@@ -326,8 +326,8 @@ const activeGate = Effect.fn("test.activeGate")(function* (
 ) {
   const gate = yield* makeWorkAdmissionGate({ marker: marker ?? (yield* memoryUpdateHoldStore) });
   for (const consumer of consumers) yield* gate.register(consumer);
-  // Startup recovery has run.
-  yield* gate.heldForUpdateSince;
+  // Startup has started whatever the last update held.
+  yield* gate.finishHeldWork;
   return gate;
 });
 
@@ -336,9 +336,7 @@ const makeWorld = Effect.fn("test.makeWorld")(function* (
   options: {
     readonly bootService?: boolean;
     readonly gate?: WorkAdmissionGate;
-    readonly marker?: UpdateHoldStore & {
-      readonly current: Effect.Effect<{ heldAt: string; targetVersion: string } | undefined>;
-    };
+    readonly marker?: Effect.Success<typeof memoryUpdateHoldStore>;
     /**
      * What the launcher does when asked: accept, refuse, or take the request without the answer
      * coming back (the 30 s reply timeout), with or without its record then showing it pending.
@@ -688,16 +686,39 @@ describe("auto-update loop", () => {
     }),
   );
 
-  it.effect("starts held work again after the maximum hold, whatever the launcher says", () =>
+  it.effect("keeps holding past the maximum hold while the launcher has this update pending", () =>
     Effect.gen(function* () {
       const world = yield* makeWorld();
       yield* world.at(DUE);
       yield* world.at(DUE + 1);
-      // A hung launcher: its record still says pending, or cannot be read at all.
+      // A slow restart: the launcher's record still shows this update pending, so the restart is
+      // still coming and work started now would be cut off by it.
+      for (const extra of [0, 1, 10 * AUTO_UPDATE_QUIET_POLL_MS]) {
+        yield* world.at(DUE + 1 + AUTO_UPDATE_MAX_HOLD_MS + extra);
+        expect(yield* world.gate.isHeld).toBe(true);
+      }
+      expect((yield* world.state).phase).toBe("handed-off");
+      expect(yield* world.resets).toBe(0);
+      expect(yield* world.marker.current).toMatchObject({ targetVersion: TARGET });
+      // Once the record says something else, the cap lets held work start.
+      yield* Ref.set(world.record, { type: "update", update: outcome("rolled-back") });
+      const due = DUE + 1 + AUTO_UPDATE_MAX_HOLD_MS + 11 * AUTO_UPDATE_QUIET_POLL_MS;
+      yield* world.at(due);
+      expect(yield* world.gate.isHeld).toBe(false);
+      expect(yield* world.resets).toBe(1);
+    }),
+  );
+
+  it.effect("starts held work after the maximum hold when the launcher record is unreadable", () =>
+    Effect.gen(function* () {
+      const world = yield* makeWorld();
+      yield* world.at(DUE);
+      yield* world.at(DUE + 1);
+      // A hung launcher whose record cannot be read: nothing shows a restart is still coming.
       const almost = DUE + 1 + AUTO_UPDATE_MAX_HOLD_MS - 1;
+      yield* Ref.set(world.record, { type: "unreadable", reason: "bad file" });
       yield* world.at(almost);
       expect(yield* world.gate.isHeld).toBe(true);
-      yield* Ref.set(world.record, { type: "unreadable", reason: "bad file" });
       const due = DUE + 1 + AUTO_UPDATE_MAX_HOLD_MS;
       yield* world.at(due);
       expect(yield* world.gate.isHeld).toBe(false);
@@ -763,24 +784,28 @@ describe("auto-update loop", () => {
     }),
   );
 
