From 148aabd3efd0fe68cf8396f87242767250a44df8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 30 Sep 2026 23:01:38 +0000
Subject: [PATCH] fix: stop false "update available" for same-version images,
 plus review fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The checker compared the registry digest against only the FIRST of the
image's RepoDigests. Docker keeps several digests for one repo when the same
image is known under more than one manifest (tag re-pushed with a new index,
or pulled via two tags), listed lexically rather than newest-first — so an
up-to-date container could be flagged forever, showing the same version on
both sides, and updating it changed nothing. All matching repo digests are
now tracked and compared.

Also:
- sse: a finished session's cleanup timer could delete a NEW session started
  within 30s (e.g. Revert right after a failed update), hanging its log.
- notify: ntfy titles contain emoji and were sent as a header, which fetch
  rejects — every real ntfy notification threw (the ASCII test passed).
  Title/tags now go in query params. Messages show "current → available".
- standalone recreate/revert: no longer pins the old image's ENV/CMD/labels
  onto the new image; keeps anonymous volumes and a custom hostname; renames
  the old container aside and restores it if create/start fails.
- checker: check each ref once but evaluate every container running it;
  skip containers with no registry digest; single-flight concurrent checks;
  breaking-change scan uses the remembered running version.
- scheduler: notifications use remembered versions; dashboards refresh after
  the daily scan.
- client: brief SSE disconnects no longer mark an update failed; "Update all"
  runs one container at a time per stack; same-version rebuilds are labelled.

feat: "Skip" an offered update until a newer build is published

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiL5R3bRpvGk6QP3E21eHF
---
 API_CONTRACT.md                           |  19 ++
 README.md                                 |   8 +-
 client/src/Dashboard.jsx                  |   5 +-
 client/src/api.js                         |  11 +
 client/src/components/UpdateAllButton.jsx |  47 ++--
 client/src/components/UpdateCard.jsx      |  71 +++++-
 client/src/hooks/useSSE.js                |  24 +-
 client/src/styles/app.css                 |   6 +
 server/src/checker.js                     |  60 ++++-
 server/src/containers-service.js          |  21 +-
 server/src/db.js                          |  21 ++
 server/src/docker.js                      | 297 ++++++++++++++++------
 server/src/notify.js                      |  50 +++-
 server/src/reconcile.js                   |  16 ++
 server/src/routes/api.js                  |  32 +++
 server/src/scheduler.js                   |   6 +
 server/src/sse.js                         |  11 +-
 server/test/containers-service.test.js    |  32 +++
 server/test/db-skip.test.js               |  52 ++++
 server/test/docker.test.js                | 114 +++++++++
 server/test/notify.test.js                |  47 ++++
 server/test/sse.test.js                   |  60 +++++
 22 files changed, 870 insertions(+), 140 deletions(-)
 create mode 100644 server/test/db-skip.test.js
 create mode 100644 server/test/sse.test.js

diff --git a/API_CONTRACT.md b/API_CONTRACT.md
index 9f2c575..16613ae 100644
--- a/API_CONTRACT.md
+++ b/API_CONTRACT.md
@@ -215,6 +215,22 @@ always returns normalized refs. Pinning ("Pin Version") holds a container at
 its current version: it's never flagged for updates and is grouped into a
 separate section, but can still be updated by hand.
 
+### `POST /api/skip`
+
+- Auth: cookie.
+- Body: `{ "ref": "string" }` (normalized like `/api/pin`).
+- Skips the currently offered update for that image ("not this build"): the
+  item reports `updateAvailable: false, skipped: true` and it's left out of
+  notifications, until a newer build is found (which is offered as usual).
+- Response: `200 { "ok": true }`; `404 { "error": "no_pending_update" }` if
+  there's no pending update for the ref.
+
+### `DELETE /api/skip/:ref`
+
+- Auth: cookie.
+- Un-skips the pending update for `ref` (URL-encoded). Same responses as
+  `POST /api/skip`.
+
 ### `GET /api/settings`
 
 - Auth: cookie.
@@ -313,6 +329,9 @@ Field notes:
   the running and available versions mention breaking changes (best-effort,
   GitHub-sourced images only; scanned when the update event is recorded).
   `false` otherwise, including when no update is available.
+- `skipped` — `true` when an update exists but the user skipped that exact
+  build (`POST /api/skip`); `updateAvailable` is then `false`, while
+  `availableDigest`/`availableVersion` still describe the skipped build.
 - `pinned` — `true` if the image ref is in the `pinned` table ("Pin Version":
   update indicator is suppressed and the container is grouped separately, but
   a manual update is still allowed).
diff --git a/README.md b/README.md
index 8249231..eaa2de7 100644
--- a/README.md
+++ b/README.md
@@ -75,9 +75,13 @@ If the paths don't match you'll get `compose file not found` and broken bind mou
 - **Updates tab** — containers grouped by stack, update-available ones on top.
   Defaults to showing only what needs updating; flip to **All** to see everything.
   Tap **Update** to pull + recreate that service (watch live logs), or **Update all**
-  to run them one at a time. After an update DockPull verifies the container actually
+  to run them (one at a time within each stack). After an update DockPull verifies the container actually
   comes up healthy (catching crash-loops), and offers a one-click **Revert** to the
-  previous image if it doesn't. **Pin Version** holds a container at its current version.
+  previous image if it doesn't. **Pin Version** holds a container at its current version;
+  **Skip** dismisses just the update on offer, and the card returns when a newer
+  build is published. An update marked **(rebuilt)** has the same version number
+  but a new image — the publisher re-pushed the tag, usually for base-image or
+  security patches.
 - **History tab** — a log of past updates. **Clear history** wipes it (with a confirm).
 - **Settings tab** — theme, default view, auto-check on open, the **daily background
   scan** + **notifications** (Discord, ntfy, Gotify, or a generic webhook — with a
diff --git a/client/src/Dashboard.jsx b/client/src/Dashboard.jsx
index 160f3c1..aad7b54 100644
--- a/client/src/Dashboard.jsx
+++ b/client/src/Dashboard.jsx
@@ -210,7 +210,10 @@ export default function Dashboard({ onPendingCountChange }) {
   );
   const mainItems = useMemo(() => visible.filter((c) => !c.pinned), [visible]);
 
-  const pendingTargets = useMemo(() => mainItems.filter(hasUpdate).map((c) => c.name), [mainItems]);
+  const pendingTargets = useMemo(
+    () => mainItems.filter(hasUpdate).map((c) => ({ name: c.name, project: c.project })),
+    [mainItems]
+  );
 
   useEffect(() => {
     if (onPendingCountChange) onPendingCountChange(pendingTargets.length);
diff --git a/client/src/api.js b/client/src/api.js
index 01228f3..72c754b 100644
--- a/client/src/api.js
+++ b/client/src/api.js
@@ -157,6 +157,17 @@ export function unpin(ref) {
   return del(`/pin/${encodeURIComponent(ref)}`);
 }
 
+// --- Skipping a specific update ---
+
+// Dismiss the currently offered build for an image until a newer one appears.
+export function skipUpdate(ref) {
+  return post('/skip', { ref });
+}
+
+export function unskipUpdate(ref) {
+  return del(`/skip/${encodeURIComponent(ref)}`);
+}
+
 // --- Settings ---
 
 export function getSettings() {
diff --git a/client/src/components/UpdateAllButton.jsx b/client/src/components/UpdateAllButton.jsx
index 739590c..3771ff4 100644
--- a/client/src/components/UpdateAllButton.jsx
+++ b/client/src/components/UpdateAllButton.jsx
@@ -1,13 +1,15 @@
 import React, { useCallback, useState } from 'react';
 
