From e080f53fb5755fe4702241cde87f85c4bca940d6 Mon Sep 17 00:00:00 2001
From: Eli Bosley <eli@bosley.dev>
Date: Wed, 17 Jun 2026 19:15:45 -0400
Subject: [PATCH 1/8] fix(web): show OS update confirm when key state has an
 error

The update confirmation body and footer were gated on `!stateDataError`,
which suppressed the entire confirm UI whenever the server had any state
error (e.g. an EGUID key/GUID mismatch). A standalone OS update on such a
server rendered a blank "install update" modal with no confirm button,
even though OS update eligibility is independent of key validity.

Swap the guard to the existing `showPostInstallKeyError` computed, which
is only true after a key install left the server in an error state. This
preserves the original intent (prioritize the key error in the combined
key-install + update flow) without blocking standalone updates.

Add tests covering the standalone-update-with-state-error case and the
combined key-install error case.
---
 .../components/CallbackFeedback.test.ts       | 55 +++++++++++++++++++
 .../UserProfile/CallbackFeedback.vue          |  4 +-
 2 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/web/__test__/components/CallbackFeedback.test.ts b/web/__test__/components/CallbackFeedback.test.ts
index abdb0e8a64..2b4c5f0be9 100644
--- a/web/__test__/components/CallbackFeedback.test.ts
+++ b/web/__test__/components/CallbackFeedback.test.ts
@@ -310,6 +310,61 @@ describe('CallbackFeedback.vue', () => {
     expect(wrapper.find('.modal').attributes('data-success')).toBe('false');
   });
 
+  describe('OS update confirmation', () => {
+    it('renders the update confirmation when a standalone update lands on a server with a state error', () => {
+      updateOsStatus.value = 'confirming';
+      callbackUpdateRelease.value = { name: 'Unraid 7.3.1' };
+      osVersion.value = '7.3.0';
+      // Server is in an error state (e.g. EGUID GUID mismatch) but no key was installed
+      stateDataError.value = true;
+      keyInstallStatus.value = 'ready';
+
+      const wrapper = mountComponent();
+
+      expect(wrapper.find('h1').text()).toBe('Update Unraid OS confirmation required');
+      expect(wrapper.text()).toContain('Current Version: Unraid 7.3.0');
+      expect(wrapper.text()).toContain('New Version: Unraid 7.3.1');
+      expect(wrapper.text()).toContain('Confirm and start update');
+    });
+
+    it('confirms the update when the confirm button is clicked', async () => {
+      updateOsStatus.value = 'confirming';
+      callbackUpdateRelease.value = { name: 'Unraid 7.3.1' };
+      stateDataError.value = true;
+      keyInstallStatus.value = 'ready';
+
+      const wrapper = mountComponent();
+
+      const confirmButton = wrapper
+        .findAll('button')
+        .find((button) => button.text() === 'Confirm and start update');
+      expect(confirmButton).toBeDefined();
+      await confirmButton!.trigger('click');
+
+      expect(mockInstallOsUpdate).toHaveBeenCalledTimes(1);
+      expect(mockSetCallbackStatus).toHaveBeenCalledWith('ready');
+    });
+
+    it('suppresses the update confirmation when a key install left the server in an error state', () => {
+      updateOsStatus.value = 'confirming';
+      callbackUpdateRelease.value = { name: 'Unraid 7.3.1' };
+      osVersion.value = '7.3.0';
+      // Combined key-install + update flow where the install errored
+      callbackStatus.value = 'success';
+      keyActionType.value = 'purchase';
+      keyInstallStatus.value = 'success';
+      keyType.value = 'Pro';
+      stateDataError.value = true;
+      callbackCallsCompleted.value = true;
+
+      const wrapper = mountComponent();
+
+      expect(wrapper.text()).not.toContain('New Version: Unraid 7.3.1');
+      expect(wrapper.text()).not.toContain('Confirm and start update');
+      expect(wrapper.text()).toContain('Post Install License Key Error');
+    });
+  });
+
   it('reloads the page when the modal is dismissed after a callback action', async () => {
     const mockReload = vi.fn();
 
diff --git a/web/src/components/UserProfile/CallbackFeedback.vue b/web/src/components/UserProfile/CallbackFeedback.vue
index 47d3430866..0239ed2335 100644
--- a/web/src/components/UserProfile/CallbackFeedback.vue
+++ b/web/src/components/UserProfile/CallbackFeedback.vue
@@ -327,7 +327,7 @@ const showPostInstallKeyError = computed(() =>
         />
       </div>
 
-      <template v-if="updateOsStatus === 'confirming' && !stateDataError">
+      <template v-if="updateOsStatus === 'confirming' && !showPostInstallKeyError">
         <div class="my-4 flex flex-col gap-y-2">
           <div class="flex flex-col gap-y-1">
             <p class="text-center text-lg">
@@ -383,7 +383,7 @@ const showPostInstallKeyError = computed(() =>
           </template>
         </template>
 
-        <template v-if="updateOsStatus === 'confirming' && !stateDataError">
+        <template v-if="updateOsStatus === 'confirming' && !showPostInstallKeyError">
           <BrandButton
             variant="underline"
             :icon="XMarkIcon"

From 71cc535d649422eddb8cd9ec7bc705d3291cac88 Mon Sep 17 00:00:00 2001
From: Eli Bosley <eli@bosley.dev>
Date: Wed, 17 Jun 2026 20:03:38 -0400
Subject: [PATCH 2/8] fix(web): allow OS update/reboot UI when key state has an
 error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OS update eligibility and a pending reboot are independent of registration
/key validity (they key off the update-entitlement window, not key state),
but two more spots gated this UI on `!stateDataError`:

- HeaderOsVersion: the pending-reboot badge sat below the stateDataError
  early-return, so an EGUID server that had already installed an update
  showed no "reboot to apply" prompt. Surface rebootTypeText before the
  stateDataError gate.
- DropdownContent: the update button (check-for-update / update-available /
  reboot-required) was hidden whenever the server had a state error. Show
  it regardless — users may update without a valid key.

