Fix review findings: secrets in snapshots, URL spoofing, migration data loss

Adversarial review of the branch produced findings across four areas. This addresses them, plus the Windows CI environment. Secrets. commit_container_snapshot baked the container's full env into the per-project snapshot image, so the shared OAuth token — and the AWS keys, git token and gateway master key — outlived revocation and were readable via docker inspect. Verified against Engine 29.6 that a commit body's config merges over the container's: keys cannot be dropped but can be overwritten, so all of them now commit as KEY=. clear_claude_token additionally rewrites images from earlier builds and reports honestly when a tag could not be rewritten. The recommendation to move the token out of env entirely was not taken, with reasoning: apiKeyHelper is a different auth method that outranks CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no file-based delivery exists. The durable exposure — the image — is what is closed here. Separately noted, not fixed: entrypoint.sh captures the token into the scheduler's .env inside the persisted volume. URL spoofing. Three call sites reached openUrl with container-controlled strings, one of which the review missed (the WebLinksAddon handler). The sign-in URL was scraped from container output with a longest-match tie-break and no userinfo check, so claude.ai@evil.tld rendered as "claude.ai…" in a truncating element. There is now one sanitizer in front of every sink — scheme allowlist, no userinfo, C0/C1 and quote rejection, host allowlist for the sign-in case, first-match — and the origin renders un-truncated. The toast is keyed so a changed URL remounts, closing a bait-and-switch where the user read one URL and clicked another. Migration. The rollback pin was best-effort: a tag failure was logged and the migration continued past remove_container, after which the final commit overwrote the only copy of the old system layer. It now aborts before anything destructive and reads the tag back. /var was destroyed while the ordinary recreate path preserves it — making the "safe" alternative to Reset more destructive than Reset's alternative; data-bearing subtrees are now detected and disclosed in the pre-flight rather than copied, since tarring a live database onto a different base's packages is a corruption risk. resume_migration now verifies the migration-state label instead of reporting success for a container that never swapped. dismiss actually resolves the record rather than leaving the feature permanently refusing to migrate. Start and Reset are guarded while a migration is live. Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and advertised URL are derived together so they cannot drift. Disabling it now stops it. App exit runs teardown concurrently under a budget with a visible shutting-down state instead of blocking for minutes. Auto-starts retry when Docker is not up yet, and the polling-recovery path now reconciles, so interrupted migrations are still recovered. Auth-bridge forwards are capped, closing a container-driven fd exhaustion. Windows CI. build-windows failed on this branch with "linker link.exe not found". The runner had no MSVC build tools and the workflow assumed a hand-provisioned machine, so a bare runner registers, accepts jobs and fails at link time after downloading the whole crate graph. The job now installs the VC++ workload when vswhere cannot find it, matching how it already conditionally installs Rust and Node. 192 Rust tests, 274 frontend tests, both builds clean, zero warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09 19:35:39 -07:00
parent eb1324cb16
commit 2de00b3c55
43 changed files with 4348 additions and 346 deletions
@@ -22,6 +22,7 @@ const STALE: ContainerStaleness = {
  apt_delta: ["socat", "bubblewrap"],
  npm_global_delta: [],
  verbatim_paths: [],
+  unpreserved_data: [],
  outdated_package_count: 61,
  probe_error: null,
 };
@@ -30,6 +31,7 @@ function migration(overrides: Partial<ContainerMigration> = {}): ContainerMigrat
  return {
    staleness: STALE,
    probing: false,
+    probeSettled: true,
    running: false,
    recovered: false,
    interrupted: null,
@@ -41,7 +43,7 @@ function migration(overrides: Partial<ContainerMigration> = {}): ContainerMigrat
    resume: vi.fn(async () => {}),
    keep: vi.fn(async () => {}),
    rollback: vi.fn(async () => {}),
-    dismiss: vi.fn(),
+    dismiss: vi.fn(async () => {}),
    refresh: vi.fn(async () => {}),
    ...overrides,
  };
@@ -153,18 +155,95 @@ describe("MigrateContainerModal", () => {
      });
    });

