Fixes the three suspected bugs this PR's characterization tests pinned,
flipping those tests to assert the corrected behavior:
- plugins/store: ONE shared update comparator. New
compatibility.is_update_available() (PEP 440 via packaging) is now used
by both the web UI's update badge (api_v3._is_plugin_update_available
is a thin alias) and store_manager.update_plugin's reinstall decision.
Previously update_plugin used raw string equality: 'v1.2.0' vs '1.2.0'
triggered a full reinstall the UI called unnecessary, and a locally-
ahead plugin (2.0.0 installed, registry 1.9.0) was silently DOWNGRADED.
Now equivalent spellings skip the reinstall and locally-ahead versions
are never downgraded; unparseable versions still reconcile by
reinstalling from the registry.
- config: save_config and save_config_atomic now refuse (ConfigError)
when config_secrets.json exists but cannot be loaded. Both previously
proceeded without stripping, writing the merged secrets into
config.json in plaintext. The shared _load_secrets_for_save() helper
raises with an actionable message instead; a missing secrets file is
still fine (nothing to strip), and _migrate_config's catch-all keeps
boot resilient.
- skins: render_skin_card resets _skin_failures on both success paths
(vegas card returned, or mode renderer handled), mirroring
_render_game. Transient card failures no longer accumulate across a
session until they permanently disable a working skin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NohXi78cwsAKtN1sCfxjUh
- ci-fixture-plugin: call display_manager.clear() before rendering (per
plugin guidelines — the fixture should model a well-behaved plugin),
add a class docstring, and document why Pillow is deliberately not
pinned in its requirements.txt (core dependency; harness installs
nothing).
- Rename two tests whose names contradicted their assertions:
test_unparseable_core_version_is_compatible ->
test_unparseable_core_with_high_floor_is_blocked, and
test_unreadable_secrets_file... -> test_corrupt_secrets_file...
- Annotate TestGetSchemaProperty.SCHEMA as ClassVar (RUF012).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NohXi78cwsAKtN1sCfxjUh
New unit tests for pure or filesystem-only logic that previously had zero
direct coverage:
- test_compatibility.py: the semver install gate (parse_semver suffix
handling, every range operator, TRUSTWORTHY_FLOOR behavior for cores
reporting untrustworthy versions, 'more restrictive wins', and the
malformed-manifest shapes that used to raise).
- test/web_interface/test_secret_helpers.py: the canonical x-secret
helpers — find/separate/mask/remove, array-item secrets, no input
mutation, and a separate->recombine round-trip.
- test/web_interface/test_api_v3_helpers.py: the module-level helpers
behind the plugin config save endpoint (_is_plugin_update_available,
_coerce_to_bool including the int==1 quirk, deep_merge including its
shared-subtree shallowness, _parse_form_value, dotted-key-aware
_get_schema_property/_set_nested_value).
- test_base_plugin_duration.py: get_display_duration's full coercion
ladder (instance attr -> config -> 15.0), including the bool-is-int
quirk where display_duration=True means one second.
- test_config_manager_secrets.py: the secrets round-trip — deep-merge on
load, strip on save, group pruning, the load fast path — and two
characterized sharp edges marked SUSPECTED BUG: an unreadable secrets
file at save time writes secrets into config.json in plaintext, and a
same-mtime-same-size content swap is served stale.
- test_schema_manager_merge.py: merge_with_defaults branch behavior (None
replacement vs falsey preservation, dict-vs-scalar mismatches, arrays
replaced wholesale, defaults never mutated).
- test_skin_system.py (extended): render_skin_card shares _render_game's
3-strike counter but never resets it on success — the asymmetry is
pinned in both directions, along with card fallthrough and the disable
interaction between the two paths.
Suspected bugs are characterized, not fixed — each carries a comment so a
future behavior change is deliberate rather than accidental.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NohXi78cwsAKtN1sCfxjUh
Claude