Allow live content hotswapping on running game profiles for non-binary content types

[undead2146]

Overview

Users cannot edit a game profile while the game is running. The sole gate is GameProfileItemViewModel.CanEdit:

If a user wants to add a custom map while sitting in a lobby, they must quit the game, edit the profile, wait for workspace rebuild, and relaunch. For maps specifically this is entirely unnecessary — the C&C Generals / Zero Hour engine reads maps from the user's Documents folder (Documents\Command and Conquer Generals Zero Hour Data\Maps\) at runtime, meaning new maps can appear in the game's map list without restarting.

Indiscriminate editing is unsafe: modifying binaries or foundation assets (GameClient, GameInstallation, Mod, Addon) while the process holds file handles will cause ERROR_SHARING_VIOLATION crashes, corrupted workspaces, or failed reconciliation. A selective approach is needed.

Motivating use case

A user is in a Zero Hour lobby and realises they need a specific custom map. Today they must:

1. Alt-Tab → quit the game
2. Open GenHub → edit the profile → enable the map
3. Wait for workspace rebuild
4. Relaunch the game

With hotswapping, the flow becomes:

1. Alt-Tab → open GenHub → edit the profile → enable the map → save
2. The map appears in Documents\...\Maps\ immediately via hard link from CAS
3. Alt-Tab back → the map is visible in the game's map list

Key Architecture Discovery: Maps Use User Data, Not the Workspace

Maps do not go to the workspace directory. They are deployed to the user's Documents folder via a completely separate pipeline:

ContentInstallTarget.UserMapsDirectory
  → Documents\Command and Conquer Generals Zero Hour Data\Maps\

The deployment pipeline is:

• IUserDataTracker (IUserDataTracker.cs) — tracks installed user data files, creates hard links from CAS to Documents, backs up overwritten files, and restores them on uninstall.
• ProfileContentLinkerService (ProfileContentLinkerService.cs) — orchestrates per-profile user data lifecycle. Has delta logic for install/uninstall.
• GameLauncher (GameLauncher.cs:764-801) — calls SwitchProfileUserDataAsync at launch time to link maps into the Documents folder.

Critical finding: ProfileContentLinkerService.UpdateProfileUserDataAsync (lines 232-301) already implements the exact delta logic needed for hotswapping:

• Computes which manifests to add (in new set but not current)
• Computes which manifests to remove (in current but not new set)
• Calls userDataTracker.InstallUserDataAsync for additions
• Calls userDataTracker.UninstallUserDataAsync for removals (which restores backed-up files — the operation is reversible)
• Re-activates if the profile is the active profile

However, UpdateProfileUserDataAsync has zero callers in production code. The infrastructure exists but is never wired into the profile save path. The hotswap implementation for maps is primarily about connecting this existing method into the save flow when a game is running.

The workspace reconciliation path (WorkspaceManager / WorkspaceReconciler) is irrelevant for maps and should not be touched for this feature.

Current Architecture Gaps

1. GameProfileManager has zero awareness of launch state. It does not depend on ILaunchRegistry. UpdateProfileAsync (GameProfileManager.cs:217-240) unconditionally clears ActiveWorkspaceId when EnabledContentIds changes — this would corrupt workspace tracking for a running game.

2. GameProfileSettingsViewModel has no concept of a running profile. Its constructor takes no ILaunchRegistry dependency. SaveAsync (GameProfileSettingsViewModel.Commands.cs:296-453) calls _gameProfileManager.UpdateProfileAsync with no process checks and no call to ProfileContentLinkerService.UpdateProfileUserDataAsync.

3. ProfileContentLinkerService.UpdateProfileUserDataAsync is dead code. The method exists with correct delta logic but is never called. Maps only get deployed at launch time via SwitchProfileUserDataAsync in GameLauncher.

4. ContentReconciliationService can destroy running workspaces. InvalidateWorkspacesForManifestInternalAsync (ContentReconciliationService.cs:386-422) iterates profiles and calls workspaceManager.CleanupWorkspaceAsync + clears ActiveWorkspaceId without checking ILaunchRegistry. A background content update can delete a workspace underneath a running game.

5. IGameProfile is a pure data model. Runtime state (IsRunning) lives only in LaunchRegistry (via GameLaunchInfo.IsRunning) and the view model layer (GameProfileItemViewModel.IsProcessRunning). There is no service-level guard.

Requirements

Hotswap eligibility classification

Content types from ContentType.cs must be classified into two operational classes during active game sessions. This classification should follow the same constant pattern as ContentTypePriority (GenHub.Core.Models.Workspace):

Hotswappable (deployed to user Documents via IUserDataTracker, read dynamically by the engine):

• Map, MapPack — deployed to ContentInstallTarget.UserMapsDirectory

Not yet hotswappable (deployed to workspace, no Documents-based loading path exists yet):

• Patch, Skin, LanguagePack, Mission — these use ContentInstallTarget.Workspace and would require workspace modification while the game holds file locks. Out of scope for the initial implementation.

Locked (loaded into process memory at launch, unsafe to modify):

• GameInstallation, GameClient, Mod, Addon, Executable, ModdingTool, UnknownContentType

Immutable profile metadata (structural properties that define workspace root or launch target):

• GameInstallationId, GameClient, WorkspaceStrategy, CustomExecutablePath, WorkingDirectory

Functional requirements

1. A user must be able to open the profile editor while a profile is running.
2. Locked content types, workspace-targeted content types, and immutable profile metadata must be visibly disabled in the editor UI with an explanatory indicator when the profile is running.
3. Saving a running profile with only map/mappack content changes must deploy (or remove) the maps to the user's Documents folder via ProfileContentLinkerService.UpdateProfileUserDataAsync without clearing ActiveWorkspaceId and without disrupting the running game process.
4. Map removal must be reversible — IUserDataTracker.UninstallUserDataAsync must restore any backed-up files that were overwritten during installation.
5. Saving a running profile with any locked content type change, workspace-targeted content change, or immutable metadata change must be rejected with a descriptive, user-facing error — profile state must not be mutated.
6. Background content reconciliation (ContentReconciliationService) must not invalidate or delete workspaces for profiles that are currently running.