 /**
- * Updates every container with `updateAvailable && !pinned`, all at once:
- * each is started immediately and its own SSE stream runs concurrently
- * (handled by `runUpdate`). A failure on one container does not affect the
- * others — `runUpdate` resolves (not rejects) even on failure, and
- * `Promise.allSettled` waits for them all regardless.
+ * Updates every container with `updateAvailable && !pinned`. Containers in the
+ * same stack (compose project) run one at a time — concurrent `docker compose
+ * up` calls against one project can race on its shared networks and
+ * dependencies — while different stacks proceed in parallel. A failure on one
+ * container does not stop the others: `runUpdate` resolves (never rejects)
+ * with the outcome.
  *
- * Disabled when there are no eligible targets or any update is in flight.
+ * `targets` is `[{ name, project }]`. Disabled when there are no eligible
+ * targets or any update is in flight.
  */
 export default function UpdateAllButton({ targets, runUpdate, disabled, onBatchDone }) {
   const [running, setRunning] = useState(false);
@@ -15,17 +17,28 @@ export default function UpdateAllButton({ targets, runUpdate, disabled, onBatchD
   const handleClick = useCallback(async () => {
     if (running || disabled || targets.length === 0) return;
     setRunning(true);
-    // Fire them all immediately, then wait for the whole batch to settle.
-    // Each run() resolves (never rejects) with { success, message }, so the
-    // dashboard can show one aggregate summary instead of making the user
-    // scroll every card to find what failed.
-    const outcomes = await Promise.all(
-      targets.map((name) =>
-        Promise.resolve(runUpdate(name))
-          .then((r) => ({ name, success: !!(r && r.success), message: (r && r.message) || '' }))
-          .catch((err) => ({ name, success: false, message: err?.message || '' }))
-      )
+    const runOne = (name) =>
+      Promise.resolve(runUpdate(name))
+        .then((r) => ({ name, success: !!(r && r.success), message: (r && r.message) || '' }))
+        .catch((err) => ({ name, success: false, message: err?.message || '' }));
+
+    // One sequential lane per stack; standalone containers each get their own.
+    const lanes = new Map();
+    for (const t of targets) {
+      const key = t.project ? `p:${t.project}` : `c:${t.name}`;
+      if (!lanes.has(key)) lanes.set(key, []);
+      lanes.get(key).push(t.name);
+    }
+    // Each run() resolves with { success, message }, so the dashboard can show
+    // one aggregate summary instead of making the user scroll every card.
+    const laneOutcomes = await Promise.all(
+      [...lanes.values()].map(async (names) => {
+        const out = [];
+        for (const name of names) out.push(await runOne(name));
+        return out;
+      })
     );
+    const outcomes = laneOutcomes.flat();
     setRunning(false);
     if (onBatchDone) onBatchDone(outcomes);
   }, [running, disabled, targets, runUpdate, onBatchDone]);
@@ -33,7 +46,7 @@ export default function UpdateAllButton({ targets, runUpdate, disabled, onBatchD
   return (
     <button
       type="button"
-      className="btn btn-primary"
+      className="btn btn-primary btn-sm"
       onClick={handleClick}
       disabled={disabled || running || targets.length === 0}
     >
diff --git a/client/src/components/UpdateCard.jsx b/client/src/components/UpdateCard.jsx
index bd95e9d..d65da43 100644
--- a/client/src/components/UpdateCard.jsx
+++ b/client/src/components/UpdateCard.jsx
@@ -1,5 +1,5 @@
 import React, { useCallback, useEffect, useState } from 'react';
-import { pin, unpin, getChangelog } from '../api.js';
+import { pin, unpin, skipUpdate, unskipUpdate, getChangelog } from '../api.js';
 import { useUpdateRunner } from '../hooks/useUpdateRunner.js';
 import StatusMessage from './StatusMessage.jsx';
 import StreamLog from './StreamLog.jsx';
@@ -37,6 +37,14 @@ function displayVersion({ currentVersion, tag, currentDigest }) {
   return shortDigest(currentDigest);
 }
 
+// Same release, different build? Compare versions ignoring a leading "v"
+// ("v1.2.3" and "1.2.3" are the same release).
+function sameVersion(a, b) {
+  if (!isMeaningfulVersion(a) || !isMeaningfulVersion(b)) return false;
+  const norm = (v) => v.trim().replace(/^v/i, '').toLowerCase();
+  return norm(a) === norm(b);
+}
+
 // Build a "Changelog"/"Source" link from the image's OCI source label. GitHub
 // repos get pointed at their releases page (best place for a changelog).
 function sourceLink(sourceUrl) {
@@ -139,7 +147,7 @@ function ChangelogContent({ data }) {
  *  - registerRunner(name, runFn) — handle for "Update all"
  */
 export default function UpdateCard({ container, onSettled, onPinChange, registerRunner }) {
-  const { name, project, service, image, currentDigest, availableVersion, availableDigest, updateAvailable, breakingRisk, pinned, sourceUrl, canRevert, rollbackVersion, checkError, state } =
+  const { name, project, service, image, currentDigest, availableVersion, availableDigest, updateAvailable, breakingRisk, skipped, pinned, sourceUrl, canRevert, rollbackVersion, checkError, state } =
     container;
 
   const [pinBusy, setPinBusy] = useState(false);
@@ -188,6 +196,25 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
     }
   }, [pinned, image, onPinChange]);
 
+  // Skip just the offered build (or undo that). Reuses the pin busy flag and
+  // refresh callback — both are "change what this card offers" actions.
+  const toggleSkip = useCallback(async () => {
+    setPinBusy(true);
+    setActionError('');
+    try {
+      if (skipped) {
+        await unskipUpdate(image);
+      } else {
+        await skipUpdate(image);
+      }
+      if (onPinChange) onPinChange();
+    } catch (err) {
+      setActionError(err.message || 'Failed to skip update');
+    } finally {
+      setPinBusy(false);
+    }
+  }, [skipped, image, onPinChange]);
+
   const toggleChangelog = useCallback(async () => {
     const next = !clOpen;
     setClOpen(next);
@@ -207,6 +234,11 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
 
   const showUpdateAvailable = updateAvailable && !pinned;
   const link = sourceLink(sourceUrl);
+  const runningLabel = displayVersion(container);
+  // The tag was re-published with a new image but the same version number —
+  // typically a base-image/security refresh. Say so, rather than showing a
+  // confusing "1.2.3 → 1.2.3".
+  const isRebuild = showUpdateAvailable && sameVersion(runningLabel, availableVersion);
 
   return (
     <div className={`update-card${showUpdateAvailable ? ' has-update' : ''}`}>
@@ -225,6 +257,11 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
               </span>
             )}
             {pinned && <span className="pill pill-pinned">Version pinned</span>}
+            {skipped && !pinned && (
+              <span className="pill" title={availableDigest || ''}>
+                Skipped {isMeaningfulVersion(availableVersion) ? availableVersion : 'update'}
+              </span>
+            )}
             {state && state !== 'running' && (
               <span className="pill pill-state" title={`Container is ${state} — updating it will start it`}>
                 {state}
@@ -249,14 +286,18 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
         <div className="version-row">
           <span className="version-label">Running</span>
           <span className="version-value" title={currentDigest || ''}>
-            {displayVersion(container)}
+            {runningLabel}
           </span>
         </div>
         {showUpdateAvailable && (
           <div className="version-row">
             <span className="version-label">Available</span>
             <span className="version-value is-available" title={availableDigest || ''}>
-              {isMeaningfulVersion(availableVersion) ? availableVersion : 'newer image'}
+              {isRebuild
+                ? `${availableVersion} (rebuilt)`
+                : isMeaningfulVersion(availableVersion)
+                  ? availableVersion
+                  : 'newer image'}
             </span>
             {breakingRisk && (
               <span className="breaking-flag" title="Release notes mention possible breaking changes">⚠️</span>
@@ -265,6 +306,13 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
         )}
       </div>
 
+      {isRebuild && (
+        <p className="card-hint">
+          Same version, new build ({shortDigest(currentDigest)} → {shortDigest(availableDigest)}). The
+          publisher re-pushed this tag — usually base-image or security patches.
+        </p>
+      )}
+
       {checkError && (
         <p className="card-check-error" title={checkError}>
           ⚠ Couldn't check for updates (e.g. private registry or rate limit).
@@ -287,6 +335,21 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
               {clOpen ? 'Hide changes' : showUpdateAvailable ? "What's changed" : 'Release notes'}
             </button>
           )}
+          {(showUpdateAvailable || (skipped && !pinned)) && (
+            <button
+              type="button"
+              className="btn-ghost"
+              onClick={toggleSkip}
+              disabled={pinBusy || busy}
+              title={
+                skipped
+                  ? 'Offer this update again'
+                  : 'Hide this update until a newer one is released (unlike pinning, newer updates still show)'
+              }
+            >
+              {skipped ? 'Unskip' : 'Skip'}
+            </button>
+          )}
           {canRevert && (
             <button
               type="button"
diff --git a/client/src/hooks/useSSE.js b/client/src/hooks/useSSE.js
index 561e443..d03c51e 100644
--- a/client/src/hooks/useSSE.js
+++ b/client/src/hooks/useSSE.js
@@ -11,6 +11,8 @@ import { API_BASE } from '../api.js';
  * The stream is keyed by container name (not the streamId returned by
  * POST /api/update/:name — that value is informational only).
  */
+const RECONNECT_GRACE_MS = 30_000;
+
 export function useSSE(name, active) {
   const [lines, setLines] = useState([]);
   const [result, setResult] = useState(null);
@@ -34,9 +36,16 @@ export function useSSE(name, active) {
 
     const es = new EventSource(`${API_BASE}/update/${encodeURIComponent(name)}/stream`);
     esRef.current = es;
+    // Pending "give up reconnecting" timer while the browser retries.
+    let giveUp = null;
 
     es.onopen = () => {
+      clearTimeout(giveUp);
+      giveUp = null;
       setConnected(true);
+      // The server replays the whole buffered log to every (re)connection, so
+      // start fresh rather than duplicating what we already showed.
+      setLines([]);
     };
 
     es.onmessage = (event) => {
@@ -61,10 +70,23 @@ export function useSSE(name, active) {
 
     es.onerror = () => {
       setConnected(false);
-      setError('Connection lost');
+      // A blip (phone sleeping, proxy hiccup) is not a failed update: the
+      // browser reconnects on its own and the update keeps running server-side.
+      // Only report failure if the stream is closed for good, or stays down.
+      if (es.readyState === EventSource.CLOSED) {
+        setError('Connection lost');
+        return;
+      }
+      if (!giveUp) {
+        giveUp = setTimeout(() => {
+          es.close();
+          setError('Connection lost — the update may still be running. Refresh to check.');
+        }, RECONNECT_GRACE_MS);
+      }
     };
 
     return () => {
+      clearTimeout(giveUp);
       es.close();
       esRef.current = null;
     };
diff --git a/client/src/styles/app.css b/client/src/styles/app.css
index ca84267..2852a4b 100644
--- a/client/src/styles/app.css
+++ b/client/src/styles/app.css
@@ -1554,6 +1554,12 @@ a {
   color: var(--color-pending);
 }
 