-  it.effect("clears a marker left by the last process once the launcher is settled", () =>
+  it.effect("does not check for updates until work held by the last update has started", () =>
     Effect.gen(function* () {
       const marker = yield* memoryUpdateHoldStore;
-      const left = { heldAt: DateTime.formatIso(DateTime.makeUnsafe(0)), targetVersion: CURRENT };
+      const left = { heldAt: DateTime.formatIso(DateTime.makeUnsafe(DUE)), targetVersion: CURRENT };
       yield* marker.write(left);
       const gate = yield* makeWorkAdmissionGate({ marker });
       for (const consumer of WORK_ADMISSION_CONSUMERS) yield* gate.register(consumer);
       const world = yield* makeWorld({ gate, marker });
-      // Startup recovery has not read it yet.
-      yield* world.at(QUIET_TICK);
-      expect(yield* marker.current).toEqual(left);
-      yield* gate.heldForUpdateSince;
-      // A trial is still pending: a rollback would need the marker again.
-      yield* Ref.set(world.record, { type: "update", update: pending });
-      yield* world.at(2 * QUIET_TICK);
+      // Startup recovery kept the held work; the update is not committed yet, so none started.
+      yield* TestClock.setTime(DUE);
+      expect(yield* gate.heldForUpdate).toBeDefined();
+      for (let minute = 0; minute < 5; minute++) {
+        yield* world.at(DUE + minute * QUIET_TICK);
+      }
+      expect(yield* world.state).toEqual(initialAutoUpdateState(0));
+      expect(yield* world.calls).toEqual([]);
+      expect(yield* gate.isHeld).toBe(false);
       expect(yield* marker.current).toEqual(left);
-      yield* Ref.set(world.record, { type: "update", update: outcome("committed") });
-      yield* world.at(3 * QUIET_TICK);
+      // Startup started it: updates go on as usual.
+      yield* gate.finishHeldWork;
+      yield* world.at(DUE + 5 * QUIET_TICK);
+      expect((yield* world.state).phase).toBe("waiting");
       expect(yield* marker.current).toBeUndefined();
     }),
   );
 
@@ -1,7 +1,7 @@
 // Automatic updates for boot-service installs, once threads are quiet and the optional hook agrees.
-// The handoff closes the WorkAdmission gate before the last read and writes a marker; work after
-// that stays unclaimed and startup recovery starts it after the restart. The gate stays closed
-// until exit, the launcher's record says no restart, or AUTO_UPDATE_MAX_HOLD_MS passes.
+// The handoff closes the WorkAdmission gate and writes a marker; held work starts once the
+// restarted server's update is committed. The gate stays closed until exit or the launcher's
+// record says no restart is coming (AUTO_UPDATE_MAX_HOLD_MS applies only while not pending).
 import {
   ServerSelfUpdateError,
   type ServerSelfUpdateOutcome,
@@ -50,7 +50,8 @@ export const AUTO_UPDATE_QUIET_POLL_MS = MINUTE;
 export const AUTO_UPDATE_MAX_QUIET_WAIT_MS = 2 * 60 * MINUTE;
 /** After a failed attempt, so a release that cannot install is not fetched every hour. */
 export const AUTO_UPDATE_FAILURE_BACKOFF_MS = 6 * 60 * MINUTE;
-/** New work waits at most this long for the launcher to restart the server, then starts again. */
+/** New work waits at most this long for the launcher to restart the server, then starts again,
+ * unless the launcher's record still shows this update pending. */
 export const AUTO_UPDATE_MAX_HOLD_MS = 30 * MINUTE;
 /** When the launcher's answer was lost (its 30 s reply timeout), how long its record may take to
  * show the update pending before the handoff counts as dropped. */
@@ -332,7 +333,8 @@ export const makeAutoUpdater = Effect.fn("cloud.auto_update.make")(function* (
     initialAutoUpdateState(yield* Clock.currentTimeMillis),
   );
   const loggedUnavailable = yield* Ref.make(false);
-  const markerSettled = yield* Ref.make(false);
+  const loggedUnsettled = yield* Ref.make(false);
+  const loggedPastCap = yield* Ref.make(false);
   const lastUnreadable = yield* Ref.make<string | null>(null);
   const backedOffFailureId = yield* Ref.make<string | undefined>(undefined);
   const hookCommand = deps.preferences.pipe(
@@ -363,8 +365,9 @@ export const makeAutoUpdater = Effect.fn("cloud.auto_update.make")(function* (
     const command = preferences.autoUpdateQuietCommand;
     const hook = yield* deps.askHook(command, targetVersion);
     if (hook !== null) return hook;
-    // Taken before the gate closes: anything requested from here on is either counted below or
-    // held, and the marker lets startup recovery start the held part.
+    // Anything saved after the gate closes is either counted below (and stops the update) or held,
+    // and the marker lets startup recovery keep and later start the held part. Recovery decides by
+    // that order, not by request times; `heldAt` only tells a fresh marker from a stale one.
     const heldAt = DateTime.formatIso(yield* DateTime.now);
     const starting = yield* deps.gate.hold;
     let reason =
@@ -542,36 +545,45 @@ export const makeAutoUpdater = Effect.fn("cloud.auto_update.make")(function* (
   });
 
