Keep leases alive during long restores and exports; PR review fixes

Full restore, raw directory restore, per-user export and the safety export
held a fixed-TTL lease on the location that nothing refreshed. A restore or
export running longer than that TTL let a cleanup take over and delete data
still in use. They now refresh the lease while they work (per blob, per row
batch, per written chunk), throttled to once a minute.

Also:
- backup:prune still applies snapshot retention when user-export retention
  fails for a location.
- The recovery kit carries the deletion delay, so a disaster recovery keeps
  the original protection instead of falling back to 7 days. Older kits
  still import with the default.
- CI checkouts no longer persist the token in the git config.
- recoveryKit() has its real return type; the stale baseline entry is gone.

lib/Service/KeyService.php

@@ -93,7 +93,9 @@ final class KeyService {
 		$this->cached = $keys;
 		$this->appConfig->setValueString(Application::APP_ID, self::KEY_WRAPPED, json_encode($kit['wrapped_key'], JSON_THROW_ON_ERROR), true, true);
 		$this->appConfig->setValueString(Application::APP_ID, self::KEY_FINGERPRINT, $this->fingerprintOf($keys), true);
-		$this->appConfig->setValueInt(Application::APP_ID, self::KEY_DELETE_DELAY, self::DEFAULT_DELETE_DELAY, true);
+		// Kits from before this field existed fall back to the default.
+		$delay = (int)($kit['delete_delay_days'] ?? self::DEFAULT_DELETE_DELAY);
+		$this->appConfig->setValueInt(Application::APP_ID, self::KEY_DELETE_DELAY, ($delay >= 1 && $delay <= 365) ? $delay : self::DEFAULT_DELETE_DELAY, true);
 		$this->appConfig->setValueInt(Application::APP_ID, self::KEY_KIT_VERSION, (int)($kit['kit_version'] ?? 1), true);
 		// Having and successfully using a real kit file is stronger proof than the normal
 		// download-and-confirm flow it replaces.
@@ -260,13 +262,14 @@ final class KeyService {
 		return $this->appConfig->getValueString(Application::APP_ID, self::KEY_FINGERPRINT, '', true);
 	}
 
-	/** @return array{version:int, app:string, fingerprint:string, created:string, wrapped_key:array, instructions:string} */
+	/** @return array{version:int, app:string, fingerprint:string, kit_version:int, delete_delay_days:int, confirmation_code:string, created:string, wrapped_key:array, slots:list<array{slot:int, label:string, created:int}>, instructions:string} */
 	public function recoveryKit(): array {
 		return [
 			'version' => 1,
 			'app' => 'NG Backup',
 			'fingerprint' => $this->fingerprint(),
 			'kit_version' => $this->kitVersion(),
+			'delete_delay_days' => $this->deleteDelayDays(),
 			'confirmation_code' => $this->kitCode(),
 			'created' => gmdate('c'),
 			'wrapped_key' => $this->wrappedKey(),

lib/Service/LeaseService.php

@@ -76,6 +76,17 @@ final class LeaseService {
 		$qb->executeStatement();
 	}
 
+	/** Wraps $refresh so calling it often (per file, per row batch) only touches the database every $seconds. */
+	public static function throttled(callable $refresh, int $seconds = 60): \Closure {
+		$last = time();
+		return static function () use ($refresh, $seconds, &$last): void {
+			if (time() - $last >= $seconds) {
+				$refresh();
+				$last = time();
+			}
+		};
+	}
+
 	/** Run $fn under a lease; $refresh() can be called during long work. */
 	public function with(string $name, string $mode, int $ttl, callable $fn): mixed {
 		$id = $this->acquire($name, $mode, $ttl);

lib/Service/RestoreFullService.php

@@ -70,7 +70,8 @@ final class RestoreFullService {
 		if (!$check['ok']) {
 			throw new \RuntimeException($this->describeBlockers($check));
 		}
-		return $this->withSharedLock($target, function () use ($target, $snapshotId) {
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $snapshotId) {
+			$beat = LeaseService::throttled($refresh);
 			$repo = $this->targets->repository($target);
 			$meta = $repo->snapshotMeta($snapshotId);
 
@@ -100,7 +101,7 @@ final class RestoreFullService {
 				$ownAppConfig = $this->preserveOwnAppConfig();
 				$dumper = new DbDumper($this->db->getInner(), $prefix);
 				try {
-					$dumper->restore($repo, $manifest, $dbReport);
+					$dumper->restore($repo, $manifest, $dbReport, $beat);
 				} finally {
 					$this->restoreOwnAppConfig($ownAppConfig);
 				}
@@ -114,7 +115,7 @@ final class RestoreFullService {
 			$backupConfig = $this->fetchBackupConfig($target, $snapshotId);
 
 			$dataDir = rtrim($this->config->getSystemValueString('datadirectory'), '/');
-			$dataFiles = $this->restore->restoreToDirectory($target, $snapshotId, 'data', $dataDir, stripPrefix: true);
+			$dataFiles = $this->restore->restoreToDirectory($target, $snapshotId, 'data', $dataDir, stripPrefix: true, heartbeat: $beat);
 