+.card-hint {
+  margin: 8px 0 0;
+  font-size: 0.8rem;
+  color: var(--color-text-muted);
+}
+
 .about-version {
   color: var(--color-text-muted);
   font-weight: 400;
diff --git a/server/src/checker.js b/server/src/checker.js
index d8911f2..aba48d7 100644
--- a/server/src/checker.js
+++ b/server/src/checker.js
@@ -9,7 +9,7 @@
 
 import { listContainers } from './docker.js';
 import { getRemoteDigest, getRemoteVersion } from './registry.js';
-import { digestsEqual } from './reconcile.js';
+import { digestsEqual, isRunningDigest } from './reconcile.js';
 import { isMeaningfulVersion } from './version.js';
 import {
   parseGitHubRepo,
@@ -72,6 +72,9 @@ async function detectBreakingForContainer(c) {
     const gh = parseGitHubRepo(c.sourceUrl);
     if (!gh) return 0;
     const releases = await getReleasesCached(gh.owner, gh.repo);
+    // Without a known running version we can't tell which notes are "newer",
+    // and scanning the latest few releases wholesale over-flags.
+    if (!isMeaningfulVersion(c.currentVersion)) return 0;
     const newer = selectNewerReleases(releases, c.currentVersion);
     return detectBreakingChanges(newer) ? 1 : 0;
   } catch {
@@ -79,22 +82,47 @@ async function detectBreakingForContainer(c) {
   }
 }
 
+// The in-flight check, if any. A manual "Check for updates" and the daily scan
+// (or two open dashboards auto-checking) can overlap; running two checks at
+// once would race on the "already flagged?" lookup and insert duplicate events,
+// so concurrent callers share the one run instead.
+let inFlight = null;
+
 /**
  * @returns {Promise<{ total: number, checked: number, updatesFound: number, errors: number }>}
  * @throws if the Docker daemon can't be reached (caller maps to 503).
  */
-export async function runCheck() {
+export function runCheck() {
+  if (!inFlight) {
+    inFlight = doCheck().finally(() => {
+      inFlight = null;
+    });
+  }
+  return inFlight;
+}
+
+async function doCheck() {
   const containers = await listContainers();
 
-  // De-dupe by normalized ref so we hit each image once even if several
-  // containers run it.
+  // Group by normalized ref so we hit each registry tag once even if several
+  // containers run it — but keep every container, since they may be running
+  // different images of that tag (one recreated, another not). Containers with
+  // no registry digest (built locally, loaded from a tarball) have nothing to
+  // compare against, so they're counted as checked without a registry call.
   const byRef = new Map();
+  const noDigestRefs = new Set();
   for (const c of containers) {
-    if (!byRef.has(c.normalizedRef)) byRef.set(c.normalizedRef, c);
+    if (!c.currentDigest) {
+      noDigestRefs.add(c.normalizedRef);
+      continue;
+    }
+    if (!byRef.has(c.normalizedRef)) byRef.set(c.normalizedRef, []);
+    byRef.get(c.normalizedRef).push(c);
   }
   const items = [...byRef.values()];
+  const unverifiable = [...noDigestRefs].filter((ref) => !byRef.has(ref)).length;
 
-  let checked = 0;
+  let checked = unverifiable;
   let updatesFound = 0;
   let errors = 0;
   const errored = []; // { ref, image, message } per failed container check
@@ -102,14 +130,16 @@ export async function runCheck() {
   let idx = 0;
   async function worker() {
     while (idx < items.length) {
-      const c = items[idx];
+      const group = items[idx];
       idx += 1;
+      let c = group[0];
       try {
         const remote = await getRemoteDigest(c.image);
         checked += 1;
         if (!remote) continue; // digest-pinned or registry gave no digest
 
-        if (c.currentDigest && digestsEqual(remote, c.currentDigest)) {
+        const stale = group.filter((x) => !isRunningDigest(remote, x.currentDigest, x.currentDigests));
+        if (stale.length === 0) {
           // Up to date — clear any stale unresolved event.
           db.resolveEventsForRef(c.normalizedRef);
           // The running image IS the latest. If its own version label is junk
@@ -125,6 +155,7 @@ export async function runCheck() {
           }
           continue;
         }
+        c = stale[0];
 
         // Differs from what's running: flag it, unless we already have an
         // unresolved event for this exact digest (avoid duplicate rows on
@@ -146,7 +177,13 @@ export async function runCheck() {
 
         // Best-effort: only paid for images that actually have an update.
         const availableVersion = await resolveAvailableVersion(c);
-        const breaking = await detectBreakingForContainer(c);
+        // Scan release notes from what's actually running: prefer the image's
+        // own label, else a version remembered for its digest, so a junk label
+        // (`main`) doesn't make every recent release count as "newer".
+        const runningVersion = isMeaningfulVersion(c.currentVersion)
+          ? c.currentVersion
+          : db.getImageVersion(c.currentDigest);
+        const breaking = await detectBreakingForContainer({ ...c, currentVersion: runningVersion });
 
         db.recordEvent({
           image: c.image,
@@ -175,14 +212,15 @@ export async function runCheck() {
     Array.from({ length: Math.min(CONCURRENCY, items.length) }, () => worker())
   );
 
-  const summary = { at: Date.now(), total: items.length, checked, updatesFound, errors, errored };
+  const total = items.length + unverifiable;
+  const summary = { at: Date.now(), total, checked, updatesFound, errors, errored };
   try {
     db.setMeta('lastCheck', summary);
   } catch {
     // metadata persistence is best-effort; never fail a check over it.
   }
 
-  return { total: items.length, checked, updatesFound, errors };
+  return { total, checked, updatesFound, errors };
 }
 
 export default { runCheck };
diff --git a/server/src/containers-service.js b/server/src/containers-service.js
index 1d07aee..3268f24 100644
--- a/server/src/containers-service.js
+++ b/server/src/containers-service.js
@@ -9,7 +9,7 @@
  * server/test/containers-service.test.js).
  */
 
-import { isUpdateAvailable, digestsEqual } from './reconcile.js';
+import { isUpdateAvailable, isRunningDigest } from './reconcile.js';
 import { isMeaningfulVersion } from './version.js';
 
 /**
@@ -48,11 +48,13 @@ export function buildContainerItems({
     let updateAvailable;
     let availableDigest;
     let availableVersion;
+    let skipped = false;
 
-    if (event && digestsEqual(c.currentDigest, event.digest)) {
-      // The running container's digest already matches the event's digest:
-      // the update has already been applied. Mark the event resolved and
-      // report no update available.
+    if (event && isRunningDigest(event.digest, c.currentDigest, c.currentDigests)) {
+      // The running image is already known under the event's digest: the
+      // update has been applied (or the "new" digest was just a re-pushed
+      // index for the same image). Mark the event resolved and report no
+      // update available.
       refsToResolve.push(c.normalizedRef);
       updateAvailable = false;
       availableDigest = null;
@@ -61,6 +63,12 @@ export function buildContainerItems({
       updateAvailable = isUpdateAvailable(c.currentDigest, event?.digest);
       availableDigest = updateAvailable ? event.digest : null;
       availableVersion = updateAvailable ? (event?.available_version ?? null) : null;
+      // The user dismissed this exact build: not "available", but remember
+      // what was skipped so the card can offer to undo it.
+      if (updateAvailable && event?.skipped) {
+        skipped = true;
+        updateAvailable = false;
+      }
     }
 
     // Prefer the image's own meaningful version label; otherwise fall back to a
@@ -68,7 +76,7 @@ export function buildContainerItems({
     const currentVersion = isMeaningfulVersion(c.currentVersion)
       ? c.currentVersion
       : lookupVersion(c.currentDigest) ?? c.currentVersion ?? null;
-    if (updateAvailable && !isMeaningfulVersion(availableVersion)) {
+    if ((updateAvailable || skipped) && !isMeaningfulVersion(availableVersion)) {
       availableVersion = lookupVersion(availableDigest) ?? availableVersion ?? null;
     }
 
