriverKind),
+  instanceId: Schema.NullOr(ProviderInstanceId),
+  continueThreads: Schema.Boolean,
+  status: Schema.Literals(["pending", "claimed", "done", "failed", "skipped", "unknown"]),
+  claimId: Schema.NullOr(Schema.String),
+  message: Schema.NullOr(Schema.String),
+  retryRequested: Schema.optionalKey(Schema.Boolean),
+  selfUpdate: Schema.optionalKey(ServerSelfUpdateCapability),
+});
+export type UpdatePlanItem = typeof Item.Type;
+
+export const UpdateExecutionPlan = Schema.Struct({
+  schemaVersion: Schema.Literal(1),
+  id: Schema.String,
+  primaryEnvironmentId: Schema.NullOr(EnvironmentId),
+  sourceVersion: Schema.String,
+  createdAt: Schema.Number,
+  phase: Schema.Literals(["local", "awaiting-local", "servers", "providers", "paused", "complete"]),
+  pausedReason: Schema.NullOr(
+    Schema.Literals([
+      "later",
+      "download-failed",
+      "install-refused",
+      "wrong-version",
+      "not-applied",
+      "expired",
+      "storage",
+      "unknown",
+    ]),
+  ),
+  items: Schema.Array(Item),
+});
+export type UpdateExecutionPlan = typeof UpdateExecutionPlan.Type;
+
+export interface UpdatePlanStore {
+  read(): Promise<UpdateExecutionPlan | null>;
+  change(
+    update: (plan: UpdateExecutionPlan | null) => UpdateExecutionPlan | null,
+  ): Promise<UpdateExecutionPlan | null>;
+}
+
+export type ItemResolution =
+  | { readonly status: "ready" }
+  | { readonly status: "wait" }
+  | { readonly status: "done" | "skipped" | "failed" | "unknown"; readonly message?: string };
+
+export interface UpdatePlanPorts {
+  readonly claimId: string;
+  readonly recoveringClaims?: boolean;
+  readonly isClaimOwnerAlive?: (claimId: string | null) => Promise<boolean>;
+  readonly appVersion: string;
+  readonly now: () => number;
+  readonly ready: (plan: UpdateExecutionPlan) => boolean;
+  readonly notAppliedVersion: () => string | null;
+  readonly resolve: (item: UpdatePlanItem, recovering: boolean) => ItemResolution;
+  readonly download: (item: UpdatePlanItem) => Promise<boolean>;
+  readonly waitForMaintenance: () => Promise<void>;
+  readonly maintenanceReady: () => boolean;
+  readonly countdown: () => Promise<boolean>;
+  readonly install: (item: UpdatePlanItem) => Promise<boolean>;
+  readonly execute: (item: UpdatePlanItem) => Promise<ItemResolution>;
+}
+
+const UPDATE_PLAN_MAX_AGE_MS = 60 * 60 * 1000;
+
+export const exactUpdateVersion = (a: string, b: string) =>
+  a.replace(/^v/, "") === b.replace(/^v/, "");
+
+export async function runUpdatePlan(store: UpdatePlanStore, ports: UpdatePlanPorts): Promise<void> {
+  const initial = await store.read();
+  if (!initial || initial.phase === "paused" || initial.phase === "complete") return;
+  const change = (update: (plan: UpdateExecutionPlan) => UpdateExecutionPlan) =>
+    store.change((plan) => (plan?.id === initial.id ? update(plan) : plan));
+  const pause = (reason: NonNullable<UpdateExecutionPlan["pausedReason"]>) =>
+    change((plan) => ({
+      ...plan,
+      phase: "paused",
+      pausedReason: reason,
+    }));
+  const pauseAbandonedClaim = async (item: UpdatePlanItem) => {
+    if (
+      ports.isClaimOwnerAlive
+        ? await ports.isClaimOwnerAlive(item.claimId)
+        : !ports.recoveringClaims
+    )
+      return;
+    await change((plan) =>
+      plan.phase === initial.phase &&
+      plan.items.some(
+        (current) =>
+          current.key === item.key &&
+          current.status === "claimed" &&
+          current.claimId === item.claimId,
+      )
+        ? { ...plan, phase: "paused", pausedReason: "unknown" }
+        : plan,
+    );
+  };
+  if (
+    ports.now() < initial.createdAt ||
+    ports.now() - initial.createdAt >= UPDATE_PLAN_MAX_AGE_MS
+  ) {
+    await pause("expired");
+    return;
+  }
+  if (!ports.ready(initial)) return;
+  if (
+    initial.items.some(
+      (item) =>