Add regression tests for both.
---
 web/__test__/components/DropdownContent.test.ts | 17 +++++++++++++++++
 web/__test__/components/HeaderOsVersion.test.ts | 12 ++++++++++++
 .../components/HeaderOsVersion.standalone.vue   | 12 +++++++-----
 .../components/UserProfile/DropdownContent.vue  |  5 +++--
 4 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/web/__test__/components/DropdownContent.test.ts b/web/__test__/components/DropdownContent.test.ts
index e2be458c29..0f6ff0a428 100644
--- a/web/__test__/components/DropdownContent.test.ts
+++ b/web/__test__/components/DropdownContent.test.ts
@@ -129,6 +129,23 @@ describe('DropdownContent', () => {
     updateOsStoreRefs.availableWithRenewal!.value = null;
   });
 
+  it('shows the OS update button even when the server has a state error', () => {
+    // e.g. EGUID key/GUID mismatch: updating is still allowed.
+    serverStoreRefs.stateDataError!.value = { message: 'Registration key mismatch' };
+
+    const wrapper = shallowMount(DropdownContent, {
+      global: {
+        plugins: [createTestI18n()],
+      },
+    });
+
+    const items = wrapper
+      .findAllComponents({ name: 'DropdownItem' })
+      .map((itemWrapper) => itemWrapper.props('item') as UserProfileLink);
+
+    expect(items.some((item) => item?.text === 'Check for Update')).toBe(true);
+  });
+
   it('does not show manage-license helper text when sign-in is the only action', () => {
     const wrapper = shallowMount(DropdownContent, {
       global: {
diff --git a/web/__test__/components/HeaderOsVersion.test.ts b/web/__test__/components/HeaderOsVersion.test.ts
index e8051fb950..d8bad512a0 100644
--- a/web/__test__/components/HeaderOsVersion.test.ts
+++ b/web/__test__/components/HeaderOsVersion.test.ts
@@ -144,6 +144,18 @@ describe('HeaderOsVersion', () => {
     expect(findUpdateStatusComponent()).toBeNull();
   });
 
+  it('renders the pending-reboot badge even when stateDataError is present', async () => {
+    // EGUID (registration/key mismatch) produces a state error, but a pending
+    // reboot applies an already-installed update and must still be surfaced.
+    serverStore.state = 'EGUID';
+    serverStore.rebootType = 'update';
+
+    await nextTick();
+
+    expect(wrapper.find('[title="Reboot Required for Update"]').exists()).toBe(true);
+    expect(wrapper.text()).toContain('Reboot Required for Update');
+  });
+
   it('removes logo class from logo wrapper on mount', async () => {
     // Create a mock logo element
     const logoElement = document.createElement('div');
diff --git a/web/src/components/HeaderOsVersion.standalone.vue b/web/src/components/HeaderOsVersion.standalone.vue
index fa2bf7ad4c..93f2534820 100644
--- a/web/src/components/HeaderOsVersion.standalone.vue
+++ b/web/src/components/HeaderOsVersion.standalone.vue
@@ -120,11 +120,8 @@ const handleUpdateStatusClick = () => {
 };
 
 const updateOsStatus = computed(() => {
-  if (stateDataError.value) {
-    // only allowed to update when server is does not have a state error
-    return null;
-  }
-
+  // A pending reboot applies an already-installed update/downgrade — surface it
+  // regardless of registration/key state, which does not gate applying it.
   if (rebootTypeText.value) {
     return {
       badge: {
@@ -136,6 +133,11 @@ const updateOsStatus = computed(() => {
     };
   }
 
+  if (stateDataError.value) {
+    // only allowed to update when server is does not have a state error
+    return null;
+  }
+
   if (availableWithRenewal.value || available.value) {
     return {
       badge: {
diff --git a/web/src/components/UserProfile/DropdownContent.vue b/web/src/components/UserProfile/DropdownContent.vue
index dc0572c941..55bdf88995 100644
--- a/web/src/components/UserProfile/DropdownContent.vue
+++ b/web/src/components/UserProfile/DropdownContent.vue
@@ -186,8 +186,9 @@ const links = computed((): UserProfileLink[] => {
         ]
       : []),
 
-    // ensure we only show the update button when we don't have an error
-    ...(!stateDataError.value ? [...updateOsButton.value] : []),
+    // OS update/reboot availability is independent of registration/key state,
+    // so surface the update button even when the server has a state error.
+    ...updateOsButton.value,
 
     // connect plugin links
     ...(registered.value && connectPluginInstalled.value

From 2ff247569d572443a60f99bd11f8ffcbb1fd4594 Mon Sep 17 00:00:00 2001
From: Eli Bosley <eli@bosley.dev>
Date: Wed, 17 Jun 2026 20:17:37 -0400
Subject: [PATCH 3/8] fix(web): hide dropdown update button when update
 entitlement expired

Distinguish registration/key-state errors (which should NOT gate updates)
from an expired update entitlement (which SHOULD). The user-profile dropdown
now omits the check-for-update / update-available button when
regUpdatesExpired is true, leaving the renewal/eligibility link to stand in
for it. A pending reboot still surfaces, since it applies an already-installed
update.
---
 .../components/DropdownContent.test.ts        | 35 +++++++++++++++++++
 .../UserProfile/DropdownContent.vue           | 10 ++++--
 2 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/web/__test__/components/DropdownContent.test.ts b/web/__test__/components/DropdownContent.test.ts
index 0f6ff0a428..91c1dcaf21 100644
--- a/web/__test__/components/DropdownContent.test.ts
+++ b/web/__test__/components/DropdownContent.test.ts
@@ -146,6 +146,41 @@ describe('DropdownContent', () => {
     expect(items.some((item) => item?.text === 'Check for Update')).toBe(true);
   });
 
+  it('hides the OS update button when update entitlement has expired', () => {
+    serverStoreRefs.regUpdatesExpired!.value = true;
+
+    const wrapper = shallowMount(DropdownContent, {
+      global: {
+        plugins: [createTestI18n()],
+      },
+    });
+
+    const items = wrapper
+      .findAllComponents({ name: 'DropdownItem' })
+      .map((itemWrapper) => itemWrapper.props('item') as UserProfileLink);
+
+    expect(items.some((item) => item?.text === 'Check for Update')).toBe(false);
+    // the renewal/eligibility link stands in for it
+    expect(items.some((item) => item?.text === 'OS Update Eligibility Expired')).toBe(true);
+  });
+
+  it('still shows the reboot button when entitlement has expired but a reboot is pending', () => {
+    serverStoreRefs.regUpdatesExpired!.value = true;
+    serverStoreRefs.rebootType!.value = 'update';
+
+    const wrapper = shallowMount(DropdownContent, {
+      global: {
+        plugins: [createTestI18n()],
+      },
+    });
+
+    const items = wrapper
+      .findAllComponents({ name: 'DropdownItem' })
+      .map((itemWrapper) => itemWrapper.props('item') as UserProfileLink);
+
+    expect(items.some((item) => item?.text === 'Reboot Required for Update')).toBe(true);
+  });
+
   it('does not show manage-license helper text when sign-in is the only action', () => {
     const wrapper = shallowMount(DropdownContent, {
       global: {
diff --git a/web/src/components/UserProfile/DropdownContent.vue b/web/src/components/UserProfile/DropdownContent.vue
index 55bdf88995..9b680be8e5 100644
--- a/web/src/components/UserProfile/DropdownContent.vue
+++ b/web/src/components/UserProfile/DropdownContent.vue
@@ -165,6 +165,12 @@ const updateOsButton = computed((): UserProfileLink[] => {
     return btns;
   }
 