@@ -89,6 +97,7 @@ export function buildContainerItems({
       // Only meaningful alongside an actual update — a stale event's flag
       // must not leak through once the digests match again.
       breakingRisk: !!(updateAvailable && event?.breaking),
+      skipped,
       pinned: isPinned(c.normalizedRef),
       canRevert: !!rollback,
       rollbackVersion: rollback?.old_version ?? null,
diff --git a/server/src/db.js b/server/src/db.js
index 6e33c7a..fd07676 100644
--- a/server/src/db.js
+++ b/server/src/db.js
@@ -76,6 +76,11 @@ CREATE INDEX IF NOT EXISTS idx_history_created ON update_history(created_at DESC
   if (!cols.includes('breaking')) {
     db.exec('ALTER TABLE update_events ADD COLUMN breaking INTEGER DEFAULT 0');
   }
+  // `skipped`: the user dismissed this specific available build ("Skip this
+  // update"). A newer build creates a fresh, unskipped event.
+  if (!cols.includes('skipped')) {
+    db.exec('ALTER TABLE update_events ADD COLUMN skipped INTEGER DEFAULT 0');
+  }
 }
 
 const stmts = {
@@ -92,6 +97,14 @@ const stmts = {
     UPDATE update_events SET resolved = 1
     WHERE normalized_ref = ? AND resolved = 0
   `),
+  setLatestEventSkipped: db.prepare(`
+    UPDATE update_events SET skipped = ?
+    WHERE id = (
+      SELECT id FROM update_events
+      WHERE normalized_ref = ? AND resolved = 0
+      ORDER BY id DESC LIMIT 1
+    )
+  `),
   updateEventAvailableVersion: db.prepare(`
     UPDATE update_events SET available_version = ?
     WHERE normalized_ref = ? AND digest = ? AND resolved = 0
@@ -199,6 +212,14 @@ export function resolveEventsForRef(normalized_ref) {
   return stmts.resolveEventsForRef.run(normalized_ref);
 }
 
+/**
+ * Skip (or un-skip) the currently offered update for a ref — i.e. its latest
+ * unresolved event. Returns true if there was one to change.
+ */
+export function setLatestEventSkipped(normalized_ref, skipped) {
+  return stmts.setLatestEventSkipped.run(skipped ? 1 : 0, normalized_ref).changes > 0;
+}
+
 export function updateEventAvailableVersion(normalized_ref, digest, available_version) {
   return stmts.updateEventAvailableVersion.run(available_version ?? null, normalized_ref, digest);
 }
diff --git a/server/src/docker.js b/server/src/docker.js
index 50b2edc..56b415c 100644
--- a/server/src/docker.js
+++ b/server/src/docker.js
@@ -56,60 +56,61 @@ function stripLeadingSlash(rawName) {
 }
 
 /**
- * Pure: picks the digest from an image's `RepoDigests` that matches the
- * configured image ref's repo, to disambiguate when an image was pulled/
- * tagged under several refs. Falls back to the sole RepoDigest if there's
- * exactly one. Returns null when there's no usable match.
+ * Pure: every digest in an image's `RepoDigests` that belongs to the
+ * configured image ref's repo. An image can legitimately carry several digests
+ * for the same repo — e.g. it was pulled under two tags whose manifest lists
+ * differ only in annotations, or the publisher re-pushed the tag's index
+ * (adding attestations) without changing the image itself. Docker lists them
+ * in lexical order, not newest-first, so any one of them may be the digest the
+ * registry currently serves; callers must compare against all of them. Falls
+ * back to the sole RepoDigest if there's exactly one and no repo match.
  *
  * @param {string[]|undefined} repoDigests - image inspect `RepoDigests`.
  * @param {string} image - configured image ref, e.g. "nginx:latest".
- * @returns {string|null}
+ * @returns {string[]}
  */
-function pickRepoDigest(repoDigests, image) {
+export function pickRepoDigests(repoDigests, image) {
   if (!Array.isArray(repoDigests) || repoDigests.length === 0) {
-    return null;
+    return [];
   }
 
   // Determine the repo (registry/repo, no tag) we're looking for.
   let wantedRepo = null;
   try {
-    const normalized = normalizeRef(image);
-    wantedRepo = normalized.includes(':')
-      ? normalized.slice(0, normalized.lastIndexOf(':'))
-      : normalized;
+    const { registry, repository } = parseRef(image);
+    wantedRepo = `${registry}/${repository}`;
   } catch {
     wantedRepo = null;
   }
 
+  const matches = [];
   if (wantedRepo) {
     for (const entry of repoDigests) {
       const atIdx = entry.lastIndexOf('@');
       if (atIdx === -1) continue;
-      const repoPart = entry.slice(0, atIdx);
-      let normalizedRepoPart;
+      let entryRepo;
       try {
-        // Append a dummy tag so normalizeRef parses repoPart as a name,
-        // not as "repo:port"-style ambiguity; we only need the
-        // registry/repo portion back out.
-        const probe = normalizeRef(`${repoPart}:__probe__`);
-        normalizedRepoPart = probe.slice(0, probe.lastIndexOf(':'));
+        const { registry, repository } = parseRef(entry);
+        entryRepo = `${registry}/${repository}`;
       } catch {
-        normalizedRepoPart = repoPart;
+        entryRepo = entry.slice(0, atIdx);
       }
-      if (normalizedRepoPart === wantedRepo) {
-        return entry.slice(atIdx + 1);
+      const digest = entry.slice(atIdx + 1);
+      if (entryRepo === wantedRepo && !matches.includes(digest)) {
+        matches.push(digest);
       }
     }
   }
+  if (matches.length > 0) return matches;
 
   // No repo match found; fall back to the sole RepoDigest's digest part, but
   // only if there's exactly one (otherwise it's ambiguous which applies).
   if (repoDigests.length === 1) {
     const atIdx = repoDigests[0].lastIndexOf('@');
-    return atIdx === -1 ? null : repoDigests[0].slice(atIdx + 1);
+    return atIdx === -1 ? [] : [repoDigests[0].slice(atIdx + 1)];
   }
 
-  return null;
+  return [];
 }
 
 /**
@@ -120,7 +121,7 @@ function pickRepoDigest(repoDigests, image) {
  *
  * @param {string} imageIdOrName - `Image` field from container inspect.
  * @param {string} image - configured image ref, e.g. "nginx:latest".
- * @returns {Promise<{ digest: string|null, version: string|null }>}
+ * @returns {Promise<{ digest: string|null, digests: string[], version: string|null, source: string|null }>}
  */
 async function inspectImageMeta(imageIdOrName, image) {
   let imageInfo;
@@ -128,7 +129,7 @@ async function inspectImageMeta(imageIdOrName, image) {
     imageInfo = await docker.getImage(imageIdOrName).inspect();
   } catch (err) {
     console.warn(`docker.js: failed to inspect image ${imageIdOrName}: ${err.message}`);
-    return { digest: null, version: null };
+    return { digest: null, digests: [], version: null, source: null };
   }
 
   const labels = imageInfo?.Config?.Labels || {};
@@ -136,8 +137,8 @@ async function inspectImageMeta(imageIdOrName, image) {
   const source = normalizeSourceUrl(
     labels['org.opencontainers.image.source'] || labels['org.opencontainers.image.url'] || null
   );
-  const digest = pickRepoDigest(imageInfo?.RepoDigests, image);
-  return { digest, version, source };
+  const digests = pickRepoDigests(imageInfo?.RepoDigests, image);
+  return { digest: digests[0] ?? null, digests, version, source };
 }
 
 /**
@@ -311,6 +312,7 @@ export async function listContainers() {
 
       const {
         digest: currentDigest,
+        digests: currentDigests,
         version: currentVersion,
         source: sourceUrl,
       } = await inspectImageMeta(inspectData.Image, image);
@@ -351,6 +353,7 @@ export async function listContainers() {
         currentVersion,
         sourceUrl: sourceUrl || null,
         currentDigest,
+        currentDigests,
         project: project || null,
         service: service || null,
         composeFile: composeFile || null,
@@ -450,6 +453,181 @@ async function currentDigestForContainerName(name) {
   return resolveCurrentDigest(inspectData.Image, image);
 }
 
