fix: make web updates restart cleanly

Dockerfile

@@ -1,20 +1,25 @@
 # syntax=docker/dockerfile:1.7
 
-# ---- Stage 1: build the web frontend ----
-FROM node:20-alpine AS web-builder
+# Build toolchains run natively on the BuildKit host. Without BUILDPLATFORM,
+# the arm64 branch executes npm and the Go compiler through QEMU, which is much
+# slower and makes npm ci appear to hang despite producing no progress output.
+# ---- Stage 1: build the web frontend once on the native builder ----
+FROM --platform=$BUILDPLATFORM node:20-alpine AS web-builder
 WORKDIR /web
 COPY web/package.json web/package-lock.json* ./
 RUN npm ci
 COPY web/ ./
 RUN npm run build
 
-# ---- Stage 2: build the Go binary ----
-FROM golang:1.25-alpine AS go-builder
+# ---- Stage 2: cross-compile the Go binary on the native builder ----
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS go-builder
 RUN apk add --no-cache git
 WORKDIR /src
 
 ARG VERSION=0.1.0-dev
 ARG BUILD_TIME=""
+ARG TARGETOS
+ARG TARGETARCH
 
 COPY go.mod go.sum ./
 RUN go mod download
@@ -23,7 +28,7 @@ COPY . .
 # Overlay the freshly built frontend so go:embed web/dist picks it up.
 COPY --from=web-builder /web/dist ./web/dist
 
-RUN CGO_ENABLED=0 GOOS=linux go build \
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build \
     -trimpath \
     -ldflags "-s -w -X vocat/internal/buildinfo.Version=${VERSION} -X vocat/internal/buildinfo.BuildTime=${BUILD_TIME}" \
     -o /out/vocat \

cmd/vocat/main.go

@@ -248,6 +248,10 @@ func run(logger *slog.Logger, logs *loghub.Hub) error {
 	case <-signalContext.Done():
 		logger.Info("shutdown signal received")
 	}
+	// Long-lived SSE and polling handlers use this context. Stop them before
+	// http.Server.Shutdown so they do not consume the entire graceful-shutdown
+	// deadline while waiting for a stream that is intentionally still active.
+	cancelPolling()
 
 	shutdownContext, cancelShutdown := context.WithTimeout(
 		context.Background(),

internal/update/update.go

@@ -7,8 +7,8 @@
 // Trust model: GitHub TLS guarantees the channel; the repository owner controls
 // which assets are published; SHA256SUMS guards integrity. There is no GPG
 // signature verification — an accepted trade-off for a closed-network testing
-// tool. The web UI's check-update button remains an intentional no-op; only the
-// CLI performs code replacement.
+// tool. Both the CLI and authenticated web UI use this same verified replacement
+// path.
 package update
 
 import (
@@ -232,7 +232,10 @@ func RestartService(logger *slog.Logger) error {
 	if _, err := exec.LookPath("systemctl"); err != nil {
 		return fmt.Errorf("systemctl not found in PATH")
 	}
-	cmd := exec.Command("systemctl", "restart", "vocat")
+	// Queue the restart and let systemctl exit before systemd stops this unit.
+	// A blocking restart command becomes part of vocat.service's own cgroup and
+	// waits for that same cgroup to terminate, creating a stop-timeout cycle.
+	cmd := exec.Command("systemctl", "restart", "--no-block", "vocat")
 	if out, err := cmd.CombinedOutput(); err != nil {
 		logger.Warn("systemctl restart failed", "error", err, "output", string(out))
 		return fmt.Errorf("systemctl restart vocat: %w", err)

internal/vowifi/ims/sms_runtime_test.go

@@ -29,8 +29,9 @@ func TestSessionReceivesAndAcknowledgesSMSOverIMS(t *testing.T) {
 