+  // Update entitlement has lapsed: the renewal/eligibility link stands in for
+  // the update button (a pending reboot above still applies an installed update).
+  if (regUpdatesExpired.value) {
+    return btns;
+  }
+
   if (osUpdateAvailable.value) {
     btns.push(updateOsResponseModalOpenButton.value);
   } else {
@@ -186,8 +192,8 @@ const links = computed((): UserProfileLink[] => {
         ]
       : []),
 
-    // OS update/reboot availability is independent of registration/key state,
-    // so surface the update button even when the server has a state error.
+    // Surface the update button regardless of registration/key state errors;
+    // updateOsButton itself omits it when update entitlement has expired.
     ...updateOsButton.value,
 
     // connect plugin links

From a440c83dc97058ec4af9771291027db06e8585cd Mon Sep 17 00:00:00 2001
From: Eli Bosley <eli@bosley.dev>
Date: Wed, 17 Jun 2026 22:10:39 -0400
Subject: [PATCH 4/8] refactor(web): centralize OS update/reboot gating in
 useOsUpdateStatus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce a single source of truth for whether the server can check for /
install an OS update and whether a reboot is pending, so the key-vs-
entitlement rule lives in one place instead of being re-derived (and
drifting) per component.

The composable names the two gating concepts explicitly:
- entitlementExpired (regUpdatesExpired) — DOES gate the update affordance
- blockedByKeyState (stateDataError) — informational only, never gates

Migrate the three components that previously re-derived this inline:
- HeaderOsVersion: surface the update-available badge regardless of key
  state (consistent with the dropdown); reboot still shown first.
- DropdownContent: read rebootRequired/entitlementExpired from the seam.
- UpdateOs/Status: read rebootRequired/updateAvailable/entitlementExpired
  from the seam.

Pure-display components (CheckUpdateResponseModal, Registration/* expiration,
UpdateIneligible) consume availability/entitlement getters and never gate on
key state, so they're left untouched.

Add a unit test for the composable and update component tests.
---
 .../components/HeaderOsVersion.test.ts        |  11 +-
 .../composables/useOsUpdateStatus.test.ts     | 126 ++++++++++++++++++
 .../components/HeaderOsVersion.standalone.vue |  16 +--
 web/src/components/UpdateOs/Status.vue        |  27 ++--
 .../UserProfile/DropdownContent.vue           |  25 ++--
 web/src/composables/useOsUpdateStatus.ts      |  59 ++++++++
 6 files changed, 222 insertions(+), 42 deletions(-)
 create mode 100644 web/__test__/composables/useOsUpdateStatus.test.ts
 create mode 100644 web/src/composables/useOsUpdateStatus.ts

diff --git a/web/__test__/components/HeaderOsVersion.test.ts b/web/__test__/components/HeaderOsVersion.test.ts
index d8bad512a0..716987d198 100644
--- a/web/__test__/components/HeaderOsVersion.test.ts
+++ b/web/__test__/components/HeaderOsVersion.test.ts
@@ -77,11 +77,6 @@ describe('HeaderOsVersion', () => {
   let serverStore: ReturnType<typeof useServerStore>;
   let errorsStore: ReturnType<typeof useErrorsStore>;
 
-  const findUpdateStatusComponent = () => {
-    const statusElement = wrapper.find('a.group:not([title*="release notes"]), button.group');
-    return statusElement.exists() ? statusElement : null;
-  };
-
   beforeEach(() => {
     testingPinia = createTestingPinia({ createSpy: vi.fn });
     setActivePinia(testingPinia);
@@ -124,7 +119,9 @@ describe('HeaderOsVersion', () => {
     expect(hasUpdateButton).toBe(false);
   });
 
-  it('does not render update status when stateDataError is present', async () => {
+  it('still renders the update-available badge when the server has a state error', async () => {
+    // A registration/key error (here surfaced as a serverState error) must not
+    // hide an available OS update — update eligibility is independent of it.
     const mockError: CustomApiError = {
       message: 'State data fetch failed',
       heading: 'Fetch Error',
@@ -141,7 +138,7 @@ describe('HeaderOsVersion', () => {
 
     await nextTick();
 
-    expect(findUpdateStatusComponent()).toBeNull();
+    expect(wrapper.find('[title="Unraid OS 6.13.0 Update Available"]').exists()).toBe(true);
   });
 
