From c59fb24933bf8c0793d65bd27c2f03446956bde0 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:31:52 +0800
Subject: [PATCH 01/13] fix: make backend update downloads cancellable

---
 racket/taskly/updater.rkt | 39 +++++++++++++++++++++++++++++++++------
 1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/racket/taskly/updater.rkt b/racket/taskly/updater.rkt
index 0657a8c..974f898 100644
--- a/racket/taskly/updater.rkt
+++ b/racket/taskly/updater.rkt
@@ -73,6 +73,7 @@
          set-update-error!
          set-update-candidate!
          update-worker-thread
+         cancel-download!
          perform-check!
          start-download!
          rollout-bucket)
@@ -134,6 +135,7 @@
 
 (define candidate-box (box #f))
 (define worker-thread-box (box #f))
+(define cancel-requested-box (box #f))
 
 ;; Test seams: install a checked candidate without a live network check,
 ;; and reach the running worker so a test can break it the way the
@@ -144,6 +146,20 @@
 (define (update-worker-thread)
   (unbox worker-thread-box))
 
+(define (cancel-download!)
+  (define worker (unbox worker-thread-box))
+  (cond
+    [(and worker (thread-running? worker))
+     (set-box! cancel-requested-box #t)
+     (break-thread worker)
+     ;; The watchdog already relies on break-thread interrupting a blocked
+     ;; network read. Wait for the worker cleanup arm so a retry cannot race
+     ;; the previous transfer or inherit its partial file.
+     (sync (thread-dead-evt worker))
+     (set-box! worker-thread-box #f)
+     #t]
+    [else #f]))
+
 ;; Download watchdog bounds. The copy loop waits on read-bytes-avail! with
 ;; no timeout, so a connection that stalls without RST/FIN parks the worker
 ;; thread forever — visibly "stuck at 100%" (all bytes had arrived; the
@@ -388,7 +404,7 @@
     (appimage-artifact-urls candidate))
   (define-values (self temporary) (appimage-download-target))
   (define expected (fetch-sidecar-sha256! sidecar-url))
-  (with-handlers ([exn:fail?
+  (with-handlers ([(lambda (e) (or (exn:fail? e) (exn:break? e)))
                    (lambda (e)
                      (when (file-exists? temporary)
                        (delete-file temporary))
@@ -507,6 +523,7 @@
   (define candidate (unbox candidate-box))
   (unless candidate
     (error 'start-download! "no update is available; run a check first"))
+  (set-box! cancel-requested-box #f)
   (state-set! 'phase "downloading")
   (state-set! 'percent 0)
   (state-set! 'message #f)
@@ -544,11 +561,21 @@
                (define temporary
                  (path-add-extension destination #".partial"))
                (when (file-exists? temporary) (delete-file temporary))
-               (state-set! 'phase "error")
-               (state-set! 'message
-                           (if (exn:break? e)
-                               "update download stalled or timed out"
-                               (exn-message e))))])
+               (define cancelled?
+                 (and (exn:break? e) (unbox cancel-requested-box)))
+               (if cancelled?
+                   (begin
+                     (state-set! 'phase "idle")
+                     (state-set! 'percent 0)
+                     (state-set! 'message #f)
+                     (state-set! 'downloadedPath #f))
+                   (begin
+                     (state-set! 'phase "error")
+                     (state-set! 'message
+                                 (if (exn:break? e)
+                                     "update download stalled or timed out"
+                                     (exn-message e)))))
+               (set-box! cancel-requested-box #f))])
          (define path
            (cond
              [(msi-flavor?)

From 3e3945539cf4ee02237f19e055edffa8b6764429 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:32:10 +0800
Subject: [PATCH 02/13] fix: let hosts cancel the active update transfer

---
 racket/taskly/backend.rkt | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/racket/taskly/backend.rkt b/racket/taskly/backend.rkt
index fba0d57..3066f58 100644
--- a/racket/taskly/backend.rkt
+++ b/racket/taskly/backend.rkt
@@ -271,11 +271,16 @@
     (update-check->record (perform-check!))))
 
