@@ -59,8 +59,9 @@ public static boolean hasPending(Context ctx) {
      */
     static boolean canDrainNow(Context ctx) {
         if (org.iiab.controller.install.presentation.ModuleQueueRepository.get().isRunning()
-                || MapsProvisioner.hasPending(ctx)) {
-            Log.d(TAG, "kolibri drain blocked: proot (runrole) work is pending/running");
+                || MapsProvisioner.hasPending(ctx)
+                || org.iiab.controller.redesign.DashboardRebuildService.isRunning()) {   // ADFA-5333
+            Log.d(TAG, "kolibri drain blocked: proot (runrole) or dashboard-update work is in flight");
             return false;
         }
         // ADFA-5074: unfinished work only. This read a merely registered session, so a
 
@@ -41,8 +41,9 @@ public static void drain(Context ctx) {
         // background processes and concurrent REST work is a recipe for corruption. Defer REST while a
         // module-queue (proot) job is pending or running; a later drain pass picks it up once idle.
         if (org.iiab.controller.install.presentation.ModuleQueueRepository.get().isRunning()
-                || MapsProvisioner.hasPending(ctx)) {
-            Log.d(TAG, "books drain deferred: proot (runrole) work is pending/running");
+                || MapsProvisioner.hasPending(ctx)
+                || DashboardRebuildService.isRunning()) {   // ADFA-5333: a live dashboard update restarts dash-node
+            Log.d(TAG, "books drain deferred: proot (runrole) or dashboard-update work is in flight");
             return;
         }
         // ADFA-4954 (ADR-4954 D8): the live REST streams also serialize against each other.
 
@@ -147,7 +147,7 @@ private void resolveInitialUpdatingState() {
                 if (!isAdded()) return;
                 if (DashboardRebuildService.STATE_RUNNING.equals(state) && !DashboardRebuildService.isRunning()) {
                     setUpdating(true);
-                    DashboardRebuildService.start(ctx);
+                    DashboardRebuildService.attach(ctx);   // re-own without risking a fresh rebuild
                 }
             }
             @Override public void onErr(String message) { /* box stopped/offline — nothing in flight to show */ }
 
@@ -51,6 +51,8 @@ public final class DashboardRebuildService extends Service {
     private static final int NOTIFICATION_ID = 10;   // app-global; distinct from the other services
 
     public static final String ACTION_START = "org.iiab.controller.DASHBOARD_UPDATE_START";
+    /** ADFA-5333: re-own an already-running rebuild (poll only, never POST a new one). */
+    public static final String ACTION_ATTACH = "org.iiab.controller.DASHBOARD_UPDATE_ATTACH";
     /** ADFA-5333: request a clean cancel (from the notification action or the card button). */
     public static final String ACTION_CANCEL = "org.iiab.controller.DASHBOARD_UPDATE_CANCEL";
     /** App-internal broadcast on every state change so a visible card can reflect it live. */
@@ -72,14 +74,20 @@ public final class DashboardRebuildService extends Service {
     private boolean started = false;    // one rebuild per service instance; ignore re-delivered starts
     private boolean cancelling = false; // a cancel request is in flight; ignore repeats
 
-    /** Kick the background live update. Safe to call again while running — the box reports 409 and the
-     *  service just keeps polling the in-flight rebuild (so a card can re-own a lost session by calling
-     *  this after it sees the box still rebuilding). */
+    /** Kick a NEW background live update (POST + poll). */
     public static void start(Context ctx) {
         ContextCompat.startForegroundService(ctx,
                 new Intent(ctx, DashboardRebuildService.class).setAction(ACTION_START));
     }
 
+    /** Re-own a rebuild that is ALREADY running on the box (e.g. our process was killed mid-update): poll
+     *  it to completion and restore the notification, but never POST a new rebuild — so a card that sees
+     *  the box still building can attach without risking a second run if the original just finished. */
+    public static void attach(Context ctx) {
+        ContextCompat.startForegroundService(ctx,
+                new Intent(ctx, DashboardRebuildService.class).setAction(ACTION_ATTACH));
+    }
+
     @Override public void onCreate() { super.onCreate(); createNotificationChannel(); }
     @Nullable @Override public IBinder onBind(Intent intent) { return null; }
 