   it('renders the pending-reboot badge even when stateDataError is present', async () => {
diff --git a/web/__test__/composables/useOsUpdateStatus.test.ts b/web/__test__/composables/useOsUpdateStatus.test.ts
new file mode 100644
index 0000000000..bb1a5226b1
--- /dev/null
+++ b/web/__test__/composables/useOsUpdateStatus.test.ts
@@ -0,0 +1,126 @@
+import { createPinia, setActivePinia } from 'pinia';
+
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import type { Ref } from 'vue';
+
+import { useOsUpdateStatus } from '~/composables/useOsUpdateStatus';
+
+const { serverRefs, updateOsRefs, updateOsActionsRefs } = vi.hoisted(() => ({
+  serverRefs: {
+    regUpdatesExpired: null as Ref<boolean> | null,
+    stateDataError: null as Ref<{ message: string } | undefined> | null,
+    rebootType: null as Ref<string> | null,
+    rebootVersion: null as Ref<string | undefined> | null,
+  },
+  updateOsRefs: {
+    available: null as Ref<string | undefined> | null,
+    availableWithRenewal: null as Ref<string | undefined> | null,
+    availableRequiresAuth: null as Ref<boolean> | null,
+  },
+  updateOsActionsRefs: {
+    rebootTypeText: null as Ref<string> | null,
+  },
+}));
+
+vi.mock('~/store/server', async () => {
+  const { ref } = await import('vue');
+  const { defineStore } = await import('pinia');
+  serverRefs.regUpdatesExpired = ref(false);
+  serverRefs.stateDataError = ref(undefined);
+  serverRefs.rebootType = ref('');
+  serverRefs.rebootVersion = ref(undefined);
+  const useServerStore = defineStore('serverMockForOsUpdateStatus', () => ({
+    regUpdatesExpired: serverRefs.regUpdatesExpired!,
+    stateDataError: serverRefs.stateDataError!,
+    rebootType: serverRefs.rebootType!,
+    rebootVersion: serverRefs.rebootVersion!,
+  }));
+  return { useServerStore };
+});
+
+vi.mock('~/store/updateOs', async () => {
+  const { ref } = await import('vue');
+  const { defineStore } = await import('pinia');
+  updateOsRefs.available = ref(undefined);
+  updateOsRefs.availableWithRenewal = ref(undefined);
+  updateOsRefs.availableRequiresAuth = ref(false);
+  const useUpdateOsStore = defineStore('updateOsMockForOsUpdateStatus', () => ({
+    available: updateOsRefs.available!,
+    availableWithRenewal: updateOsRefs.availableWithRenewal!,
+    availableRequiresAuth: updateOsRefs.availableRequiresAuth!,
+  }));
+  return { useUpdateOsStore };
+});
+
+vi.mock('~/store/updateOsActions', async () => {
+  const { ref } = await import('vue');
+  const { defineStore } = await import('pinia');
+  updateOsActionsRefs.rebootTypeText = ref('');
+  const useUpdateOsActionsStore = defineStore('updateOsActionsMockForOsUpdateStatus', () => ({
+    rebootTypeText: updateOsActionsRefs.rebootTypeText!,
+  }));
+  return { useUpdateOsActionsStore };
+});
+
+describe('useOsUpdateStatus', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia());
+    serverRefs.regUpdatesExpired!.value = false;
+    serverRefs.stateDataError!.value = undefined;
+    serverRefs.rebootType!.value = '';
+    serverRefs.rebootVersion!.value = undefined;
+    updateOsRefs.available!.value = undefined;
+    updateOsRefs.availableWithRenewal!.value = undefined;
+    updateOsRefs.availableRequiresAuth!.value = false;
+    updateOsActionsRefs.rebootTypeText!.value = '';
+  });
+
+  it('keeps key-state errors separate from update eligibility', () => {
+    serverRefs.stateDataError!.value = { message: 'Registration key mismatch' };
+
+    const status = useOsUpdateStatus();
+
+    // A key error is informational and must not imply the entitlement expired.
+    expect(status.blockedByKeyState.value).toBe(true);
+    expect(status.entitlementExpired.value).toBe(false);
+  });
+
+  it('flags entitlement expiration independently of key state', () => {
+    serverRefs.regUpdatesExpired!.value = true;
+
+    const status = useOsUpdateStatus();
+
+    expect(status.entitlementExpired.value).toBe(true);
+    expect(status.blockedByKeyState.value).toBe(false);
+  });
+
+  it('treats update and downgrade reboots as a required reboot', () => {
+    const status = useOsUpdateStatus();
+
+    serverRefs.rebootType!.value = 'update';
+    expect(status.rebootRequired.value).toBe(true);
+
+    serverRefs.rebootType!.value = 'downgrade';
+    expect(status.rebootRequired.value).toBe(true);
+
+    serverRefs.rebootType!.value = 'thirdPartyDriversDownloading';
+    expect(status.rebootRequired.value).toBe(false);
+
+    serverRefs.rebootType!.value = '';
+    expect(status.rebootRequired.value).toBe(false);
+  });
+
+  it('reports an available update from either a direct or renewal release', () => {
+    const status = useOsUpdateStatus();
+
+    expect(status.updateAvailable.value).toBe(false);
+
+    updateOsRefs.available!.value = '7.3.1';
+    expect(status.updateAvailable.value).toBe(true);
+
+    updateOsRefs.available!.value = undefined;
+    updateOsRefs.availableWithRenewal!.value = '7.3.1';
+    expect(status.updateAvailable.value).toBe(true);
+  });
+});
diff --git a/web/src/components/HeaderOsVersion.standalone.vue b/web/src/components/HeaderOsVersion.standalone.vue
index 93f2534820..c994060d02 100644
--- a/web/src/components/HeaderOsVersion.standalone.vue
+++ b/web/src/components/HeaderOsVersion.standalone.vue
@@ -26,9 +26,9 @@ import { getReleaseNotesUrl, WEBGUI_TOOLS_DOWNGRADE, WEBGUI_TOOLS_UPDATE } from
 import ChangelogModal from '~/components/UpdateOs/ChangelogModal.vue';
 import { INFO_VERSIONS_QUERY } from '~/components/UserProfile/versions.query';
 import { useClipboardWithToast } from '~/composables/useClipboardWithToast';
+import { useOsUpdateStatus } from '~/composables/useOsUpdateStatus';
 import { useServerStore } from '~/store/server';
 import { useUpdateOsStore } from '~/store/updateOs';
-import { useUpdateOsActionsStore } from '~/store/updateOsActions';
 
 const { t } = useI18n();
 const { copyWithNotification } = useClipboardWithToast();
@@ -44,11 +44,10 @@ onMounted(() => {
 // Initialize all stores - they're needed for the UI
 const serverStore = useServerStore();
 const updateOsStore = useUpdateOsStore();
-const updateOsActionsStore = useUpdateOsActionsStore();
 
-const { osVersion, rebootType, stateDataError } = storeToRefs(serverStore);
-const { available, availableWithRenewal } = storeToRefs(updateOsStore);
-const { rebootTypeText } = storeToRefs(updateOsActionsStore);
+const { osVersion } = storeToRefs(serverStore);
+const { available, availableWithRenewal, updateAvailable, rebootType, rebootTypeText } =
+  useOsUpdateStatus();
 
 // Use lazy query and only load when dropdown is opened
 const { load: loadVersions, result: versionsResult } = useLazyQuery(INFO_VERSIONS_QUERY);
@@ -133,12 +132,7 @@ const updateOsStatus = computed(() => {
     };
   }
 
