[murongg]

Summary

Add System settings → Software updates so the platform owner can inspect official SubLane stable releases and queue an update after acknowledging a verified backup. The page retains progress through restarts and confirms completion only when the target server version is serving.

An opt-in systemd user worker runs the existing checksum-verified installer for script-managed Linux Docker and binary deployments. A single filesystem job survives the application restart; the web process receives a mailbox instead of Docker control. Includes regression coverage, all 11 UI dictionaries, and checksummed installer/worker release assets.

Validation

• make generate-check SQLC=/tmp/sublane-online-sqlc passed using SQLC 1.31.1 built from the local module cache.
• make lint passed after rebasing onto the current main.
• go test -race ./internal/updates ./internal/server -run 'TestSoftwareUpdates|TestClientVersionSettings' -count=1 passed for the selected server tests; the complete updates package is verified separately.
• pnpm --dir web test passed after rebasing: 543 tests across 68 files. The affected settings/update tests also passed separately (24 tests).
• pnpm --dir web build and the production Go build passed.
• node --test scripts/install.test.mjs scripts/updater.test.mjs passed (83 tests), and go test -race ./internal/updates passed. Synthetic installer/worker tests cover both deployment modes, download/checksum/startup failures, concurrent jobs, interrupted execution, downgrade rejection, symlinks, and empty mailbox settings.
• Browser checks passed at 1440px and 390px in English/Chinese and light/dark themes, including backup confirmation and reconnect-to-completion. The confirmation dialog had zero axe WCAG A/AA violations.
• Generated Compose overlay validation and release-archive helper checks passed.
• GitHub CI passed for cfa6a38: validation, all three Go race groups, amd64/arm64 native container builds and smoke tests, and the required aggregate check. Successful run.

Compatibility and migration

• Enable web installation once with --enable-updates during installation or --update; Linux, jq, and a running systemd user manager are required. The first compatible release must publish the checksummed install.sh and updater.sh assets.
• SUBLANE_UPDATE_DIR is optional. Docker mounts only the generated mailbox; binary setup writes its absolute path. Custom deployments and development/prerelease builds retain release checks and manual upgrade guidance.
• No new database migration. Installation requires a verified-backup acknowledgement; interrupted jobs are not replayed and migrated databases are never automatically downgraded.
• Native Linux systemd upgrades, container image build, and live Docker upgrades remain unverified locally because this host has no running Docker daemon.
• Companion deployment/settings/architecture documentation: https://github.com/murongg/sublane-website/pull/53.

Checklist

• The change is focused on one problem and follows CONTRIBUTING.md.
• Behavior changes have regression tests using synthetic data only.
• Validation results and remaining gaps are documented above.
• Relevant documentation and every supported UI dictionary are updated.
• UI changes are checked for keyboard access, narrow screens, light/dark themes, and English/Chinese.
• No credentials, account identifiers, private request/response content, or local planning documents are included.