fix(errors): report a definitive 404 as not_found, not server_unreachable#1571
Merged
Conversation
github-actions
Bot
added
area:saves
…able
RomM answers a request for an entity it no longer has with HTTP 404. Every
exception-type-blind service site collapsed that onto server_unreachable, so
the UI claimed "RomM offline" while the server was plainly answering.
Route those sites through classify_error, which already maps
RommNotFoundError to NOT_FOUND. Sites whose verdict is a partial-success
flag rather than a reason slug peel the 404 off with a sibling
except RommNotFoundError instead:
- get_version_list returns the local-only list with server_query_failed
False on a 404, so the picker stops feeding the global connection store.
- get_save_status keeps server_query_failed True (the flag is what stops
the matrix classifying local files as ready-to-upload against an empty
server list) and gains the additive server_query_reason slug, so only an
explicit server_unreachable drives the offline state.
- list_file_versions and rollback_to_version gain a not_found arm,
distinct from server_unreachable (retryable) and version_deleted (one
save missing from a ROM the server still has).
classify_error gains a narrow ConnectionError/TimeoutError/socket.gaierror
branch so a raw socket failure keeps the unreachable slug. Deliberately not
bare OSError: that also covers local disk I/O, and reporting a failed
settings write as "server unreachable" is the same lie pointing the other
way.
Messages that asserted reachability are replaced ("RomM server not
reachable.", "Cannot inspect slot - server unreachable"); messages already
true for both branches are kept, since only the routing slug was wrong.
scripts/check_404_not_unreachable.py locks this in: a catch-all handler in
services/ may not bind a verdict key (reason/status/recommended_action) to a
hardcoded SERVER_UNREACHABLE. The rule is positional rather than "does the
handler call classify_error", so it also catches a handler that consults the
funnel and then discards its verdict. It finds 14 sites against the previous
tree. steamgrid.py is exempt with a recorded reason: it talks to
SteamGridDB, whose failures classify_error has no branch for.
Add scripts/check_404_not_unreachable.py to the lint task and the architecture-gate CI job, plus its row in the invariant register. check_failure_shape.py inspects key presence only, so a hardcoded server_unreachable is a perfectly canonical failure shape and every one of these sites was green there. This check inspects the slug choice instead. The class was swept once before and came back, which is why it gets a mechanical check rather than a review note. Document the rule where users meet it: the save-sync offline-behaviour paragraph and the troubleshooting offline-detection section now say that a "RomM no longer has this" answer leaves the offline badge clear, and that the fix in that case is server-side rather than with the network.
get_save_setup_info collapsed every server-saves failure onto recommended_action "server_unreachable", so a RomM database reset — which drops this device's registration and makes the saves query 404 — told the user their server was offline while it was answering fine. Add a fourth arm, "not_found", peeled off with a sibling except RommNotFoundError. It holds the wizard exactly as the unreachable branch does: a 404 leaves the server's slot inventory just as unproven as an outage, so auto-confirming the default slot could still clobber real server saves on the first post-confirmation sync. The launch gate likewise still aborts. Only the copy and the reachability verdict change. The copy deliberately does not say the game has no saves. The 404 can come from the device registration rather than the ROM, so that would swap one lie for a more specific one; it states what RomM could not find instead. SlotSetupWizard needed no change: it already tested for an explicit server_unreachable, so a not_found result now correctly reports the server reachable and leaves the reconnect gate disarmed. This clears the last site flagged by check_404_not_unreachable.py.
…budget Rollup ships src/ comments verbatim in dist/index.js, and the bundle sits close to its 800 kB size-limit: 796.76 kB before this branch. The new comments alone pushed it to 800.61 kB and failed `pnpm size`. Condense them to the load-bearing reasoning — every "why" is kept, only restatement is dropped. Two blocks in SlotSetupWizard went entirely: the surrounding comments already said "any other resolved result proves the server answered", which covers the new not_found case. 799.34 kB.
Review caught three consumers that still spoke of an unreachable server on an answered 404, and three smaller defects: - computeSyncSummary (the Saves-tab slot header, #1560's own surface) printed a literal "Server unreachable" off the bare server_query_failed flag. Gate it on server_query_reason: only server_unreachable says so, otherwise "Save status unavailable". - CustomPlayButton's resolve-conflict toast body was left ungated inside the branch whose store feed was already gated, so it asserted reachability on a 404. Gate the copy on the same slug. - VersionHistoryPanel's load and restore copy claimed the game's saves are gone. The 404 can be the device registration, not the ROM (the backend says so in its own comment), so it now says RomM couldn't find the save data — matching the wizard's wording. Each of these three strings now carries a test asserting it never claims reachability nor that the saves are absent; the two that had unpinned copy were how the drift got in. Also: the 404 gate's nested-try handling was the reverse of its docstring — a nested peel leaked into the outer handler's scan and would false-positive. Scope the dict walk to skip nested try statements (each is scanned as its own statement) and pin both directions with tests. Move a misplaced union comment onto the member it describes, and drop a dead duplicate mock setup.
