Web UI updates now run through the exact same update engine as the Telegram 'Update all'. Web-triggered updates used to skip container-group ordering, the netns sidecar snapshot, the restart-dependents cascade and per-container cooldowns, and the bulk path didn't take the shared update lock (so a Web update could overlap a scheduled or self-update run). Both the single-row Update button and bulk 'Update selected' now go through the shared engine under that lock — groups, sidecars, dependents and cooldowns honoured everywhere, and two updates can't run at once. Notifier fan-out and the Telegram summary match the bot path too.