Proposed Approach

1. Add ContentHotswapClassification constants

Create a static class alongside ContentTypePriority in GenHub.Core.Models.Workspace (or GenHub.Core.Constants) that provides:

• IsHotswappable(ContentType) — returns true for Map and MapPack only (initial scope)
• IsLocked(ContentType) — returns true for GameInstallation, GameClient, Mod, Addon, Executable, ModdingTool

2. Inject ILaunchRegistry into GameProfileManager

Give GameProfileManager awareness of running state by adding ILaunchRegistry as a constructor dependency. In UpdateProfileAsync:

• Query ILaunchRegistry.GetAllActiveLaunchesAsync() to determine if the target profile is running.
• If running and content changed:
  • Resolve added/removed manifests via IContentManifestPool.
  • Validate every changed manifest is hotswappable using ContentHotswapClassification.IsHotswappable.
  • Validate no immutable profile metadata changed.
  • If validation passes: skip the ActiveWorkspaceId = string.Empty line at GameProfileManager.cs:239. Persist the profile update normally.
  • If validation fails: return ProfileOperationResult.CreateFailure with a descriptive message and do not mutate profile state.
• If not running: proceed with existing behaviour (clear ActiveWorkspaceId, rebuild on next launch).

3. Wire UpdateProfileUserDataAsync into the save path

This is the core of the feature. When GameProfileSettingsViewModel.SaveAsync saves a running profile with hotswappable content changes:

• After _gameProfileManager.UpdateProfileAsync succeeds, resolve the full manifests for the new EnabledContentIds.
• Call ProfileContentLinkerService.UpdateProfileUserDataAsync(profileId, newManifests, targetGame).
• This method already handles the complete delta: it installs new map hard links from CAS to Documents\...\Maps\ and uninstalls removed maps with backup restoration.
• Surface the result as a toast notification: success → "Maps updated live", failure → warning with error detail.

The GameProfileSettingsViewModel will need IProfileContentLinker and ILaunchRegistry (or a derived boolean) as new dependencies.

4. Guard ContentReconciliationService against running profiles

In InvalidateWorkspacesForManifestInternalAsync and ReconcileBulkManifestReplacementInternalAsync:

• Query ILaunchRegistry before calling workspaceManager.CleanupWorkspaceAsync.
• If the profile is running: skip workspace cleanup and log a warning. The existing ActiveWorkspaceId mismatch detection on next launch will handle deferred reconciliation.
• If the profile is not running: proceed with existing behaviour.

5. Propagate running state to the editor UI

• Add ILaunchRegistry (or a derived bool IsProfileRunning) as a dependency to GameProfileSettingsViewModel.
• When the editor is opened for a running profile:
  • Display a prominent "Hotswap Mode" status indicator.
  • Disable interactive elements for locked content types (GameClient, GameInstallation, Mod, Addon) and workspace-targeted types (Patch, Skin, LanguagePack) and immutable metadata fields (WorkspaceStrategy, GameInstallation dropdown) with explanatory tooltips.
  • Keep checkboxes enabled only for Map and MapPack.
• Update GameProfileItemViewModel.CanEdit:

  public bool CanEdit => !IsPreparingWorkspace;

Acceptance Criteria

• A ContentHotswapClassification (or equivalent constant class) exists with an IsHotswappable(ContentType) method that returns true for Map and MapPack.
• GameProfileManager depends on ILaunchRegistry and checks profile running state in UpdateProfileAsync before deciding on workspace invalidation.
• GameProfileItemViewModel.CanEdit permits opening the profile editor while a profile is running.
• GameProfileSettingsViewModel dynamically disables locked fields and workspace-targeted content types, and displays a "Hotswap Mode" indicator when the profile is running. Only Map/MapPack checkboxes remain enabled.
• Saving a running profile with a newly enabled Map or MapPack calls ProfileContentLinkerService.UpdateProfileUserDataAsync, which installs the map files as hard links from CAS to Documents\Command and Conquer Generals Zero Hour Data\Maps\.
• The newly installed map is visible in the game's map list without restarting the game process.
• Saving a running profile with a removed Map or MapPack calls IUserDataTracker.UninstallUserDataAsync, which removes the hard links and restores any backed-up files.
• Saving a running profile with any locked or workspace-targeted content type change or immutable metadata change returns a descriptive error without mutating profile state.
• ContentReconciliationService does not call CleanupWorkspaceAsync or clear ActiveWorkspaceId on profiles that are currently running.
• Unit tests cover: hotswap classification for all ContentType values, running-profile update validation (accept Map/MapPack, reject locked types), live user data deployment via UpdateProfileUserDataAsync, map removal with backup restoration, and ContentReconciliationService running-profile guard.

Explicitly Out of Scope

• Live modification of GameClient executables, GameInstallation archives, Mod BIG archives, or Addon DLLs while the game is running.
• Hotswapping Patch, Skin, or LanguagePack content — these deploy to the workspace, not the user's Documents folder, and no Documents-based loading path exists for them yet.
• In-memory code injection or live DLL hot-patching.
• Automatic reconciliation of hotswapped content when the game process exits (tracked separately if needed).