-    it("does not ask to copy paths when there are none to copy", async () => {
+    it("never derives copy_paths from a delta the probe may not have read", async () => {
+      // The regression: `copy_paths: copyPaths && verbatim.length > 0` read the
+      // toggle's meaning off `staleness`, which is null while the ~6 s probe
+      // runs. That sent `copy_paths: false` to a backend that recomputes the
+      // real set but honours the flag — files silently not copied, while this
+      // dialog said there was nothing to copy. The toggle's own value is the
+      // only thing that may be sent; the backend skips the step when *its* set
+      // comes out empty, which is the only place that knows.
      const { m } = await renderModal({ ...STALE, verbatim_paths: [] });
      fireEvent.click(
        screen.getByRole("button", { name: "Update container base" }),
      );
      expect(m.start).toHaveBeenCalledWith({
        replay_packages: true,
-        copy_paths: false,
+        copy_paths: true,
        keep_rollback: true,
      });
    });

+    it("cannot be started until the probe has settled, and says so", async () => {
+      await renderModal(null, { probeSettled: false, probing: true });
+      expect(
+        screen.getByRole("button", { name: "Update container base" }),
+      ).toBeDisabled();
+      expect(
+        screen.getByText(/lists below are not complete until it finishes/i),
+      ).toBeInTheDocument();
+      // "None found" and "not checked yet" must not be the same sentence.
+      expect(
+        screen.getByText(/Still checking which apt packages/i),
+      ).toBeInTheDocument();
+      expect(screen.getByText("Not checked yet.")).toBeInTheDocument();
+      expect(
+        screen.queryByText(/No extra apt packages were found/i),
+      ).not.toBeInTheDocument();
+    });
+
+    it("names the data under /var that the update destroys and cannot restore", async () => {
+      await renderModal({
+        ...STALE,
+        unpreserved_data: [
+          { path: "/var/lib/postgresql", bytes: 41_000_000, file_count: 912 },
+        ],
+      });
+      const panel = screen.getByTestId("migration-unpreserved");
+      expect(panel.textContent).toMatch(/\/var\/lib\/postgresql/);
+      expect(panel.textContent).toMatch(/41\.0 MB in 912 files/);
+      expect(panel.textContent).toMatch(/reinstalling the package does not bring it back/i);
+    });
+
+    it("says plainly that /var is not carried across even when nothing is at risk", async () => {
+      await renderModal();
+      const panel = screen.getByTestId("migration-unpreserved");
+      expect(panel.textContent).toMatch(/nothing here to lose/i);
+      expect(panel.textContent).toMatch(/Data written under \/var is not carried across/i);
+    });
+
+    it("offers Resume rather than Keep on a container that is mid-swap", async () => {
+      // Keep drops the rollback image, and on an unfinished migration
+      // `:latest` still points at the old lineage — so Keep here deletes the
+      // only way back from a container the app can no longer reason about.
+      const { m } = await renderModal(STALE, {
+        interrupted: {
+          phase: "interrupted",
+          from_image_id: "sha256:aaa",
+          to_base_id: "sha256:bbb",
+          started_at: "2026-08-09T10:00:00Z",
+          report: null,
+          rollback_image: "triple-c-snapshot-p1:pre-migration-20260809-100000",
+          staging_path: null,
+          options: { replay_packages: true, copy_paths: true, keep_rollback: true },
+          plan: null,
+        },
+        report: {
+          phase: "failed",
+          packages_requested: [],
+          packages_installed: [],
+          packages_failed: [],
+          paths_copied: [],
+          features_restored: [],
+          rollback_available: true,
+          message: "saving it failed",
+        },
+      });
+      expect(screen.queryByRole("button", { name: "Keep" })).not.toBeInTheDocument();
+      fireEvent.click(screen.getByRole("button", { name: "Resume update" }));
+      expect(m.resume).toHaveBeenCalledTimes(1);
+    });
+
    it("does not start anything on cancel", async () => {
      const { m, onClose } = await renderModal();
      fireEvent.click(screen.getByRole("button", { name: "Cancel" }));
@@ -5,8 +5,10 @@ import Button from "../ui/Button";
 import Toggle from "../ui/Toggle";
 import { SwitchRow } from "../ui/Field";
 import MigrationReportCard from "./MigrationReportCard";
+import MigrationInterruptedCard from "./MigrationInterruptedCard";
 import type { ContainerMigration } from "../../hooks/useContainerMigration";
 import {
+  DATA_NOT_CARRIED,
  KEPT_AUTOMATICALLY,
  KEPT_WHY,
  LOST_WITHOUT_REPLAY,
@@ -14,6 +16,7 @@ import {
  REPLAY_COST,
  ROLLBACK_DISK_COST,
  ROLLBACK_SCOPE,
+  formatDataSize,
  formatSnapshotDate,
 } from "./migrationCopy";