+/**
+ * True when two JSON-ish values are structurally equal (arrays/objects/
+ * primitives, as Docker inspect returns them). null and undefined are equal.
+ */
+function sameValue(a, b) {
+  if (a == null && b == null) return true;
+  return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+}
+
+/**
+ * Pure: container create options that recreate `inspectData`'s container from
+ * `targetImage`, keeping only what the user configured and letting the target
+ * image supply its own defaults.
+ *
+ * A container's inspected Config is the *merge* of the old image's defaults and
+ * the user's overrides. Copying it verbatim onto a new image would pin the old
+ * image's ENV (e.g. APP_VERSION, PATH), CMD/ENTRYPOINT, labels and volumes
+ * over the new image's — so anything identical to `baseImageConfig` (the image
+ * the container currently runs) is dropped and left to the target image.
+ * Also carries anonymous volumes over by name (their data would otherwise be
+ * orphaned) and keeps a user-set hostname.
+ *
+ * @param {object} inspectData - container inspect output.
+ * @param {object|null} baseImageConfig - `Config` of the image it runs now.
+ * @param {string} targetImage - image ref/ID to create from.
+ * @returns {object} options for `docker.createContainer` (without `name`).
+ */
+export function buildRecreateOptions(inspectData, baseImageConfig, targetImage) {
+  const cfg = inspectData.Config || {};
+  const base = baseImageConfig || {};
+  const unlessDefault = (key) => (sameValue(cfg[key], base[key]) ? undefined : cfg[key]);
+
+  const baseEnv = new Set(base.Env || []);
+  const env = (cfg.Env || []).filter((e) => !baseEnv.has(e));
+
+  const baseLabels = base.Labels || {};
+  const labels = {};
+  for (const [k, v] of Object.entries(cfg.Labels || {})) {
+    if (baseLabels[k] !== v) labels[k] = v;
+  }
+
+  const minusBase = (obj, baseObj) => {
+    const out = {};
+    for (const k of Object.keys(obj || {})) {
+      if (!baseObj || !(k in baseObj)) out[k] = obj[k];
+    }
+    return Object.keys(out).length ? out : undefined;
+  };
+
+  // Docker's default hostname is the short container ID; only a hostname the
+  // user set (`hostname:` / --hostname) should survive into the new container.
+  const defaultHostname = (inspectData.Id || '').slice(0, 12);
+  const hostname = cfg.Hostname && cfg.Hostname !== defaultHostname ? cfg.Hostname : undefined;
+
+  // Re-attach anonymous volumes (64-hex names) by name so their data follows
+  // the container. Skip destinations the user already mounts explicitly.
+  const hostConfig = { ...(inspectData.HostConfig || {}) };
+  const covered = new Set([
+    ...(hostConfig.Binds || []).map((b) => b.split(':')[1]).filter(Boolean),
+    ...(hostConfig.Mounts || []).map((m) => m.Target).filter(Boolean),
+  ]);
+  const anonBinds = (inspectData.Mounts || [])
+    .filter((m) => m.Type === 'volume' && /^[0-9a-f]{64}$/.test(m.Name || '') && !covered.has(m.Destination))
+    .map((m) => `${m.Name}:${m.Destination}${m.RW === false ? ':ro' : ''}`);
+  if (anonBinds.length) hostConfig.Binds = [...(hostConfig.Binds || []), ...anonBinds];
+
+  // Keep only the user-meaningful endpoint settings; runtime state (IPs,
+  // endpoint/network IDs, the old container's ID alias) must not be replayed.
+  const shortId = defaultHostname;
+  const endpoints = {};
+  for (const [net, ep] of Object.entries(inspectData.NetworkSettings?.Networks || {})) {
+    const aliases = (ep?.Aliases || []).filter((a) => a !== shortId);
+    endpoints[net] = {
+      ...(ep?.IPAMConfig ? { IPAMConfig: ep.IPAMConfig } : {}),
+      ...(ep?.Links ? { Links: ep.Links } : {}),
+      ...(aliases.length ? { Aliases: aliases } : {}),
+      ...(ep?.DriverOpts ? { DriverOpts: ep.DriverOpts } : {}),
+    };
+  }
+
+  const opts = {
+    Image: targetImage,
+    Hostname: hostname,
+    Domainname: cfg.Domainname || undefined,
+    Cmd: unlessDefault('Cmd'),
+    Entrypoint: unlessDefault('Entrypoint'),
+    Env: env,
+    Labels: labels,
+    ExposedPorts: minusBase(cfg.ExposedPorts, base.ExposedPorts),
+    Volumes: minusBase(cfg.Volumes, base.Volumes),
+    WorkingDir: unlessDefault('WorkingDir'),
+    User: unlessDefault('User'),
+    Healthcheck: unlessDefault('Healthcheck'),
+    StopSignal: unlessDefault('StopSignal'),
+    StopTimeout: cfg.StopTimeout,
+    Tty: cfg.Tty,
+    OpenStdin: cfg.OpenStdin,
+    HostConfig: hostConfig,
+    NetworkingConfig: { EndpointsConfig: endpoints },
+  };
+  for (const k of Object.keys(opts)) if (opts[k] === undefined) delete opts[k];
+  return opts;
+}
+
+async function imageConfigOf(imageId) {
+  try {
+    return (await docker.getImage(imageId).inspect())?.Config || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Replace a container with a new one built from `createOpts`, without ever
+ * leaving the user with nothing: the old container is stopped and renamed out
+ * of the way (not removed) until the new one has been created and started. On
+ * any failure the new container is discarded and the old one is renamed back
+ * and restarted. The old one is only removed once the new one is running.
+ *
+ * @param {{ start?: boolean }} [opts] - start the new container (defaults to
+ *   whether the old one was running).
+ * @returns {Promise<void>} throws (after rolling back) if the swap failed.
+ */
+async function replaceContainer(name, inspectData, createOpts, log, opts = {}) {
+  const old = docker.getContainer(inspectData.Id);
+  const wasRunning = inspectData.State?.Running === true;
+  const start = opts.start ?? wasRunning;
+  const backupName = `${name}-dockpull-old-${Date.now()}`;
+
+  if (wasRunning) {
+    try {
+      await old.stop();
+    } catch (err) {
+      if (err.statusCode !== 304) throw err; // 304: already stopped
+    }
+  }
+
+  // Rename the old container out of the way. An --rm (AutoRemove) container
+  // is already gone once stopped — then there's nothing to fall back to.
+  let backedUp = false;
+  try {
+    await old.rename({ name: backupName });
+    backedUp = true;
+  } catch (err) {
+    if (err.statusCode !== 404) throw err;
+  }
+
+  let created = null;
+  try {
+    created = await docker.createContainer({ name, ...createOpts });
+    if (start) await created.start();
+  } catch (err) {
+    if (backedUp) {
+      log?.(`Recreate failed (${err.message}); restoring the previous container…`);
+      try {
+        if (created) await created.remove({ force: true });
+        await old.rename({ name });
+        if (wasRunning) await old.start();
+        log?.('Previous container restored.');
+      } catch (restoreErr) {
+        log?.(`Could not restore the previous container (kept as "${backupName}"): ${restoreErr.message}`);
+      }
+    }
+    throw err;
+  }
+
+  if (backedUp) {
+    try {
+      await old.remove();
+    } catch (err) {
+      console.warn(`docker.js: couldn't remove old container ${backupName}: ${err.message}`);
+    }
+  }
+}
+
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
 /**
@@ -661,40 +839,11 @@ export async function updateContainer(name, onLine) {
     };
   }
 
+  const wasRunning = inspectData.State?.Running === true;
   try {
-    const container = docker.getContainer(name);
-
-    const wasRunning = inspectData.State?.Running === true;
-
-    if (wasRunning) {
-      await container.stop();
-    }
-    await container.remove();
-
-    const created = await docker.createContainer({
-      name,
-      Image: inspectData.Config.Image,
-      Cmd: inspectData.Config.Cmd,
-      Entrypoint: inspectData.Config.Entrypoint,
-      Env: inspectData.Config.Env,
-      Labels: inspectData.Config.Labels,
-      ExposedPorts: inspectData.Config.ExposedPorts,
-      Volumes: inspectData.Config.Volumes,
-      WorkingDir: inspectData.Config.WorkingDir,
-      User: inspectData.Config.User,
-      Tty: inspectData.Config.Tty,
-      OpenStdin: inspectData.Config.OpenStdin,
-      StopSignal: inspectData.Config.StopSignal,
-      StopTimeout: inspectData.Config.StopTimeout,
-      HostConfig: inspectData.HostConfig,
-      NetworkingConfig: {
-        EndpointsConfig: inspectData.NetworkSettings?.Networks,
-      },
-    });
-
-    if (wasRunning) {
-      await created.start();
-    }
+    const baseImageConfig = await imageConfigOf(inspectData.Image);
+    const createOpts = buildRecreateOptions(inspectData, baseImageConfig, image);
+    await replaceContainer(name, inspectData, createOpts, (l) => onLine?.(l, 'stdout'));
   } catch (err) {
     return {
       success: false,
@@ -741,33 +890,13 @@ export async function revertContainer(name, imageId, onLine) {
   }
 
   const oldDigest = await currentDigestForContainerName(name);
-  const wasRunning = inspectData.State?.Running === true;
 
