Lazy mod metadata load can fetch alias target instead of concrete loaded build

[ushkinaz]

Summary

ensureModsLoaded() may fetch all_mods.json using an alias (stable/nightly) instead of the concrete build that was already loaded in setVersion.

When aliases move (or cache differs), this can produce a mismatch between:

• core dataset (all.json) currently rendered,
• lazy-loaded mod metadata (all_mods.json) fetched later.

Relevant code

• src/data.ts in ensureModsLoaded():
  • const modsVersion = startData.fetching_version ?? startData.build_number;

If fetching_version is an alias (stable/nightly), it wins over build_number.

Why this is problematic

With service worker/workbox caching, alias and concrete build URLs can be cached very differently. A delayed metadata fetch can resolve to newer/other data than the already-loaded concrete build.

Steps to Reproduce (deterministic with mocked responses)

1. Call setVersion(...) through alias (e.g. stable) so fetching_version is set to alias while build_number resolves to concrete build.
2. Return all.json for build A during initial load.
3. Before opening Mod Selector, make alias endpoint for all_mods.json return build B metadata.
4. Trigger ensureModsLoaded() (open Mod Selector).
5. Observe metadata now corresponds to alias target B, not loaded core build A.

Actual

Lazy metadata load prefers alias and can drift from loaded build.

Expected

When core data is already loaded, lazy mod metadata fetch should be pinned to the same concrete build to guarantee consistency.

Notes

If product direction intentionally prefers alias continuity over concrete pinning, this still needs explicit consistency handling and user-facing guarantees (because mixed-basis data is otherwise possible).

[ushkinaz]

Maintainer preference noted during review follow-up: if a session starts from an alias (stable/nightly), it is preferable to keep alias-based fetching throughout (workbox behavior differs between alias and concrete build URLs). So the key risk to track here is mixed-basis data and explicit contract/documentation, not necessarily forcing concrete pinning.