-  if (stateDataError.value) {
-    // only allowed to update when server is does not have a state error
-    return null;
-  }
-
-  if (availableWithRenewal.value || available.value) {
+  if (updateAvailable.value) {
     return {
       badge: {
         color: 'orange',
diff --git a/web/src/components/UpdateOs/Status.vue b/web/src/components/UpdateOs/Status.vue
index f148099524..c8eb4d3d1d 100644
--- a/web/src/components/UpdateOs/Status.vue
+++ b/web/src/components/UpdateOs/Status.vue
@@ -16,6 +16,7 @@ import { Badge, BrandLoading, Button } from '@unraid/ui';
 import { WEBGUI_TOOLS_REGISTRATION } from '~/helpers/urls';
 
 import useDateTimeHelper from '~/composables/dateTime';
+import { useOsUpdateStatus } from '~/composables/useOsUpdateStatus';
 import { useAccountStore } from '~/store/account';
 import { useServerStore } from '~/store/server';
 import { useUpdateOsStore } from '~/store/updateOs';
@@ -42,12 +43,18 @@ const updateOsActionsStore = useUpdateOsActionsStore();
 
 const LoadingIcon = () => h(BrandLoading, { variant: 'white', style: 'width: 16px; height: 16px;' });
 
-const { dateTimeFormat, osVersion, rebootType, rebootVersion, regExp, regUpdatesExpired } =
-  storeToRefs(serverStore);
-const { available, availableWithRenewal } = storeToRefs(updateOsStore);
-const { ineligibleText, rebootTypeText, status } = storeToRefs(updateOsActionsStore);
-
-const updateAvailable = computed(() => available.value || availableWithRenewal.value);
+const { dateTimeFormat, osVersion, regExp } = storeToRefs(serverStore);
+const { ineligibleText, status } = storeToRefs(updateOsActionsStore);
+const {
+  available,
+  availableWithRenewal,
+  updateAvailable,
+  entitlementExpired,
+  rebootType,
+  rebootTypeText,
+  rebootVersion,
+  rebootRequired,
+} = useOsUpdateStatus();
 
 const { outputDateTimeReadableDiff: readableDiffRegExp, outputDateTimeFormatted: formattedRegExp } =
   useDateTimeHelper(dateTimeFormat.value, t, true, regExp.value);
@@ -57,12 +64,12 @@ const regExpOutput = computed(() => {
     return undefined;
   }
   return {
-    text: regUpdatesExpired.value
+    text: entitlementExpired.value
       ? `${t('registration.updateExpirationAction.eligibleForUpdatesReleasedOnOr', [formattedRegExp.value])} ${t('registration.updateExpirationAction.extendYourLicenseToAccessThe')}`
       : t('registration.updateExpirationAction.eligibleForFreeFeatureUpdatesUntil', [
           formattedRegExp.value,
         ]),
-    title: regUpdatesExpired.value
+    title: entitlementExpired.value
       ? t('registration.updateExpirationAction.ineligibleAsOf', [readableDiffRegExp.value])
       : t('registration.updateExpirationAction.eligibleForFreeFeatureUpdatesFor', [
           readableDiffRegExp.value,
@@ -70,9 +77,7 @@ const regExpOutput = computed(() => {
   };
 });
 
-const showRebootButton = computed(
-  () => rebootType.value === 'downgrade' || rebootType.value === 'update'
-);
+const showRebootButton = rebootRequired;
 
 const checkButton = computed(() => {
   if (showRebootButton.value || props.showExternalDowngrade) {
diff --git a/web/src/components/UserProfile/DropdownContent.vue b/web/src/components/UserProfile/DropdownContent.vue
index 9b680be8e5..f4c8e7a473 100644
--- a/web/src/components/UserProfile/DropdownContent.vue
+++ b/web/src/components/UserProfile/DropdownContent.vue
@@ -29,6 +29,7 @@ import DropdownConnectStatus from '~/components/UserProfile/DropdownConnectStatu
 import DropdownError from '~/components/UserProfile/DropdownError.vue';
 import DropdownItem from '~/components/UserProfile/DropdownItem.vue';
 import Keyline from '~/components/UserProfile/Keyline.vue';
+import { useOsUpdateStatus } from '~/composables/useOsUpdateStatus';
 import { useAccountStore } from '~/store/account';
 import { useErrorsStore } from '~/store/errors';
 import { useServerStore } from '~/store/server';
@@ -45,17 +46,15 @@ const errorsStore = useErrorsStore();
 const updateOsStore = useUpdateOsStore();
 
 const { errors } = storeToRefs(errorsStore);
+const { keyActions, connectPluginInstalled, registered, stateData, stateDataError } =
+  storeToRefs(useServerStore());
 const {
-  keyActions,
-  connectPluginInstalled,
+  available: osUpdateAvailable,
+  availableWithRenewal: osUpdateAvailableWithRenewal,
+  entitlementExpired,
   rebootType,
-  registered,
-  regUpdatesExpired,
-  stateData,
-  stateDataError,
-} = storeToRefs(useServerStore());
-const { available: osUpdateAvailable, availableWithRenewal: osUpdateAvailableWithRenewal } =
-  storeToRefs(updateOsStore);
+  rebootRequired,
+} = useOsUpdateStatus();
 
 const signInAction = computed(
   () => stateData.value.actions?.filter((act: { name: string }) => act.name === 'signIn') ?? []
@@ -159,15 +158,15 @@ const rebootDetectedButton = computed((): UserProfileLink => {
 });
 
 const updateOsButton = computed((): UserProfileLink[] => {
-  const btns = [];
-  if (rebootType.value === 'downgrade' || rebootType.value === 'update') {
+  const btns: UserProfileLink[] = [];
+  if (rebootRequired.value) {
     btns.push(rebootDetectedButton.value);
     return btns;
   }
 
   // Update entitlement has lapsed: the renewal/eligibility link stands in for
   // the update button (a pending reboot above still applies an installed update).
-  if (regUpdatesExpired.value) {
+  if (entitlementExpired.value) {
     return btns;
   }
 
