ADFA-5343 fix(server-lifecycle): §3.3 follow-up - route an interrupted install off the module index to recovery - #509
Merged
Conversation
…d install off the module index to recovery A killed module install can have its SetupProgressActivity task restored on top by the OS. That index resumed and polled for a server that never comes up on a broken base, and the DAMAGED loop-cut (LibraryActivity.evaluateRecovery -> userWantsOn=false) never ran, so the reconciler retried pdsm start uncut until the user manually reached Home. Root: the give-up decision is owned by a UI Activity, so any path that bypasses LibraryActivity.onCreate bypasses the cut. - SetupProgressActivity.onCreate: if InstallGuard.isInterrupted (a dead-process marker = a killed install; a live run reads isLive and clears on a clean finish), route to LibraryActivity via FLAG_ACTIVITY_CLEAR_TOP WITHOUT SINGLE_TOP so the standard- launchMode Home is re-created and its onCreate re-runs the recovery evaluation (onNewIntent is a monitor and would not). The single recovery owner then boots a healthy base and clears the marker, or declares DAMAGED and cuts. No new state, no duplicated verdict - the cut stays owned in one place; this only funnels the stray path into it. The reconciler-owned end-state (a retry budget that removes the cut-hack entirely) is recorded in ADR-5343b as a future redesign. Gates: :app:testDebugUnitTest + :app:lintDebug green. Runtime is device-only.
…ed-install reroute against live sessions Code-review hardening of fa7c5bc: SetupProgressActivity.onCreate is entered from ~14 sites, so the isInterrupted reroute must not hijack a screen that has live work. Route to recovery only when the marker is interrupted AND nothing live owns the screen: !rebuildInSession() (a dashboard rebuild does not plant InstallGuard) && !EnvironmentLock.isBusyNow() (a live content download). After a real kill the queue/downloads are idle (device-observed: holder=NONE), so the guard never blocks the case it exists for. Gates: :app:testDebugUnitTest + :app:lintDebug green. Runtime is device-only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A killed module install can have its SetupProgressActivity task restored on top by the OS. That index resumed and polled for a server that never comes up on a broken base, and the DAMAGED loop-cut (LibraryActivity.evaluateRecovery -> userWantsOn=false) never ran, so the reconciler retried pdsm start uncut until the user manually reached Home. Root: the give-up decision is owned by a UI Activity, so any path that bypasses LibraryActivity.onCreate bypasses the cut.
No new state, no duplicated verdict - the cut stays owned in one place; this only funnels the stray path into it. The reconciler-owned end-state (a retry budget that removes the cut-hack entirely) is recorded in ADR-5343b as a future redesign.
Gates: :app:testDebugUnitTest + :app:lintDebug green. Runtime is device-only.