Merge main (update-after-download, search button) into beta

frontend/app.js

@@ -8705,10 +8705,34 @@ async function maybeShowUpdateBanner() {
     // swap is instant. Purely an optimisation — if it never finishes, applyUpdate
     // falls back to downloading.
     prefetchUpdate();
+    // Ask only once the new build is fully on disk, so "Refresh UI" is an
+    // instant swap. Until then keep downloading quietly and re-check; if the
+    // download never completes (8 min) ask anyway — Refresh UI then downloads.
+    _updateSeenAt = _updateSeenAt || Date.now();
+    if (!(await updateDownloaded()) && Date.now() - _updateSeenAt < 8 * 60 * 1000) {
+      setTimeout(maybeShowUpdateBanner, 15000);
+      return;
+    }
     showUpdateBanner(server);
   }
 }
 
+let _updateSeenAt = 0;
+// Is the new worker installed and holding the complete new shell? No service
+// worker support (or no registration) means there is nothing to wait for.
+async function updateDownloaded() {
+  try {
+    if (!('serviceWorker' in navigator)) return true;
+    const reg = _swReg || await navigator.serviceWorker.getRegistration();
+    if (!reg) return true;
+    if (!reg.waiting) return false;
+    const SU = window.SwUpdate;
+    if (!SU) return true;
+    const st = await SU.askCacheStatus(reg.waiting, { timeoutMs: 4000, setTimeout: (fn, ms) => setTimeout(fn, ms) });
+    return !!(st && st.ready);
+  } catch { return false; }
+}
+
 // Kicks the service worker into installing the new build in the background.
 // Safe to call repeatedly: update() is a no-op when a worker is already
 // installing or waiting.