@@ -85,10 +88,12 @@ export default function MigrateContainerModal({
  const [keepRollback, setKeepRollback] = useState(true);
  const logRef = useRef<HTMLDivElement>(null);

-  const { running, report, log, phaseMessage, busy } = migration;
+  const { running, report, interrupted, log, phaseMessage, busy, probeSettled } =
+    migration;
  const aptDelta = staleness?.apt_delta ?? [];
  const npmDelta = staleness?.npm_global_delta ?? [];
  const verbatim = staleness?.verbatim_paths ?? [];
+  const atRisk = staleness?.unpreserved_data ?? [];
  const gains = staleness?.missing_features ?? [];
  const snapshot = formatSnapshotDate(staleness?.snapshot_created_at ?? null);

@@ -100,13 +105,44 @@ export default function MigrateContainerModal({

  const start = () => {
    const options: MigrationOptions = {
+      // Deliberately *not* `&& verbatim.length > 0`. That looked like a
+      // harmless optimisation but read the toggle's meaning off a probe that
+      // may not have landed, so a null `staleness` sent `copy_paths: false`
+      // and the backend — which recomputes the real set but honours the flag —
+      // skipped files that did exist. The backend already skips the step when
+      // its own set comes out empty; that is the only place that knows.
      replay_packages: replayPackages,
-      copy_paths: copyPaths && verbatim.length > 0,
+      copy_paths: copyPaths,
      keep_rollback: keepRollback,
    };
    void migration.start(options);
  };

+  // ---- Unfinished ---------------------------------------------------------
+  // Ahead of the report, for the reason spelled out in MigrationInterruptedCard:
+  // Keep is not a legitimate action on a container that is mid-swap.
+  if (interrupted) {
+    return (
+      <Modal
+        title={`Update container base — ${projectName}`}
+        onClose={onClose}
+        widthClassName="w-[34rem]"
+        footer={
+          <Button size="md" variant="ghost" onClick={onClose}>
+            Close
+          </Button>
+        }
+      >
+        <MigrationInterruptedCard
+          record={interrupted}
+          busy={busy || running}
+          onResume={() => void migration.resume()}
+          onRollback={() => void migration.rollback().then(onClose)}
+        />
+      </Modal>
+    );
+  }
+
  // ---- Outcome ------------------------------------------------------------
  if (report) {
    return (
@@ -125,10 +161,7 @@ export default function MigrateContainerModal({
          busy={busy}
          onKeep={() => void migration.keep().then(onClose)}
          onRollback={() => void migration.rollback().then(onClose)}
-          onDismiss={() => {
-            migration.dismiss();
-            onClose();
-          }}
+          onDismiss={() => void migration.dismiss().then(onClose)}
        />
      </Modal>
    );
@@ -187,13 +220,35 @@ export default function MigrateContainerModal({
          <Button size="md" variant="ghost" onClick={onClose}>
            Cancel
          </Button>
-          <Button size="md" variant="primary" onClick={start}>
+          <Button
+            size="md"
+            variant="primary"
+            disabled={!probeSettled}
+            onClick={start}
+          >
            Update container base
          </Button>
        </>
      }
    >
      <div className="space-y-3">
+        {/* 0. Until the probe lands, every list below is "not known" wearing
+            "empty"'s clothes. Say which one it is, and do not let the run
+            start on an unread delta. */}
+        {!probeSettled && (
+          <section
+            className="border border-[var(--warning)]/40 bg-[var(--warning-muted)] rounded-[var(--radius-panel)] px-3.5 py-3"
+            role="status"
+            aria-live="polite"
+          >
+            <p className="text-xs text-[var(--text-primary)] leading-snug">
+              Still working out what this container has that the current base
+              does not. The lists below are not complete until it finishes, so
+              the update cannot start yet.
+            </p>
+          </section>
+        )}
+
        {/* 1. Reassurance first. Not a choice — a statement of fact. */}
        <Section title="Kept automatically">
          <BulletList items={KEPT_AUTOMATICALLY} />
@@ -203,6 +258,51 @@ export default function MigrateContainerModal({
          </p>
        </Section>