[coderabbitai]

Coding Plan

Summary

• Add a single ContentHotswapClassification utility that mirrors ContentTypePriority and classifies each ContentType as hotswappable or locked.
• Make GameProfileManager launch-aware. When a profile runs, allow only hotswappable content changes, reject locked and immutable changes with descriptive errors, and preserve ActiveWorkspaceId.
• Build a live per-file delta-execution path in WorkspaceManager that applies WorkspaceReconciler deltas through IFileOperationsService with lock-aware, non-fatal error handling and CAS reference tracking, and route the editor facade through it for running profiles.
• Update the UI so users can open a running profile, see a "Hotswap Mode" indicator, and edit only hotswappable content, and guard the real workspace cleanup paths against running profiles since the ticket's named ContentReconciliationService does not exist.

Design Choices

Design Choice 1: Location of `ContentHotswapClassification`

Options Considered:

1. Place it in GenHub/GenHub/Features/Workspace/ alongside the real location of ContentTypePriority.
2. Place it in GenHub.Core.Models.Workspace as the ticket text states.

Chosen Option: 1

Rationale: Placing it beside the real ContentTypePriority keeps the established precedent. It remains directly usable by GameProfileManager and WorkspaceManager, both in the Features layer.

Design Choice 2: Handling of the `ContentReconciliationService` running-profile guard

Options Considered:

1. Add the running-profile guard to the actual current cleanup call sites that touch profile workspaces (for example the WorkspaceManager recreate path and any profile-scoped cleanup), so the safety guarantee holds against today's real invalidation paths.
2. Create the missing ContentReconciliationService from scratch to match the ticket references.

Chosen Option: 1

Rationale: The named service does not exist, so building it is out of scope. Add the launch-state guard to the real cleanup paths that can affect a running profile. Document that no background invalidation service exists today.

Design Choice 3: Existence of a live delta-execution workspace path

Options Considered:

1. Build a new delta-execution path that feeds the WorkspaceReconciler delta list into IFileOperationsService for per-file apply, restricted to hotswappable files.
2. Reuse the existing full recreate path.

Chosen Option: 1

Rationale: A full recreate deletes locked files that the running process holds open. This would crash the game. A per-file delta-execution path is required to satisfy the requirement that the running game process not be disrupted.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Content hotswap classification

This phase adds the shared classification utility. It mirrors the ContentTypePriority pattern. It gives every later phase a single source of truth for hotswap eligibility.

Create the `ContentHotswapClassification` static class

Add a stateless lookup utility for hotswap eligibility.

• Create ContentHotswapClassification in GenHub/GenHub/Features/Workspace/, beside ContentTypePriority.cs.
• Expose static bool IsHotswappable(ContentType contentType) using a switch expression.
• Return true for Map, MapPack, Patch, Mission, Skin, LanguagePack, Video, Replay, Screensaver.
• Return false for all locked types: GameInstallation, GameClient, Mod, Addon, ModdingTool, UnknownContentType, and the default arm. Note that the enum has no Executable value; the default false arm covers any unlisted type.
• Add an overload static bool IsHotswappable(ContentBundle bundle) that returns true only when bundle.Items.All(i => IsHotswappable(i.ContentType)), so a bundle is hotswappable only if every BundleItem.ContentType is hotswappable.

🤖 Prompt for AI agents

Implement Phase 1: create a shared static classification utility for hotswap
eligibility, mirroring the existing `ContentTypePriority` pattern.

- Create a new static class named `ContentHotswapClassification` in
`GenHub/GenHub/Features/Workspace/`, placed beside `ContentTypePriority.cs`.
- Add a method `static bool IsHotswappable(ContentType contentType)`. Implement
it with a `switch` expression.
- Return `true` for these content types: `Map`, `MapPack`, `Patch`, `Mission`,
`Skin`, `LanguagePack`, `Video`, `Replay`, `Screensaver`.
- Return `false` for these locked content types: `GameInstallation`,
`GameClient`, `Mod`, `Addon`, `ModdingTool`, `UnknownContentType`.
- Use a default arm that returns `false` to cover any unlisted type. Note there
is no `Executable` value in the enum; the default arm covers this case.
- Add an overload `static bool IsHotswappable(ContentBundle bundle)`. This
overload must return `true` only when every item in `bundle.Items` is
hotswappable, that is, `bundle.Items.All(i => IsHotswappable(i.ContentType))` is
true.

Phase 2: Launch-aware profile update validation

This phase gives GameProfileManager awareness of running state. It validates hotswap eligibility and immutable metadata before it mutates and persists a profile.

Task 1: Inject `ILaunchRegistry` into `GameProfileManager`

Give the manager access to live launch state.

• Update GenHub/GenHub/Features/GameProfiles/Services/GameProfileManager.cs primary constructor to add ILaunchRegistry launchRegistry. Store it in a null-checked field.
• No DI module change is required beyond the constructor parameter, because ILaunchRegistry is already a registered singleton and does not depend back on IGameProfileManager (no circular dependency).

Task 2: Add running-state and hotswap validation in `UpdateProfileAsync`

Guard mutations that are unsafe while a profile runs.

• In UpdateProfileAsync, before applying field mutations, determine running state. Call _launchRegistry.GetAllActiveLaunchesAsync() and select the launch where ProfileId == profileId and IsRunning is true.
• If not running: keep existing behaviour. Note that the current code never actually clears ActiveWorkspaceId; if a clear is later added for the not-running path, keep it only for the not-running branch.
• If running: compute the actual content difference. Compare the incoming request.EnabledContentIds against profile.EnabledContentIds (order-independent set comparison) to derive added and removed content IDs.
• For each added and removed content ID, resolve its ContentManifest via IContentManifestPool.GetManifestAsync. Classify each with ContentHotswapClassification.IsHotswappable. For ContentBundle manifests, use the bundle overload.
• If any changed manifest is locked (not hotswappable): return ProfileOperationResult<GameProfile>.CreateFailure with a descriptive message and error code (for example "ProfileRunningLockedContent"). Do not mutate or persist the profile.
• Detect immutable metadata changes while running. If request.GameInstallationId, request.PreferredStrategy (maps to WorkspaceStrategy), request.CustomExecutablePath, or request.WorkingDirectory differs from the current profile value, return ProfileOperationResult<GameProfile>.CreateFailure with a descriptive message and error code (for example "ProfileRunningImmutableMetadata"). Do not mutate or persist the profile.
• If validation passes while running: apply only the hotswappable content change, keep ActiveWorkspaceId unchanged, and persist normally.

