Merge "Ensure CancelUpdate() always works in recovery." into main