+        item.kind === "server" &&
+        (item.status === "unknown" ||
+          (initial.phase === "providers" &&
+            (item.status === "pending" || item.status === "claimed"))),
+    )
+  ) {
+    await pause("unknown");
+    return;
+  }
+  const settle = (item: UpdatePlanItem, result: ItemResolution) => {
+    if (result.status === "wait" || result.status === "ready") return Promise.resolve(null);
+    return change((plan) => {
+      const matches = (current: UpdatePlanItem) =>
+        current.key === item.key &&
+        current.status === item.status &&
+        current.claimId === item.claimId;
+      if (!plan.items.some(matches)) return plan;
+      return {
+        ...plan,
+        ...(item.kind === "server" &&
+        result.status === "unknown" &&
+        plan.phase !== "paused" &&
+        plan.phase !== "complete"
+          ? { phase: "paused" as const, pausedReason: "unknown" as const }
+          : {}),
+        items: plan.items.map((current) =>
+          matches(current)
+            ? { ...current, status: result.status, message: result.message ?? null }
+            : current,
+        ),
+      };
+    });
+  };
+  const releaseUndispatched = (item: UpdatePlanItem) =>
+    change((plan) => {
+      const matches = (current: UpdatePlanItem) =>
+        current.key === item.key &&
+        current.status === "claimed" &&
+        current.claimId === ports.claimId &&
+        current.claimId === item.claimId;
+      if (!plan.items.some(matches)) return plan;
+      return {
+        ...plan,
+        ...(item.kind === "app" && plan.phase === "awaiting-local"
+          ? { phase: "local" as const }
+          : {}),
+        items: plan.items.map((current) =>
+          matches(current) ? { ...current, status: "pending", claimId: null } : current,
+        ),
+      };
+    });
+  const claim = async (item: UpdatePlanItem) => {
+    let claimed = false;
+    await change((plan) => ({
+      ...plan,
+      items: plan.items.map((current) => {
+        if (
+          plan.phase !== initial.phase ||
+          current.key !== item.key ||
+          current.status !== "pending"
+        )
+          return current;
+        claimed = true;
+        return { ...current, status: "claimed", claimId: ports.claimId };
+      }),
+    }));
+    return claimed ? { ...item, status: "claimed" as const, claimId: ports.claimId } : null;
+  };
+  const app = initial.items.find((item) => item.kind === "app");
+  if (app?.status === "done" && !exactUpdateVersion(ports.appVersion, app.targetVersion)) return;
+  if (
+    (!app || app.status === "skipped") &&
+    !exactUpdateVersion(ports.appVersion, initial.sourceVersion) &&
+    !initial.items.some(
+      (item) =>
+        item.kind === "server" &&
+        item.environmentId === initial.primaryEnvironmentId &&
+        exactUpdateVersion(ports.appVersion, item.targetVersion),
+    )
+  ) {
+    await pause("wrong-version");
+    return;
+  }
+  if (initial.phase === "awaiting-local") {
+    if (!app || app.claimId === ports.claimId) return;
+    if (ports.notAppliedVersion() === app.targetVersion) {
+      await pause("not-applied");
+      return;
+    }
+    if (exactUpdateVersion(ports.appVersion, initial.sourceVersion)) return;

@@ -0,0 +1,317 @@
+import type { ServerProvider } from "@t3tools/contracts";
+import {
+  canOneClickUpdateProviderCandidate,
+  collectProviderUpdateCandidates,
+  isProviderUpdateActive,
+} from "../ProviderUpdateLaunchNotification.logic";
+import { collectServerUpdateTargets, type UpdateOptionMachine } from "./updateEverything.logic";
+import { resolveServerSelfUpdateCapability } from "~/versionSkew";
+import {
+  exactUpdateVersion,
+  type ItemResolution,
+  type UpdatePlanItem,
+  type UpdateExecutionPlan,
+} from "./updateEverythingPlan";
+
+export function createUpdatePlanClaimOwner(
+  claimId: string,