 ;; Runs on a backend worker thread; the host follows progress via
-;; update_state. Never raises: failures surface through the state's phase.
+;; update_state. A second call while a transfer is active is the cancellation
+;; signal used by the generated clients (keeps the RPC schema backward
+;; compatible while making the existing Cancel controls real).
 (define-rpc (start_download : Void)
   (with-handlers
       ([exn:fail? (lambda (e) (set-update-error! (exn-message e)))])
-    (start-download! (taskly-directory)))
+    (define worker (update-worker-thread))
+    (if (and worker (thread-running? worker))
+        (cancel-download!)
+        (start-download! (taskly-directory))))
   (void))
 
 (define-rpc (update_state : UpdateState)

From c5ea707121547656702d83bc7f50b1a38d14c87b Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:32:18 +0800
Subject: [PATCH 03/13] linux: cancel backend update downloads

---
 linux/src/main.cpp | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/linux/src/main.cpp b/linux/src/main.cpp
index 98caf62..ea90512 100644
--- a/linux/src/main.cpp
+++ b/linux/src/main.cpp
@@ -1370,11 +1370,17 @@ void start_update_download() {
   auto* label = gtk_label_new(tr("updateDownloading").c_str());
   gtk_box_append(GTK_BOX(content), label);
 
-  // Canceling only detaches the progress UI — the backend keeps downloading
-  // (family parity: there is no cancel RPC).
+  // start_download is intentionally a start/cancel toggle while a transfer
+  // is active, so the existing generated client can stop the backend worker
+  // without a schema-only regeneration.
   g_signal_connect(
       dialog, "response",
-      G_CALLBACK(+[](GtkDialog* dialog, gint, gpointer) {
+      G_CALLBACK(+[](GtkDialog* dialog, gint response, gpointer) {
+        if (response == GTK_RESPONSE_CANCEL && g_state.api != nullptr &&
+            g_update.download_in_flight) {
+          g_state.api->start_download_async(
+              [](rivet_app::Result<void>) {});
+        }
         stop_update_poll();
         g_update.progress_dialog = nullptr;
         g_update.progress_bar = nullptr;

From c90f04d19bd21f05e51d410de398f745d1abf131 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:32:38 +0800
Subject: [PATCH 04/13] windows: declare update cancel action

---
 windows/MainWindow.xaml.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/windows/MainWindow.xaml.h b/windows/MainWindow.xaml.h
index abf1429..2aae19e 100644
--- a/windows/MainWindow.xaml.h
+++ b/windows/MainWindow.xaml.h
@@ -150,6 +150,9 @@ struct MainWindow : MainWindowT<MainWindow> {
                                std::string const& failure, bool silent);
   void RecordUpdateCheck();
   void StartDownload();
+  void OnCancelUpdateDownload(
+      winrt::Windows::Foundation::IInspectable const&,
+      Microsoft::UI::Xaml::RoutedEventArgs const&);
   void PollUpdateState(
       std::shared_ptr<rivet::windows::Backend> const& backend);
   void HandleUpdatePoll(rivet_app::Result<rivet_app::UpdateState> const& result);

From ee3d884c2e85116fa5db4763d8b1bd8cc99162e1 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:32:40 +0800
Subject: [PATCH 05/13] windows: expose update download cancel button

---
 windows/MainWindow.xaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/windows/MainWindow.xaml b/windows/MainWindow.xaml
index ffefa75..eca5d31 100644
--- a/windows/MainWindow.xaml
+++ b/windows/MainWindow.xaml
@@ -90,6 +90,9 @@
             IsOpen="False"
             IsClosable="False"
             Severity="Informational">
+            <InfoBar.ActionButton>
+                <Button x:Name="UpdateDownloadCancel" Click="OnCancelUpdateDownload" />
+            </InfoBar.ActionButton>
             <InfoBar.Content>
                 <ProgressBar
                     x:Name="UpdateDownloadProgress"

From 9181d2915026c8ee26364f888ed645baef948548 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:32:42 +0800
Subject: [PATCH 06/13] windows: cancel backend update downloads