   try {
     log(`Reverting "${name}" to the previous image…`);
-    const container = docker.getContainer(name);
-    if (wasRunning) await container.stop();
-    await container.remove();
-
-    const created = await docker.createContainer({
-      name,
-      Image: imageId,
-      Cmd: inspectData.Config.Cmd,
-      Entrypoint: inspectData.Config.Entrypoint,
-      Env: inspectData.Config.Env,
-      Labels: inspectData.Config.Labels,
-      ExposedPorts: inspectData.Config.ExposedPorts,
-      Volumes: inspectData.Config.Volumes,
-      WorkingDir: inspectData.Config.WorkingDir,
-      User: inspectData.Config.User,
-      Tty: inspectData.Config.Tty,
-      OpenStdin: inspectData.Config.OpenStdin,
-      StopSignal: inspectData.Config.StopSignal,
-      StopTimeout: inspectData.Config.StopTimeout,
-      HostConfig: inspectData.HostConfig,
-      NetworkingConfig: { EndpointsConfig: inspectData.NetworkSettings?.Networks },
-    });
-    await created.start();
+    const baseImageConfig = await imageConfigOf(inspectData.Image);
+    const createOpts = buildRecreateOptions(inspectData, baseImageConfig, imageId);
+    // Revert always starts the container, even if it was stopped.
+    await replaceContainer(name, inspectData, createOpts, log, { start: true });
     log('Container recreated from the previous image.');
   } catch (err) {
     return { success: false, message: `Failed to revert container: ${err.message}`, oldDigest, newDigest: null };
diff --git a/server/src/notify.js b/server/src/notify.js
index f92af92..1d2dc4c 100644
--- a/server/src/notify.js
+++ b/server/src/notify.js
@@ -16,11 +16,21 @@ const MAX_LISTED = 25; // keep messages from blowing past provider limits
 
 export const NOTIFY_TYPES = ['discord', 'ntfy', 'gotify', 'webhook'];
 
+// "(1.2.3 → 1.2.4)", "(current: 1.2.3)", or "" — whatever versions we know.
+function versionSuffix(i) {
+  const cur = i.currentVersion || null;
+  const avail = i.availableVersion || null;
+  if (cur && avail && cur !== avail) return ` (${cur} → ${avail})`;
+  if (cur && avail) return ` (${cur}, rebuilt)`;
+  if (avail) return ` (→ ${avail})`;
+  if (cur) return ` (current: ${cur})`;
+  return '';
+}
+
 function summaryLines(items) {
   return items.slice(0, MAX_LISTED).map((i) => {
-    const ver = i.currentVersion ? ` (current: ${i.currentVersion})` : '';
     const warn = i.breakingRisk ? '⚠️ ' : '';
-    return `• ${warn}${i.name} — ${i.image}${ver}`;
+    return `• ${warn}${i.name} — ${i.image}${versionSuffix(i)}`;
   });
 }
 
@@ -41,9 +51,8 @@ function title(items) {
 export function buildDiscordPayload(items) {
   const header = `🔔 **${title(items)}**`;
   const lines = items.slice(0, MAX_LISTED).map((i) => {
-    const ver = i.currentVersion ? ` (current: ${i.currentVersion})` : '';
     const warn = i.breakingRisk ? '⚠️ ' : '';
-    return `• ${warn}**${i.name}** — \`${i.image}\`${ver}`;
+    return `• ${warn}**${i.name}** — \`${i.image}\`${versionSuffix(i)}`;
   });
   return { content: [header, ...lines, ...moreLine(items)].join('\n') };
 }
@@ -100,12 +109,26 @@ async function postJson(url, payload, { timeoutMs = 10000 } = {}) {
   return { ok: res.ok, status: res.status };
 }
 
-async function postText(url, body, headers = {}, { timeoutMs = 10000 } = {}) {
+/**
+ * ntfy target URL carrying the title/tags as query parameters. ntfy accepts
+ * them either as headers or as `?title=&tags=`; headers can't be used here
+ * because fetch only allows Latin-1 header values and our titles contain
+ * emoji (a `Title: 🔔 …` header throws before the request is even sent).
+ * Query params are percent-encoded UTF-8, so they're always safe.
+ */
+export function buildNtfyUrl(url, { title: t, tags } = {}) {
+  const u = new URL(url.trim());
+  if (t) u.searchParams.set('title', t);
+  if (tags) u.searchParams.set('tags', tags);
+  return u.toString();
+}
+
+async function postNtfy(url, message, { timeoutMs = 10000 } = {}) {
   assertValidUrl(url);
-  const res = await fetch(url, {
+  const res = await fetch(buildNtfyUrl(url, message), {
     method: 'POST',
-    headers: { 'Content-Type': 'text/plain; charset=utf-8', ...headers },
-    body,
+    headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+    body: message.body,
     signal: AbortSignal.timeout(timeoutMs),
   });
   return { ok: res.ok, status: res.status };
@@ -117,10 +140,8 @@ async function postText(url, body, headers = {}, { timeoutMs = 10000 } = {}) {
  */
 export function sendUpdates(type, url, items, opts) {
   switch (type) {
-    case 'ntfy': {
-      const m = buildNtfyMessage(items);
-      return postText(url, m.body, { Title: m.title, Tags: m.tags }, opts);
-    }
+    case 'ntfy':
+      return postNtfy(url, buildNtfyMessage(items), opts);
     case 'gotify':
       return postJson(url, buildGotifyPayload(items), opts);
     case 'webhook':
@@ -136,7 +157,9 @@ export function sendTest(type, url, opts) {
   const text = '✅ DockPull test — your notifications are configured correctly.';
   switch (type) {
     case 'ntfy':
-      return postText(url, text, { Title: 'DockPull test', Tags: 'white_check_mark' }, opts);
+      // Same emoji-bearing title style as real notifications, so a passing
+      // test really proves real notifications will get through.
+      return postNtfy(url, { title: '✅ DockPull test', tags: 'white_check_mark', body: text }, opts);
     case 'gotify':
       return postJson(url, { title: 'DockPull test', message: text, priority: 5 }, opts);
     case 'webhook':
@@ -151,6 +174,7 @@ export default {
   NOTIFY_TYPES,
   buildDiscordPayload,
   buildNtfyMessage,
+  buildNtfyUrl,
   buildGotifyPayload,
   buildWebhookPayload,
   sendUpdates,
diff --git a/server/src/reconcile.js b/server/src/reconcile.js
index 97531f2..e1ae4d6 100644
--- a/server/src/reconcile.js
+++ b/server/src/reconcile.js
@@ -151,6 +151,22 @@ export function digestsEqual(a, b) {
   return na === nb;
 }
 
+/**
+ * True if `digest` equals the primary `currentDigest` or any of the image's
+ * other repo digests (see docker.js pickRepoDigests — one local image can be
+ * known under several registry digests, and any of them means "this exact
+ * image is what's running").
+ *
+ * @param {string|null|undefined} digest
+ * @param {string|null|undefined} currentDigest
+ * @param {Array<string>|null|undefined} [currentDigests]
+ * @returns {boolean}
+ */
+export function isRunningDigest(digest, currentDigest, currentDigests) {
+  if (digestsEqual(digest, currentDigest)) return true;
+  return Array.isArray(currentDigests) && currentDigests.some((d) => digestsEqual(digest, d));
+}
+
 /**
  * @param {string|null|undefined} digest
  * @returns {string|null} trimmed, lowercased `sha256:...` string, or null
diff --git a/server/src/routes/api.js b/server/src/routes/api.js
index b006a61..7294018 100644
--- a/server/src/routes/api.js
+++ b/server/src/routes/api.js
@@ -241,6 +241,38 @@ apiRouter.delete('/api/pin/:ref', (req, res) => {
   return res.status(200).json({ ok: true });
 });
 
+// Skip the currently offered update for an image ("not this build") without
+// pinning it: the card and notifications stay quiet until a newer build
+// appears. `DELETE` undoes it.
+function setSkipped(rawRef, skipped, res) {
+  if (typeof rawRef !== 'string' || rawRef.trim() === '') {
+    return res.status(400).json({ error: 'invalid_payload' });
+  }
+  let normalized;
+  try {
+    normalized = normalizeRef(rawRef);
+  } catch {
+    return res.status(400).json({ error: 'invalid_payload' });
+  }
+  if (!db.setLatestEventSkipped(normalized, skipped)) {
+    return res.status(404).json({ error: 'no_pending_update' });
+  }
+  broadcastGlobal({ type: 'containers-changed' });
+  return res.status(200).json({ ok: true });
+}
+
+apiRouter.post('/api/skip', (req, res) => setSkipped(req.body?.ref, true, res));
+
+apiRouter.delete('/api/skip/:ref', (req, res) => {
+  let ref;
+  try {
+    ref = decodeURIComponent(req.params.ref);
+  } catch {
+    return res.status(400).json({ error: 'invalid_payload' });
+  }
+  return setSkipped(ref, false, res);
+});
+
 // --- Settings ---
 
 apiRouter.get('/api/settings', (req, res) => {
diff --git a/server/src/scheduler.js b/server/src/scheduler.js
index 3589fae..86a3e6d 100644
--- a/server/src/scheduler.js
+++ b/server/src/scheduler.js
@@ -15,6 +15,7 @@ import { listContainers, listDanglingImages } from './docker.js';
 import { buildContainerItems } from './containers-service.js';
 import { normalizeRef } from './reconcile.js';
 import { sendUpdates } from './notify.js';
+import { broadcastGlobal } from './sse.js';
 import * as db from './db.js';
 
 let timer = null;
@@ -68,6 +69,8 @@ export function selectNotifyTargets(items, unnotifiedRefs, normalizeRefFn) {
  */
 export async function runScheduledCheck() {
   await runCheck();
+  // Let any open dashboards pick up what the scan found.
+  broadcastGlobal({ type: 'containers-changed' });
 
