Fixes the three suspected bugs this PR's characterization tests pinned,
flipping those tests to assert the corrected behavior:
- plugins/store: ONE shared update comparator. New
compatibility.is_update_available() (PEP 440 via packaging) is now used
by both the web UI's update badge (api_v3._is_plugin_update_available
is a thin alias) and store_manager.update_plugin's reinstall decision.
Previously update_plugin used raw string equality: 'v1.2.0' vs '1.2.0'
triggered a full reinstall the UI called unnecessary, and a locally-
ahead plugin (2.0.0 installed, registry 1.9.0) was silently DOWNGRADED.
Now equivalent spellings skip the reinstall and locally-ahead versions
are never downgraded; unparseable versions still reconcile by
reinstalling from the registry.
- config: save_config and save_config_atomic now refuse (ConfigError)
when config_secrets.json exists but cannot be loaded. Both previously
proceeded without stripping, writing the merged secrets into
config.json in plaintext. The shared _load_secrets_for_save() helper
raises with an actionable message instead; a missing secrets file is
still fine (nothing to strip), and _migrate_config's catch-all keeps
boot resilient.
- skins: render_skin_card resets _skin_failures on both success paths
(vegas card returned, or mode renderer handled), mirroring
_render_game. Transient card failures no longer accumulate across a
session until they permanently disable a working skin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NohXi78cwsAKtN1sCfxjUh
Claude
206eca078e