 	received := make(chan ReceivedSMS, 1)
 	serverDone := make(chan error, 1)
+	readyForClose := make(chan struct{})
 	nonce := base64.StdEncoding.EncodeToString(make([]byte, 32))
-	go func() { serverDone <- serveInboundSMS(listener, nonce) }()
+	go func() { serverDone <- serveInboundSMS(listener, nonce, readyForClose) }()
 	provider, err := NewProvider(
 		smsTestAKA{&recordingAKA{result: vowifi.AKAResult{RES: []byte{1, 2, 3, 4}}}},
 		Config{
@@ -65,6 +66,11 @@ func TestSessionReceivesAndAcknowledgesSMSOverIMS(t *testing.T) {
 	case <-time.After(5 * time.Second):
 		t.Fatal("timed out waiting for inbound SMS")
 	}
+	select {
+	case <-readyForClose:
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for the inbound RP-ACK exchange")
+	}
 	if err := session.Close(context.Background()); err != nil {
 		t.Fatal(err)
 	}
@@ -102,9 +108,10 @@ func TestSessionSendsSMSOverIMS(t *testing.T) {
 	defer listener.Close()
 	_ = listener.SetDeadline(time.Now().Add(10 * time.Second))
 	serverDone := make(chan error, 1)
+	readyForClose := make(chan struct{})
 	statusReceived := make(chan ReceivedSMSStatus, 1)
 	nonce := base64.StdEncoding.EncodeToString(make([]byte, 32))
-	go func() { serverDone <- serveOutboundSMS(listener, nonce) }()
+	go func() { serverDone <- serveOutboundSMS(listener, nonce, readyForClose) }()
 	provider, err := NewProvider(
 		smsTestAKA{&recordingAKA{result: vowifi.AKAResult{RES: []byte{1, 2, 3, 4}}}},
 		Config{
@@ -145,6 +152,11 @@ func TestSessionSendsSMSOverIMS(t *testing.T) {
 	case <-time.After(5 * time.Second):
 		t.Fatal("timed out waiting for SMS delivery status")
 	}
+	select {
+	case <-readyForClose:
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for the status-report RP-ACK exchange")
+	}
 	if err := session.Close(context.Background()); err != nil {
 		t.Fatal(err)
 	}
@@ -153,7 +165,7 @@ func TestSessionSendsSMSOverIMS(t *testing.T) {
 	}
 }
 
-func serveInboundSMS(listener *net.UDPConn, nonce string) error {
+func serveInboundSMS(listener *net.UDPConn, nonce string, readyForClose chan<- struct{}) error {
 	packet := make([]byte, 65535)
 	count, remote, err := listener.ReadFromUDP(packet)
 	if err != nil {
@@ -229,6 +241,7 @@ func serveInboundSMS(listener *net.UDPConn, nonce string) error {
 	if _, err = listener.WriteToUDP(testResponse(200, "OK", report.Request.value("Call-ID"), report.Request.value("CSeq"), nil), remote); err != nil {
 		return err
 	}
+	close(readyForClose)
 
 	count, remote, err = listener.ReadFromUDP(packet)
 	if err != nil {
@@ -245,7 +258,7 @@ func serveInboundSMS(listener *net.UDPConn, nonce string) error {
 	return err
 }
 
-func serveOutboundSMS(listener *net.UDPConn, nonce string) error {
+func serveOutboundSMS(listener *net.UDPConn, nonce string, readyForClose chan<- struct{}) error {
 	packet := make([]byte, 65535)
 	count, remote, err := listener.ReadFromUDP(packet)
 	if err != nil {
@@ -355,6 +368,7 @@ func serveOutboundSMS(listener *net.UDPConn, nonce string) error {
 	if _, err = listener.WriteToUDP(testResponse(200, "OK", statusACK.Request.value("Call-ID"), statusACK.Request.value("CSeq"), nil), remote); err != nil {
 		return err
 	}
+	close(readyForClose)
 
 	count, remote, err = listener.ReadFromUDP(packet)
 	if err != nil {

scripts/install.sh

@@ -216,7 +216,9 @@ ExecStart=${BINARY_PATH}
 Restart=on-failure
 RestartSec=3s
 TimeoutStartSec=30s
-TimeoutStopSec=20s
+# HTTP, VoWiFi, and modem cleanup have bounded shutdown contexts totalling up
+# to 30 seconds. Leave a small margin before systemd resorts to SIGKILL.
+TimeoutStopSec=40s
 
 AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
 CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
@@ -229,7 +231,9 @@ ProtectKernelLogs=true
 ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectControlGroups=true
-ReadWritePaths=/opt/vocat/data
+# The web/CLI self-updater verifies a release in this directory and atomically
+# renames it over the running binary. Keep the rest of the host read-only.
+ReadWritePaths=/opt/vocat/data /opt/vocat/bin
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 RestrictRealtime=true
 LockPersonality=true