test(updates): fix channel-signature fallout + add i18n keys to all 14 locales

- test_update_stash_recovery: add merge-base handler for the force-update
  rewind guard probe (origin/master is a descendant of HEAD -> not a rewind)
- test_security_review_fixes: fake_check accepts channel kwarg
- i18n.js: native translations of the 4 update-channel keys for all 14
  non-English locales (locale-coverage tests enforce key presence)

static/i18n.js

@@ -2541,6 +2541,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Mostra sessioni di messaggistica precedenti',
     settings_label_sync_insights: 'Sincronizza con insights',
     settings_label_check_updates: 'Verifica aggiornamenti',
+    settings_label_update_channel: 'Canale di aggiornamento',
+    settings_update_channel_stable: 'Stabile (consigliato)',
+    settings_update_channel_experimental: 'Sperimentale',
+    settings_desc_update_channel: 'Stabile riceve release consolidate e testate. Sperimentale riceve ogni release appena esce: più veloce, ma può avere imperfezioni. Tornando a Stabile mantieni la versione attuale finché Stabile non la raggiunge.',
     settings_label_ignore_agent_updates: 'Ignore Agent updates',
     settings_label_whats_new_summary: "Summarize What's New with AI",
     settings_label_bot_name: 'Nome assistente predefinito',
@@ -4227,6 +4231,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: '以前のメッセージングセッションを表示',
     settings_label_sync_insights: 'インサイトに同期',
     settings_label_check_updates: 'アップデートを確認',
+    settings_label_update_channel: 'アップデートチャンネル',
+    settings_update_channel_stable: '安定版（推奨）',
+    settings_update_channel_experimental: '実験版',
+    settings_desc_update_channel: '安定版は熟成済みの実績あるリリースを受け取ります。実験版はリリースを出た直後に受け取ります。速いですが不具合が出ることがあります。安定版に戻しても、安定版が追いつくまで現在のバージョンを維持します。',
     settings_label_ignore_agent_updates: 'Agentのアップデートを無視',
     settings_label_whats_new_summary: "What's New をAIで要約",
     settings_label_bot_name: 'デフォルトのアシスタント名',
@@ -5621,6 +5629,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Показывать предыдущие сеансы обмена сообщениями',
     settings_label_sync_insights: 'Синхронизировать с Insights',
     settings_label_check_updates: 'Проверять обновления',
+    settings_label_update_channel: 'Канал обновлений',
+    settings_update_channel_stable: 'Стабильный (рекомендуется)',
+    settings_update_channel_experimental: 'Экспериментальный',
+    settings_desc_update_channel: 'Стабильный канал получает проверенные, обкатанные релизы. Экспериментальный получает каждый релиз сразу — быстрее, но возможны шероховатости. При возврате на Стабильный ваша версия сохраняется, пока Стабильный не догонит её.',
     settings_label_ignore_agent_updates: 'Ignore Agent updates',
     settings_label_whats_new_summary: "Summarize What's New with AI",
     settings_label_bot_name: 'Имя помощника по умолчанию',
@@ -7234,6 +7246,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Mostrar sesiones de mensajería anteriores',
     settings_label_sync_insights: 'Sincronizar con insights',
     settings_label_check_updates: 'Buscar actualizaciones',
+    settings_label_update_channel: 'Canal de actualizaciones',
+    settings_update_channel_stable: 'Estable (recomendado)',
+    settings_update_channel_experimental: 'Experimental',
+    settings_desc_update_channel: 'Estable recibe versiones probadas y maduradas. Experimental recibe cada versión en cuanto sale: más rápido, pero puede tener asperezas. Al volver a Estable conservas tu versión actual hasta que Estable la alcance.',
     settings_label_ignore_agent_updates: 'Ignore Agent updates',
     settings_label_whats_new_summary: "Summarize What's New with AI",
     settings_label_bot_name: 'Nombre predeterminado del asistente',
@@ -8835,6 +8851,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Vorherige Messaging-Sitzungen anzeigen',
     settings_label_sync_insights: 'Mit Insights synchronisieren',
     settings_label_check_updates: 'Nach Updates suchen',
+    settings_label_update_channel: 'Update-Kanal',
+    settings_update_channel_stable: 'Stabil (empfohlen)',
+    settings_update_channel_experimental: 'Experimentell',
+    settings_desc_update_channel: 'Stabil erhält ausgereifte, bewährte Releases. Experimentell erhält jedes Release sofort — schneller, aber mit möglichen Ecken und Kanten. Beim Zurückwechseln zu Stabil behältst du deine aktuelle Version, bis Stabil aufholt.',
     settings_label_ignore_agent_updates: 'Ignore Agent updates',
     settings_label_whats_new_summary: "Summarize What's New with AI",
     settings_label_bot_name: 'Standard-Assistentenname',
@@ -10501,6 +10521,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: '显示以前的消息会话',
     settings_label_sync_insights: '同步到 insights',
     settings_label_check_updates: '检查更新',
+    settings_label_update_channel: '更新通道',
+    settings_update_channel_stable: '稳定版（推荐）',
+    settings_update_channel_experimental: '实验版',
+    settings_desc_update_channel: '稳定版提供经过充分验证的成熟版本。实验版会在每个版本发布时立即提供——更快，但可能有粗糙之处。切回稳定版会保留当前版本，直到稳定版赶上。',
     settings_label_ignore_agent_updates: '忽略智能体更新',
     settings_label_whats_new_summary: "用AI总结新功能",
     settings_label_bot_name: '默认助手名称',
@@ -12408,6 +12432,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: '顯示以前的訊息對話',
     settings_label_sync_insights: '同步至 insights',
     settings_label_check_updates: '檢查更新',
+    settings_label_update_channel: '更新通道',
+    settings_update_channel_stable: '穩定版（建議）',
+    settings_update_channel_experimental: '實驗版',
+    settings_desc_update_channel: '穩定版提供經過充分驗證的成熟版本。實驗版會在每個版本發布時立即提供——更快，但可能有粗糙之處。切回穩定版會保留目前版本，直到穩定版趕上。',
     settings_label_ignore_agent_updates: '忽略 Agent 更新',
     settings_label_whats_new_summary: '使用 AI 摘要新版內容',
     settings_label_bot_name: '助理名稱',
@@ -13989,6 +14017,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Mostrar sessões de mensagens anteriores',
