Fix the nine issues found testing Reflash on an A8 (#149-#157)

[eliasbakken]

Fixes the nine issues found by using Reflash on an A8 (s/n 0498): #149, #150, #151, #152, #153, #154, #155, #156, #157.

Each fix has a test that fails on main and passes here. make test passes: Go, 85 bats, 123 vitest.

The cancels

Most of these were one bug wearing different hats: a cancel changed the state, and something else changed it back.

• Cancelling a backup ends in ERROR instead of CANCELLED #152 Cancelling a backup ended in ERROR. cancelBackup set CANCELLED, the next get_progress poll turned that into IDLE before the killed pipeline had exited, and goBackup then saw no cancel and recorded an error. goInstall and goMagic never checked for a cancel at all, so a cancelled install or magic did the same. A cancel now only asks - it sets a flag and kills xz - and the job reports CANCELLED once it has exited and cleaned up.
• Install/Backup button sends a cancel while a download or upload is running #156 The kill was pkill -f xz -9, which matched any process with "xz" in its command line. Jobs now run in their own process group and the cancel reaches only that group's xz. Cancelling with nothing running is a no-op instead of an error toast.
• Cancelling a file upload reports a USB drive failure and leaves the drive mounted rw #151 Cancelling an upload closed the file while a chunk was still writing. The write failed with "invalid argument", which set ERROR with "The upload failed while writing to the USB drive" - two red toasts for pressing Cancel - and because the state was ERROR the drive was never remounted read-only. upload_cancel now waits for the chunk in flight, then cleans up.
• Download cancel (found on the way, no issue): cancel stopped only the wait. The copy ran on in a goroutine nothing stopped, downloading into the removed file until it was complete - hence "target is busy" on the remount and progress lines after the cancel. A failed download also panicked the server.

The leftovers

• Cancelled backups and uploads leave truncated .img.xz files that cannot be deleted from the UI #153 A cancelled backup left <label>.img.xz behind, because cancelBackup removed <label>, which never exists. Cancelled and failed backups and uploads now remove their partial image, and /api/delete_image plus a Delete button (two clicks) can remove any image, which nothing could before.

The rest

• Wi-Fi dialog says "Connected" after a wrong passphrase - the board fell back to its hotspot #149 The Wi-Fi dialog said "Connected" for a wrong passphrase: it called it joined as soon as the board reported station mode with the target SSID, and network-status reads that SSID from iwctl's "Connected network", which is filled in while still connecting. Joined now needs an address and a finished attempt, and wifi_poll_connect's error ends the watch as a failure.
• A failed Wi-Fi connect leaves the wrong passphrase in iwd with AutoConnect=true #150 The profile was written before the attempt with AutoConnect=true and never removed, so a wrong passphrase stayed in /var/lib/iwd and iwd kept retrying it - and a mistyped retry overwrote a profile that worked. A failed attempt now restores what was there.
• Wi-Fi scan shows **** signal for every network and no frequency #154 iwctl prints four stars for every network and greys out the unlit ones, so stripping the colour first made everything read ****.
• Progress accounting: negative MB/s at start, finished download stuck at 96% #155 New operations inherited the last one's counters ("-4.66 MB/s" on the first line of a download), a finished download stayed at 96%, and a rate was logged while IDLE.
• Wi-Fi passphrase with a quote breaks the settings for the flashed image; runInstallFinishedCommands responds several times #157 WIFI_SSID and WIFI_PSK went into /etc/rebuild-settings between bare single quotes, and that file is sourced by bash as root on the flashed image - it's-my-wifi broke it, and a crafted value ran commands. Also save-settings wrote it with echo -e, and one failing rotate step put several JSON bodies in one reply.

Two extras

• tests: stop slowInit's watchdog from outliving its test - the Go suite already failed about 1 run in 4 on main, because a test left the watchdog running and it changed the shared state underneath later tests. 0 in 10 after.
• wifi-connect: check the hotspot came back, and retry once - while testing a wrong passphrase, iwd 3.8 segfaulted during the restore and came back in station mode, leaving the board with no hotspot at all (WiFi credentials flow: unbounded polling against a dead origin, no hotspot fallback on failure #90's failure). Once in five attempts, and the same sequence without this branch's changes did not reproduce it either, so it looks like iwd rather than the caller - but the consequence is a board unreachable over Wi-Fi, so the restore now verifies and retries.

Checked on the board

A build of this branch was deployed to A8 0498 and driven through the same actions that produced the reports: upload cancel (clean, partial removed, drive ro), backup cancel (BACKUPING -> CANCELLED, partial removed), download cancel (no busy remount), a full download (100%, 332374256 of 332374256), delete (removed the images, refused ../options.cfg), the scan (signals from 1 to 4 stars), and a wrong passphrase in the browser: 67 seconds of "switching", then "Could not join Kraakeslottet", never "Connected", with the profile removed and the board back on its hotspot.

Not exercised on hardware: cancelling an install and the settings file written at the end of one, since both write the eMMC. Both have tests.

🤖 Generated with Claude Code