🤖 Prompt for AI agents

Implement Phase 2: add launch-state awareness to `GameProfileManager` so it
validates hotswap eligibility and immutable metadata before it mutates and
persists a running profile.

First, inject `ILaunchRegistry`:
- Update the primary constructor of
`GenHub/GenHub/Features/GameProfiles/Services/GameProfileManager.cs` to add a
parameter `ILaunchRegistry launchRegistry`. Store it in a null-checked field.
- No DI module change beyond the constructor parameter is required, because
`ILaunchRegistry` is already a registered singleton and has no circular
dependency back on `IGameProfileManager`.

Then, add validation logic in `UpdateProfileAsync`:
- Before applying field mutations, determine running state. Call
`_launchRegistry.GetAllActiveLaunchesAsync()` and select the launch where
`ProfileId == profileId` and `IsRunning` is true.
- If the profile is not running, keep the existing behaviour. Note the current
code never clears `ActiveWorkspaceId`; if a clear is added later for the
not-running path, keep it scoped to that branch only.
- If the profile is running, compute the actual content difference: compare
`request.EnabledContentIds` against `profile.EnabledContentIds` using an
order-independent set comparison to derive added and removed content IDs.
- For each added and removed content ID, resolve its `ContentManifest` through
`IContentManifestPool.GetManifestAsync`. Classify each manifest with
`ContentHotswapClassification.IsHotswappable`. Use the bundle overload for
`ContentBundle` manifests.
- If any changed manifest is locked (not hotswappable), return
`ProfileOperationResult<GameProfile>.CreateFailure` with a descriptive message
and an error code such as `"ProfileRunningLockedContent"`. Do not mutate or
persist the profile in this case.
- Detect immutable metadata changes while running: if
`request.GameInstallationId`, `request.PreferredStrategy` (maps to
`WorkspaceStrategy`), `request.CustomExecutablePath`, or
`request.WorkingDirectory` differs from the current profile value, return
`ProfileOperationResult<GameProfile>.CreateFailure` with a descriptive message
and an error code such as `"ProfileRunningImmutableMetadata"`. Do not mutate or
persist the profile in this case.
- If validation passes while the profile is running, apply only the hotswappable
content change, keep `ActiveWorkspaceId` unchanged, and persist normally.

Phase 3: Live workspace delta reconciliation

This phase makes a running profile's workspace update in place. It adds an execution path for the reconciler deltas and routes the editor facade through it. This phase is required because no delta-execution path exists today.

Task 1: Add a delta-execution method to `WorkspaceManager`

Apply reconciler deltas per file without a full recreate.

• Add a public method to GenHub/GenHub/Features/Workspace/WorkspaceManager.cs (for example ApplyWorkspaceDeltaAsync) that accepts a WorkspaceConfiguration and the target WorkspaceInfo.
• Call WorkspaceReconciler.AnalyzeWorkspaceDeltaAsync to compute the Add/Update/Remove/Skip deltas against the cached workspace.
• For each delta, dispatch to IFileOperationsService based on WorkspaceDelta.Operation and ManifestFile.SourceType:
  • Add/Update, ContentAddressable source: use LinkFromCasAsync or CopyFromCasAsync per the profile WorkspaceStrategy.
  • Add/Update, local source: use CreateSymlinkAsync, CreateHardLinkAsync, or CopyFileAsync per strategy.
  • Remove: delete the workspace file using the existing static file helper used elsewhere in WorkspaceManager.
  • Skip: no operation.
• Before executing Add operations that pull from CAS, update CAS references. Call CasReferenceTracker.TrackWorkspaceReferencesAsync with the complete updated hash set for the workspace, so references exist before materialization and no GC race occurs.
• Wrap each per-file operation in try/catch for IOException and UnauthorizedAccessException. Log these as non-fatal warnings and continue with the remaining deltas. Do not fail the whole update for a single locked file.
• Update the workspace metadata (manifest IDs, file count) after a successful delta apply, so later launches see the new content set.

Task 2: Route `ProfileEditorFacade` through the live delta path for running profiles

Use the delta path when a running profile changes only hotswappable content.

• Update GenHub/GenHub/Features/GameProfiles/Services/ProfileEditorFacade.cs UpdateProfileWithWorkspaceAsync.
• After _profileManager.UpdateProfileAsync succeeds and request.EnabledContentIds != null, determine running state via ILaunchRegistry.
• If the profile is running: build the WorkspaceConfiguration with ForceRecreate = false and the existing ActiveWorkspaceId, then call the new WorkspaceManager.ApplyWorkspaceDeltaAsync. Do not overwrite ActiveWorkspaceId.
• If the profile is not running: keep existing behaviour (ForceRecreate = true, then set ActiveWorkspaceId).
• Inject ILaunchRegistry into ProfileEditorFacade if it is not already available.

🤖 Prompt for AI agents

Implement Phase 3: add a live per-file delta-execution path so a running
profile's workspace updates in place, and route the editor facade through this
path for running profiles.