+        {/* 1b. The one thing that is genuinely destroyed. Directly under the
+            reassurance, because a user who reads only the top of this dialog
+            must not come away thinking nothing is at stake. */}
+        <section
+          className="border border-[var(--error)]/40 bg-[var(--error-muted)] rounded-[var(--radius-panel)] px-3.5 py-3 space-y-2"
+          data-testid="migration-unpreserved"
+        >
+          <h3 className="text-[13px] font-medium text-[var(--text-primary)]">
+            {atRisk.length > 0
+              ? `Destroyed, and not restored by this update (${atRisk.length})`
+              : "Not carried across"}
+          </h3>
+          <p className="text-xs text-[var(--text-secondary)] leading-snug">
+            {DATA_NOT_CARRIED}
+          </p>
+          {probeSettled ? (
+            atRisk.length > 0 ? (
+              <ul className="space-y-1 pl-4 list-disc marker:text-[var(--text-disabled)]">
+                {atRisk.map((d) => (
+                  <li
+                    key={d.path}
+                    className="text-xs leading-snug text-[var(--text-primary)]"
+                  >
+                    <span className="font-mono break-all">{d.path}</span>
+                    <span className="text-[var(--text-secondary)]">
+                      {" "}
+                      — {formatDataSize(d.bytes)} in {d.file_count} file
+                      {d.file_count === 1 ? "" : "s"}
+                    </span>
+                  </li>
+                ))}
+              </ul>
+            ) : (
+              <p className="text-xs text-[var(--text-secondary)]">
+                Nothing was found under <code className="font-mono">/var</code>{" "}
+                on this container, so there is nothing here to lose.
+              </p>
+            )
+          ) : (
+            <p className="text-xs text-[var(--text-secondary)]">
+              Not checked yet.
+            </p>
+          )}
+        </section>
+
        {/* 2. The apt replay. */}
        <Section
          title={`Reinstalled from the new base's repos (${aptDelta.length})`}
@@ -216,7 +316,12 @@ export default function MigrateContainerModal({
        >
          {aptDelta.length === 0 ? (
            <p className="text-xs text-[var(--text-secondary)]">
-              No extra apt packages were found on this container.
+              {/* "None found" and "not looked yet" are different sentences.
+                  Printing the first while the probe is still running is how a
+                  user ends up believing a delta was empty when it was unread. */}
+              {probeSettled
+                ? "No extra apt packages were found on this container."
+                : "Still checking which apt packages this container added."}
            </p>
          ) : (
            <BulletList items={aptDelta} mono />
@@ -232,10 +337,16 @@ export default function MigrateContainerModal({
          <p className="text-xs text-[var(--text-secondary)]">{REPLAY_COST}</p>
        </Section>