@@ -181,7 +180,7 @@ const updateOsButton = computed((): UserProfileLink[] => {
 
 const links = computed((): UserProfileLink[] => {
   return [
-    ...(regUpdatesExpired.value
+    ...(entitlementExpired.value
       ? [
           {
             href: WEBGUI_TOOLS_REGISTRATION,
diff --git a/web/src/composables/useOsUpdateStatus.ts b/web/src/composables/useOsUpdateStatus.ts
new file mode 100644
index 0000000000..7960e04ac2
--- /dev/null
+++ b/web/src/composables/useOsUpdateStatus.ts
@@ -0,0 +1,59 @@
+import { computed } from 'vue';
+import { storeToRefs } from 'pinia';
+
+import { useServerStore } from '~/store/server';
+import { useUpdateOsStore } from '~/store/updateOs';
+import { useUpdateOsActionsStore } from '~/store/updateOsActions';
+
+/**
+ * Single source of truth for whether the server can check for / install an OS
+ * update, and whether a reboot is pending to apply one.
+ *
+ * The two gating concepts are intentionally separated and named here so the
+ * rule lives in one place instead of being re-derived (and drifting) in each
+ * component:
+ *
+ * - `entitlementExpired` — the license's update window has lapsed. This DOES
+ *   gate the plain "check for update" / "update available" affordance; the
+ *   renewal/eligibility path replaces it.
+ * - `blockedByKeyState` — the server has a registration/key error (e.g. an
+ *   EGUID GUID mismatch). This is INFORMATIONAL ONLY and must never gate update
+ *   or reboot UI: OS update eligibility is keyed off the entitlement window, not
+ *   key validity, and a pending reboot applies an already-installed update.
+ */
+export const useOsUpdateStatus = () => {
+  const serverStore = useServerStore();
+  const updateOsStore = useUpdateOsStore();
+  const updateOsActionsStore = useUpdateOsActionsStore();
+
+  const { regUpdatesExpired, stateDataError, rebootType, rebootVersion } = storeToRefs(serverStore);
+  const { available, availableWithRenewal, availableRequiresAuth } = storeToRefs(updateOsStore);
+  const { rebootTypeText } = storeToRefs(updateOsActionsStore);
+
+  /** License update entitlement has lapsed — gates the plain update affordance. */
+  const entitlementExpired = computed(() => regUpdatesExpired.value);
+
+  /** Registration/key error present — informational only, never gates updates. */
+  const blockedByKeyState = computed(() => Boolean(stateDataError.value));
+
+  /** A newer release exists (directly installable or via renewal). */
+  const updateAvailable = computed(() => Boolean(available.value || availableWithRenewal.value));
+
+  /** A reboot is pending to apply an already-installed update/downgrade. */
+  const rebootRequired = computed(
+    () => rebootType.value === 'update' || rebootType.value === 'downgrade'
+  );
+
+  return {
+    entitlementExpired,
+    blockedByKeyState,
+    available,
+    availableWithRenewal,
+    updateAvailable,
+    requiresAuth: availableRequiresAuth,
+    rebootType,
+    rebootTypeText,
+    rebootVersion,
+    rebootRequired,
+  };
+};

From f5e703f9eb535973a15e992077900728ea569c6e Mon Sep 17 00:00:00 2001
From: Eli Bosley <eli@bosley.dev>
Date: Wed, 17 Jun 2026 22:37:59 -0400
Subject: [PATCH 5/8] test(api): increase timeout for openid-client error
 properties test

The test hits a real network endpoint (expired-cert.badssl.com) and can
exceed the 5s default in CI. Bump to 20s for headroom.
---
 .../graph/resolvers/sso/core/oidc.service.integration.test.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/src/unraid-api/graph/resolvers/sso/core/oidc.service.integration.test.ts b/api/src/unraid-api/graph/resolvers/sso/core/oidc.service.integration.test.ts
index a867ddbd75..aac569dca5 100644
--- a/api/src/unraid-api/graph/resolvers/sso/core/oidc.service.integration.test.ts
+++ b/api/src/unraid-api/graph/resolvers/sso/core/oidc.service.integration.test.ts
@@ -487,6 +487,6 @@ describe('OidcService Integration Tests - Enhanced Logging', () => {
             expect(result.details).toHaveProperty('type');
             // Should be one of the known transport failure types
             expect(['SSL_ERROR', 'FETCH_ERROR', 'DNS_ERROR']).toContain((result.details as any).type);
-        });
+        }, 20000);
     });
 });

From ca45bca652154d214c018566ed6c3f27a1a83406 Mon Sep 17 00:00:00 2001
From: Eli Bosley <eli@bosley.dev>
Date: Wed, 17 Jun 2026 22:48:44 -0400
Subject: [PATCH 6/8] fix(web): keep state errors gating OS update confirm
 during pending key reconciliation

In a combined key-install + OS-update callback, the confirm button was gated
only on showPostInstallKeyError, which is false until callbackCallsCompleted.
During the delayed refreshServerState reconciliation window the pre-refresh
stateDataError still exposed the confirm button, letting the user start an OS
update before we knew the key install cleared the license error.

Introduce keyErrorBlocksUpdate (stateDataError + a resolved key install in this
callback) and gate the confirm UI on it so the confirmation stays suppressed
through the pending window, not just after completion.
---
 .../components/CallbackFeedback.test.ts       | 20 ++++++++
 web/auto-imports.d.ts                         | 51 +++++--------------
 web/components.d.ts                           |  5 +-
 .../UserProfile/CallbackFeedback.vue          | 24 ++++++---
 4 files changed, 55 insertions(+), 45 deletions(-)

diff --git a/web/__test__/components/CallbackFeedback.test.ts b/web/__test__/components/CallbackFeedback.test.ts
index 2b4c5f0be9..3ff0cb5447 100644
--- a/web/__test__/components/CallbackFeedback.test.ts
+++ b/web/__test__/components/CallbackFeedback.test.ts
@@ -363,6 +363,26 @@ describe('CallbackFeedback.vue', () => {
       expect(wrapper.text()).not.toContain('Confirm and start update');
       expect(wrapper.text()).toContain('Post Install License Key Error');
     });
+
+    it('suppresses the update confirmation while key-install reconciliation is still pending', () => {
+      updateOsStatus.value = 'confirming';
+      callbackUpdateRelease.value = { name: 'Unraid 7.3.1' };
+      osVersion.value = '7.3.0';
+      // Combined key-install + update flow, but the delayed refreshServerState
+      // reconciliation has not finished yet, so the pre-refresh error persists.
+      callbackStatus.value = 'success';
+      keyActionType.value = 'purchase';
+      keyInstallStatus.value = 'success';
+      keyType.value = 'Pro';
+      stateDataError.value = true;
+      refreshServerStateStatus.value = 'refreshing';
+      callbackCallsCompleted.value = false;
+
+      const wrapper = mountComponent();
+
+      expect(wrapper.text()).not.toContain('New Version: Unraid 7.3.1');
+      expect(wrapper.text()).not.toContain('Confirm and start update');
+    });
   });
 