First, add a delta-execution method to `WorkspaceManager`:
- Add a public method to `GenHub/GenHub/Features/Workspace/WorkspaceManager.cs`,
for example named `ApplyWorkspaceDeltaAsync`, that accepts a
`WorkspaceConfiguration` and the target `WorkspaceInfo`.
- Call `WorkspaceReconciler.AnalyzeWorkspaceDeltaAsync` to compute the
`Add`/`Update`/`Remove`/`Skip` deltas against the cached workspace.
- For each delta, dispatch to `IFileOperationsService` based on
`WorkspaceDelta.Operation` and `ManifestFile.SourceType`:
- For `Add`/`Update` with a `ContentAddressable` source, use `LinkFromCasAsync`
or `CopyFromCasAsync`, chosen according to the profile `WorkspaceStrategy`.
- For `Add`/`Update` with a local source, use `CreateSymlinkAsync`,
`CreateHardLinkAsync`, or `CopyFileAsync`, chosen according to strategy.
- For `Remove`, delete the workspace file using the existing static file helper
already used elsewhere in `WorkspaceManager`.
  - For `Skip`, perform no operation.
- Before executing `Add` operations that pull from CAS, update CAS references
first: call `CasReferenceTracker.TrackWorkspaceReferencesAsync` with the
complete updated hash set for the workspace. This ensures references exist
before materialization and prevents a GC race.
- Wrap each per-file operation in a `try/catch` for `IOException` and
`UnauthorizedAccessException`. Log these as non-fatal warnings and continue
processing the remaining deltas. Do not fail the entire update because of one
locked file.
- After a successful delta apply, update the workspace metadata (manifest IDs,
file count), so later launches see the new content set.

Then, route `ProfileEditorFacade` through this delta path:
- Update `UpdateProfileWithWorkspaceAsync` in
`GenHub/GenHub/Features/GameProfiles/Services/ProfileEditorFacade.cs`.
- After `_profileManager.UpdateProfileAsync` succeeds and
`request.EnabledContentIds != null`, determine running state via
`ILaunchRegistry`.
- If the profile is running, build the `WorkspaceConfiguration` with
`ForceRecreate = false` and the existing `ActiveWorkspaceId`, then call the new
`WorkspaceManager.ApplyWorkspaceDeltaAsync`. Do not overwrite
`ActiveWorkspaceId` in this branch.
- If the profile is not running, keep the existing behaviour: `ForceRecreate =
true`, then set `ActiveWorkspaceId`.
- Inject `ILaunchRegistry` into `ProfileEditorFacade` if it is not already
available there.

Phase 4: Editor UI running-state propagation

This phase lets users open and use the editor while a profile runs. It shows the Hotswap Mode indicator and disables locked and immutable fields.

Task 1: Allow editing a running profile

Remove the running gate from the edit action.

• Update GenHub/GenHub/Features/GameProfiles/ViewModels/GameProfileItemViewModel.cs computed property to public bool CanEdit => !IsPreparingWorkspace;.
• Keep the [NotifyPropertyChangedFor(nameof(CanEdit))] annotations so CanEdit still updates when IsPreparingWorkspace changes.

Task 2: Add running-state awareness to `GameProfileSettingsViewModel`

Expose a hotswap state signal to the editor.

• Update GenHub/GenHub/Features/GameProfiles/ViewModels/GameProfileSettingsViewModel.cs constructor to accept a running-state source. Prefer IProfileLauncherFacade and its GetLaunchStatusAsync(profileId), because it already maps a profile ID to GameProcessInfo.IsRunning. If IProfileLauncherFacade is not injectable here, inject ILaunchRegistry and match ProfileId.
• When the editor loads an existing profile, query running state once and set an observable IsHotswapMode (or IsProfileRunning) property.
• Add observable properties or helpers that the view binds to for enabling and disabling fields. Disable inputs for locked content types (GameClient, GameInstallation, Mod, Addon) and immutable metadata (WorkspaceStrategy, GameInstallation dropdown, CustomExecutablePath, WorkingDirectory) when IsHotswapMode is true. Keep hotswappable content checkboxes enabled.
• Use ContentHotswapClassification.IsHotswappable to drive per-content enable state in the enabled-content list, so each item's checkbox reflects its own type.

Task 3: Update the editor view for Hotswap Mode

Show the indicator and explanatory tooltips.

• Update the profile settings view (the .axaml bound to GameProfileSettingsViewModel) to show a prominent "Hotswap Mode" status indicator when IsHotswapMode is true.
• Bind IsEnabled of locked content controls and immutable metadata fields to the disable signals from Task 4.2.
• Add explanatory tooltips on disabled controls that state the field cannot change while the game runs.

🤖 Prompt for AI agents

Implement Phase 4: allow users to open and edit a running profile in the UI,
show a "Hotswap Mode" indicator, and disable locked and immutable fields.

First, allow editing a running profile:
- Update the computed property in
`GenHub/GenHub/Features/GameProfiles/ViewModels/GameProfileItemViewModel.cs` to
`public bool CanEdit => !IsPreparingWorkspace;`.
- Keep the `[NotifyPropertyChangedFor(nameof(CanEdit))]` annotations so
`CanEdit` continues to update when `IsPreparingWorkspace` changes.

Then, add running-state awareness to `GameProfileSettingsViewModel`:
- Update the constructor of
`GenHub/GenHub/Features/GameProfiles/ViewModels/GameProfileSettingsViewModel.cs`
to accept a running-state source. Prefer `IProfileLauncherFacade` and its
`GetLaunchStatusAsync(profileId)` method, since it already maps a profile ID to
`GameProcessInfo.IsRunning`. If `IProfileLauncherFacade` cannot be injected
here, inject `ILaunchRegistry` and match on `ProfileId` instead.
- When the editor loads an existing profile, query running state once and set an
observable property, for example `IsHotswapMode` or `IsProfileRunning`.
- Add observable properties or helper members that the view binds to for
enabling and disabling fields. When `IsHotswapMode` is true, disable inputs for
locked content types (`GameClient`, `GameInstallation`, `Mod`, `Addon`) and for
immutable metadata (`WorkspaceStrategy`, the `GameInstallation` dropdown,
`CustomExecutablePath`, `WorkingDirectory`). Keep hotswappable content
checkboxes enabled.
- Use `ContentHotswapClassification.IsHotswappable` to drive the per-content
enable state in the enabled-content list, so each item's checkbox reflects the
hotswap eligibility of its own content type.