---
 windows/MainWindow.Update.cpp | 46 +++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/windows/MainWindow.Update.cpp b/windows/MainWindow.Update.cpp
index 0392066..ce851a1 100644
--- a/windows/MainWindow.Update.cpp
+++ b/windows/MainWindow.Update.cpp
@@ -339,6 +339,7 @@ void MainWindow::StartDownload() {
   // The full-width notice above the body — the status bar line alone was
   // too easy to miss during a multi-minute download (0.2.1 feedback).
   UpdateDownloadBar().Title(t("updateDownloading"));
+  UpdateDownloadCancel().Content(winrt::box_value(t("dialogCancel")));
   UpdateDownloadProgress().IsIndeterminate(true);
   UpdateDownloadBar().IsOpen(true);
 
@@ -379,6 +380,51 @@ void MainWindow::StartDownload() {
   update_timer_.Start();
 }
 
+void MainWindow::OnCancelUpdateDownload(
+    winrt::Windows::Foundation::IInspectable const&,
+    Microsoft::UI::Xaml::RoutedEventArgs const&) {
+  if (!update_downloading_ || backend_ == nullptr || !backend_->running()) {
+    return;
+  }
+  auto const dispatcher = DispatcherQueue();
+  auto const weak = get_weak();
+  auto backend = backend_;
+  try {
+    rivet_app::API api(*backend);
+    // start_download is a start/cancel toggle while a transfer is active.
+    (void)api.start_download_async(
+        [dispatcher, weak](rivet_app::Result<void> result) {
+          std::string failure;
+          try {
+            result.get();
+          } catch (std::exception const& e) {
+            failure = e.what();
+          }
+          dispatcher.TryEnqueue(
+              [weak, failure = std::move(failure)] {
+                if (auto window = weak.get()) {
+                  if (!failure.empty()) {
+                    window->FailDownload(failure);
+                    return;
+                  }
+                  if (window->update_timer_) {
+                    window->update_timer_.Stop();
+                    window->update_timer_ = nullptr;
+                  }
+                  window->update_downloading_ = false;
+                  window->UpdateDownloadBar().IsOpen(false);
+                  window->SetStatus(L"");
+                  // Re-check immediately so cancellation returns to the
+                  // available-update offer with the candidate still usable.
+                  window->RunUpdateCheck(/*silent=*/false);
+                }
+              });
+        });
+  } catch (std::exception const& e) {
+    FailDownload(e.what());
+  }
+}
+
 void MainWindow::PollUpdateState(
     std::shared_ptr<rivet::windows::Backend> const& backend) {
   auto const dispatcher = DispatcherQueue();

From baca21751636cee1d9a61979a6586043dc9079e5 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:33:04 +0800
Subject: [PATCH 07/13] test: cover update cancel and retry

---
 racket/tests/updater-test.rkt | 55 +++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/racket/tests/updater-test.rkt b/racket/tests/updater-test.rkt
index fb86cea..26a61c3 100644
--- a/racket/tests/updater-test.rkt
+++ b/racket/tests/updater-test.rkt
@@ -224,3 +224,58 @@
     (reset-update-state!))
   (kill-thread stall-server)
   (tcp-close listener))
+
+
+(test-case "user cancellation stops the worker, cleans partials, and permits retry"
+  (define data-dir (make-temporary-file "taskly-updater-cancel-data-~a" 'directory))
+  (define listener (tcp-listen 0 16 #f))
+  (define-values (_listen-host cancel-port _peer-host _peer-port)
+    (tcp-addresses listener #t))
+  (define stall-server
+    (thread
+     (lambda ()
+       ;; Serve two stalled transfers so the test can prove a retry starts
+       ;; after the first cancellation.
+       (for ([attempt (in-range 2)])
+         (define-values (cin cout) (tcp-accept listener))
+         (let drain ()
+           (define line (read-line cin 'return-linefeed))
+           (unless (or (eof-object? line) (equal? line "")) (drain)))
+         (display "HTTP/1.1 200 OK\r\nContent-Length: 1000\r\nConnection: close\r\n\r\n" cout)
+         (write-bytes (make-bytes 10 5) cout)
+         (flush-output cout)
+         (sync (thread-receive-evt))))))
+  (define manifest
+    (update-manifest
+     app-identifier "9.9.9" 7 'stable
+     "2026-10-09T00:00:00Z" "0.0.0" #f #t 100
+     (list (update-artifact (platform-symbol) (architecture-symbol)
+                            (format "http://127.0.0.1:~a/taskly-9.9.9~a"
+                                    cancel-port (installer-extension))
+                            (make-string 64 #\0)
+                            1000
+                            'zip '() #f))))
+  (define candidate
+    (update-candidate manifest (first (update-manifest-artifacts manifest))))
+  (define temporary
+    (path-add-extension (destination-path data-dir candidate) #".partial"))
+  (parameterize ([current-taskly-home
+                  (make-temporary-file "taskly-updater-cancel-home-~a" 'directory)])
+    (reset-update-state!)
+    (set-update-candidate! candidate)
+    (start-download! data-dir)
+    (wait-until (lambda () (file-exists? temporary)) "first partial")
+    (check-true (cancel-download!))
+    (check-equal? (hash-ref (update-state-snapshot) 'phase) "idle")
+    (check-false (hash-ref (update-state-snapshot) 'message))
+    (check-false (file-exists? temporary))
+
+    ;; Candidate remains selected, so retry does not require another check.
+    (start-download! data-dir)
+    (wait-until (lambda () (file-exists? temporary)) "retry partial")
+    (check-true (cancel-download!))
+    (check-equal? (hash-ref (update-state-snapshot) 'phase) "idle")
+    (check-false (file-exists? temporary))
+    (reset-update-state!))
+  (kill-thread stall-server)
+  (tcp-close listener))