-        {/* 3. Verbatim copies — usually nothing, so usually not shown at all. */}
-        {verbatim.length > 0 && (
+        {/* 3. Verbatim copies — usually nothing once the probe has settled, so
+            usually not shown at all. Shown while it has not, because a hidden
+            section reads as "there is nothing here". */}
+        {(verbatim.length > 0 || !probeSettled) && (
          <Section
-            title={`Copied across as-is (${verbatim.length})`}
+            title={
+              probeSettled
+                ? `Copied across as-is (${verbatim.length})`
+                : "Copied across as-is"
+            }
            control={
              <Toggle
                label="Copy user-authored files across as-is"
@@ -251,7 +362,13 @@ export default function MigrateContainerModal({
              <code className="font-mono">/workspace</code> that belongs to no
              package, so it cannot be reinstalled from a repository.
            </p>
-            <BulletList items={verbatim} mono />
+            {probeSettled ? (
+              <BulletList items={verbatim} mono />
+            ) : (
+              <p className="text-xs text-[var(--text-secondary)]">
+                Still checking what is there.
+              </p>
+            )}
          </Section>
        )}

@@ -0,0 +1,74 @@
+import type { MigrationState } from "../../lib/types";
+import Button from "../ui/Button";
+import StatusIndicator from "../ui/StatusIndicator";
+import { ROLLBACK_SCOPE, formatSnapshotDate } from "./migrationCopy";
+
+interface Props {
+  record: MigrationState;
+  /** Disables the action row while resume/rollback is in flight. */
+  busy?: boolean;
+  onResume: () => void;
+  onRollback: () => void;
+}
+
+/**
+ * A migration that got past the container swap and stopped there.
+ *
+ * This is deliberately **not** [`MigrationReportCard`]. That card's primary
+ * action is Keep, which means "accept this and drop the rollback image" — and
+ * on an unfinished migration `triple-c-snapshot-<id>:latest` still points at
+ * the *old* lineage, so Keep would delete the only way back while leaving a
+ * container the app can no longer reason about. The backend's own message on
+ * this record says to resume; offering Keep beside it was the UI contradicting
+ * the backend and losing.
+ *
+ * So the two actions here are Resume and Roll back, and nothing else. It is
+ * shown ahead of any report, whether the record was found on mount or produced
+ * by a run that just failed — those are the same situation.
+ */
+export default function MigrationInterruptedCard({
+  record,
+  busy = false,
+  onResume,
+  onRollback,
+}: Props) {
+  const started = formatSnapshotDate(record.started_at);
+
+  return (
+    <div className="space-y-2">
+      <StatusIndicator
+        tone="error"
+        label="The container base update did not finish"
+        className="text-[13px] font-semibold"
+      />
+
+      <p className="text-xs text-[var(--text-secondary)] leading-snug">
+        This container is part-way onto the new base: it was replaced, but the
+        result was never saved
+        {started ? `. The update started ${started}` : ""}. Resuming replays the
+        same plan it was given — it is the only way to finish it.
+      </p>
+
+      {record.report?.message && (
+        <p className="text-xs text-[var(--text-secondary)] leading-snug select-text">
+          {record.report.message}
+        </p>
+      )}
+
+      <p className="text-xs text-[var(--text-secondary)] leading-snug">
+        {ROLLBACK_SCOPE}
+      </p>
+
+      <div className="flex flex-wrap gap-1.5 pt-0.5">
+        <Button size="md" variant="primary" disabled={busy} onClick={onResume}>
+          Resume update
+        </Button>
+        {record.rollback_image && (
+          <Button size="md" variant="danger" disabled={busy} onClick={onRollback}>
+            Roll back
+          </Button>
+        )}
+      </div>
+    </div>
+  );
+}
@@ -18,6 +18,7 @@ const FRESH: ContainerStaleness = {
  apt_delta: [],
  npm_global_delta: [],
  verbatim_paths: [],
+  unpreserved_data: [],
  outdated_package_count: 0,
  probe_error: null,
 };
@@ -40,6 +41,7 @@ function migration(overrides: Partial<ContainerMigration> = {}): ContainerMigrat
  return {
    staleness: null,
    probing: false,
+    probeSettled: true,
    running: false,
    recovered: false,
    interrupted: null,
@@ -51,7 +53,7 @@ function migration(overrides: Partial<ContainerMigration> = {}): ContainerMigrat
    resume: vi.fn(async () => {}),
    keep: vi.fn(async () => {}),
    rollback: vi.fn(async () => {}),
-    dismiss: vi.fn(),
+    dismiss: vi.fn(async () => {}),
    refresh: vi.fn(async () => {}),
    ...overrides,
  };
@@ -173,7 +175,7 @@ describe("ContainerMigrationBanner", () => {
    });
    renderBanner(m);
    expect(
-      screen.getByText(/A container base update was interrupted/i),
+      screen.getByText(/The container base update did not finish/i),
    ).toBeInTheDocument();
    expect(screen.getByText(/part-way onto the new base/i)).toBeInTheDocument();
    // The plain "Update container base…" call to action must not be what is
@@ -207,6 +209,36 @@ describe("ContainerMigrationBanner", () => {
    expect(screen.getByRole("button", { name: "Resume update" })).toBeInTheDocument();
  });