+  wake: () => void,
+  locks: LockManager | undefined,
+) {
+  const name = (id: string) => `t3code-update-plan-owner:${id}`;
+  let release!: () => void;
+  const lifetime = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  let acquired!: () => void;
+  let failed!: (reason: unknown) => void;
+  const ready = new Promise<void>((resolve, reject) => {
+    acquired = resolve;
+    failed = reject;
+  });
+  const stopped = new AbortController();
+  const waiting = new Set<string>();
+  const holding = locks?.request(name(claimId), () => {
+    acquired();
+    return lifetime;
+  });
+  if (holding) void holding.catch(failed);
+  else acquired();
+  return {
+    ready,
+    isAlive: locks
+      ? async (id: string | null) => {
+          if (id === null) return false;
+          const state = await locks.query();
+          if (!state.held?.some((lock) => lock.name === name(id))) return false;
+          if (!waiting.has(id)) {
+            waiting.add(id);
+            void locks
+              .request(name(id), { signal: stopped.signal }, () => {})
+              .then(
+                () => {
+                  waiting.delete(id);
+                  wake();
+                },
+                () => {
+                  waiting.delete(id);
+                },
+              );
+          }
+          return true;
+        }
+      : undefined,
+    async [Symbol.asyncDispose]() {
+      stopped.abort();
+      release();
+      await holding;
+    },
+  };
+}
+
+export function retryExecutionPlan(
+  plan: UpdateExecutionPlan,
+  appVersion: string,
+  resolve: (item: UpdatePlanItem, recovering: boolean) => ItemResolution,
+): UpdateExecutionPlan {
+  if (
+    (plan.phase !== "paused" && plan.phase !== "complete") ||
+    plan.pausedReason === "expired" ||
+    plan.pausedReason === "storage"
+  )
+    return plan;
+  if (
+    plan.items.some(
+      (item) =>
+        item.kind !== "app" &&
+        (item.status === "claimed" || item.status === "unknown") &&
+        resolve(item, true).status === "wait",
+    )
+  )
+    return plan;
+  const items = plan.items.map((item) => {
+    if (item.kind === "app" && exactUpdateVersion(appVersion, item.targetVersion))
+      return { ...item, status: "done" as const, message: null };
+    if (item.status === "done" || item.status === "skipped" || item.status === "pending")
+      return item;
+    if (item.kind !== "app" && (item.status === "claimed" || item.status === "unknown")) {
+      const result = resolve(item, true);
+      if (result.status === "wait") return item;
+      if (result.status === "done") return { ...item, status: "done" as const, message: null };
+    }
+    return {

@@ -642,6 +654,31 @@ export const make = Effect.gen(function* () {
       })),
     );
 
+  const releaseInstallRestartPolicy = Effect.fn("desktop.updates.releaseInstallRestartPolicy")(
+    function* (disarmUntouched: boolean) {
+      const policy = yield* Ref.getAndSet(installRestartPolicyRef, Option.none());
+      if (Option.isNone(policy)) return;
+      const { requestId, instances, stopped } = policy.value;
+      const untouched = instances.filter((instance) => !stopped.has(instance));
+      if (disarmUntouched && untouched.length > 0) {
+        const accepted = yield* telemetry.requestUpdateRestartPolicy(
+          untouched.map((instance) => instance.id),
+          {
+            version: 1,
+            type: "desktopUpdateRestartPolicy",
+            requestId,
+            continueRunningThreads: true,
+          },
+        );
+        if (!accepted)

@@ -323,15 +286,500 @@ export function DesktopUpdateLaunchNotice() {
 
   useEffect(() => {
     if (notAppliedVersion === null || notifiedNotAppliedVersion === notAppliedVersion) return;
-    notifiedNotAppliedVersion = notAppliedVersion;
+    void updatePlanStore()
+      .then((store) => store.read())