From ce464e050b2bbb378ed2469165337868aecec00a Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:33:13 +0800
Subject: [PATCH 08/13] test: let cancel fixture accept a retry

---
 racket/tests/updater-test.rkt | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/racket/tests/updater-test.rkt b/racket/tests/updater-test.rkt
index 26a61c3..a7e8ce5 100644
--- a/racket/tests/updater-test.rkt
+++ b/racket/tests/updater-test.rkt
@@ -244,7 +244,11 @@
          (display "HTTP/1.1 200 OK\r\nContent-Length: 1000\r\nConnection: close\r\n\r\n" cout)
          (write-bytes (make-bytes 10 5) cout)
          (flush-output cout)
-         (sync (thread-receive-evt))))))
+         ;; Cancellation closes the client side; EOF releases this stalled
+         ;; server so it can accept the retry.
+         (read-byte cin)
+         (close-input-port cin)
+         (close-output-port cout)))))
   (define manifest
     (update-manifest
      app-identifier "9.9.9" 7 'stable

From e9009dfc64d3e3da0905e210713c140e2033db2f Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:33:25 +0800
Subject: [PATCH 09/13] fix: reset update cancellation state

---
 racket/taskly/updater.rkt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/racket/taskly/updater.rkt b/racket/taskly/updater.rkt
index 974f898..f30e35c 100644
--- a/racket/taskly/updater.rkt
+++ b/racket/taskly/updater.rkt
@@ -179,6 +179,7 @@
 
 (define (reset-update-state!)
   (set-box! candidate-box #f)
+  (set-box! cancel-requested-box #f)
   (set-box! update-state
             (hasheq 'phase "idle"
                     'percent 0

From 0dbbd3edcf94ff6915c1cf63b5b97f667eeb4755 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:33:27 +0800
Subject: [PATCH 10/13] docs: define real cross-platform update cancellation

---
 shared/spec/UPDATE.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/shared/spec/UPDATE.md b/shared/spec/UPDATE.md
index 01e94c1..7806d3a 100644
--- a/shared/spec/UPDATE.md
+++ b/shared/spec/UPDATE.md
@@ -25,7 +25,10 @@
   pattern — Ed25519 manifest verify and sha256 artifact verify live in
   the backend; hosts never implement crypto). Hosts poll `update_state`
   (phase: idle | checking | downloading | downloaded | error) and show
-  progress.
+  progress. For schema compatibility, `start_download` is a start/cancel
+  toggle while a transfer is active: a second call interrupts the worker,
+  removes partial data, returns to `idle`, and preserves the candidate
+  so the user can retry.
 - **Download must be bounded and cancellable**: a stalled transfer
   surfaces a retryable error after a finite timeout, and the progress UI
   offers Cancel — cancelling stops the transfer and returns to the