+  it("distinguishes an unsettled probe from a running container", () => {
+    // "Stop the container to update its base" on a container that is already
+    // stopped — because the probe has not landed — reads as a bug.
+    renderBanner(
+      migration({ staleness: STALE, probing: true, probeSettled: false }),
+      false,
+    );
+    expect(
+      screen.getByText(/Checking what this container has/i),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByText(/Stop the container to update its base/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("names the /var data that updating would destroy", () => {
+    renderBanner(
+      migration({
+        staleness: {
+          ...STALE,
+          unpreserved_data: [
+            { path: "/var/lib/postgresql", bytes: 41_000_000, file_count: 912 },
+          ],
+        },
+      }),
+    );
+    expect(screen.getByText("/var/lib/postgresql")).toBeInTheDocument();
+    expect(screen.getByText(/back this up before updating/i)).toBeInTheDocument();
+  });
+
  describe("the report", () => {
    const CLEAN: MigrationReport = {
      phase: "succeeded",
@@ -295,6 +327,39 @@ describe("ContainerMigrationBanner", () => {
      expect(screen.getByRole("button", { name: "Dismiss" })).toBeInTheDocument();
    });

+    it("never offers Keep over a container that is still mid-swap", () => {
+      // The failing-commit path returns a report *and* leaves the record
+      // interrupted. Keep would untag the rollback image and delete the record
+      // while `triple-c-snapshot-<id>:latest` still points at the old lineage —
+      // and the backend's own message on that record says to resume.
+      const m = migration({
+        staleness: STALE,
+        interrupted: {
+          phase: "interrupted",
+          from_image_id: "sha256:aaa",
+          to_base_id: "sha256:bbb",
+          started_at: "2026-08-09T10:00:00Z",
+          report: null,
+          rollback_image: "triple-c-snapshot-p1:pre-migration-20260809-100000",
+          staging_path: null,
+          options: { replay_packages: true, copy_paths: true, keep_rollback: true },
+          plan: null,
+        },
+        report: {
+          ...CLEAN,
+          phase: "failed",
+          message: "saving it failed. Resume it, or roll back.",
+        },
+      });
+      renderBanner(m);
+      expect(screen.queryByRole("button", { name: "Keep" })).not.toBeInTheDocument();
+      expect(
+        screen.getByRole("button", { name: "Resume update" }),
+      ).toBeInTheDocument();
+      fireEvent.click(screen.getByRole("button", { name: "Roll back" }));
+      expect(m.rollback).toHaveBeenCalledTimes(1);
+    });
+
    it("does not describe rollback as a time machine", () => {
      renderBanner(migration({ staleness: FRESH, report: CLEAN }));
      expect(
@@ -2,7 +2,8 @@ import type { ContainerMigration } from "../../../hooks/useContainerMigration";
 import Button from "../../ui/Button";
 import StatusIndicator from "../../ui/StatusIndicator";
 import MigrationReportCard from "../MigrationReportCard";
-import { ROLLBACK_SCOPE, formatSnapshotDate, joinFeatures } from "../migrationCopy";
+import MigrationInterruptedCard from "../MigrationInterruptedCard";
+import { formatSnapshotDate, joinFeatures } from "../migrationCopy";