   // Best-effort: note whether there's anything to prune, so the client can
   // show a badge without hitting the Docker API on every page load. Never
@@ -96,6 +99,9 @@ export async function runScheduledCheck() {
     containers,
     lookupEvent: db.latestUnresolvedEventForRef,
     isPinned: (ref) => db.isPinned(ref),
+    // Same remembered versions the dashboard shows, so the message reads
+    // "1.2.3 → 1.2.4" rather than a junk label like "main".
+    lookupVersion: (digest) => db.getImageVersion(digest),
   });
 
   const { toNotify, hasNew } = selectNotifyTargets(items, unnotified, normalizeRef);
diff --git a/server/src/sse.js b/server/src/sse.js
index 5121b91..c8b637d 100644
--- a/server/src/sse.js
+++ b/server/src/sse.js
@@ -40,6 +40,13 @@ export function startSession(name) {
     return false;
   }
 
+  // A just-finished session for this name may still be in its grace period;
+  // cancel its cleanup timer, or it would fire mid-way through the NEW session
+  // (e.g. a Revert started right after a failed update) and delete it —
+  // silently dropping its logs and result.
+  const previous = sessions.get(name);
+  if (previous?.timer) clearTimeout(previous.timer);
+
   const session = {
     lines: [],
     result: null,
@@ -98,8 +105,10 @@ export function finish(name, result) {
   session.subscribers.clear();
 
   session.timer = setTimeout(() => {
-    sessions.delete(name);
+    // Only remove this session — never a newer one started under the same name.
+    if (sessions.get(name) === session) sessions.delete(name);
   }, FINISHED_SESSION_TTL_MS);
+  session.timer.unref?.();
 }
 
 /**
diff --git a/server/test/containers-service.test.js b/server/test/containers-service.test.js
index 49619b0..ce45617 100644
--- a/server/test/containers-service.test.js
+++ b/server/test/containers-service.test.js
@@ -158,6 +158,7 @@ describe('buildContainerItems', () => {
       availableDigest: null,
       availableVersion: null,
       breakingRisk: false,
+      skipped: false,
       pinned: false,
       canRevert: false,
       rollbackVersion: null,
@@ -207,3 +208,34 @@ describe('buildContainerItems', () => {
     assert.deepEqual(refsToResolve, ['docker.io/library/b:latest']);
   });
 });
+
+describe('buildContainerItems: image known under several repo digests', () => {
+  // Regression for "says there's an update but it's the same version": the
+  // running image has two RepoDigests for its repo (e.g. the publisher
+  // re-pushed the tag's index). The registry's current digest is the second
+  // one — that's the SAME image, not an update.
+  test('event digest matching any of the running repo digests -> no update, event resolved', () => {
+    const containers = [
+      makeContainer({ currentDigest: 'sha256:aaa', currentDigests: ['sha256:aaa', 'sha256:bbb'] }),
+    ];
+    const { items, refsToResolve } = buildContainerItems({
+      containers,
+      lookupEvent: () => ({ digest: 'sha256:bbb', available_version: '1.0.0' }),
+      isPinned: () => false,
+    });
+    assert.equal(items[0].updateAvailable, false);
+    assert.deepEqual(refsToResolve, ['docker.io/library/nginx:latest']);
+  });
+
+  test('a genuinely different digest is still an update', () => {
+    const containers = [
+      makeContainer({ currentDigest: 'sha256:aaa', currentDigests: ['sha256:aaa', 'sha256:bbb'] }),
+    ];
+    const { items } = buildContainerItems({
+      containers,
+      lookupEvent: () => ({ digest: 'sha256:ccc' }),
+      isPinned: () => false,
+    });
+    assert.equal(items[0].updateAvailable, true);
+  });
+});
diff --git a/server/test/db-skip.test.js b/server/test/db-skip.test.js
new file mode 100644
index 0000000..eac2b1e
--- /dev/null
+++ b/server/test/db-skip.test.js
@@ -0,0 +1,52 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// Point DATA_DIR at a throwaway dir BEFORE importing db.
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'dockpull-skip-'));
+process.env.DATA_DIR = tmp;
+
+const db = await import('../src/db.js');
+const { buildContainerItems } = await import('../src/containers-service.js');
+
+const REF = 'docker.io/library/nginx:latest';
+const container = {
+  name: 'nginx',
+  image: 'nginx:latest',
+  currentDigest: 'sha256:aaa',
+  normalizedRef: REF,
+  state: 'running',
+};
+const items = () =>
+  buildContainerItems({
+    containers: [container],
+    lookupEvent: db.latestUnresolvedEventForRef,
+    isPinned: () => false,
+  }).items;
+
+test('skip hides the offered build; a newer build shows up again; unskip restores', () => {
+  db.recordEvent({ image: 'nginx:latest', normalized_ref: REF, status: 'update', digest: 'sha256:bbb', available_version: '1.1' });
+  assert.equal(items()[0].updateAvailable, true);
+
+  assert.equal(db.setLatestEventSkipped(REF, true), true);
+  let [it] = items();
+  assert.equal(it.updateAvailable, false);
+  assert.equal(it.skipped, true);
+  assert.equal(it.availableVersion, '1.1');
+
+  assert.equal(db.setLatestEventSkipped(REF, false), true);
+  assert.equal(items()[0].updateAvailable, true);
+
+  db.setLatestEventSkipped(REF, true);
+  db.recordEvent({ image: 'nginx:latest', normalized_ref: REF, status: 'update', digest: 'sha256:ccc' });
+  [it] = items();
+  assert.equal(it.updateAvailable, true);
+  assert.equal(it.skipped, false);
+  assert.equal(it.availableDigest, 'sha256:ccc');
+});
+
+test('skip with no pending update reports nothing changed', () => {
+  assert.equal(db.setLatestEventSkipped('docker.io/library/none:latest', true), false);
+});
diff --git a/server/test/docker.test.js b/server/test/docker.test.js
index 4556dae..361c84a 100644
--- a/server/test/docker.test.js
+++ b/server/test/docker.test.js
@@ -18,3 +18,117 @@ test('shortImageId: empty / missing input returns an empty string', () => {
   assert.equal(shortImageId(null), '');
   assert.equal(shortImageId(undefined), '');
 });
+
+import { pickRepoDigests } from '../src/docker.js';
+
+test('pickRepoDigests: returns every digest for the configured repo, in order', () => {
+  const repoDigests = [
+    'nginx@sha256:111',
+    'ghcr.io/other/nginx@sha256:222',
+    'docker.io/library/nginx@sha256:333',
+  ];
+  assert.deepEqual(pickRepoDigests(repoDigests, 'nginx:latest'), ['sha256:111', 'sha256:333']);
+});
+
+test('pickRepoDigests: normalizes Hub namespaces and registries', () => {
+  assert.deepEqual(
+    pickRepoDigests(['linuxserver/sonarr@sha256:aaa'], 'docker.io/linuxserver/sonarr:latest'),
+    ['sha256:aaa']
+  );
+  assert.deepEqual(
+    pickRepoDigests(['registry:5000/team/app@sha256:bbb'], 'registry:5000/team/app:1.2'),
+    ['sha256:bbb']
+  );
+});
+
+test('pickRepoDigests: sole unrelated digest is used as a fallback; several are ambiguous', () => {
+  assert.deepEqual(pickRepoDigests(['mirror.local/x@sha256:aaa'], 'nginx:latest'), ['sha256:aaa']);
+  assert.deepEqual(
+    pickRepoDigests(['mirror.local/x@sha256:aaa', 'mirror.local/y@sha256:bbb'], 'nginx:latest'),
+    []
+  );
+  assert.deepEqual(pickRepoDigests(undefined, 'nginx:latest'), []);
+  assert.deepEqual(pickRepoDigests([], 'nginx:latest'), []);
+});
+
+import { buildRecreateOptions } from '../src/docker.js';
+
+const ID = 'abcdef1234567890'.padEnd(64, '0');
+const baseImage = {
+  Env: ['PATH=/usr/bin', 'APP_VERSION=1.0'],
+  Cmd: ['serve'],
+  Entrypoint: ['/entry'],
+  Labels: { 'org.opencontainers.image.version': '1.0' },
+  ExposedPorts: { '80/tcp': {} },
+  Volumes: { '/data': {} },
+  WorkingDir: '/app',
+  User: '',
+};
+const inspect = {
+  Id: ID,
+  Config: {
+    Hostname: ID.slice(0, 12),
+    Image: 'app:latest',
+    Env: ['PATH=/usr/bin', 'APP_VERSION=1.0', 'TZ=Europe/London'],
+    Cmd: ['serve'],
+    Entrypoint: ['/entry'],
+    Labels: { 'org.opencontainers.image.version': '1.0', 'my.label': 'x' },
+    ExposedPorts: { '80/tcp': {}, '9000/tcp': {} },
+    Volumes: { '/data': {} },
+    WorkingDir: '/app',
+    User: '',
+  },
+  HostConfig: { Binds: ['/srv/conf:/conf:ro'], RestartPolicy: { Name: 'unless-stopped' } },
+  Mounts: [
+    { Type: 'bind', Source: '/srv/conf', Destination: '/conf' },
+    { Type: 'volume', Name: 'f'.repeat(64), Destination: '/data', RW: true },
+  ],
+  NetworkSettings: {
+    Networks: {
+      web: { Aliases: ['app', ID.slice(0, 12)], IPAddress: '172.18.0.5', NetworkID: 'n1', EndpointID: 'e1' },
+    },
+  },
+};
+
+test('buildRecreateOptions: drops the old image defaults, keeps user overrides', () => {
+  const o = buildRecreateOptions(inspect, baseImage, 'app:latest');
+  assert.equal(o.Image, 'app:latest');
+  assert.deepEqual(o.Env, ['TZ=Europe/London']); // new image supplies PATH/APP_VERSION
+  assert.equal(o.Cmd, undefined);
+  assert.equal(o.Entrypoint, undefined);
+  assert.equal(o.WorkingDir, undefined);
+  assert.deepEqual(o.Labels, { 'my.label': 'x' });
+  assert.deepEqual(o.ExposedPorts, { '9000/tcp': {} });
+  assert.equal(o.Volumes, undefined);
+  assert.equal(o.Hostname, undefined); // default hostname = short ID
+  assert.deepEqual(o.HostConfig.RestartPolicy, { Name: 'unless-stopped' });
+});
+
+test('buildRecreateOptions: keeps a user-set command and hostname', () => {
+  const o = buildRecreateOptions(
+    { ...inspect, Config: { ...inspect.Config, Cmd: ['serve', '--debug'], Hostname: 'myhost' } },
+    baseImage,
+    'app:latest'
+  );
+  assert.deepEqual(o.Cmd, ['serve', '--debug']);
+  assert.equal(o.Hostname, 'myhost');
+});
+
+test('buildRecreateOptions: re-attaches anonymous volumes so their data survives', () => {
+  const o = buildRecreateOptions(inspect, baseImage, 'app:latest');
+  assert.deepEqual(o.HostConfig.Binds, ['/srv/conf:/conf:ro', `${'f'.repeat(64)}:/data`]);
+  // Does not mutate the inspect data.
+  assert.deepEqual(inspect.HostConfig.Binds, ['/srv/conf:/conf:ro']);
+});
+
+test('buildRecreateOptions: network endpoints keep aliases but drop runtime state', () => {
+  const o = buildRecreateOptions(inspect, baseImage, 'app:latest');
+  assert.deepEqual(o.NetworkingConfig.EndpointsConfig, { web: { Aliases: ['app'] } });
+});
+
+test('buildRecreateOptions: without the base image config, everything is kept', () => {
+  const o = buildRecreateOptions(inspect, null, 'sha256:old');
+  assert.equal(o.Image, 'sha256:old');
+  assert.deepEqual(o.Env, inspect.Config.Env);
+  assert.deepEqual(o.Cmd, ['serve']);
+});
diff --git a/server/test/notify.test.js b/server/test/notify.test.js
index abb93ee..2822c4d 100644
--- a/server/test/notify.test.js
+++ b/server/test/notify.test.js
@@ -5,7 +5,11 @@ import {
   buildNtfyMessage,
   buildGotifyPayload,
   buildWebhookPayload,
+  buildNtfyUrl,
+  sendUpdates,
+  sendTest,
 } from '../src/notify.js';
+import http from 'node:http';
 