   it('reloads the page when the modal is dismissed after a callback action', async () => {
diff --git a/web/auto-imports.d.ts b/web/auto-imports.d.ts
index 81d84147ed..e7ac9983b5 100644
--- a/web/auto-imports.d.ts
+++ b/web/auto-imports.d.ts
@@ -7,10 +7,10 @@
 export {}
 declare global {
   const avatarGroupInjectionKey: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useAvatarGroup.js')['avatarGroupInjectionKey']
-  const defineLocale: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/defineLocale.js')['defineLocale']
-  const defineShortcuts: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/defineShortcuts.js')['defineShortcuts']
-  const extendLocale: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/defineLocale.js')['extendLocale']
-  const extractShortcuts: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/defineShortcuts.js')['extractShortcuts']
+  const defineLocale: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/defineLocale').defineLocale
+  const defineShortcuts: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/defineShortcuts').defineShortcuts
+  const extendLocale: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/defineLocale').extendLocale
+  const extractShortcuts: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/defineShortcuts').extractShortcuts
   const fieldGroupInjectionKey: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useFieldGroup.js')['fieldGroupInjectionKey']
   const formBusInjectionKey: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useFormField.js')['formBusInjectionKey']
   const formFieldInjectionKey: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useFormField.js')['formFieldInjectionKey']
@@ -21,42 +21,19 @@ declare global {
   const kbdKeysMap: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useKbd.js')['kbdKeysMap']
   const localeContextInjectionKey: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useLocale.js')['localeContextInjectionKey']
   const portalTargetInjectionKey: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/usePortal.js')['portalTargetInjectionKey']
-  const useAppConfig: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/vue/composables/useAppConfig.js')['useAppConfig']
+  const useAppConfig: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/vue/composables/useAppConfig.js').useAppConfig
   const useAvatarGroup: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useAvatarGroup.js')['useAvatarGroup']
   const useComponentIcons: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useComponentIcons.js')['useComponentIcons']
-  const useContentSearch: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useContentSearch.js')['useContentSearch']
+  const useContentSearch: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useContentSearch').useContentSearch
   const useFieldGroup: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useFieldGroup.js')['useFieldGroup']
-  const useFileUpload: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useFileUpload.js')['useFileUpload']
-  const useFormField: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useFormField.js')['useFormField']
-  const useKbd: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useKbd.js')['useKbd']
+  const useFileUpload: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useFileUpload').useFileUpload
+  const useFormField: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useFormField').useFormField
+  const useKbd: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useKbd').useKbd
   const useLocale: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useLocale.js')['useLocale']
-  const useOverlay: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useOverlay.js')['useOverlay']
+  const useOverlay: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useOverlay').useOverlay
   const usePortal: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/usePortal.js')['usePortal']
-  const useResizable: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useResizable.js')['useResizable']
-  const useScrollspy: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useScrollspy.js')['useScrollspy']
-  const useToast: typeof import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useToast.js')['useToast']
-}
-// for type re-export
-declare global {
-  // @ts-ignore
-  export type { ShortcutConfig, ShortcutsConfig, ShortcutsOptions } from '../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/defineShortcuts.d'
-  import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/defineShortcuts.d')
-  // @ts-ignore
-  export type { UseComponentIconsProps } from '../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useComponentIcons.d'
-  import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useComponentIcons.d')
-  // @ts-ignore
-  export type { UseFileUploadOptions } from '../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useFileUpload.d'
-  import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useFileUpload.d')
-  // @ts-ignore
-  export type { KbdKey, KbdKeySpecific } from '../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useKbd.d'
-  import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useKbd.d')
-  // @ts-ignore
-  export type { OverlayOptions, Overlay } from '../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useOverlay.d'
-  import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useOverlay.d')
-  // @ts-ignore
-  export type { UseResizableProps, UseResizableReturn } from '../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useResizable.d'
-  import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useResizable.d')
-  // @ts-ignore
-  export type { Toast } from '../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useToast.d'
-  import('../node_modules/.pnpm/@nuxt+ui@4.0.0-alpha.0_@babel+parser@7.28.4_@netlify+blobs@9.1.2_change-case@5.4.4_db0@_655bac6707ae017754653173419b3890/node_modules/@nuxt/ui/dist/runtime/composables/useToast.d')
+  const useResizable: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useResizable').useResizable
+  const useScrollShadow: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useScrollShadow').useScrollShadow
+  const useScrollspy: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useScrollspy').useScrollspy
+  const useToast: typeof import('../node_modules/.pnpm/@nuxt+ui@4.8.2_@internationalized+date@3.12.2_@internationalized+number@3.6.7_@netlify+_803f2ca0584a2439b30afe1f069cc63b/node_modules/@nuxt/ui/dist/runtime/composables/useToast').useToast
 }
diff --git a/web/components.d.ts b/web/components.d.ts
index 8ba941e38e..8baa6df9f6 100644
--- a/web/components.d.ts
+++ b/web/components.d.ts
@@ -1,8 +1,11 @@
 /* eslint-disable */
 // @ts-nocheck
+// biome-ignore lint: disable
+// oxlint-disable
+// ------
 // Generated by unplugin-vue-components
 // Read more: https://github.com/vuejs/core/pull/3399
-// biome-ignore lint: disable
+
 export {}
 
 /* prettier-ignore */
diff --git a/web/src/components/UserProfile/CallbackFeedback.vue b/web/src/components/UserProfile/CallbackFeedback.vue
index 0239ed2335..b58acdd1df 100644
--- a/web/src/components/UserProfile/CallbackFeedback.vue
+++ b/web/src/components/UserProfile/CallbackFeedback.vue
@@ -240,13 +240,23 @@ const showUpdateEligibility = computed(() => {
   return !['Basic', 'Plus', 'Pro', 'Lifetime', 'Trial'].includes(keyType.value);
 });
 
+const keyInstallResolved = computed(
+  () => keyInstallStatus.value === 'success' || keyInstallStatus.value === 'failed'
+);
+
 const showPostInstallKeyError = computed(() =>
-  Boolean(
-    stateDataError.value &&
-      callbackCallsCompleted.value &&
-      (keyInstallStatus.value === 'success' || keyInstallStatus.value === 'failed')
-  )
+  Boolean(stateDataError.value && callbackCallsCompleted.value && keyInstallResolved.value)
 );
+
+/**
+ * A key install in this callback left the server with a license error — or the
+ * post-callback reconciliation that would clear it hasn't finished yet. Until we
+ * know the final key state, keep suppressing the OS update confirmation so the
+ * user can't start an update against a possibly-still-broken license. Broader
+ * than `showPostInstallKeyError` (which waits for `callbackCallsCompleted`)
+ * because the confirm button must stay hidden during the pending window too.
+ */
+const keyErrorBlocksUpdate = computed(() => Boolean(stateDataError.value && keyInstallResolved.value));
 </script>
 