 			// Last step: nothing after this may need $this->targets->repository($target) again.
 			if ($backupConfig !== []) {
@@ -215,9 +216,8 @@ final class RestoreFullService {
 
 	private function withSharedLock(Target $target, callable $fn): mixed {
 		try {
-			// No progress from DbDumper::restore()/Repository::restore() to refresh this lease
-			// against; a very large instance could in theory outrun this TTL (same limitation as
-			// RestoreService::restoreToDirectory(), see also UserBackupService).
+			// Refreshed during the database and data restore (per row batch, per blob), so a
+			// cleanup cannot take over the location while a long restore is still reading it.
 			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 7200, $fn);
 		} catch (LockedException) {
 			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');

lib/Service/RestoreService.php

@@ -156,14 +156,23 @@ final class RestoreService {
 	 *             Repository::restore()); used to restore "data/" or "config/" straight into the
 	 *             real data/config directory for occ backup:restore:full.
 	 */
-	public function restoreToDirectory(Target $target, string $snapshotId, string $prefix, string $directory, bool $stripPrefix = false): int {
+	public function restoreToDirectory(Target $target, string $snapshotId, string $prefix, string $directory, bool $stripPrefix = false, ?callable $heartbeat = null): int {
 		if ($prefix !== '' && !Repository::isSafePath($prefix)) {
 			throw new \InvalidArgumentException('Invalid path: ' . $prefix);
 		}
 		if (!is_dir($directory) && !mkdir($directory, 0750, true) && !is_dir($directory)) {
 			throw new \RuntimeException("Cannot create $directory");
 		}
-		return $this->withSharedLock($target, fn () => $this->targets->repository($target)->restore($snapshotId, $directory, trim($prefix, '/') === '' ? '' : trim($prefix, '/') . '/', $stripPrefix), 3600);
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $snapshotId, $prefix, $directory, $stripPrefix, $heartbeat): int {
+			$own = LeaseService::throttled($refresh);
+			$beat = static function () use ($own, $heartbeat): void {
+				$own();
+				if ($heartbeat !== null) {
+					$heartbeat();
+				}
+			};
+			return $this->targets->repository($target)->restore($snapshotId, $directory, trim($prefix, '/') === '' ? '' : trim($prefix, '/') . '/', $stripPrefix, $beat);
+		}, 3600);
 	}
 
 	private function writeFile(Repository $repo, Folder $dest, string $relPath, array $entry): void {

lib/Service/UserBackupService.php

@@ -34,9 +34,9 @@ final class UserBackupService {
 	/** @throws UserMigrationException when user_migration is not enabled, or the export itself fails */
 	public function backupUser(Target $target, IUser $user): string {
 		$service = $this->locator->get();
-		return $this->withSharedLock($target, function () use ($target, $user, $service) {
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $user, $service) {
 			$repo = $this->targets->repository($target);
-			$dest = new RepositoryExportDestination($repo, $user->getUID());
+			$dest = new RepositoryExportDestination($repo, $user->getUID(), LeaseService::throttled($refresh));
 			$service->export($dest, $user);
 			// A short exclusive lock around the catalog write only: the shared lock above
 			// allows another concurrent backup (full or per-user) to be writing the catalog at
@@ -49,10 +49,7 @@ final class UserBackupService {
 
 	private function withSharedLock(Target $target, callable $fn): mixed {
 		try {
-			// UserMigrationService::export() exposes no progress, so unlike
-			// RestoreService::restoreUserFiles() this lease cannot be refreshed mid-call; a very
-			// large account could in theory outrun this TTL. Resumable, step-based per-user
-			// backup (like the main BackupService run) is a possible future improvement.
+			// Refreshed by RepositoryExportDestination as it writes data, so a long export keeps it.
 			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
 		} catch (LockedException) {
 			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');

lib/Service/UserRestoreService.php

@@ -45,7 +45,7 @@ final class UserRestoreService {
 	/** @throws UserMigrationException when user_migration is not enabled, or the restore itself fails */
 	public function restoreUser(Target $target, string $manifestPath, string $mode = self::MODE_REPLACE): IUser {
 		$service = $this->locator->get();
-		return $this->withSharedLock($target, function () use ($target, $manifestPath, $mode, $service): IUser {
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $manifestPath, $mode, $service): IUser {
 			$repo = $this->targets->repository($target);
 			// Only ever read a manifest the verified catalog actually recorded: a path alone
 			// (even one this app generated before) proves nothing about it still being current
@@ -80,7 +80,7 @@ final class UserRestoreService {
 			if ($existing !== null) {
 				// Never import over a live account: export its current state first, so nothing
 				// is lost if the restore turns out to be the wrong choice.
-				$safety = new RepositoryExportDestination($repo, $originalUid);
+				$safety = new RepositoryExportDestination($repo, $originalUid, LeaseService::throttled($refresh));
 				$service->export($safety, $existing);
 				$safetyManifestPath = $safety->manifestPath();
 				// Same race as UserBackupService::backupUser(): reopen the repository inside the
@@ -119,8 +119,7 @@ final class UserRestoreService {
 
 	private function withSharedLock(Target $target, callable $fn): mixed {
 		try {
-			// See UserBackupService::withSharedLock(): UserMigrationService exposes no progress,
-			// so this lease cannot be refreshed mid-call.
+			// Refreshed while the safety export writes data (see UserBackupService::withSharedLock()).
 			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
 		} catch (LockedException) {
 			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');