luigilink · Oct 7, 2026 · Oct 7, 2026 · Oct 7, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.2.0] - 2026-10-07
+
 ### Changed
 
 - The one-shot `SPSUpdate-RebootConfirm` boot task (automatic reboot) now runs as **`NT AUTHORITY\SYSTEM`** instead of the farm InstallAccount decrypted from `secrets.psd1`. This removes the stored-credential dependency that could abort the reboot at task registration (`0x8007052E` when the secret did not match the account password) and decouples the reboot from password rotation. `Add-SPSScheduledTask` gains a `-RunAsSystem` switch (mutually exclusive with `-ExecuteAsCredential`). Because a `SYSTEM` task reaches a UNC status store as the computer account, the share must grant the farm computer accounts (e.g. `Domain Computers`) Modify — add them to `New-SPSDashboardSite.ps1 -WriteAccounts`; `-Action ConfirmReboot` logs a clear, actionable warning (and retries on the next boot) when the grant is missing. ([#64](https://github.com/luigilink/SPSUpdate/issues/64))
@@ -13,6 +15,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - A deferred automatic reboot that was already performed **out-of-band** (a manual restart or a Windows Update reboot) is now reconciled instead of restarting the server again: when a `.pending` reboot request predates the server's last boot time, `Invoke-SPSAutomaticReboot` marks the Reboot phase `Done` ("Reboot already completed out-of-band"), clears the pending marker and skips the restart. A fresh reboot required by an install performed in the same run is unaffected. ([#68](https://github.com/luigilink/SPSUpdate/issues/68))
 - `-Action ProductUpdate` now refreshes the installed server's live **Patch Status** on the Binaries Installation card after the cumulative update is installed, so the column reflects the real post-install state (typically `Upgrade Required` until the Configuration Wizard runs) instead of keeping the pre-install value (`No Action Required`) until the next `Default` run. It reuses the same master-side patch-status read as the `Default` baseline (no remoting) and is status-only — the Content Databases and Configuration Wizard cards still evolve only during a `Default` run. A failed read preserves the last-known-good value. ([#59](https://github.com/luigilink/SPSUpdate/issues/59))
+
+## [5.1.0] - 2026-10-06
+
+### Added
+
 - The near real-time dashboard now refreshes the live farm status at key transitions (the pre-patch baseline, after the Configuration Wizard completes, and the final render) instead of only at the pre-patch baseline. The master re-reads each server's patch status and re-publishes the content-database inventory with fresh upgrade status, so a successful campaign no longer shows a stale `Upgrade Required` Patch Status or a lingering pre-patch inconsistency banner once the farm is back to `No Action Required`. The Content Databases card also shows a database that SPSUpdate has already upgraded (State `Done`) as `No update pending` even before the next refresh. Server patch status and role are shown with short readable labels (for example `Upgrade Required`, `Application with Search`) via the new public helpers `ConvertTo-SPSPatchStatusLabel` and `ConvertTo-SPSRoleLabel`, instead of the raw enum names. ([#51](https://github.com/luigilink/SPSUpdate/issues/51))
 - A standalone, idempotent helper `New-SPSDashboardSite.ps1` (in `src/`) that provisions the dashboard hosting target on an IIS/pull server — folder, SMB share (Modify for the write accounts), NTFS permissions, a static-file `web.config`, and either a dedicated IIS site or a sub-application under an existing site. It has no dependency on the `SPSUpdate.Common` module, so it can be copied on its own to the IIS server. A new wiki page, *Hosting the dashboard on IIS*, documents the validated setup (and the manual equivalent). ([#49](https://github.com/luigilink/SPSUpdate/issues/49))
 - `Test-SPSUpdateReadiness.ps1` now checks the optional `Dashboard.OutputPath`: it verifies the folder exists and is writable, and warns when it is a master-local (drive-letter) path rather than a shared UNC path that worker runs can also reach. ([#49](https://github.com/luigilink/SPSUpdate/issues/49))

diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md
@@ -1,12 +1,20 @@
 # SPSUpdate - Release Notes
 
-## [5.0.1] - 2026-09-21
+## [5.2.0] - 2026-10-07
 
-This patch fixes the near real-time patching dashboard on farms that have no content
-databases (for example a dedicated search farm).
+SPSUpdate 5.2.0 refines the automatic reboot and the live patching dashboard introduced in 5.1.0.
+The one-shot reboot-confirmation boot task now runs as `NT AUTHORITY\SYSTEM` (no stored
+credential), a deferred reboot already performed out-of-band is reconciled instead of restarting
+the server again, and the Binaries Installation card shows the real live patch status right after a
+`ProductUpdate` installs a cumulative update.
 