 interface Props {
  migration: ContainerMigration;
@@ -31,8 +32,38 @@ export default function ContainerMigrationBanner({
  canMigrate,
  onOpen,
 }: Props) {
-  const { staleness, running, recovered, interrupted, report, phaseMessage, busy } =
-    migration;
+  const {
+    staleness,
+    probing,
+    probeSettled,
+    running,
+    recovered,
+    interrupted,
+    report,
+    phaseMessage,
+    busy,
+  } = migration;
+
+  // An unfinished migration outranks its own report. The report's action row
+  // offers Keep, and Keep on a mid-swap container drops the rollback image
+  // while `:latest` still points at the old lineage — the backend's message on
+  // the very same record says to resume. Resume is the only honest primary
+  // action here, so the report card is not rendered at all.
+  if (interrupted) {
+    return (
+      <section
+        className={`${SHELL} border-[var(--error)]/40 bg-[var(--error-muted)]`}
+        aria-label="Container base update was interrupted"
+      >
+        <MigrationInterruptedCard
+          record={interrupted}
+          busy={busy || running}
+          onResume={() => void migration.resume()}
+          onRollback={() => void migration.rollback()}
+        />
+      </section>
+    );
+  }

  // The report outranks staleness: after a run, the outcome is the news.
  if (report) {
@@ -50,7 +81,7 @@ export default function ContainerMigrationBanner({
          busy={busy}
          onKeep={() => void migration.keep()}
          onRollback={() => void migration.rollback()}
-          onDismiss={migration.dismiss}
+          onDismiss={() => void migration.dismiss()}
        />
      </section>
    );
@@ -90,53 +121,6 @@ export default function ContainerMigrationBanner({
    );
  }

-  // Nothing is driving this one. It outranks staleness because the container is
-  // sitting mid-swap, and the one thing it must never do is look like a normal
-  // out-of-date container that the user can take or leave.
-  if (interrupted) {
-    return (
-      <section
-        className={`${SHELL} border-[var(--error)]/40 bg-[var(--error-muted)]`}
-        aria-label="Container base update was interrupted"
-      >
-        <StatusIndicator
-          tone="error"
-          label="A container base update was interrupted"
-          className="text-[13px] font-semibold"
-        />
-        <p className="text-xs text-[var(--text-secondary)] leading-snug">
-          It started{" "}
-          {formatSnapshotDate(interrupted.started_at) ?? "earlier"} and the app
-          closed before it finished, so this container is part-way onto the new
-          base. Resuming replays the same plan it was given.
-        </p>
-        <p className="text-xs text-[var(--text-secondary)] leading-snug">
-          {ROLLBACK_SCOPE}
-        </p>
-        <div className="flex flex-wrap gap-1.5">
-          <Button
-            size="md"
-            variant="primary"
-            disabled={busy}
-            onClick={() => void migration.resume()}
-          >
-            Resume update
-          </Button>
-          {interrupted.rollback_image && (
-            <Button
-              size="md"
-              variant="danger"
-              disabled={busy}
-              onClick={() => void migration.rollback()}
-            >
-              Roll back
-            </Button>
-          )}
-        </div>
-      </section>
-    );
-  }
-
  if (!staleness) return null;

  // `stale` is deliberately false whenever `known` is false — an unestablished
@@ -210,9 +194,32 @@ export default function ContainerMigrationBanner({
            </p>
          )}