Finally, update the editor view:
- Update the profile settings view (the `.axaml` file bound to
`GameProfileSettingsViewModel`) to show a prominent "Hotswap Mode" status
indicator when `IsHotswapMode` is true.
- Bind `IsEnabled` of locked content controls and immutable metadata fields to
the disable signals exposed by the view model.
- Add explanatory tooltips on the disabled controls that state the field cannot
change while the game runs.

Phase 5: Guard background workspace cleanup against running profiles

This phase protects a running profile's workspace from deletion. The named ContentReconciliationService does not exist, so the guard applies to the real cleanup paths.

Add a running-profile guard to profile-scoped workspace cleanup

Prevent cleanup while a profile runs.

• Identify the real cleanup call sites that can affect a running profile. Today these are the ForceRecreate = true recreate branch inside WorkspaceManager.PrepareWorkspaceAsync and any profile-scoped CleanupWorkspaceAsync invocation.
• Before a profile-scoped CleanupWorkspaceAsync runs, query ILaunchRegistry for an active launch with the matching ProfileId. If the profile is running, skip cleanup, skip clearing ActiveWorkspaceId, and log a warning. Rely on the existing manifest-ID mismatch detection at the next launch to reconcile deferred changes.
• If the profile is not running, keep existing behaviour.
• Document in code comments that no background ContentReconciliationService exists in the codebase, so the guard is applied to the current cleanup paths.

🤖 Prompt for AI agents

Implement Phase 5: add a running-profile guard to the real workspace cleanup
paths, since the ticket's named `ContentReconciliationService` does not exist in
the codebase.

- Identify the real cleanup call sites that can affect a running profile. Today
these are the `ForceRecreate = true` recreate branch inside
`WorkspaceManager.PrepareWorkspaceAsync` and any profile-scoped
`CleanupWorkspaceAsync` invocation.
- Before a profile-scoped `CleanupWorkspaceAsync` runs, query `ILaunchRegistry`
for an active launch with the matching `ProfileId`.
- If the profile is running, skip cleanup, skip clearing `ActiveWorkspaceId`,
and log a warning. Rely on the existing manifest-ID mismatch detection at the
next launch to reconcile deferred changes.
- If the profile is not running, keep the existing behaviour unchanged.
- Add a code comment documenting that no background
`ContentReconciliationService` exists in the codebase, and that the guard is
therefore applied to the current, real cleanup paths.

Phase 6: Tests

This phase adds unit coverage for the new logic, as required by the acceptance criteria.

Task 1: Test hotswap classification

Verify classification for every content type.

• Add tests for ContentHotswapClassification.IsHotswappable over all ContentType values.
• Add a test for the ContentBundle overload that a bundle is hotswappable only when all Items are hotswappable.

Task 2: Test running-profile update validation

Verify accept and reject paths.

• Add tests for GameProfileManager.UpdateProfileAsync with a mocked ILaunchRegistry.
• Assert that a running profile with only hotswappable content changes persists and keeps ActiveWorkspaceId.
• Assert that a running profile with a locked content change or an immutable metadata change returns CreateFailure and does not mutate profile state.
• Assert that a not-running profile keeps existing behaviour.

Task 3: Test the running-profile cleanup guard

Verify cleanup is skipped while running.

• Add tests that verify CleanupWorkspaceAsync is not called and ActiveWorkspaceId is not cleared for a running profile in the guarded cleanup path.

🤖 Prompt for AI agents

Implement Phase 6: add unit test coverage for all new logic introduced in the
previous phases, as required by the acceptance criteria.

- Add tests for `ContentHotswapClassification.IsHotswappable` covering every
`ContentType` value. Add a test for the `ContentBundle` overload confirming a
bundle is hotswappable only when all `Items` are hotswappable.
- Add tests for `GameProfileManager.UpdateProfileAsync` using a mocked
`ILaunchRegistry`:
- Assert that a running profile with only hotswappable content changes persists
successfully and keeps `ActiveWorkspaceId` unchanged.
- Assert that a running profile with a locked content change, or with an
immutable metadata change, returns `CreateFailure` and does not mutate profile
state.
  - Assert that a not-running profile keeps the existing behaviour.
- Add tests for the running-profile cleanup guard: verify that
`CleanupWorkspaceAsync` is not called and `ActiveWorkspaceId` is not cleared for
a running profile in the guarded cleanup path.

Research

The profile system uses GameProfileManager (scoped) for profile CRUD operations. It uses ProfileEditorFacade.UpdateProfileWithWorkspaceAsync for profile-plus-workspace updates.

Workspace materialization runs through WorkspaceManager.PrepareWorkspaceAsync. This method selects an IWorkspaceStrategy. WorkspaceReconciler.AnalyzeWorkspaceDeltaAsync already computes Add/Update/Remove/Skip deltas. The result is currently consumed only for cleanup previews, not for execution.

Launch state lives in ILaunchRegistry (singleton). This registry returns GameLaunchInfo records keyed by LaunchId. Each record carries ProfileId and IsRunning.

ContentTypePriority is the precedent static classification utility. It is located in GenHub.Features.Workspace. Content types come from the ContentType enum in GenHub.Core.Models.Enums.

IFileOperationsService exposes atomic per-file primitives: copy, symlink, hardlink, and CAS link/copy. These primitives have lock-aware retry logic.

CasReferenceTracker is a concrete class. It tracks whole-workspace hash snapshots.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement Phase 1: create a shared static classification utility for hotswap
eligibility, mirroring the existing `ContentTypePriority` pattern.