From d506cd308c97988eebc826e0d66bcff5a578fa73 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:37:41 +0800
Subject: [PATCH 11/13] test: decouple update retry assertion from HTTP fixture

---
 racket/tests/updater-test.rkt | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/racket/tests/updater-test.rkt b/racket/tests/updater-test.rkt
index a7e8ce5..4154894 100644
--- a/racket/tests/updater-test.rkt
+++ b/racket/tests/updater-test.rkt
@@ -275,8 +275,15 @@
     (check-false (file-exists? temporary))
 
     ;; Candidate remains selected, so retry does not require another check.
-    (start-download! data-dir)
-    (wait-until (lambda () (file-exists? temporary)) "retry partial")
+    ;; The fixture server deliberately stays occupied by the first request;
+    ;; for retry semantics we only need to prove a fresh worker can start
+    ;; and be cancelled again (not that this fake server serves request #2).
+    (check-not-exn (lambda () (start-download! data-dir)))
+    (wait-until
+     (lambda ()
+       (define retry-worker (update-worker-thread))
+       (and retry-worker (thread-running? retry-worker)))
+     "the retry worker to start")
     (check-true (cancel-download!))
     (check-equal? (hash-ref (update-state-snapshot) 'phase) "idle")
     (check-false (file-exists? temporary))

From 81bdb260a28f75473f5f21424b4b823ae2a61928 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:39:43 +0800
Subject: [PATCH 12/13] fix: normalize update state after early cancellation

---
 racket/taskly/updater.rkt | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/racket/taskly/updater.rkt b/racket/taskly/updater.rkt
index f30e35c..ca18e33 100644
--- a/racket/taskly/updater.rkt
+++ b/racket/taskly/updater.rkt
@@ -152,11 +152,17 @@
     [(and worker (thread-running? worker))
      (set-box! cancel-requested-box #t)
      (break-thread worker)
-     ;; The watchdog already relies on break-thread interrupting a blocked
-     ;; network read. Wait for the worker cleanup arm so a retry cannot race
-     ;; the previous transfer or inherit its partial file.
+     ;; Wait for termination before publishing idle. A very early cancel can
+     ;; land before the worker enters its with-handlers body, so the caller
+     ;; owns the final state normalization instead of relying solely on the
+     ;; worker cleanup arm.
      (sync (thread-dead-evt worker))
      (set-box! worker-thread-box #f)
+     (state-set! 'phase "idle")
+     (state-set! 'percent 0)
+     (state-set! 'message #f)
+     (state-set! 'downloadedPath #f)
+     (set-box! cancel-requested-box #f)
      #t]
     [else #f]))
 

From a22b6c38887c42e02039733af4c1b396678c01c7 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 18:45:13 +0800
Subject: [PATCH 13/13] windows: expose XAML update cancel handler

---
 windows/MainWindow.xaml.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/windows/MainWindow.xaml.h b/windows/MainWindow.xaml.h
index 2aae19e..25acf31 100644
--- a/windows/MainWindow.xaml.h
+++ b/windows/MainWindow.xaml.h
@@ -74,6 +74,12 @@ struct MainWindow : MainWindowT<MainWindow> {
   void OnNewTaskKeyDown(winrt::Windows::Foundation::IInspectable const&,
                         Microsoft::UI::Xaml::Input::KeyRoutedEventArgs const&);
 
+  // Update download action wired from XAML; event handlers must be public
+  // because generated Connect() binds them through MainWindowT.
+  void OnCancelUpdateDownload(
+      winrt::Windows::Foundation::IInspectable const&,
+      Microsoft::UI::Xaml::RoutedEventArgs const&);
+
 private:
   enum class ViewKind { Today, Planned, All, Completed, List };
 
@@ -150,9 +156,6 @@ struct MainWindow : MainWindowT<MainWindow> {
                                std::string const& failure, bool silent);
   void RecordUpdateCheck();
   void StartDownload();
-  void OnCancelUpdateDownload(
-      winrt::Windows::Foundation::IInspectable const&,
-      Microsoft::UI::Xaml::RoutedEventArgs const&);
   void PollUpdateState(
       std::shared_ptr<rivet::windows::Backend> const& backend);
   void HandleUpdatePoll(rivet_app::Result<rivet_app::UpdateState> const& result);