 <template>
@@ -327,7 +337,7 @@ const showPostInstallKeyError = computed(() =>
         />
       </div>
 
-      <template v-if="updateOsStatus === 'confirming' && !showPostInstallKeyError">
+      <template v-if="updateOsStatus === 'confirming' && !keyErrorBlocksUpdate">
         <div class="my-4 flex flex-col gap-y-2">
           <div class="flex flex-col gap-y-1">
             <p class="text-center text-lg">
@@ -383,7 +393,7 @@ const showPostInstallKeyError = computed(() =>
           </template>
         </template>
 
-        <template v-if="updateOsStatus === 'confirming' && !showPostInstallKeyError">
+        <template v-if="updateOsStatus === 'confirming' && !keyErrorBlocksUpdate">
           <BrandButton
             variant="underline"
             :icon="XMarkIcon"

From 07452bc92977c333c288837ec7bd3549d3e5edef Mon Sep 17 00:00:00 2001
From: Eli Bosley <eli@bosley.dev>
Date: Wed, 17 Jun 2026 22:51:48 -0400
Subject: [PATCH 7/8] test(web): exercise real stateDataError and isolate mocks
 in OS update tests

- HeaderOsVersion: drive the state-error precondition via state='EGUID' (which
  sets stateData.error) instead of errorsStore.errors, which never feeds
  stateDataError. Assert stateDataError is defined so the badge test actually
  exercises the path it names.
- DropdownContent: clear shared mock call history in beforeEach for isolation.
---
 web/__test__/components/DropdownContent.test.ts |  1 +
 web/__test__/components/HeaderOsVersion.test.ts | 12 +++---------
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/web/__test__/components/DropdownContent.test.ts b/web/__test__/components/DropdownContent.test.ts
index 91c1dcaf21..7bb6caa4e5 100644
--- a/web/__test__/components/DropdownContent.test.ts
+++ b/web/__test__/components/DropdownContent.test.ts
@@ -108,6 +108,7 @@ describe('DropdownContent', () => {
   };
 
   beforeEach(() => {
+    vi.clearAllMocks();
     setActivePinia(createPinia());
 
     serverStoreRefs.keyActions!.value = [];
diff --git a/web/__test__/components/HeaderOsVersion.test.ts b/web/__test__/components/HeaderOsVersion.test.ts
index 716987d198..69156d19ea 100644
--- a/web/__test__/components/HeaderOsVersion.test.ts
+++ b/web/__test__/components/HeaderOsVersion.test.ts
@@ -11,7 +11,6 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import type { TestingPinia } from '@pinia/testing';
 import type { VueWrapper } from '@vue/test-utils';
-import type { Error as CustomApiError } from '~/store/errors';
 import type { ServerUpdateOsResponse } from '~/types/server';
 
 import HeaderOsVersion from '~/components/HeaderOsVersion.standalone.vue';
@@ -120,15 +119,9 @@ describe('HeaderOsVersion', () => {
   });
 
   it('still renders the update-available badge when the server has a state error', async () => {
-    // A registration/key error (here surfaced as a serverState error) must not
+    // A registration/key error (EGUID GUID mismatch → stateDataError) must not
     // hide an available OS update — update eligibility is independent of it.
-    const mockError: CustomApiError = {
-      message: 'State data fetch failed',
-      heading: 'Fetch Error',
-      level: 'error',
-      type: 'serverState',
-    };
-    errorsStore.errors = [mockError];
+    serverStore.state = 'EGUID';
     serverStore.updateOsResponse = {
       version: '6.13.0',
       isNewer: true,
@@ -138,6 +131,7 @@ describe('HeaderOsVersion', () => {
 
     await nextTick();
 
+    expect(serverStore.stateDataError).toBeDefined();
     expect(wrapper.find('[title="Unraid OS 6.13.0 Update Available"]').exists()).toBe(true);
   });
 

From 4ffcd1cfec69917a5e9fe9d7fdf226c16554c495 Mon Sep 17 00:00:00 2001
From: Eli Bosley <eli@bosley.dev>
Date: Wed, 17 Jun 2026 23:49:52 -0400
Subject: [PATCH 8/8] test(api): apply suite-level timeout to oidc integration
 tests

A different network-dependent test in the suite timed out at 5s in CI after the
per-test bump. These integration tests all make real outbound calls (discovery,
SSL/DNS probes), so raise the timeout for the whole suite instead of one test.
---
 .../resolvers/sso/core/oidc.service.integration.test.ts    | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/api/src/unraid-api/graph/resolvers/sso/core/oidc.service.integration.test.ts b/api/src/unraid-api/graph/resolvers/sso/core/oidc.service.integration.test.ts
index aac569dca5..fba613641c 100644
--- a/api/src/unraid-api/graph/resolvers/sso/core/oidc.service.integration.test.ts
+++ b/api/src/unraid-api/graph/resolvers/sso/core/oidc.service.integration.test.ts
@@ -17,7 +17,10 @@ import { OidcProvider } from '@app/unraid-api/graph/resolvers/sso/models/oidc-pr
 import { OidcSessionService } from '@app/unraid-api/graph/resolvers/sso/session/oidc-session.service.js';
 import { OidcStateService } from '@app/unraid-api/graph/resolvers/sso/session/oidc-state.service.js';
 
-describe('OidcService Integration Tests - Enhanced Logging', () => {
+// These integration tests make real outbound network calls (discovery, SSL/DNS
+// probes), which can exceed the 5s default under slow CI networking. Give the
+// whole suite generous headroom.
+describe('OidcService Integration Tests - Enhanced Logging', { timeout: 20000 }, () => {
     let service: OidcService;
     let configPersistence: OidcConfigPersistence;
     let loggerSpy: any;
@@ -487,6 +490,6 @@ describe('OidcService Integration Tests - Enhanced Logging', () => {
             expect(result.details).toHaveProperty('type');
             // Should be one of the known transport failure types
             expect(['SSL_ERROR', 'FETCH_ERROR', 'DNS_ERROR']).toContain((result.details as any).type);
-        }, 20000);
+        });
     });
 });