@@ -78,6 +78,10 @@ if [ "${INSTALL_DIR}" != "${TARGET_DIR}" ]; then
     rsync -a --delete --exclude ".venv" --exclude ".git" "${INSTALL_DIR}/" "${TARGET_DIR}/"
 fi
 chown -R "${SERVICE_USER}:${SERVICE_USER}" "${TARGET_DIR}"
+# the orchestrator reads its own git HEAD (self-update); keep that working even when a human owns the checkout
+if ! git config --system --get-all safe.directory | grep -qxF "${TARGET_DIR}"; then
+    git config --system --add safe.directory "${TARGET_DIR}"
+fi
 
 echo "==> building orchestrator venv"
 if [ ! -d "${TARGET_DIR}/.venv" ]; then
 
@@ -2,12 +2,14 @@
 import subprocess
 import sys
 import tempfile
+import threading
 import time
 import uuid
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Callable
 
+from robot_orchestrator.bootlog import logged_run
 from robot_orchestrator.config import SelfUpdateConfig
 from robot_orchestrator.paths import Paths
 from robot_orchestrator.repos import git
@@ -29,16 +31,17 @@ class SelfUpdateStatus:
     staged_at: float | None
     remote_sha: str | None = None
     error: str | None = None
+    in_progress: bool = False
 
 
 def _default_build_venv(venv_path: Path, release_dir: Path) -> None:
     venv_path.parent.mkdir(parents=True, exist_ok=True)
-    subprocess.run([sys.executable, "-m", "venv", str(venv_path)], check=True, capture_output=True, text=True)
+    logged_run([sys.executable, "-m", "venv", str(venv_path)], source="self-update", check=True)
     pip = str(venv_pip(venv_path))
     requirements = release_dir / "requirements.txt"
     if requirements.exists():
-        subprocess.run([pip, "install", "-r", str(requirements)], check=True, capture_output=True, text=True)
-    subprocess.run([pip, "install", "-e", str(release_dir)], check=True, capture_output=True, text=True)
+        logged_run([pip, "install", "-r", str(requirements)], source="self-update", check=True)
+    logged_run([pip, "install", "-e", str(release_dir)], source="self-update", check=True)
 
 
 def _default_validate(venv_path: Path, release_dir: Path) -> tuple[bool, str]:
@@ -91,16 +94,28 @@ def __init__(
         self.venv_builder = venv_builder or _default_build_venv
         self.validator = validator or _default_validate
         self.source_root = source_root
+        self._stage_lock = threading.Lock()
 
     def status(self) -> SelfUpdateStatus:
         return SelfUpdateStatus(
             current_sha=_resolve_current_sha(self.db, self.source_root),
             staged_sha=self.db.get_meta("self_update.staged_sha") or None,
             staged_at=float(v) if (v := self.db.get_meta("self_update.staged_at")) else None,
             error=self.db.get_meta("self_update.last_error") or None,
+            in_progress=self._stage_lock.locked(),
         )
 
     def check_and_stage(self) -> SelfUpdateStatus:
+        # a second concurrent run would rebuild (and, on failure, delete) the very same release/venv
+        # directories the first one is still using, so a busy manager just reports its current status
+        if not self._stage_lock.acquire(blocking=False):
+            return self.status()
+        try:
+            return self._check_and_stage_locked()
+        finally:
+            self._stage_lock.release()
+
+    def _check_and_stage_locked(self) -> SelfUpdateStatus:
         current_sha = _resolve_current_sha(self.db, self.source_root)
         try:
             git.ensure_mirror_fresh(self.paths.self_mirror, self.config.url, timeout=self.config.fetch_timeout_s)
@@ -125,6 +140,9 @@ def _stage(self, target_sha: str, current_sha: str | None, superseded_sha: str |
         staging = self.paths.self_staging(op_id)
         release_dir = self.paths.self_release(target_sha[:12])
         venv_path = self.paths.self_venv(target_sha[:12])
+        # leftovers of an attempt that crashed half-way would make the final rename fail
+        git.rmtree_safe(release_dir)
+        git.rmtree_safe(venv_path)
         try:
             git.clone_no_checkout(self.paths.self_mirror, staging)
             git.checkout_detach(staging, target_sha)
 
@@ -273,7 +273,7 @@ def get_self_update(claims: dict = Depends(require_auth)):
         return {
             "enabled": c.settings.self_update.enabled,
             "current_sha": status.current_sha, "staged_sha": status.staged_sha,
-            "staged_at": status.staged_at, "error": status.error,
+            "staged_at": status.staged_at, "error": status.error, "in_progress": status.in_progress,
         }
 
     @app.post("/api/self-update/check")
@@ -284,7 +284,7 @@ async def check_self_update(claims: dict = Depends(require_auth)):
         status = await asyncio.to_thread(c.self_update_manager.check_and_stage)
         return {
             "current_sha": status.current_sha, "staged_sha": status.staged_sha,
-            "staged_at": status.staged_at, "error": status.error,
+            "staged_at": status.staged_at, "error": status.error, "in_progress": status.in_progress,
         }
 
     @app.post("/api/self-update/apply")
 