- Create a new static class named `ContentHotswapClassification` in
`GenHub/GenHub/Features/Workspace/`, placed beside `ContentTypePriority.cs`.
- Add a method `static bool IsHotswappable(ContentType contentType)`. Implement
it with a `switch` expression.
- Return `true` for these content types: `Map`, `MapPack`, `Patch`, `Mission`,
`Skin`, `LanguagePack`, `Video`, `Replay`, `Screensaver`.
- Return `false` for these locked content types: `GameInstallation`,
`GameClient`, `Mod`, `Addon`, `ModdingTool`, `UnknownContentType`.
- Use a default arm that returns `false` to cover any unlisted type. Note there
is no `Executable` value in the enum; the default arm covers this case.
- Add an overload `static bool IsHotswappable(ContentBundle bundle)`. This
overload must return `true` only when every item in `bundle.Items` is
hotswappable, that is, `bundle.Items.All(i => IsHotswappable(i.ContentType))` is
true.
===============================================================================

Task: 2

Implement Phase 2: add launch-state awareness to `GameProfileManager` so it
validates hotswap eligibility and immutable metadata before it mutates and
persists a running profile.

First, inject `ILaunchRegistry`:
- Update the primary constructor of
`GenHub/GenHub/Features/GameProfiles/Services/GameProfileManager.cs` to add a
parameter `ILaunchRegistry launchRegistry`. Store it in a null-checked field.
- No DI module change beyond the constructor parameter is required, because
`ILaunchRegistry` is already a registered singleton and has no circular
dependency back on `IGameProfileManager`.

Then, add validation logic in `UpdateProfileAsync`:
- Before applying field mutations, determine running state. Call
`_launchRegistry.GetAllActiveLaunchesAsync()` and select the launch where
`ProfileId == profileId` and `IsRunning` is true.
- If the profile is not running, keep the existing behaviour. Note the current
code never clears `ActiveWorkspaceId`; if a clear is added later for the
not-running path, keep it scoped to that branch only.
- If the profile is running, compute the actual content difference: compare
`request.EnabledContentIds` against `profile.EnabledContentIds` using an
order-independent set comparison to derive added and removed content IDs.
- For each added and removed content ID, resolve its `ContentManifest` through
`IContentManifestPool.GetManifestAsync`. Classify each manifest with
`ContentHotswapClassification.IsHotswappable`. Use the bundle overload for
`ContentBundle` manifests.
- If any changed manifest is locked (not hotswappable), return
`ProfileOperationResult<GameProfile>.CreateFailure` with a descriptive message
and an error code such as `"ProfileRunningLockedContent"`. Do not mutate or
persist the profile in this case.
- Detect immutable metadata changes while running: if
`request.GameInstallationId`, `request.PreferredStrategy` (maps to
`WorkspaceStrategy`), `request.CustomExecutablePath`, or
`request.WorkingDirectory` differs from the current profile value, return
`ProfileOperationResult<GameProfile>.CreateFailure` with a descriptive message
and an error code such as `"ProfileRunningImmutableMetadata"`. Do not mutate or
persist the profile in this case.
- If validation passes while the profile is running, apply only the hotswappable
content change, keep `ActiveWorkspaceId` unchanged, and persist normally.
===============================================================================

Task: 3

Implement Phase 3: add a live per-file delta-execution path so a running
profile's workspace updates in place, and route the editor facade through this
path for running profiles.

First, add a delta-execution method to `WorkspaceManager`:
- Add a public method to `GenHub/GenHub/Features/Workspace/WorkspaceManager.cs`,
for example named `ApplyWorkspaceDeltaAsync`, that accepts a
`WorkspaceConfiguration` and the target `WorkspaceInfo`.
- Call `WorkspaceReconciler.AnalyzeWorkspaceDeltaAsync` to compute the
`Add`/`Update`/`Remove`/`Skip` deltas against the cached workspace.
- For each delta, dispatch to `IFileOperationsService` based on
`WorkspaceDelta.Operation` and `ManifestFile.SourceType`:
- For `Add`/`Update` with a `ContentAddressable` source, use `LinkFromCasAsync`
or `CopyFromCasAsync`, chosen according to the profile `WorkspaceStrategy`.
- For `Add`/`Update` with a local source, use `CreateSymlinkAsync`,
`CreateHardLinkAsync`, or `CopyFileAsync`, chosen according to strategy.
- For `Remove`, delete the workspace file using the existing static file helper
already used elsewhere in `WorkspaceManager`.
  - For `Skip`, perform no operation.
- Before executing `Add` operations that pull from CAS, update CAS references
first: call `CasReferenceTracker.TrackWorkspaceReferencesAsync` with the
complete updated hash set for the workspace. This ensures references exist
before materialization and prevents a GC race.
- Wrap each per-file operation in a `try/catch` for `IOException` and
`UnauthorizedAccessException`. Log these as non-fatal warnings and continue
processing the remaining deltas. Do not fail the entire update because of one
locked file.
- After a successful delta apply, update the workspace metadata (manifest IDs,
file count), so later launches see the new content set.

Then, route `ProfileEditorFacade` through this delta path:
- Update `UpdateProfileWithWorkspaceAsync` in
`GenHub/GenHub/Features/GameProfiles/Services/ProfileEditorFacade.cs`.
- After `_profileManager.UpdateProfileAsync` succeeds and
`request.EnabledContentIds != null`, determine running state via
`ILaunchRegistry`.
- If the profile is running, build the `WorkspaceConfiguration` with
`ForceRecreate = false` and the existing `ActiveWorkspaceId`, then call the new
`WorkspaceManager.ApplyWorkspaceDeltaAsync`. Do not overwrite
`ActiveWorkspaceId` in this branch.
- If the profile is not running, keep the existing behaviour: `ForceRecreate =
true`, then set `ActiveWorkspaceId`.
- Inject `ILaunchRegistry` into `ProfileEditorFacade` if it is not already
available there.
===============================================================================

Task: 4

Implement Phase 4: allow users to open and edit a running profile in the UI,
show a "Hotswap Mode" indicator, and disable locked and immutable fields.