   /** The gate stays closed until exit. It opens again only when the launcher's record shows it
-   * will not restart this server, or after AUTO_UPDATE_MAX_HOLD_MS; an unreadable record or a
-   * lost answer is not a reason to let work start while a restart may still come. */
+   * will not restart this server, or after AUTO_UPDATE_MAX_HOLD_MS unless the record shows this
+   * update pending (the restart is still coming: work that started now would be cut off by it).
+   * Before the cap an unreadable record or a lost answer keeps the hold too. */
   const watchHandoff = Effect.fn("cloud.auto_update.watchHandoff")(function* (
     current: Extract<AutoUpdateState, { phase: "handed-off" }>,
     nowMs: number,
   ) {
     const heldMs = nowMs - current.since;
-    if (heldMs >= AUTO_UPDATE_MAX_HOLD_MS) {
+    const pastCap = heldMs >= AUTO_UPDATE_MAX_HOLD_MS;
+    const record = yield* deps.launcherRecord;
+    if (
+      record.type === "update" &&
+      record.update.status === "pending" &&
+      record.update.targetVersion === current.version
+    ) {
+      yield* Ref.set(lastUnreadable, null);
+      if (!current.confirmed) yield* Ref.set(state, { ...current, confirmed: true });
+      if (pastCap && !(yield* Ref.getAndSet(loggedPastCap, true))) {
+        yield* Effect.logWarning(
+          "Automatic server update: the restart is taking long; new work keeps waiting while the launcher has it pending.",
+          { targetVersion: current.version, heldMinutes: Math.round(heldMs / MINUTE) },
+        );
+      }
+      return;
+    }
+    if (pastCap) {
       return yield* dropHandoff(
         current,
         nowMs,
         `no restart after ${Math.round(heldMs / MINUTE)} minutes`,
       );
     }
-    const record = yield* deps.launcherRecord;
     if (record.type === "unreadable") {
       return yield* logUnreadable(
         record.reason,
         "Automatic server update cannot read the launcher state; new work keeps waiting.",
       );
     }
     yield* Ref.set(lastUnreadable, null);
-    if (
-      record.type === "update" &&
-      record.update.status === "pending" &&
-      record.update.targetVersion === current.version
-    ) {
-      if (!current.confirmed) yield* Ref.set(state, { ...current, confirmed: true });
-      return;
-    }
     if (!current.confirmed && heldMs < AUTO_UPDATE_UNCONFIRMED_GRACE_MS) return;
     yield* dropHandoff(
       current,
@@ -582,21 +594,6 @@ export const makeAutoUpdater = Effect.fn("cloud.auto_update.make")(function* (
     );
   });
 
-  /** A marker left by the process before this one served startup recovery. Kept while the
-   * launcher's trial is pending: a rollback restores the database as it was at the stop, and the
-   * previous version's recovery needs the marker again. */
-  const settleMarker = Effect.gen(function* () {
-    if (yield* Ref.get(markerSettled)) return;
-    // Startup recovery runs after this loop starts and must see the marker first.
-    if (!(yield* deps.gate.updateMarkerRead)) return;
-    if (yield* deps.gate.isHeld) return;
-    const record = yield* deps.launcherRecord;
-    if (record.type === "unreadable") return;
-    if (record.type === "update" && record.update.status === "pending") return;
-    yield* deps.gate.clearUpdateMarker;
-    yield* Ref.set(markerSettled, true);
-  });
-
   const probe = Effect.fn("cloud.auto_update.probe")(function* (
     current: Extract<AutoUpdateState, { phase: "waiting" }>,
     nowMs: number,
@@ -669,7 +666,6 @@ export const makeAutoUpdater = Effect.fn("cloud.auto_update.make")(function* (
     const current = yield* Ref.get(state);
     // A handoff in progress is followed whatever the settings say now.
     if (current.phase === "handed-off") return yield* watchHandoff(current, nowMs);
-    yield* settleMarker;
     const preferences = yield* deps.preferences;
     if (!preferences.autoUpdateServer) {
       if (current.phase === "waiting") {
@@ -700,6 +696,16 @@ export const makeAutoUpdater = Effect.fn("cloud.auto_update.make")(function* (
       }
       return;
     }
+    // Work an earlier update held must start before this server holds work again; startup starts
+    // it once its own update is committed.
+    if (!(yield* deps.gate.heldWorkSettled)) {
+      if (!(yield* Ref.getAndSet(loggedUnsettled, true))) {
+        yield* Effect.logInfo(
+          "Automatic server update waits until work held by the last update has started.",
+        );
+      }
+      return;
+    }
     const step = nextAutoUpdateStep(current, nowMs);
     if (step.type === "check") return yield* check(nowMs);
     if (step.type === "probe" && current.phase === "waiting") return yield* probe(current, nowMs);