+      .then((plan) => {
+        if (
+          plan?.items.some(
+            (item) => item.kind === "app" && item.targetVersion === notAppliedVersion,
+          )
+        )
+          return;
+        if (
+          ownedNotAppliedVersion === notAppliedVersion ||
+          notifiedNotAppliedVersion === notAppliedVersion
+        )
+          return;
+        notifiedNotAppliedVersion = notAppliedVersion;
+        toastManager.add(
+          stackedThreadToast({
+            type: "error",
+            title: "Update did not apply",
+            description: `T3 Code is still on ${APP_VERSION}. Install ${notAppliedVersion} again from the update button.`,
+          }),
+        );
+      })
+      .catch(() => {});
+  }, [notAppliedVersion]);
+
+  return null;
+}
+
+const rendererClaimId = randomUUID();
+const claimOwner = createUpdatePlanClaimOwner(
+  rendererClaimId,
+  () => {
+    void wakeUpdatePlan();
+  },
+  globalThis.navigator?.locks,
+);
+let desktopNotAppliedVersion: string | null = null;
+let coordinatorRunning = false;
+let coordinatorAgain = false;
+let recoveryPlanId: string | null = null;
+const executingItems = new Set<string>();
+let displayedPlanId: string | null = null;
+let storageStopped = false;
+let displayGeneration = 0;
+
+function planReady(plan: UpdateExecutionPlan): boolean {
+  if (storageStopped) return false;
+  const snapshot = appAtomRegistry.get(updateOptionsSnapshotAtom);
+  if (!snapshot.ready || snapshot.primaryEnvironmentId !== plan.primaryEnvironmentId) return false;
+  if (plan.primaryEnvironmentId === null) return true;
+  return snapshot.machines.some(
+    (machine) =>
+      machine.environmentId === plan.primaryEnvironmentId &&
+      machine.connected &&
+      machine.sessionReady &&
+      machine.serverConfig?.environment.environmentId === plan.primaryEnvironmentId,
+  );
+}
+
+const planItemResolver = createUpdatePlanItemResolver(
+  () => appAtomRegistry.get(updateOptionsSnapshotAtom),
+  () => {
+    void wakeUpdatePlan();
+  },
+);
+const resolvePlanItem = planItemResolver.resolve;
+
+function waitForHostedMaintenance(): Promise<void> {
+  return waitForHostedMaintenanceInRegistry(appAtomRegistry, updateOptionsSnapshotAtom);
+}
+
+export function waitForHostedProviderWork(): Promise<void> {
+  return waitForHostedProviderWorkInRegistry(appAtomRegistry, updateOptionsSnapshotAtom);
+}
+
+const planPorts: UpdatePlanPorts = {
+  claimId: rendererClaimId,
+  ...(claimOwner.isAlive ? { isClaimOwnerAlive: claimOwner.isAlive } : {}),
+  appVersion: APP_VERSION,
+  now: Date.now,
+  ready: planReady,
+  notAppliedVersion: () => desktopNotAppliedVersion,
+  resolve: resolvePlanItem,
+  download: (item) =>
+    window.desktopBridge
+      ? downloadUpdateForPlan(window.desktopBridge, item.targetVersion)
+      : Promise.resolve(false),
+  waitForMaintenance: waitForHostedMaintenance,
+  maintenanceReady: () => isHostedMaintenanceReady(appAtomRegistry.get(updateOptionsSnapshotAtom)),
+  countdown: () => waitForUpdateRestart(5_000),
+  install: async (item) => {
+    if (!window.desktopBridge) return false;
+    if (
+      item.autoResume === false &&
+      window.desktopBridge.supportsUpdateThreadContinuationControl !== true
+    )
+      return false;
+    try {
+      const result = await window.desktopBridge.installUpdate(item.targetVersion, item.autoResume);
+      return (
+        result.accepted &&
+        !(result.state.status === "error" && result.state.errorContext === "install")
+      );
+    } catch {
+      return false;
+    }
+  },
+  execute: async (item) => {
+    executingItems.add(item.key);
+    try {
+      const latest = resolvePlanItem(item, false);
+      if (latest.status !== "ready") return latest;
+      if (item.kind === "server") {
+        const machine = appAtomRegistry
+          .get(updateOptionsSnapshotAtom)