First, allow editing a running profile:
- Update the computed property in
`GenHub/GenHub/Features/GameProfiles/ViewModels/GameProfileItemViewModel.cs` to
`public bool CanEdit => !IsPreparingWorkspace;`.
- Keep the `[NotifyPropertyChangedFor(nameof(CanEdit))]` annotations so
`CanEdit` continues to update when `IsPreparingWorkspace` changes.

Then, add running-state awareness to `GameProfileSettingsViewModel`:
- Update the constructor of
`GenHub/GenHub/Features/GameProfiles/ViewModels/GameProfileSettingsViewModel.cs`
to accept a running-state source. Prefer `IProfileLauncherFacade` and its
`GetLaunchStatusAsync(profileId)` method, since it already maps a profile ID to
`GameProcessInfo.IsRunning`. If `IProfileLauncherFacade` cannot be injected
here, inject `ILaunchRegistry` and match on `ProfileId` instead.
- When the editor loads an existing profile, query running state once and set an
observable property, for example `IsHotswapMode` or `IsProfileRunning`.
- Add observable properties or helper members that the view binds to for
enabling and disabling fields. When `IsHotswapMode` is true, disable inputs for
locked content types (`GameClient`, `GameInstallation`, `Mod`, `Addon`) and for
immutable metadata (`WorkspaceStrategy`, the `GameInstallation` dropdown,
`CustomExecutablePath`, `WorkingDirectory`). Keep hotswappable content
checkboxes enabled.
- Use `ContentHotswapClassification.IsHotswappable` to drive the per-content
enable state in the enabled-content list, so each item's checkbox reflects the
hotswap eligibility of its own content type.

Finally, update the editor view:
- Update the profile settings view (the `.axaml` file bound to
`GameProfileSettingsViewModel`) to show a prominent "Hotswap Mode" status
indicator when `IsHotswapMode` is true.
- Bind `IsEnabled` of locked content controls and immutable metadata fields to
the disable signals exposed by the view model.
- Add explanatory tooltips on the disabled controls that state the field cannot
change while the game runs.
===============================================================================

Task: 5

Implement Phase 5: add a running-profile guard to the real workspace cleanup
paths, since the ticket's named `ContentReconciliationService` does not exist in
the codebase.

- Identify the real cleanup call sites that can affect a running profile. Today
these are the `ForceRecreate = true` recreate branch inside
`WorkspaceManager.PrepareWorkspaceAsync` and any profile-scoped
`CleanupWorkspaceAsync` invocation.
- Before a profile-scoped `CleanupWorkspaceAsync` runs, query `ILaunchRegistry`
for an active launch with the matching `ProfileId`.
- If the profile is running, skip cleanup, skip clearing `ActiveWorkspaceId`,
and log a warning. Rely on the existing manifest-ID mismatch detection at the
next launch to reconcile deferred changes.
- If the profile is not running, keep the existing behaviour unchanged.
- Add a code comment documenting that no background
`ContentReconciliationService` exists in the codebase, and that the guard is
therefore applied to the current, real cleanup paths.
===============================================================================

Task: 6

Implement Phase 6: add unit test coverage for all new logic introduced in the
previous phases, as required by the acceptance criteria.

- Add tests for `ContentHotswapClassification.IsHotswappable` covering every
`ContentType` value. Add a test for the `ContentBundle` overload confirming a
bundle is hotswappable only when all `Items` are hotswappable.
- Add tests for `GameProfileManager.UpdateProfileAsync` using a mocked
`ILaunchRegistry`:
- Assert that a running profile with only hotswappable content changes persists
successfully and keeps `ActiveWorkspaceId` unchanged.
- Assert that a running profile with a locked content change, or with an
immutable metadata change, returns `CreateFailure` and does not mutate profile
state.
  - Assert that a not-running profile keeps the existing behaviour.
- Add tests for the running-profile cleanup guard: verify that
`CleanupWorkspaceAsync` is not called and `ActiveWorkspaceId` is not cleared for
a running profile in the guarded cleanup path.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

🔗 Related PRs

#261 - feat: implement content reconciliation system with CAS lifecycle management [merged]
#267 - feat: Implement copy profile functionality [merged]
#328 - feat(platform): make paths, manifests, and Unix workspaces platform-aware [merged]
#332 - feat(launching): launch the native BGFX client against retail archives [merged]
#343 - fix(generalsonline): launch and track through the Easy Anti-Cheat bootstrapper [merged]
#349 - fix(cas): fall back from unwritable installation pools [merged]
#352 - feat(installations): detect retail installations by archive presence [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[undead2146]

Note on GeneralsOnline UserData Data Patches (#371, #372)

With the introduction of GeneralsOnline Data Patches (#371 / #372), ContentType.Patch manifests may now deploy directly to the user's Documents folder (%USERPROFILE%\Documents\Command and Conquer Generals Zero Hour Data\GeneralsOnlineGameData\) via IUserDataTracker (with InstallTarget = ContentInstallTarget.UserDataDirectory), rather than exclusively deploying to ContentInstallTarget.Workspace.

Hotswap Classification Alignment:
Even though these data patches reside in the user's Documents directory (similar to Maps), the C&C Generals / Zero Hour game engine opens and holds file handles to .big archives upon initialization. Modifying, swapping, or deleting .big files while the game process is running risks file access violations or engine instability.

Therefore, for the scope of #370:

• ContentType.Patch (including UserData-deployed .big patches) must remain classified as Locked / Non-hotswappable while the game profile is actively running (ILaunchRegistry.IsRunning == true).
• Only Map and MapPack (ContentInstallTarget.UserMapsDirectory) remain hotswappable at runtime in Phase 1.