Guard Lepton storage setup and preserve partial game updates

docs/user-guide/apk-manager.md

@@ -24,7 +24,7 @@ Choose **Install APK**, select an individual `.apk`, and review its name, packag
 
 Inside Frame, file inputs in both management panels use Framely’s built-in file picker, including APKs, plugin packages and language files. It opens Downloads by default, remembers the last selected folder, and provides a lazily loaded folder tree for Home, temporary files and mounted storage, with folder navigation, path entry, search, hidden files and file-type filtering. Select a file and confirm; B/Escape cancels the picker without closing the panel. External browsers continue using their system file picker. The launcher’s **Install APK** shortcut opens APK Manager.
 
-Framely installs packages into separate Android package directories even when they share a container. Container restarts preserve downloaded resources in Android external storage. Older single-APK mounts are repaired from the saved APK when available, and legacy OBB resource links are migrated before replacement without deleting their original target. This prevents future loss; resources already deleted by an older startup cannot be reconstructed from the APK alone.
+Framely installs packages into separate Android package directories even when they share a container. Container restarts preserve downloaded resources in Android external storage, including unfinished download fragments and update checkpoints. Unrecognized Lepton media setup hooks are rejected before they can discard those files. Whether a game resumes its download still depends on its own updater. Older single-APK mounts are repaired from the saved APK when available, and legacy OBB resource links are migrated before replacement without deleting their original target. This prevents future loss; resources already deleted by an older startup cannot be reconstructed from the APK alone.
 
 Each new app uses its own independent container. Existing shared containers remain discoverable; their existing packages can still be updated or managed, but new package identities cannot be added. Framely does not automatically split, migrate or delete older shared containers or their data. Steam-managed containers remain excluded.
 

docs/zh-CN/user-guide/apk-manager.md

@@ -26,6 +26,10 @@ APK 管理用于安装和管理 Steam Frame 上的 Lepton 侧载应用，本地
 
 在 Frame 内，两个管理面板的文件选择入口统一使用 Framely 内置文件选择器，包括 APK、插件包和语言文件。默认打开下载目录，记住上次选择的目录；左侧为按需加载的文件夹树，覆盖主目录、临时目录和已挂载存储，支持逐级展开、收起和当前路径定位，提供目录导航、手动输入路径、搜索、隐藏文件和文件类型筛选。选中文件后确认；B/Escape 只取消选择器，不关闭管理面板。外部浏览器继续使用系统文件选择器。启动台右侧的“安装APK”按钮打开 APK 管理面板。
 
+共享容器中的 APK 使用各自独立的 Android 安装目录。容器重启会保留 Android 外部存储中的已下载资源，包括未完成的下载片段和更新进度记录。无法识别的 Lepton 存储初始化脚本会在执行前拒绝，避免丢弃文件；游戏是否继续下载仍由自身更新器决定。旧版单 APK 挂载会在保存的安装包可用时恢复，旧 OBB 资源链接会在替换安装前迁移，并保留原目标。这只能防止后续丢失，旧版启动流程已经删除的下载资源无法仅靠 APK 还原。
+
+已显示的应用再次打开时复用运行中的容器和虚拟手柄。无显示或已完全隐藏的窗口、改变窗口物理尺寸、首次挂载新的手柄设备时仍需重启，因为 Lepton 无法安全地在运行中完成这些显示或设备切换。
+
 每个新应用固定使用独立容器。已有共享容器继续识别，允许更新和管理其中已安装的应用，但不能再添加新的包名。Framely 不会自动拆分、迁移或删除旧共享容器及其数据；Steam 管理的容器仍不作为安装目标。
 
 安装全程使用无显示的后台容器，不打开安卓桌面，不受所选显示方式影响。安装不会自动打开应用，完成后可以点击“打开”。没有检测到启动入口的 APK 仍可管理，但不会放进启动台。
@@ -103,6 +107,4 @@ Moonlight V+ 12.12.12 的创建连接界面在当前测试的 Lepton 版本上
 
 开启此选项后，请通过管理面板或启动台打开 APK。一次性命令行进程无法管理持续运行的输入桥接，此时命令行启动会明确报错。
 
-共享容器中的 APK 使用各自独立的 Android 安装目录。容器重启会保留 Android 外部存储中的已下载资源；旧版单 APK 挂载会在保存的安装包可用时恢复，旧 OBB 资源链接会在替换安装前迁移，并保留原目标。这只能防止后续丢失，旧版启动流程已经删除的下载资源无法仅靠 APK 还原。
 
-已显示的应用再次打开时复用运行中的容器和虚拟手柄。无显示或已完全隐藏的窗口、改变窗口物理尺寸、首次挂载新的手柄设备时仍需重启，因为 Lepton 无法安全地在运行中完成这些显示或设备切换。

src/apk.rs

@@ -964,6 +964,12 @@ for framely_mount_hook in setup_mounts setup_podman_mounts; do
     declare -F "$framely_mount_hook" >/dev/null || continue
     framely_mount_body="$(declare -f "$framely_mount_hook")"
     framely_media_remove='rm -rf "$(data_mount_path)/media/0"'
+    # Refuse an unrecognized storage hook before invoking it. A future Lepton
+    # syntax change must never silently bypass resource preservation.
+    if [[ "$framely_mount_hook" == setup_mounts && "$framely_mount_body" == *'$(data_mount_path)/media/0'* && "$framely_mount_body" != *"$framely_media_remove"* ]]; then
+        echo "Unsupported Lepton media setup; refusing to risk downloaded resources" >&2
+        exit 64
+    fi
     if [[ "$framely_mount_body" == *"$framely_media_remove"* ]]; then
         framely_mount_body="${framely_mount_body//"$framely_media_remove"/framely_prepare_media || return}"
         eval "$framely_mount_body"
@@ -2828,8 +2834,14 @@ setup_podman_mounts
             }
             c.status().unwrap()
         };
+        let part = marker.with_file_name("resource.part");
+        let checkpoint = marker.with_file_name("update.checkpoint");
+        fs::write(&part, b"unfinished download").unwrap();
+        fs::write(&checkpoint, b"offset=19").unwrap();
         assert!(run(None).success());
         assert!(run(None).success());
+        assert_eq!(fs::read(&part).unwrap(), b"unfinished download");
+        assert_eq!(fs::read(&checkpoint).unwrap(), b"offset=19");
         assert_eq!(fs::read_to_string(&marker).unwrap(), "downloaded resource");
         let compat = dir.path().join("compat");
         fs::create_dir(&compat).unwrap();
@@ -2840,6 +2852,15 @@ setup_podman_mounts
             fs::read_link(data.join("media/0")).unwrap(),
             compat.join("external")
         );
+        let current = fs::read_to_string(library.join("liblepton.sh")).unwrap();
+        fs::write(
+            library.join("liblepton.sh"),
+            current.replace("rm -rf ", "rm -rf -- "),
+        )
+        .unwrap();
+        assert!(!run(Some(&compat)).success());
+        assert_eq!(fs::read(&part).unwrap(), b"unfinished download");
+        assert_eq!(fs::read(&checkpoint).unwrap(), b"offset=19");
     }
     #[test]
     fn local_apk_review_snapshots_source_and_rejects_invalid_selections() {