 test('buildDiscordPayload: header pluralizes and lists items', () => {
   const p = buildDiscordPayload([
@@ -51,3 +55,46 @@ test('buildWebhookPayload: structured containers array', () => {
   assert.equal(p.containers[0].currentVersion, '10.9.0');
   assert.equal(p.containers[1].currentVersion, null);
 });
+
+test('versions: shows "current → available", and flags same-version rebuilds', () => {
+  const p = buildDiscordPayload([
+    { name: 'a', image: 'a:latest', currentVersion: '1.0.0', availableVersion: '1.1.0' },
+    { name: 'b', image: 'b:latest', currentVersion: '2.0.0', availableVersion: '2.0.0' },
+  ]);
+  assert.match(p.content, /1\.0\.0 → 1\.1\.0/);
+  assert.match(p.content, /2\.0\.0, rebuilt/);
+});
+
+test('buildNtfyUrl: carries title/tags as query params and keeps existing ones', () => {
+  const u = new URL(buildNtfyUrl('https://ntfy.example/topic?auth=abc', { title: '🔔 2 updates', tags: 'package' }));
+  assert.equal(u.searchParams.get('auth'), 'abc');
+  assert.equal(u.searchParams.get('title'), '🔔 2 updates');
+  assert.equal(u.searchParams.get('tags'), 'package');
+});
+
+// Regression: the emoji title used to go in a `Title` header, which fetch
+// rejects (headers must be Latin-1) — so every real ntfy notification threw.
+test('sendUpdates/sendTest (ntfy): emoji titles are delivered, not thrown', async () => {
+  const received = [];
+  const server = http.createServer((req, res) => {
+    let body = '';
+    req.on('data', (c) => (body += c));
+    req.on('end', () => {
+      received.push({ url: req.url, body });
+      res.end('ok');
+    });
+  });
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const url = `http://127.0.0.1:${server.address().port}/updates`;
+  try {
+    const r1 = await sendUpdates('ntfy', url, items);
+    const r2 = await sendTest('ntfy', url);
+    assert.equal(r1.ok, true);
+    assert.equal(r2.ok, true);
+    const q = new URL(received[0].url, 'http://x').searchParams;
+    assert.match(q.get('title'), /🔔 2 container updates available/);
+    assert.match(received[0].body, /jellyfin/);
+  } finally {
+    server.close();
+  }
+});
diff --git a/server/test/sse.test.js b/server/test/sse.test.js
new file mode 100644
index 0000000..4e3f345
--- /dev/null
+++ b/server/test/sse.test.js
@@ -0,0 +1,60 @@
+import { test, mock } from 'node:test';
+import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
+import * as sse from '../src/sse.js';
+
+function fakeRes() {
+  const res = new EventEmitter();
+  res.chunks = [];
+  res.ended = false;
+  res.writeHead = () => {};
+  res.write = (c) => res.chunks.push(c);
+  res.end = () => {
+    res.ended = true;
+  };
+  return res;
+}
+
+test('a finished session\'s cleanup timer never deletes a newer session with the same name', () => {
+  mock.timers.enable({ apis: ['setTimeout'] });
+  try {
+    sse.startSession('web');
+    sse.finish('web', { success: false, message: 'unhealthy' });
+
+    // Revert started within the grace period.
+    assert.ok(sse.startSession('web'));
+    mock.timers.tick(60_000);
+
+    assert.equal(sse.isActive('web'), true, 'new session must survive the old timer');
+    const res = fakeRes();
+    sse.subscribe('web', res);
+    sse.pushLog('web', 'reverting…');
+    sse.finish('web', { success: true, message: 'Reverted' });
+    const out = res.chunks.join('');
+    assert.match(out, /reverting…/);
+    assert.match(out, /"type":"result","success":true/);
+    assert.equal(res.ended, true);
+  } finally {
+    mock.timers.reset();
+  }
+});
+
+test('a finished session is still replayable during the grace period, then removed', () => {
+  mock.timers.enable({ apis: ['setTimeout'] });
+  try {
+    sse.startSession('db');
+    sse.pushLog('db', 'pulling');
+    sse.finish('db', { success: true, message: 'ok' });
+
+    const late = fakeRes();
+    sse.subscribe('db', late);
+    assert.match(late.chunks.join(''), /pulling[\s\S]*"success":true/);
+
+    mock.timers.tick(31_000);
+    const later = fakeRes();
+    sse.subscribe('db', later);
+    assert.match(later.chunks.join(''), /No active update/);
+  } finally {
+    mock.timers.reset();
+  }
+});