copy_save_to_slot landed on main during PR 1's review; its post-preflight list_saves collapsed every failure onto server_unreachable — the same conflation this branch removes, which its own new gate now flags. The call is rom- AND device-scoped, so a definitive 404 is the #1560 family (dead ROM or dropped device registration): the server answered. Add a sibling except RommNotFoundError before the catch-all, returning the discriminated not_found status and persisting the pre-flight-mutated save_state first, exactly as the server_unreachable branch does — otherwise that work is lost. The catch-all keeps server_unreachable for genuine transport failures. Frontend: add the not_found member to CopySaveToSlotStatus and a case in useCopyToSlot that neither reports the server offline nor claims the game's saves are gone (the 404 can be the device registration). Tests pin the backend branch (incl. that the pre-flight timestamp was persisted) and the copy rule for the new string.
danielcopper
force-pushed
the
fix/1570-error-classification
branch
from
July 23, 2026 20:01
d42b959 to
59c6bdb
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
PR 1 of #1570. A definitive HTTP 404 from RomM — "I don't have this entity" — was being reported to the
UI as "the server is unreachable", so the whole plugin flipped to RomM offline while the server was
answering fine. This PR makes a definitive 404 carry the
not_foundslug, and makes the frontend'sglobal connection state react only to an explicit
server_unreachableverdict.Classification only — no new behaviour, no liveness logic. The version-picker fixes that build on it
(
vanished/bound_vanished, the switch guard, the purge) are PRs 3–5 of the same issue.Why the whole UI went offline
A correct 404 funnel already existed —
classify_errormapsRommNotFoundError→ErrorCode.NOT_FOUND— but ~17 service sites bypassed it, collapsing every exception onto
SERVER_UNREACHABLE. Seven ofthose reach the global connection store through the frontend, violating that store's own documented
contract ("never feed it an arbitrary error"). One site even called
classify_errorand then discardedits verdict. This class was swept once before (#971) and grew back, because nothing enforced it.
What changed
classify_error(the audit found 3 the issue's list missed;all named in the commit). A definitive entity-404 yields
not_found; a genuine transport failure stillyields
server_unreachable.classify_errorgained a narrow transport branch —ConnectionError | TimeoutError | socket.gaierror→server_unreachable. BareOSErrorwas deliberately not mapped (a local"disk full" must stay
unknown); the rejected experiment is recorded at the call site and pinned by atest.
not_foundarm without collapsingtheir additive flags:
get_save_statuskeepsserver_query_failed: Trueand addsserver_query_reason(flipping the flag would run the save matrix against an empty server list andmis-classify local files as ready-to-upload); the save-setup wizard gained a 4th
recommended_action: "not_found"that still HOLDS setup and still ABORTS the launch gate — only thecopy and the offline verdict change.
server_unreachableslug. User-visible strings that asserted reachability were replaced; strings that were neutral and
true in both branches were kept.
scripts/check_404_not_unreachable.py(wired intomise.tomland CI, with aninvariant-register row): a catch-all handler in
services/may not bind a verdict key to a hardcodedSERVER_UNREACHABLE. It keys on the verdict's position, not on whether the funnel was called, so itcatches the discard-the-verdict shape. Proven non-vacuous: 14 findings against pre-change
main, 0now.
Relationship to #1560
#1560 is the same conflation on the device-registration path (a 404 on a stale
device_idreported as"offline"). This PR makes that path's message honest; making it recover is PR 2, which closes #1560.
Changed user-visible copy (for on-device review)
Steam truncates a toast body to one line; detail goes in the subtext.
None of the new strings claim the game has no saves (a 404 can be the device registration) and none
assert reachability on an answered 404 — both rules are pinned by tests.
Verification
mise run gategreen at the final commit: allcheck_*gates, import-linter, 6260 backend tests,2146 frontend tests, ruff/basedpyright/typecheck clean, bundle 799.74 kB under the 800 kB limit.
Docs updated in the same PR:
docs/user-guide/save-sync.md,docs/user-guide/troubleshooting.md,CLAUDE.md invariant register.
Deferred (named so review reads them as decisions, not gaps)
artwork.py'sif not rom:branch and the sites that swallow a 404 intoNone— carried to PR 3,which owns the "server answered with nothing" shape.
build change that PR 2 should take first, tracked separately.
Closes part of #1570.