+          .machines.find((machine) => machine.environmentId === item.environmentId)!;
+        const target = collectServerUpdateTargets(
+          [machine],
+          item.targetVersion,
+          item.retryRequested === true,
+        ).targets[0];
+        if (!target) return { status: "skipped", message: "T3 update is no longer available" };
+        if (
+          item.autoResume === false &&
+          machine.serverConfig?.environment.capabilities.threadRestartContinuationControl !== true
+        )
+          return {
+            status: "skipped",
+            message: "This version cannot disable thread resume for an update",
+          };
+        const result = await runAtomCommand(
+          appAtomRegistry,
+          serverEnvironment.updateServer,
+          {
+            environmentId: item.environmentId,
+            input: {
+              targetVersion: item.targetVersion,
+              ...(item.autoResume === false
+                ? { continueRunningThreads: false }
+                : item.continueThreads &&
+                    target.threadContinuation &&
+                    target.continueThreadsAfterServerUpdate
+                  ? { continueRunningThreads: true }
+                  : {}),
+            },
+          },
+          { reportFailure: false },
+        );
+        if (result._tag === "Success") return { status: "done" };
+        return {
+          status: isAtomCommandInterrupted(result) ? "unknown" : "failed",
+          message: String(squashAtomCommandFailure(result)),
+        };
+      }
+      if (!item.driver || !item.instanceId)
+        return { status: "skipped", message: "Provider identity is missing" };
+      const result = await runAtomCommand(
+        appAtomRegistry,
+        serverEnvironment.updateProvider,
+        {
+          environmentId: item.environmentId,
+          input: { provider: item.driver, instanceId: item.instanceId },
+        },
+        { reportFailure: false },
+      );
+      if (result._tag === "Failure")
+        return {
+          status: isAtomCommandInterrupted(result) ? "unknown" : "failed",
+          message: String(squashAtomCommandFailure(result)),
+        };
+      const provider = result.value.providers.find(
+        (provider) => provider.driver === item.driver && provider.instanceId === item.instanceId,
+      );
+      return provider?.updateState?.status === "succeeded"
+        ? { status: "done" }
+        : {
+            status: "failed",
+            message: provider?.updateState?.message ?? "Provider update did not finish",
+          };
+    } finally {
+      executingItems.delete(item.key);
+    }
+  },
+};
+
+function showPlan(plan: UpdateExecutionPlan | null): void {
+  ownedNotAppliedVersion = plan?.items.find((item) => item.kind === "app")?.targetVersion ?? null;
+  if (!plan) {
+    planItemResolver.dispose();
+    if (displayedPlanId !== null) setUpdateEverythingRun(() => null);
+    displayedPlanId = null;
+    return;
+  }
+  displayedPlanId = plan.id;
+  const groups = new Map<EnvironmentId, UpdatePlanItem[]>();
+  for (const item of plan.items) {
+    if (item.kind === "app") continue;
+    const items = groups.get(item.environmentId) ?? [];
+    items.push(item);
+    groups.set(item.environmentId, items);
+  }
+  const app = plan.items.find((item) => item.kind === "app");
+  setUpdateEverythingRun((current) => ({
+    localVersion: app && app.status !== "skipped" ? app.targetVersion : null,
+    phase:
+      plan.phase === "awaiting-local"
+        ? "installing"
+        : current?.phase === "countdown" && plan.phase === "local"

@@ -749,19 +787,92 @@ export const make = Effect.gen(function* () {
           // hard-killed by the OS instead of receiving SIGTERM + grace.
           const instances = yield* pool.list;
           // stop clears desiredRunning, so retain the recovery set beforehand.