@@ -90,15 +98,22 @@ public int onStartCommand(Intent intent, int flags, int startId) {
         // — otherwise the system raises "did not call startForeground". It's idempotent, so satisfy the
         // contract first.
         startForeground(NOTIFICATION_ID, buildOngoing());
-        if (ACTION_CANCEL.equals(intent != null ? intent.getAction() : null)) { requestCancel(); return START_NOT_STICKY; }
+        final String action = intent != null ? intent.getAction() : null;
+        if (ACTION_CANCEL.equals(action)) { requestCancel(); return START_NOT_STICKY; }
         if (started) return START_NOT_STICKY;
         started = true;
         RUNNING = true;
         broadcastState(STATE_RUNNING);
-        DashboardClient.rebuildStart(new DashboardClient.RebuildStartCb() {
-            @Override public void onStarted(boolean alreadyRunning) { pollStatus(); }
-            @Override public void onErr(String message) { finish(STATE_ERROR, R.string.k2go_dash_live_start_failed); }
-        });
+        if (ACTION_ATTACH.equals(action)) {
+            // Re-own: the box is already building, so just poll to completion (a first poll that finds
+            // done/error finishes at once — no new rebuild is ever launched).
+            pollStatus();
+        } else {
+            DashboardClient.rebuildStart(new DashboardClient.RebuildStartCb() {
+                @Override public void onStarted(boolean alreadyRunning) { pollStatus(); }
+                @Override public void onErr(String message) { finish(STATE_ERROR, R.string.k2go_dash_live_start_failed); }
+            });
+        }
         return START_NOT_STICKY;
     }
 
 
@@ -42,8 +42,9 @@ public static void drain(Context ctx) {
         // background processes; concurrent REST work risks corruption). Defer ZIM while a module-queue
         // (proot) job is pending or running; a later drain pass runs it once proot is idle.
         if (org.iiab.controller.install.presentation.ModuleQueueRepository.get().isRunning()
-                || MapsProvisioner.hasPending(ctx)) {
-            Log.d(TAG, "zim drain deferred: proot (runrole) work is pending/running");
+                || MapsProvisioner.hasPending(ctx)
+                || DashboardRebuildService.isRunning()) {   // ADFA-5333: a live dashboard update restarts dash-node
+            Log.d(TAG, "zim drain deferred: proot (runrole) or dashboard-update work is in flight");
             return;
         }
         // ADFA-4954 (ADR-4954 D8): the live REST streams also serialize against each other.
 