@@ -216,7 +216,7 @@ <h3 style="margin-top:0;">Оркестратор</h3>
     <div class="card">
       <h3 style="margin-top:0;">Самообновление оркестратора</h3>
       <div id="self-update-info"></div>
-      <button class="action secondary" onclick="checkSelfUpdate()">Check now</button>
+      <button id="btn-self-check" class="action secondary" onclick="checkSelfUpdate()">Check now</button>
       <button class="action danger" onclick="applySelfUpdate()">Apply staged update</button>
       <div id="self-update-msg" class="msg"></div>
     </div>
@@ -642,28 +642,41 @@ <h3 style="margin-top:0;">Самообновление оркестратора<
     const res = await api("/api/self-update");
     const data = await res.json();
     const info = document.getElementById("self-update-info");
+    const escape = (s) => String(s).replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch]));
     info.innerHTML = `
       <p><strong>Включено:</strong> ${data.enabled ? "да" : "нет"}</p>
       <p><strong>Текущая версия:</strong> <code>${(data.current_sha || "—").slice(0, 12)}</code></p>
       <p><strong>Готова к применению:</strong> <code>${(data.staged_sha || "нет").slice(0, 12)}</code></p>
-      ${data.error ? `<p style="color:#f28b8b;">${data.error}</p>` : ""}`;
+      ${data.in_progress ? `<p style="color:#7fb3e0;">Идёт проверка и сборка обновления — это может занять несколько минут…</p>` : ""}
+      ${data.error ? `<p style="color:#f28b8b;">${escape(data.error)}</p>` : ""}`;
+    document.getElementById("btn-self-check").disabled = !!data.in_progress;
   } catch (e) {
     document.getElementById("self-update-info").textContent = String(e);
   }
 }
 
 async function checkSelfUpdate() {
   const msg = document.getElementById("self-update-msg");
-  msg.textContent = "Проверка...";
+  const button = document.getElementById("btn-self-check");
+  button.disabled = true;
+  msg.textContent = "Проверка и сборка обновления… (не нажимайте повторно)";
+  msg.className = "msg";
   try {
     const res = await api("/api/self-update/check", { method: "POST" });
     const body = await res.json();
-    msg.textContent = body.staged_sha ? `Готово к применению: ${body.staged_sha.slice(0, 12)}` : (body.error || "Обновлений нет");
-    msg.className = body.error ? "msg error" : "msg success";
+    if (body.in_progress) {
+      msg.textContent = "Проверка уже выполняется — дождитесь результата";
+      msg.className = "msg";
+    } else {
+      msg.textContent = body.staged_sha ? `Готово к применению: ${body.staged_sha.slice(0, 12)}` : (body.error || "Обновлений нет");
+      msg.className = body.error ? "msg error" : "msg success";
+    }
     loadSelfUpdate();
   } catch (e) {
     msg.textContent = String(e);
     msg.className = "msg error";
+  } finally {
+    button.disabled = false;
   }
 }
 
 
@@ -29,6 +29,12 @@ def test_logind_never_acts_on_idle():
     assert "IdleAction=ignore" in _read("systemd/logind-robot-no-idle.conf")
 
 
+def test_install_script_trusts_the_checkout_so_self_update_can_read_its_head():
+    script = _read("install.sh")
+
+    assert 'git config --system --add safe.directory "${TARGET_DIR}"' in script
+
+
 def test_install_script_wires_up_every_no_sleep_measure():
     script = _read("install.sh")
 
 
@@ -334,3 +334,70 @@ def test_gc_keeps_current_and_staged_but_removes_superseded_release(env, tmp_pat
     assert paths.self_release(sha2[:12]).exists()
     assert paths.self_release(sha3[:12]).exists()
     assert any(r.name == "strayjunk12" for r in removed)
+
+
+def test_concurrent_check_is_rejected_while_a_build_is_running(env, tmp_path):
+    import threading
+
+    paths, db, journal = env
+    src = tmp_path / "src"
+    sha1 = _init_repo(src, {"main.py": "print(1)\n"})
+    db.set_meta("self_update.current_sha", sha1)
+    (src / "main.py").write_text("print(2)\n", encoding="utf-8")
+    sha2 = _commit_all(src, "second")
+
+    build_started = threading.Event()
+    release_build = threading.Event()
+    calls = []
+
+    def slow_builder(venv_path: Path, release_dir: Path) -> None:
+        calls.append(venv_path)
+        venv_path.mkdir(parents=True, exist_ok=True)
+        build_started.set()
+        assert release_build.wait(timeout=10)
+
+    config = SelfUpdateConfig(enabled=True, url=str(src), branch="main")
+    manager = SelfUpdateManager(paths, journal, db, config, venv_builder=slow_builder, validator=_fake_validator())
+
+    results = []
+    first = threading.Thread(target=lambda: results.append(manager.check_and_stage()))
+    first.start()
+    assert build_started.wait(timeout=10)
+
+    second = manager.check_and_stage()
+
+    assert second.in_progress is True
+    assert second.staged_sha is None
+    assert manager.status().in_progress is True
+    assert len(calls) == 1
+
+    release_build.set()
+    first.join(timeout=10)
+
+    assert results[0].staged_sha == sha2
+    assert results[0].error is None
+    assert manager.status().in_progress is False
+    assert len(calls) == 1
+
+
+def test_stale_leftovers_from_a_crashed_attempt_do_not_block_staging(env, tmp_path):
+    paths, db, journal = env
+    src = tmp_path / "src"
+    sha1 = _init_repo(src, {"main.py": "print(1)\n"})
+    db.set_meta("self_update.current_sha", sha1)
+    (src / "main.py").write_text("print(2)\n", encoding="utf-8")
+    sha2 = _commit_all(src, "second")
+
+    stale_release = paths.self_release(sha2[:12])
+    stale_release.mkdir(parents=True)
+    (stale_release / "half-written-file").write_text("junk", encoding="utf-8")
+    stale_venv = paths.self_venv(sha2[:12])
+    stale_venv.mkdir(parents=True)
+    (stale_venv / "junk").write_text("junk", encoding="utf-8")
+
+    manager = _manager(env, src, [])
+    status = manager.check_and_stage()
+
+    assert status.error is None
+    assert status.staged_sha == sha2
+    assert not (paths.self_release(sha2[:12]) / "half-written-file").exists()