[P1] Save projects locally and validate portable project imports #14

Parent plan: #1
Priority / gate: P1 / M2
Requirement: F10 in the PRD
Design: Technical design
Depends on: #2, #3, #4, #10, #11, #9

Outcome

Preserve editable drawings between sessions and let users move projects safely through files.

Scope

• Provide transactional persistence primitives for independent saved-sound snapshots, clip assets, and metadata. Keep current-project autosave separate from saved entry identity; the soundboard UI/flow is delivered in F16.
• Implement debounced local autosave and restoration with a visible save state using the selected browser storage adapter.
• Export/import named versioned project JSON containing all three workspaces, oscillator IDs/names/colors, waveforms, pitch/gain lanes, selected models, relative phases, shared duration, mute/solo, and rendering choices.
• Validate schemas, finite values, ranges, 20,000 total input points, and the 10 MiB file limit before allocating/replacing state.
• Document schema migration behavior and treat derived numerical results as versioned caches.
• Handle storage unavailability/quota errors while leaving editing and project download available.
• Provide versioned asset-reference and ownership/transaction primitives for [P1] Import audio and preserve reusable clip assets in portable projects #19/[P1] Modulate sounds with imported audio or saved clips #20; source PCM is immutable, and saved snapshots/drafts/undo can hold references independently of source-pad metadata. The F17 issue owns complete audio-bearing bundle validation and round trips.

Acceptance criteria

• Snapshot/audio/metadata writes commit together or preserve the previous state on failure; quota errors and current-project autosave cannot overwrite or silently delete a saved sound.
• Reload restores the drawing and settings with audio stopped.
• Project export/import round trips preserve source samples and evaluator behavior within 10^-6 under the same algorithm version.
• Malformed, oversized, non-finite, unsupported-version, and out-of-range projects fail with useful messages while the active project stays intact.
• Imported files are parsed as data and never execute JavaScript or expressions.
• Save success/error states reflect real storage results; clearing local browser data is explained and portable download remains available.
• All mode workspaces and oscillator identities/colors survive save/restore; envelope changes and cross-mode copying do not destroy other voices or original work.
• Storage primitives preserve a shared asset while any project/snapshot/undo reference remains; failed reference/metadata updates cannot orphan a required asset or replace valid current state.

Validation

Storage failure/quota simulation, schema migration and corrupt-input fixtures, reload/browser integration, and round-trip numerical comparisons.

Boundaries

Accounts, remote storage, multi-user collaboration, or implicit cloud upload.

Implementation evidence

IndexedDB autosave, recovery snapshots, version/range validation, asset-free JSON and self-contained stored-ZIP projects are implemented. Reload, corrupt import, quota failure and fresh-storage bundle flows pass.

Merged work: #25, #26, #29.

Validated CI run · Validation report. The report arrives with the final documentation PR; numerical/browser logs already exist. Release-wide human acceptance and the recorded performance/memory gaps remain explicit in #15 and #16.