@@ -316,16 +316,32 @@ apiRouter.post('/system/dashboard/rebuild/cancel', (_req: Request, res: Response
         // can't signal it. Do NOT claim success or touch the status — the app can retry in a moment.
         res.status(409).json({ error: 'cancel not ready', cancelled: false }); return;
     }
+    // Verify the pid is actually OUR rebuild script before signaling — never SIGTERM a recycled/unrelated
+    // pid. /proc/<pid>/cmdline is NUL-separated; a substring match on the script name is enough.
+    let cmdline = '';
+    try { cmdline = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8'); } catch { /* process gone / no proc */ }
+    const healStale = (): void => {
+        try { fs.writeFileSync(REBUILD_STATUS_FILE, 'idle'); } catch { /* best effort */ }
+        try { fs.rmdirSync(REBUILD_LOCK_DIR); } catch { /* maybe already gone */ }
+        try { fs.unlinkSync(REBUILD_PHASE_FILE); } catch { /* maybe already gone */ }
+        try { fs.unlinkSync(REBUILD_PID_FILE); } catch { /* maybe already gone */ }
+    };
+    if (cmdline === '' && !fs.existsSync(`/proc/${pid}`)) {
+        // The run already exited but left stale state (status 'running' with a dead pid) — heal it and
+        // report success; there is nothing left to stop.
+        healStale();
+        res.status(200).json({ ok: true, cancelled: true }); return;
+    }
+    if (!cmdline.includes('rebuild-dashboard.sh')) {
+        // The pid is alive but was recycled by an unrelated process — refuse to signal it.
+        res.status(409).json({ error: 'stale pid', cancelled: false }); return;
+    }
     try {
-        // Signal the whole detached session group; its EXIT/TERM trap purges staging + removes lock/phase/pid.
+        // Signal the whole detached session group; the script's on_cancel/EXIT trap sets status idle and
+        // purges staging + lock/phase/pid. We also write idle + best-effort rmdir here as belt-and-suspenders.
         try { process.kill(-pid, 'SIGTERM'); } catch { /* group already gone */ }
         try { process.kill(pid, 'SIGTERM'); } catch { /* leader already gone */ }
-        // We own the status file, so reset it to idle (a stopped build is "nothing running", not an error).
-        // Best-effort lock rmdir in case the trap is slow, so a fresh rebuild can start without wedging.
-        try { fs.writeFileSync(REBUILD_STATUS_FILE, 'idle'); } catch { /* best effort */ }
-        try { fs.rmdirSync(REBUILD_LOCK_DIR); } catch { /* trap likely removed it */ }
-        try { fs.unlinkSync(REBUILD_PHASE_FILE); } catch { /* trap may have removed it */ }
-        try { fs.unlinkSync(REBUILD_PID_FILE); } catch { /* trap may have removed it */ }
+        healStale();
         res.status(200).json({ ok: true, cancelled: true });
     } catch (e: any) {
         res.status(500).json({ error: e?.message || 'cancel failed', cancelled: false });
 
@@ -72,12 +72,17 @@ verify_live() {
 }
 cleanup() { [ -n "${TESTPID:-}" ] && kill "$TESTPID" 2>/dev/null || true; purge_staging; rmdir "$LOCK" 2>/dev/null || true; rm -f "$PHASE" "$PIDFILE" 2>/dev/null || true; }
 fail() { log "FAIL: $*"; set_status "error"; cleanup; exit 1; }
+# ADFA-5333: a cancel (SIGTERM/INT during the building phase) self-heals the state — set the status to
+# idle BEFORE cleanup so a killed build can never leave a wedged "running" (the endpoint also writes idle,
+# but this makes it true regardless of whether the endpoint completes). Ignored during promote (trapped off).
+on_cancel() { log "canceled"; set_status "idle"; cleanup; exit 0; }
 
 # Single-flight: mkdir is atomic.
 mkdir "$LOCK" 2>/dev/null || { echo "another rebuild is running" >&2; exit 3; }
 # ADFA-5333: clean staging + phase/pid on ANY exit, including a cancel signal (TERM/INT). Killing this
 # session during steps 1-3 therefore leaves nothing behind and the live dashboard untouched.
-trap cleanup EXIT INT TERM
+trap cleanup EXIT
+trap on_cancel INT TERM
 : > "$LOG" 2>/dev/null || true
 set_status "running"
 set_phase "building"
@@ -174,6 +179,7 @@ else
     rm -rf "$BACKUP"
     set_status "error"
 fi
-# Promote window done — nothing left touches the live dashboard, so signals may be handled normally again.
-trap cleanup EXIT INT TERM
+# Promote done: the terminal status (done/error) is already written and only cleanup remains, so keep
+# INT/TERM ignored — a late signal must NOT run on_cancel and overwrite that status with "idle". The EXIT
+# trap still runs cleanup on the way out.
 cleanup
Original file line number	Diff line number	Diff line change
`@@ -147,7 +147,7 @@ private void resolveInitialUpdatingState() {`
`147`	`147`	`if (!isAdded()) return;`
`148`	`148`	`if (DashboardRebuildService.STATE_RUNNING.equals(state) && !DashboardRebuildService.isRunning()) {`
`149`	`149`	`setUpdating(true);`
`150`		`- DashboardRebuildService.start(ctx);`
	`150`	`+ DashboardRebuildService.attach(ctx); // re-own without risking a fresh rebuild`
`151`	`151`	`}`
`152`	`152`	`}`
`153`	`153`	`@Override public void onErr(String message) { /* box stopped/offline — nothing in flight to show */ }`