-          const runningInstances = yield* Effect.filter(instances, (instance) =>
-            instance.snapshot.pipe(Effect.map((snapshot) => snapshot.desiredRunning)),
+          const backendSnapshots = yield* Effect.forEach(instances, (instance) =>
+            instance.snapshot.pipe(Effect.map((snapshot) => ({ instance, snapshot }))),
           );
+          const runningInstances = backendSnapshots
+            .filter(({ snapshot }) => snapshot.desiredRunning)
+            .map(({ instance }) => instance);
+          if (continueRunningThreads === false) {
+            const affected = backendSnapshots.filter(
+              ({ snapshot }) => snapshot.desiredRunning || Option.isSome(snapshot.activePid),
+            );
+            if (affected.some(({ snapshot }) => Option.isNone(snapshot.activePid))) {
+              return yield* Effect.die(
+                new Error(
+                  "Wait for every desktop backend to start before disabling thread continuation.",
+                ),
+              );
+            }
+            if (affected.length > 0) {
+              const requestId = yield* crypto.randomUUIDv4().pipe(Effect.orDie);
+              yield* Ref.set(
+                installRestartPolicyRef,
+                Option.some({
+                  requestId,
+                  instances: affected.map(({ instance }) => instance),
+                  stopped: new Set(),
+                }),
+              );
+              const accepted = yield* telemetry.requestUpdateRestartPolicy(
+                affected.map(({ instance }) => instance.id),
+                {
+                  version: 1,
+                  type: "desktopUpdateRestartPolicy",
+                  requestId,
+                  continueRunningThreads: false,
+                },
+              );
+              if (!accepted)
+                return yield* Effect.die(
+                  new Error(
+                    "Every running backend must accept the desktop update restart policy before installing.",
+                  ),
+                );
+            }

@@ -0,0 +1,180 @@
+import { RunId } from "@t3tools/contracts";
+import { writeFileStringAtomically } from "@t3tools/shared/atomicWrite";
+import * as HostProcess from "@t3tools/shared/HostProcess";
+import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Ref from "effect/Ref";
+import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
+
+import * as ServerConfig from "./config.ts";
+
+const Entry = Schema.Struct({
+  requestId: Schema.String,
+  ownerId: Schema.String,
+  pending: Schema.Boolean,
+  runIds: Schema.Array(RunId),
+});
+const State = Schema.Struct({
+  entries: Schema.Array(Entry),
+  latestRequestId: Schema.NullOr(Schema.String),
+});
+const decode = Schema.decodeUnknownEffect(Schema.fromJsonString(State));
+const encode = Schema.encodeEffect(Schema.fromJsonString(State));
+
+export class UpdateRestartPolicyError extends Schema.TaggedError<UpdateRestartPolicyError>()(
+  "UpdateRestartPolicyError",
+  { cause: Schema.Defect() },
+) {}
+
+export class UpdateRestartPolicy extends Context.Reference<{
+  readonly set: (
+    requestId: string,
+    continueRunningThreads: boolean,
+  ) => Effect.Effect<void, UpdateRestartPolicyError>;
+  readonly capture: (
+    runIds: ReadonlyArray<RunId>,
+    trigger: "startup" | "shutdown",
+    continuationPending?: (runId: RunId) => Effect.Effect<boolean, UpdateRestartPolicyError>,
+  ) => Effect.Effect<void, UpdateRestartPolicyError>;
+  readonly isVetoed: (runId: RunId) => Effect.Effect<boolean>;
+}>("t3/UpdateRestartPolicy", {
+  defaultValue: () => ({
+    set: (_requestId, enabled) =>
+      enabled
+        ? Effect.void
+        : Effect.fail(new UpdateRestartPolicyError({ cause: "Update policy is unavailable." })),
+    capture: () => Effect.void,
+    isVetoed: () => Effect.succeed(false),
