S3-090: Implement complete versioned saves and migration policy

Parent and ownership

Parent epic: https://github.com/stacksjs/the-settlers-iii-remake/issues/14 Source owner: stacksjs/the-settlers-iii-remake. Master roadmap: https://github.com/stacksjs/the-settlers-iii-remake/issues/4.

Problem and observable result

Round-trip jobs, cargo, tools, randomness, and objectives. Validate schema, rules, and content compatibility. Preserve incompatible prototype saves unchanged.

The current application is a browser prototype. Passing the Riverlands campaign does not establish original-game or native parity. This issue is complete only when its stated behavior has retained evidence.

Evidence and interfaces

Versioned save envelopes and seeded command logs preserve complete simulation state. Online matches run authoritatively in Bun and emit visibility-filtered updates to authenticated clients.

• https://github.com/stacksjs/the-settlers-iii-remake/blob/884406e97f912d18a50a33734b535a27dd25531d/resources/game/controller.ts
• https://github.com/stacksjs/stacks/tree/c8e9b2755edeead39ecf6aa540014a7642ff7149/storage/framework/core/realtime

Pin the inspected revisions and fixture hashes in the implementation evidence. Original-game observations govern rules and timing. JSettlers is implementation evidence, not an authoritative balance specification. Unknown values remain explicitly unverified.

Acceptance criteria

• Round-trip jobs, cargo, tools, randomness, and objectives.
• Validate schema, rules, and content compatibility.
• Preserve incompatible prototype saves unchanged.
• The visible result agrees with the underlying simulation or platform state, including failure paths.
• Tests exercise the maintained public interface and retain reproducible fixtures or execution receipts.

Test matrix

• Save during each job and mission phase.
• Reject corrupt data without overwriting recovery copies.
• Exercise invalid input, cancellation or interruption, and repeated execution where this interface permits them.
• Verify determinism/conservation for simulation changes and resource ownership/disposal for platform changes.
• Run owning-repository lint, relevant type checks and tests. Capture actual native output for native capability claims.

Scope constraints

Implement this behavior as a complete verifiable slice. Do not silently expand into adjacent tickets or substitute simplified gameplay. Keep the shared TypeScript simulation, shared stx signals, and ts-css conventions. Native gameplay and HUD must not depend on a WebView. HomeOS reuse must not introduce a kernel dependency into the game. Existing unrelated edits and authored guidance must be preserved.

Blocked by

• https://github.com/stacksjs/the-settlers-iii-remake/issues/27

Upstream release and adoption

Application behavior belongs here. If a reproduction identifies a framework defect, repair and release its owning source first, update Stacks where affected, then install the verified packages here.

No node_modules edits, copied runtimes, generated-source string patches, fabricated globals, successful no-op implementations, or skipped release gates. Push tested conventional commits as Chris to the owning origin/main without coauthor trailers or force pushes.

Completion evidence

• Implementation commits and relevant upstream issue links.
• Exact checks and results, fixture hashes, and screenshots/native execution evidence where applicable.
• Published package versions, downstream lockfile identity, and release receipts when affected.
• Remaining limitations stated explicitly. Partial work does not close this issue.

Completed: versioned saves and migration policy

• Saves are envelopes with format version, rules identity (id, version, digest), content identity, tick, checksum and the full state: jobs, cargo, tools, reservations, randomness, growth schedule, cooldowns, mission objectives and pending commands. Map layers are little-endian base64 so saves are identical across hosts.
• Every field is validated as untrusted input; references, occupancy, bounds and the checksum must agree.
• Migration policy: older formats migrate step by step; newer formats and the Riverlands prototype saves are refused and the prototype save is left untouched under its own key. Format 2 added mission progress; format 1 saves are verified under their own checksum and then migrated (e5c1a53), tested with a genuine format 1 save.
• Saves made with other rules are refused with a message naming the rules they need.

Test matrix: saves during deliveries, construction phases, missions and long mixed economies restore and continue identically; corrupt, mismatched and tampered saves are refused with specific codes; checkpoints keep recovery copies when a write fails (see S3-091).

Evidence base for this update (all on main, authored as Chris):

• 3ca4847 deterministic session, rules profile, routing, goods, carriers, construction, production, territory, visibility, saves and replays
• da2a104 reference building geometry and the delivery livelock fix
• b2efc1f the browser game on the engine, expanded original-media import
• 7b1cc36 worlds from decoded original maps
• a495e7a, 0a3ff46, 0e7889e, e5c1a53, f3b71ce, ed1dc8f controls, missions, render scene, save migration, checkpoints, audit and statistics

Checks: ./buddy lint (0 problems), bun run typecheck (app, tools, stx), ./buddy test --unit (106 tests, 0 failures), bun run assets:verify, bun run content:verify, and the production browser scenario. CI passed on 0e7889e and 9e2ba7c (which contains f3b71ce), including the production Chrome check.

Rule values are the roman-engineering 0.2.0 profile (resources/game/engine/rules.ts). Every value names its evidence class: manual candidates (M) from the pinned manual, reference-remake geometry (E), or placeholders (U) that name their owning issue. qualificationGaps() lists them and the profile cannot qualify a release. Adopting observed original values remains with S3-002/S3-007; nothing here is an original-executable observation.

Landscape identity changes in #219 use the existing map terrain indices and save contract. Rules 0.13 remain frozen and 0.14 is selected by its own identity. Current and existing-profile restore checks, actual terrain changes and the ordinary browser checkpoint/save/reload gate passed. This is a compatibility slice, not completion of every lifecycle/storage scenario.

Validation: full CI, 413 unit tests and all 16 browser suites. The original diagnostic artifact checksum and ZIP integrity were independently verified.