Built both packages on a real Windows box and drove the whole flow. Four bugs
that only surfaced by running it, none of which static checks could see.
1. Stale version after updating. app_version() read installed dist metadata,
which lives in python/ -- the directory the updater deliberately never
replaces. A self-updated install kept reporting the old version and would
re-offer an update it had already applied, forever. It now prefers the app
layer's static/version.json, which moves with backend/. Gitignored, so Docker
and source checkouts still fall through to the hatch-vcs metadata.
Proven: after a real update, python/ dist-info says 0.13.0 while /api/health
reports 0.13.1.
2. The page CSP blocked the whole feature. The UI is served over http by the
Python backend, so its connect-src applies: api.github.com is allowed,
github.com and objects.githubusercontent.com are not, and that is where
release assets live. Fetching the checksum and runtime id from JS was
refused, so the pill would simply never appear. Those two reads moved into
Rust (check_app_update), whose HTTP client is not bound by the page CSP, so
the policy from #171 stays exactly as tight as it was.
3. plugin:event|listen refused by the Tauri ACL. App-defined commands are not
ACL-gated but plugin commands are, and the capability does not cover the
remote http origin the UI is served from. The progress bar is now
indeterminate instead of granting a remote origin event permissions to put a
percentage on a 5 MB download.
4. The post-strip import check re-bloated the package. Running Python
regenerated 1,912 files / 39 MB of __pycache__ that the strip had just
removed, cancelling nearly all of it: the net saving was 180 files. Swept
once after the last interpreter run, and backend/ no longer ships a
developer's local __pycache__ either.
Also: the *.old sweep now runs on every launch rather than only on a version
change. apply_app_update relaunches then exits, so on the first launch of the
new build Windows still holds StemDeck.exe.old open, the delete fails silently,
and gated on a change that already happened it would never retry. Observed for
real: 15.7 MB stranded. Verified swept on the next launch.
UI: "Update now" is an accent pill BESIDE Download, not a replacement, so the
zip stays one click away and is the escape hatch if an update fails.
Measured against the published v0.13.0 package: 18,143 -> 16,056 files
(-2,087, -11.5%) and 883 -> 850 MB. The real win for #421 is the update path
itself: 5 MB and 123 files instead of 284 MB and 16,056.
Verified on this machine: a real 6-stem Demucs separation through the stripped
package; the full notify -> Update now -> download -> restart -> relaunch cycle,
after which user data (job, 7 stems, 130 MB of models), portable.txt, cpu-only
and python/ were all untouched; and the safety gate correctly declining, with
no download attempted, when the release's runtime id differs.
Not covered: the NVIDIA package was not built, though the risk that motivated
the gate is structurally gone now that python/ is never swapped.
Thales
8c0a96689f