+  }),
+}) {}
+
+export const make = Effect.fn("UpdateRestartPolicy.make")(
+  function* (filePath: string) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const platform = yield* HostProcess.Platform;
+    const ownerId = yield* Crypto.Crypto.pipe(Effect.flatMap((crypto) => crypto.randomUUIDv4()));
+    const initial = yield* fs.readFileString(filePath).pipe(
+      Effect.flatMap(decode),
+      Effect.catchIf(
+        (error) => "reason" in error && error.reason._tag === "NotFound",
+        () => Effect.succeed({ entries: [], latestRequestId: null } as typeof State.Type),
+      ),
+    );

@@ -521,6 +551,10 @@ export const make = Effect.fn("resourceTelemetry.desktopTelemetryReceiver.make")
           );
         }
 
+        if (message.type === "desktopUpdateRestartPolicy") {
+          return applyUpdateRestartPolicy(message).pipe(Effect.flatMap(sendControlMessage));
+        }

@@ -323,15 +286,503 @@ export function DesktopUpdateLaunchNotice() {
 
   useEffect(() => {
     if (notAppliedVersion === null || notifiedNotAppliedVersion === notAppliedVersion) return;
-    notifiedNotAppliedVersion = notAppliedVersion;
-    toastManager.add(
-      stackedThreadToast({
-        type: "error",
-        title: "Update did not apply",
-        description: `T3 Code is still on ${APP_VERSION}. Install ${notAppliedVersion} again from the update button.`,
+    void updatePlanStore()
+      .then((store) => store.read())
+      .then((plan) => {
+        if (
+          plan?.items.some(
+            (item) => item.kind === "app" && item.targetVersion === notAppliedVersion,
+          )
+        )
+          return;
+        if (
+          ownedNotAppliedVersion === notAppliedVersion ||
+          notifiedNotAppliedVersion === notAppliedVersion
+        )
+          return;
+        notifiedNotAppliedVersion = notAppliedVersion;
+        toastManager.add(
+          stackedThreadToast({
+            type: "error",
+            title: "Update did not apply",
+            description: `T3 Code is still on ${APP_VERSION}. Install ${notAppliedVersion} again from the update button.`,
+          }),
+        );
+      })
+      .catch(() => {});
+  }, [notAppliedVersion]);
+
+  return null;
+}
+
+const rendererClaimId = randomUUID();
+const claimOwner = createUpdatePlanClaimOwner(
+  rendererClaimId,
+  () => {
+    void wakeUpdatePlan();
+  },
+  globalThis.navigator?.locks,
+);
+let desktopNotAppliedVersion: string | null = null;
+let coordinatorRunning = false;
+let coordinatorAgain = false;
+let recoveryPlanId: string | null = null;
+const executingItems = new Set<string>();
+let displayedPlanId: string | null = null;
+let storageStopped = false;
+let displayGeneration = 0;
+
+function planReady(plan: UpdateExecutionPlan): boolean {
+  if (storageStopped) return false;
+  const snapshot = appAtomRegistry.get(updateOptionsSnapshotAtom);
+  if (!snapshot.ready || snapshot.primaryEnvironmentId !== plan.primaryEnvironmentId) return false;
+  if (plan.primaryEnvironmentId === null) return true;
+  return snapshot.machines.some(
+    (machine) =>
+      machine.environmentId === plan.primaryEnvironmentId &&
+      machine.connected &&
+      machine.sessionReady &&
+      machine.serverConfig?.environment.environmentId === plan.primaryEnvironmentId,
+  );
+}
+
+const planItemResolver = createUpdatePlanItemResolver(
+  () => appAtomRegistry.get(updateOptionsSnapshotAtom),
+  () => {
+    void wakeUpdatePlan();
+  },
+);
+const resolvePlanItem = planItemResolver.resolve;
+
+function waitForHostedMaintenance(): Promise<void> {
+  return waitForHostedMaintenanceInRegistry(appAtomRegistry, updateOptionsSnapshotAtom);
+}
+
+export function waitForHostedProviderWork(): Promise<void> {
+  return waitForHostedProviderWorkInRegistry(appAtomRegistry, updateOptionsSnapshotAtom);
+}
+
+const planPorts: UpdatePlanPorts = {
