K2GO-384 feat(restore): per-pass ETA + stage-granular cancel with damaged-state recovery - #535
Merged
Merged
Conversation
Surface the per-pass ETA the extractor already computed but the service dropped: thread etaSeconds through DeepOpState / DeepOpProgressRepository / DeepOpService to BackupJobFragment, rendered via the existing EtaText. The ETA sits on its own line below a full-width bar so it never shrinks the bar (matches the module-install / maps rows). Fix the extract pass progress source. It measured compressed bytes READ from the .gz, which saturates the instant the archive is fully piped into tar -- the bar froze at ~99% and showed a false "under a min" for minutes while tar was still writing the rootfs to disk. It now tracks members WRITTEN (tar -v, one line per file), so the bar moves through the write and the ETA reads honest minutes. VERIFY still counts bytes read (there, reading is the work). Device-verified on OnePlus 7T: backup -> restore -> clean boot; extract bar advances through the tail, ETA counts down instead of freezing.
Adds an on-screen Cancel to restore, matched to each pass, and closes the lifecycle gap a mid-extract cancel exposed. - Copy pauses/resumes; verify (tar -t) kills + holds so Keep re-runs the check on the same temp (no re-copy); extract is a destructive cancel behind a red acknowledgement dialog. - Cancel intents de-aliased: a safe-zone abort (cancelBeforeExtract) can never reach the extract feeder, which reads its own forceExtractCancel; both gated on the service's own phase, not the UI's lagging copy. - A force-cancelled or failed extract marks the InstallGuard marker DAMAGED (known damage) -> isSystemInstalled=false: the box stays down (no flap on a torn rootfs) and the "install in progress" gate lifts, while recovery still owns it via isInterrupted. See docs/ADR-5343c. - A safe-zone cancel is a CANCELLED terminal (survives config change). - New cancel strings translated to 33 locales (machine, pending review).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Standardizes restore under K2GO-384: honest per-pass progress/ETA, an on-screen
Cancel matched to each pass, and the lifecycle a mid-extract cancel needs.
What changes
Per-pass ETA + honest progress
TarExtractoralready computes (it was droppedbetween the extractor and the progress screen), threaded through
DeepOpState/DeepOpProgressRepositorytoBackupJobFragment.from the
.gz(saturates the moment the pipe empties) instead of memberswritten, so the bar froze near 97% and the ETA read "under a min" on a
multi-minute extract. Now member-based.
Stage-granular Cancel
tar -t) is killed and held so "Keep restoring"re-runs the check on the same staged temp (no re-copy). Extract is a
destructive cancel behind a red acknowledgement dialog.
cancelBeforeExtract)can never reach the extract feeder, which reads its own
forceExtractCancel;both are gated on the service's own phase, not the UI's lagging copy — so a
confirm racing the verify→extract boundary can't tear the rootfs.
CANCELLEDterminal (on the op state, so it survivesa config change).
Known-damage recovery lifecycle — see
docs/ADR-5343cDAMAGED — a fourth reading on the one existing marker.
isSystemInstalledbecomes false (box stays down, no reconciler flap on a torn rootfs) and the
"install in progress" gate lifts, while recovery still owns it via
isInterrupted.ServerReconcile.desired's no-healthyinvariant is kept.Localization
The 8 new cancel strings are translated into all 33 locales (machine-generated,
flagged for human review).
Verification
copy/verify aborts return to the bifurcation with services restarting, and a
force-cancelled extract settles at
desired=DOWN holder=NONE(no flap) with afresh restore no longer blocked.
:app:lintDebuggreen (MissingTranslation satisfied).