+          {/* An out-of-date container that also has data under /var is the one
+              case where updating can cost something, so it is said here and not
+              only behind the button. */}
+          {staleness.unpreserved_data.length > 0 && (
+            <p className="text-xs text-[var(--text-primary)] leading-snug">
+              Not carried across:{" "}
+              <span className="font-mono text-[var(--text-secondary)]">
+                {staleness.unpreserved_data.map((d) => d.path).join(", ")}
+              </span>
+              <span className="text-[var(--text-secondary)]">
+                {" "}
+                — back this up before updating.
+              </span>
+            </p>
+          )}
+
          {!canMigrate && (
            <p className="text-xs text-[var(--text-secondary)] leading-snug">
-              Stop the container to update its base.
+              {/* Distinguishing these matters: "stop the container" on a
+                  container that is already stopped, because the probe has not
+                  landed, reads as a bug. */}
+              {!probeSettled
+                ? probing
+                  ? "Checking what this container has that the current base does not…"
+                  : "That check did not complete, so what would be carried across is not known. Updating stays disabled until it does — try again once the container can be inspected."
+                : "Stop the container to update its base."}
            </p>
          )}
        </div>
@@ -93,11 +93,17 @@ export default function ProjectHome({ projectId, active }: Props) {
  // Reset does — with the extra condition that there is a container to migrate.
  // An interrupted migration is excluded too: its action is Resume, on the
  // Overview banner, not a fresh pre-flight.
+  //
+  // `probeSettled` is the fourth condition and it is not cosmetic. The probe
+  // takes ~6 s, and until it lands every delta the pre-flight renders reads as
+  // empty — so the dialog would tell the user there was nothing to copy while
+  // the backend was told not to copy anything.
  const canMigrate =
    isStopped &&
    !actions.busy &&
    !migration.running &&
    !migration.interrupted &&
+    migration.probeSettled &&
    !!project.container_id;

  return (
@@ -24,8 +24,23 @@ export const KEPT_AUTOMATICALLY = [
 export const KEPT_WHY =
  "/home/claude and ~/.claude are Docker volumes. They detach from the old container and re-attach to the new one unchanged.";

+/**
+ * The honest list of what the writable layer holds, because the modal's own
+ * sections name more than one thing and copy that says "the only thing" while
+ * the section below it offers to copy files is copy the user cannot trust.
+ */
 export const LOST_WITHOUT_REPLAY =
-  "What a new base does not carry over is the root-level system packages you installed with apt. Those are the only thing this update has to put back.";
+  "What a new base does not carry over is what lives in the container itself: system packages you installed with apt, global npm packages, and files under /usr/local, /opt, /srv or loose in /workspace. This update puts those back.";
+
+/**
+ * The exception, and it is not a small one — so it gets its own line wherever
+ * the update is offered. Reinstalling `postgresql` gets the package back and an
+ * empty cluster with it; the ordinary Reset-free recreate keeps /var because it
+ * builds from the project's own saved image, so this is the one way in which
+ * updating the base is more destructive than leaving it alone.
+ */
+export const DATA_NOT_CARRIED =
+  "Data written under /var is not carried across and reinstalling the package does not bring it back — a database in /var/lib, a site in /var/www. Back it up from inside the container before you update.";

 /**
 * Said plainly everywhere rollback is offered. Rollback is not a time machine:
@@ -45,6 +60,18 @@ export const MID_RUN_SAFETY =
 export const REPLAY_COST =
  "Needs network access and usually takes 1–2 minutes.";

+/** `41.0 MB`. Sizes here are informational, so the friendlier decimal unit. */
+export function formatDataSize(bytes: number): string {
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1000 && unit < units.length - 1) {
+    value /= 1000;
+    unit += 1;
+  }
+  return unit === 0 ? `${bytes} B` : `${value.toFixed(1)} ${units[unit]}`;
+}
+
 /** `1 Mar` — short enough to sit inline in the banner sentence. */
 export function formatSnapshotDate(iso: string | null): string | null {
  if (!iso) return null;