+  claimId: rendererClaimId,
+  ...(claimOwner.isAlive ? { isClaimOwnerAlive: claimOwner.isAlive } : {}),
+  appVersion: APP_VERSION,
+  now: Date.now,
+  ready: planReady,
+  notAppliedVersion: () => desktopNotAppliedVersion,
+  resolve: resolvePlanItem,
+  download: (item) =>
+    window.desktopBridge
+      ? downloadUpdateForPlan(window.desktopBridge, item.targetVersion)
+      : Promise.resolve(false),
+  waitForMaintenance: waitForHostedMaintenance,
+  maintenanceReady: () => isHostedMaintenanceReady(appAtomRegistry.get(updateOptionsSnapshotAtom)),
+  countdown: () => waitForUpdateRestart(5_000),
+  install: async (item) => {
+    if (!window.desktopBridge) return false;
+    if (
+      item.autoResume === false &&
+      window.desktopBridge.supportsUpdateThreadContinuationControl !== true
+    )
+      return false;
+    try {
+      const result = await window.desktopBridge.installUpdate(item.targetVersion, item.autoResume);
+      return (
+        result.accepted &&
+        !(result.state.status === "error" && result.state.errorContext === "install")
+      );
+    } catch {
+      return false;
+    }
+  },
+  execute: async (item) => {
+    executingItems.add(item.key);
+    try {
+      const latest = resolvePlanItem(item, false);
+      if (latest.status !== "ready") return latest;
+      if (item.kind === "server") {
+        const machine = appAtomRegistry
+          .get(updateOptionsSnapshotAtom)
+          .machines.find((machine) => machine.environmentId === item.environmentId)!;
+        const target = collectServerUpdateTargets(
+          [machine],
+          item.targetVersion,
+          item.retryRequested === true,
+        ).targets[0];
+        if (!target) return { status: "skipped", message: "T3 update is no longer available" };
+        if (
+          item.autoResume === false &&
+          machine.serverConfig?.environment.capabilities.threadRestartContinuationControl !== true
+        )
+          return {
+            status: "skipped",
+            message: "This version cannot disable thread resume for an update",
+          };
+        const result = await runAtomCommand(
+          appAtomRegistry,
+          serverEnvironment.updateServer,
+          {
+            environmentId: item.environmentId,
+            input: {
+              targetVersion: item.targetVersion,
+              ...(item.autoResume === false
+                ? { continueRunningThreads: false }
+                : item.continueThreads &&
+                    target.threadContinuation &&
+                    target.continueThreadsAfterServerUpdate
+                  ? { continueRunningThreads: true }
+                  : {}),
+            },
+          },
+          { reportFailure: false },
+        );
+        if (result._tag === "Success") return { status: "done" };
+        return {
+          status: isAtomCommandInterrupted(result) ? "unknown" : "failed",
+          message: String(squashAtomCommandFailure(result)),
+        };
+      }
+      if (!item.driver || !item.instanceId)
+        return { status: "skipped", message: "Provider identity is missing" };
+      const result = await runAtomCommand(
+        appAtomRegistry,
+        serverEnvironment.updateProvider,
+        {
+          environmentId: item.environmentId,
+          input: { provider: item.driver, instanceId: item.instanceId },

@@ -642,6 +659,35 @@ export const make = Effect.gen(function* () {
       })),
     );
 
+  const releaseInstallRestartPolicy = Effect.fn("desktop.updates.releaseInstallRestartPolicy")(
+    function* (disarmUntouched: boolean) {
+      const policy = yield* Ref.get(installRestartPolicyRef);
+      if (Option.isNone(policy)) return true;
+      const { requestId, instances, stopped } = policy.value;
+      const untouched = instances.filter((instance) => !stopped.has(instance));