     settings_label_sync_insights: 'Sincronizar para insights',
     settings_label_check_updates: 'Verificar atualizações',
+    settings_label_update_channel: 'Canal de atualização',
+    settings_update_channel_stable: 'Estável (recomendado)',
+    settings_update_channel_experimental: 'Experimental',
+    settings_desc_update_channel: 'Estável recebe versões testadas e amadurecidas. Experimental recebe cada versão assim que sai — mais rápido, mas pode ter arestas. Ao voltar para Estável você mantém sua versão atual até que o Estável a alcance.',
     settings_label_ignore_agent_updates: 'Ignore Agent updates',
     settings_label_whats_new_summary: "Summarize What's New with AI",
     settings_label_bot_name: 'Nome padrão do assistente',
@@ -15574,6 +15606,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: '이전 메시징 세션 표시',
     settings_label_sync_insights: 'Insights에 동기화',
     settings_label_check_updates: '업데이트 확인',
+    settings_label_update_channel: '업데이트 채널',
+    settings_update_channel_stable: '안정 버전(권장)',
+    settings_update_channel_experimental: '실험 버전',
+    settings_desc_update_channel: '안정 채널은 충분히 검증된 릴리스를 받습니다. 실험 채널은 릴리스가 나오는 즉시 받습니다 — 더 빠르지만 거친 부분이 있을 수 있습니다. 안정 채널로 되돌려도 안정 채널이 따라잡을 때까지 현재 버전이 유지됩니다.',
     settings_label_ignore_agent_updates: 'Ignore Agent updates',
     settings_label_whats_new_summary: "Summarize What's New with AI",
     settings_label_bot_name: '기본 Assistant 이름',
@@ -17272,6 +17308,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Afficher les sessions de messagerie précédentes',
     settings_label_sync_insights: 'Synchroniser avec les analyses',
     settings_label_check_updates: 'Vérifier les mises à jour',
+    settings_label_update_channel: 'Canal de mise à jour',
+    settings_update_channel_stable: 'Stable (recommandé)',
+    settings_update_channel_experimental: 'Expérimental',
+    settings_desc_update_channel: 'Stable reçoit des versions éprouvées et matures. Expérimental reçoit chaque version dès sa sortie — plus rapide, mais avec de possibles aspérités. En revenant sur Stable, vous conservez votre version actuelle jusqu\'à ce que Stable la rattrape.',
     settings_label_ignore_agent_updates: 'Ignorer les mises à jour de l\'agent',
     settings_label_whats_new_summary: "Résumer les nouveautés avec l'IA",
     settings_label_bot_name: 'Nom de l\'assistant par défaut',
@@ -19062,6 +19102,10 @@ const LOCALES = {
     settings_label_bot_name: 'Výchozí název asistenta',
     settings_label_chat_activity_display_mode: 'Zobrazení aktivity',
     settings_label_check_updates: 'Kontrolovat aktualizace',
+    settings_label_update_channel: 'Kanál aktualizací',
+    settings_update_channel_stable: 'Stabilní (doporučeno)',
+    settings_update_channel_experimental: 'Experimentální',
+    settings_desc_update_channel: 'Stabilní kanál dostává ověřená, prověřená vydání. Experimentální dostává každé vydání hned — rychlejší, ale může mít nedodělky. Při přepnutí zpět na Stabilní si ponecháte svou současnou verzi, dokud ji Stabilní nedožene.',
     settings_label_claude_code_sessions: 'Zobrazit Claude Code relace',
     settings_label_composer_controls: 'Ovládací prvky zápatí chatu',
     settings_label_composer_situational_controls: 'Situační ovládací prvky zápatí',
@@ -20571,6 +20615,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Önceki mesajlaşma oturumlarını göster',
     settings_label_sync_insights: 'Analizlerle senkronize edin',
     settings_label_check_updates: 'Güncellemeleri kontrol edin',
+    settings_label_update_channel: 'Güncelleme kanalı',
+    settings_update_channel_stable: 'Kararlı (önerilir)',
+    settings_update_channel_experimental: 'Deneysel',
+    settings_desc_update_channel: 'Kararlı kanal olgunlaşmış, kanıtlanmış sürümleri alır. Deneysel kanal her sürümü çıktığı anda alır — daha hızlı ama pürüzler olabilir. Kararlı\'ya geri dönmek, Kararlı yetişene kadar mevcut sürümünüzü korur.',
     settings_label_whats_new_summary: "Summarize What's New with AI",
     settings_label_bot_name: 'Varsayılan asistanın adı',
     settings_label_password: 'Erişim Şifresi',
@@ -22271,6 +22319,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Pokaż poprzednie sesje komunikatorów',
     settings_label_sync_insights: 'Synchronizuj z Insights',
     settings_label_check_updates: 'Sprawdzaj aktualizacje',
+    settings_label_update_channel: 'Kanał aktualizacji',
+    settings_update_channel_stable: 'Stabilny (zalecany)',
+    settings_update_channel_experimental: 'Eksperymentalny',
+    settings_desc_update_channel: 'Kanał stabilny otrzymuje sprawdzone, dojrzałe wydania. Eksperymentalny otrzymuje każde wydanie od razu — szybciej, ale mogą wystąpić niedoróbki. Powrót na Stabilny zachowuje bieżącą wersję, dopóki Stabilny jej nie dogoni.',
     settings_label_ignore_agent_updates: 'Ignoruj aktualizacje agenta',
     settings_label_whats_new_summary: 'Podsumuj Co Nowego za pomocą AI',
     settings_label_bot_name: 'Domyślna nazwa asystenta',
@@ -23799,6 +23851,10 @@ const LOCALES = {
     settings_label_previous_messaging_sessions: 'Hiện các phiên nhắn tin trước đó',
     settings_label_sync_insights: 'Đồng bộ sang insights',
     settings_label_check_updates: 'Kiểm tra cập nhật',
+    settings_label_update_channel: 'Kênh cập nhật',
+    settings_update_channel_stable: 'Ổn định (khuyến nghị)',
+    settings_update_channel_experimental: 'Thử nghiệm',
+    settings_desc_update_channel: 'Kênh Ổn định nhận các bản phát hành đã được kiểm chứng kỹ. Kênh Thử nghiệm nhận mọi bản phát hành ngay khi có — nhanh hơn nhưng có thể còn lỗi. Khi chuyển về Ổn định, bạn giữ phiên bản hiện tại cho đến khi Ổn định bắt kịp.',
     settings_label_ignore_agent_updates: 'Bỏ qua cập nhật Agent',
     settings_label_whats_new_summary: "Tóm tắt What's New bằng AI",
     settings_label_bot_name: 'Tên assistant mặc định',