-### Fixed
+### Changed
 
-- On a farm without content databases, the mount/upgrade sequences were shown as **Failed** with "Cannot bind argument to parameter 'Name' because it is an empty string." The inventory generator (`Initialize-SPSContentDbJsonFile`) now always writes a valid file with four (possibly empty) sequences; the master run skips the mount/upgrade sequences entirely when there is no content database (so the dashboard shows only ProductUpdate, the Configuration Wizard and side-by-side); and each sequence sub-run defensively ignores empty entries.
+- **Reboot-confirmation task runs as SYSTEM.** The one-shot `SPSUpdate-RebootConfirm` boot task now runs as `NT AUTHORITY\SYSTEM` instead of the farm InstallAccount decrypted from `secrets.psd1`, removing the stored-credential dependency that could abort the reboot at task registration (`0x8007052E`) and decoupling the reboot from password rotation. `Add-SPSScheduledTask` gains a `-RunAsSystem` switch (mutually exclusive with `-ExecuteAsCredential`). Because a SYSTEM task reaches a UNC status store as the computer account, grant the farm computer accounts (e.g. `Domain Computers`) Modify on the share — add them to `New-SPSDashboardSite.ps1 -WriteAccounts`; `-Action ConfirmReboot` logs a clear, actionable warning when the grant is missing. ([#64](https://github.com/luigilink/SPSUpdate/issues/64))
+
+### Added
+
+- **Out-of-band reboot reconciliation.** A deferred automatic reboot that was already performed outside SPSUpdate (a manual restart or a Windows Update reboot) is now reconciled instead of restarting the server again: when a `.pending` reboot request predates the server's last boot time, `Invoke-SPSAutomaticReboot` marks the Reboot phase `Done` ("Reboot already completed out-of-band"), clears the pending marker and skips the restart. A fresh reboot required by an install performed in the same run is unaffected. ([#68](https://github.com/luigilink/SPSUpdate/issues/68))
+- **Live patch status after `ProductUpdate`.** `-Action ProductUpdate` now refreshes the installed server's live patch status on the Binaries Installation card after the cumulative update is installed, so the column reflects the real post-install state (typically `Upgrade Required` until the Configuration Wizard runs) instead of keeping the pre-install value until the next `Default` run. It reuses the same master-side patch-status read as the `Default` baseline (no remoting) and is status-only. A failed read preserves the last-known-good value. ([#59](https://github.com/luigilink/SPSUpdate/issues/59))
 
 A full list of changes in each version can be found in the [change log](CHANGELOG.md)
diff --git a/src/Modules/SPSUpdate.Common/SPSUpdate.Common.psd1 b/src/Modules/SPSUpdate.Common/SPSUpdate.Common.psd1
@@ -1,6 +1,6 @@
 @{
     RootModule        = 'SPSUpdate.Common.psm1'
-    ModuleVersion     = '5.0.1'
+    ModuleVersion     = '5.2.0'
     GUID              = 'd6f4e2b7-3a1c-4d8e-9f2a-6c5b7e0a1d34'
     Author            = 'Jean-Cyril DROUHIN'
     CompanyName       = 'luigilink'

diff --git a/wiki/Home.md b/wiki/Home.md
@@ -2,7 +2,7 @@
 
 **SPSUpdate** is a PowerShell tool that installs SharePoint Server cumulative updates and runs the post-setup Configuration Wizard (PSConfig) across a farm. It targets **SharePoint Server Subscription Edition** and requires only PowerShell 5.1 or later — there is no DSC dependency.
 
-> SharePoint Server 2016 and 2019 reached end of support on 14 July 2026. For those versions, use the previous major release [v4.2.0](https://github.com/luigilink/SPSUpdate/releases/tag/v4.2.0).
+> SharePoint Server 2016 and 2019 reached end of support on 14 July 2026. For those versions, use the [`4.x` line](https://github.com/luigilink/SPSUpdate/releases/tag/v4.3.0) (latest: v4.3.0).
 
 SPSUpdate installs the update binaries, mounts and/or upgrades content databases in parallel via scheduled tasks, runs PSConfig on the local and remote servers over **CredSSP remoting**, and configures the side-by-side patching token for zero-downtime upgrades.
 

diff --git a/wiki/Usage.md b/wiki/Usage.md
@@ -68,7 +68,7 @@ by the `MountContentDatabase` flow.
 
 > Since v5.0.0 SPSUpdate is Subscription Edition only. To run `InitContentDB` on a
 > **SharePoint Server 2019 source farm** during a 2019 → Subscription Edition migration, use
-> the previous major release [v4.2.0](https://github.com/luigilink/SPSUpdate/releases/tag/v4.2.0).
+> the [`4.x` line](https://github.com/luigilink/SPSUpdate/releases/tag/v4.3.0) (latest: v4.3.0).
 
 It also writes a self-contained HTML report of the inventory under `Results\` (see below).