Description

Select the type:

• Feature
• Bug fix
• Code refactor
• Documentation

Updater hardening in three parts: failure-path robustness fixes from the dev review, apt privilege locked behind a root-owned wrapper, and self-healing for broken component directories (both RF50 field bugs).

Failure-path hardening

• Component hooks run with a 600s budget and a liveness ping that re-emits progress every 60s, so a long uv sync can neither abort the batch nor false-trip the UI's busy watchdog.
• git reset/checkout timeouts raised 10s to 60s: they back rollback, boot revert, and recover, where a SIGTERM mid-checkout on a slow SD card is worst-case.
• In-flight marker cleared on early returns (insecure remote, failed pre-update reset), removing spurious boot-revert logs.
• Lock-held rejections emit the D-Bus error signal so the UI toasts instead of silently dismissing the overlay; malformed status JSON now shows a toast; stale confirm popups are deleted; OneShotTokenError message is no longer lost.

Scoped privilege

• New root-owned /usr/local/sbin/bs-apt-helper is the single apt/dpkg sudoers grant: fixed argv per verb plus package-name validation, closing the old install --only-upgrade -y * option-injection window. It owns the dpkg-lock/conffile options and DEBIAN_FRONTEND (previously stripped by sudo env_reset).
• executor._apt_cmd routes every apt operation through the wrapper; install-updater.sh deploys it before the daemon (re)starts, so there is no fallback path.
• git safe.directory scoped to component repositories instead of '*'.

Component self-heal

• A component directory without .git (tarball-installed ~/Spoolman) no longer aborts the whole update as a network error; it is excluded per-component and the batch proceeds.
• For install_if_missing components the directory is renamed to <name>.pre-updater-<timestamp> (reversible, old config preserved) and re-provisioned in the same run.