tests/test_security_review_fixes.py

@@ -118,7 +118,7 @@ def test_post_update_check_performs_forced_fetch(monkeypatch):
     monkeypatch.setattr(routes, "load_settings", lambda: {"check_for_updates": True})
     monkeypatch.setattr(routes, "_check_csrf", lambda handler: True)
 
-    def fake_check(*, force=False, include_agent=True):
+    def fake_check(*, force=False, include_agent=True, channel="stable"):
         calls.append((force, include_agent))
         return {"checked_at": 456, "webui": None, "agent": None}
 

tests/test_update_stash_recovery.py

@@ -56,6 +56,10 @@ def test_apply_force_update_removes_untracked_files_before_reset(tmp_path):
             return '', True
         if args == ['clean', '-fd']:
             return '', True
+        if args[:2] == ['merge-base', '--is-ancestor']:
+            # rewind guard probe: origin/master is NOT an ancestor of HEAD
+            # (it's the update target ahead of HEAD) -> allow the reset.
+            return '', False
         if args == ['reset', '--hard', 'origin/master']:
             return '', True
         raise AssertionError(f'unexpected git args: {args!r}')
@@ -95,6 +99,10 @@ def test_apply_force_update_proceeds_when_clean_fails(tmp_path):
             return '', True
         if args == ['clean', '-fd']:
             return 'warning: failed to remove nul: Invalid argument', False
+        if args[:2] == ['merge-base', '--is-ancestor']:
+            # rewind guard probe: origin/master is NOT an ancestor of HEAD
+            # (it's the update target ahead of HEAD) -> allow the reset.
+            return '', False
         if args == ['reset', '--hard', 'origin/master']:
             return '', True
         raise AssertionError(f'unexpected git args: {args!r}')