lanspread/FOLLOW_UP_PLAN.md

Follow-up Plan

Distilled from REVIEW_STEP_1..4. Ordered by impact, not by review number.

Correctness / risk

1. Recovery vs. in-flight downloads race

install::recover_on_startup (transaction.rs:118-156) sweeps .version.ini.tmp / .version.ini.discarded for every game root without consulting active_operations. If load_local_library runs while a download is in-flight (e.g. SetGameDir mid-download), the sweep can delete files the download is renaming.

Fix: in recover_download_transients (and the per-root recovery), skip game IDs present in Ctx::active_operations.

2. Recovery re-runs on every state change

load_local_library (and therefore recover_on_startup) runs at startup, on SetGameDir, and after every install/update/uninstall (handlers.rs:487-497). On a 100+ game library this is O(N) fs reads per operation for no gain — the just-completed transaction already cleared its own state.

Fix: either run recover_on_startup only at startup + SetGameDir, or scope post-operation recovery to the single affected game ID.

Dead / misleading code

3. PeerCommand::UpdateGame is unreachable

Variant exists in lib.rs:163 but has no sender. Tauri's update_game sends GetGame; auto-install uses RequestedInstallOperation::Auto. Fix: remove the variant, or wire update_game to send it.

4. InstallIntent::manifest_hash never populated

Field defined in intent.rs but always None. Fix: remove it, or add a one-line comment explaining it's reserved.

5. Availability::Downloading never emitted

build_game_summary only produces Ready/LocalOnly. Operation-table gating already covers in-progress state. Fix: add a comment in the proto enum that Downloading is intentionally unreachable from build_game_summary, so the next implementor doesn't add a third gate.

6. RequestedInstallOperation::Auto and Install collapse to the same thing

handlers.rs:355-363: both pick Updating if local/ exists, Installing otherwise. Three variants, two distinct behaviors. Fix: merge Auto+Install into one variant (e.g. Inferred) or a bool flag.

7. partition_download_descriptions doesn't actually partition

download.rs:110-137 keeps version.ini inside transfer_descs and only additionally extracts a version_desc. The runtime routes sentinel chunks via version_buffer.matches(...), not by list separation. Fix: rename to reflect what it does (e.g. extract_version_descriptor), or actually split into two lists.

UI / event naming

8. Rename game-unpack-finished → game-install-finished

There is no longer an "unpack" stage distinct from "install". The event is internal; no external consumer. Update both src-tauri/src/lib.rs:880-894 and src/App.tsx:293-320.

9. UI LocalOnly is reverse-engineered from installed && !downloaded

build_game_summary computes Availability then throws it away in game_from_summary. UI recomputes (App.tsx:742-744). Works today, but silently misses any future Availability variant. Fix: add availability: string to the TS Game and serialize it end-to-end.

10. Tauri-side active_operations has no reconciliation

If a PeerEvent::InstallGameFinished / …Failed is dropped, the UI is stuck "installing" until app restart. Fix (defer): include an in-progress snapshot in PeerEvent::LocalGamesUpdated so the UI can recompute from authoritative state instead of accumulating from event history.

Test breadth (largest gap)

11. Install-recovery matrix — only 1 of ~11 rows tested

Only recovery_restores_backup_for_interrupted_update (transaction.rs:591) exercises an intent-driven row. Fix: convert to a table-driven test over (intent_state, local, .local.installing, .local.backup) combinations and assert resulting FS + intent for each.

12. Missing transaction test cases

• Successful update path (only failure path is tested).
• Update rollback on commit-rename failure (not extract failure).
• Uninstall delete-failure restore — restore_backup rollback in transaction.rs:107-114.
• begin_version_ini_transaction initial-rename behavior (download.rs:193-206).
• rollback_version_ini_transaction (download.rs:208-221).
• Multi-.eti download.
• Intent JSON: parse error / corrupt body / mismatched id field (only schema-mismatch is tested).
• Installed-only → Ready transition when user drops in a version.ini.

13. Scanner gating: zero dispatch-level tests

handle_watch_event (local_monitor.rs:208-236) and RescanGate / run_gated_rescan (local_monitor.rs:261-287) have no tests. Add:

• Event for ID under active operation is dropped.
• Burst of events collapses to ≤2 rescans for the same ID.
• Sideload picked up by fallback scan.
• Non-catalog game produces no library index entry and no LibraryDelta.

14. Serve gating: only predicates tested, not dispatch

local_download_available is tested; handle_get_game_command, handle_get_game_file_data, handle_get_game_file_chunk dispatch paths are not. Add small tests against an in-memory Ctx covering: non-catalog ID, mid-operation, missing sentinel.

15. Windows-path coverage for is_version_ini

db.rs:181-184 normalizes \\→/. Add one test with a backslash path.

Code hygiene

16. Consolidate TempDir test helper

Reimplemented in 5 files (install/intent.rs:128, install/transaction.rs:498, local_games.rs:615, download.rs:926, +variants). Move to a single test_support module or use the tempfile crate.

17. Rename partition_requires_exactly_one_root_version_ini

The test's "duplicate" case is actually a nested-decoy case under the new tight predicate. Split into two named tests: one for nested-decoy ignored, one for true duplicates rejected.

18. Split download.rs (1162 lines)

Mixes chunk planning, retry orchestration, version-sentinel transaction, in-memory buffer, and the main loop. Future split into download/{transaction,chunks,orchestrator}.rs.

19. save_library_index is not atomic

local_games.rs:141-148 writes without temp+rename. Blast radius is small (corrupt index → next scan rebuilds), but matching the intent-log atomic pattern would be cheap.

Documentation

20. Add undocumented decisions to IMPL_DECISIONS.md

Observed but not recorded:

• partition_download_descriptions keeps version.ini in transfer_descs (see #7).
• recover_on_startup re-runs on every load_local_library (see #2).
• PeerCommand::UpdateGame left as dead variant (see #3).
• Auto/Install collapse in run_install_operation (see #6).