fix: version 3.0.1 -- Actualizador espera a backend y frontend antes de recargar

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/apply-update.sh

@@ -19,11 +19,20 @@ set -euo pipefail
 : "${APP_DIR:?falta APP_DIR}"
 : "${BACKEND_SERVICE:?falta BACKEND_SERVICE}"
 : "${FRONTEND_SERVICE:?falta FRONTEND_SERVICE}"
+: "${TARGET_VERSION:?falta TARGET_VERSION}"
 
 LOG="$APP_DIR/logs/update.log"
 mkdir -p "$APP_DIR/logs" "$APP_DIR/backups"
 exec >>"$LOG" 2>&1
 
+PHASE=backup
+write_status() {
+  printf '%s|%s|%s\n' "$1" "$PHASE" "$TARGET_VERSION" > "$APP_DIR/logs/update.status.tmp"
+  mv "$APP_DIR/logs/update.status.tmp" "$APP_DIR/logs/update.status"
+}
+trap 'write_status failed' ERR
+write_status running
+
 echo ""
 echo "=== update start $(date -Iseconds) ==="
 
@@ -32,18 +41,25 @@ mysqldump --single-transaction -h "$DB_HOST" -u "$DB_USER" -p"$DB_PASSWORD" "$DB
   > "$APP_DIR/backups/pre_update_$(date +%Y%m%d_%H%M%S).sql"
 
 echo "-- git fetch + reset --"
+PHASE=source
+write_status running
 cd "$APP_DIR/source"
 git fetch origin main
 git reset --hard origin/main
 NEW_VERSION="$(cat VERSION)"
 echo "version objetivo: $NEW_VERSION"
+[[ "$NEW_VERSION" == "$TARGET_VERSION" ]] || { echo "version remota distinta de la solicitada: $TARGET_VERSION"; false; }
 
 echo "-- backend: npm install + migraciones --"
+PHASE=backend
+write_status running
 cd "$APP_DIR/source/backend"
 npm install --omit=dev
 node src/scripts/migrate-db.js
 
 echo "-- frontend: npm install + build --"
+PHASE=frontend
+write_status running
 cd "$APP_DIR/source/frontend"
 # --include=dev es necesario a la fuerza: este script hereda NODE_ENV=production del backend
 # (via EnvironmentFile), y con eso npm salta devDependencies por defecto -- incluido vite, que
@@ -53,10 +69,14 @@ npm install --include=dev
 npm run build
 
 echo "-- publicando build de frontend --"
+PHASE=publish
+write_status running
 rm -rf "$APP_DIR/frontend/dist"
 cp -r dist "$APP_DIR/frontend/dist"
 
 echo "-- reiniciando servicios --"
+PHASE=restart
+write_status running
 # Dos llamadas separadas a proposito: el sudoers NOPASSWD (ver DEPLOY_WEB.md) whitelistea cada
 # "systemctl restart <servicio>" por separado -- un solo "systemctl restart back front" junto no
 # matchea ninguna de las dos reglas, sudo pide contraseña, falla en este contexto sin terminal, y
@@ -65,4 +85,6 @@ echo "-- reiniciando servicios --"
 sudo systemctl restart "$BACKEND_SERVICE"
 sudo systemctl restart "$FRONTEND_SERVICE"
 
+PHASE=complete
+write_status done
 echo "=== update done $(date -Iseconds) -- v$NEW_VERSION ==="