fix(project): stage saves before atomic publication

.github/workflows/project-persistence-macos.yml

@@ -0,0 +1,125 @@
+name: project-persistence-macos
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - main
+    paths:
+      - "apps/desktop/core/Cargo.toml"
+      - "apps/desktop/core/src/root.rs"
+      - "apps/desktop/core/src/lib.rs"
+      - "apps/desktop/core/src/crate_root.rs"
+      - "apps/desktop/core/src/content_sha256.rs"
+      - "apps/desktop/core/src/project_format.rs"
+      - "apps/desktop/core/src/project_scoped_score_recovery.rs"
+      - "apps/desktop/core/src/score_attachment_recovery.rs"
+      - "apps/desktop/core/tests/content_sha256_shared_kernel.rs"
+      - "apps/desktop/core/tests/project_persistence*.rs"
+      - "apps/desktop/core/tests/project_format*.rs"
+      - "apps/desktop/core/tests/project_migration*.rs"
+      - "apps/desktop/core/testdata/project-*.json"
+      - "apps/desktop/src/App.tsx"
+      - "apps/desktop/src/App.project-save-source-authority.test.tsx"
+      - "apps/desktop/src/App.score-project-identity.test.tsx"
+      - "apps/desktop/src/features/workspace/SectionRoadmap.tsx"
+      - "apps/desktop/src/lib/analysis.ts"
+      - "apps/desktop/src/lib/analysis.workspace-single-flight.test.ts"
+      - "apps/desktop/src/lib/projectDocumentBridge.test.ts"
+      - "apps/desktop/src/lib/projectDocumentSaveAuthority.test.ts"
+      - "apps/desktop/src-tauri/Cargo.toml"
+      - "apps/desktop/src-tauri/Cargo.lock"
+      - "apps/desktop/src-tauri/src/main.rs"
+      - "apps/desktop/src-tauri/src/project_load.rs"
+      - "apps/desktop/src-tauri/src/project_persistence.rs"
+      - "apps/desktop/src-tauri/src/project_persistence_engine.rs"
+      - "apps/desktop/src-tauri/src/project_root.rs"
+      - "apps/desktop/src-tauri/tests/project_persistence*.rs"
+      - "apps/desktop/src-tauri/tests/project_persistence*.case"
+      - "apps/desktop/src-tauri/tests/project_root_existing_authority.rs"
+      - "docs/traceability/project-persistence-native-ci.md"
+      - "docs/traceability/project-persistence-score-publication-identity.md"
+      - "docs/traceability/project-persistence-score-recovery-project-scope.md"
+      - "docs/traceability/project-persistence-score-recovery-reconciliation.md"
+      - "docs/traceability/project-persistence-shared-song-contract.md"
+      - "docs/traceability/project-persistence-workspace-mutation-admission.md"
+      - ".github/workflows/project-persistence-macos.yml"
+      - "services/analysis-engine/tests/test_project_persistence_workflow_policy.py"
+  push:
+    branches:
+      - develop
+      - main
+    paths:
+      - "apps/desktop/core/Cargo.toml"
+      - "apps/desktop/core/src/root.rs"
+      - "apps/desktop/core/src/lib.rs"
+      - "apps/desktop/core/src/crate_root.rs"
+      - "apps/desktop/core/src/content_sha256.rs"
+      - "apps/desktop/core/src/project_format.rs"
+      - "apps/desktop/core/src/project_scoped_score_recovery.rs"
+      - "apps/desktop/core/src/score_attachment_recovery.rs"
+      - "apps/desktop/core/tests/content_sha256_shared_kernel.rs"
+      - "apps/desktop/core/tests/project_persistence*.rs"
+      - "apps/desktop/core/tests/project_format*.rs"
+      - "apps/desktop/core/tests/project_migration*.rs"
+      - "apps/desktop/core/testdata/project-*.json"
+      - "apps/desktop/src/App.tsx"
+      - "apps/desktop/src/App.project-save-source-authority.test.tsx"
+      - "apps/desktop/src/App.score-project-identity.test.tsx"
+      - "apps/desktop/src/features/workspace/SectionRoadmap.tsx"
+      - "apps/desktop/src/lib/analysis.ts"
+      - "apps/desktop/src/lib/analysis.workspace-single-flight.test.ts"
+      - "apps/desktop/src/lib/projectDocumentBridge.test.ts"
+      - "apps/desktop/src/lib/projectDocumentSaveAuthority.test.ts"
+      - "apps/desktop/src-tauri/Cargo.toml"
+      - "apps/desktop/src-tauri/Cargo.lock"
+      - "apps/desktop/src-tauri/src/main.rs"
+      - "apps/desktop/src-tauri/src/project_load.rs"
+      - "apps/desktop/src-tauri/src/project_persistence.rs"
+      - "apps/desktop/src-tauri/src/project_persistence_engine.rs"
+      - "apps/desktop/src-tauri/src/project_root.rs"
+      - "apps/desktop/src-tauri/tests/project_persistence*.rs"
+      - "apps/desktop/src-tauri/tests/project_persistence*.case"
+      - "apps/desktop/src-tauri/tests/project_root_existing_authority.rs"
+      - "docs/traceability/project-persistence-native-ci.md"
+      - "docs/traceability/project-persistence-score-publication-identity.md"
+      - "docs/traceability/project-persistence-score-recovery-project-scope.md"
+      - "docs/traceability/project-persistence-score-recovery-reconciliation.md"
+      - "docs/traceability/project-persistence-shared-song-contract.md"
+      - "docs/traceability/project-persistence-workspace-mutation-admission.md"
+      - ".github/workflows/project-persistence-macos.yml"
+      - "services/analysis-engine/tests/test_project_persistence_workflow_policy.py"
+
+permissions:
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  macos-recovery-cleanup:
+    name: test / project-persistence / macos
+    runs-on: macos-15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
+      - name: Run Project Persistence recovery module tests
+        run: 'cargo +1.97.1 test --manifest-path apps/desktop/core/Cargo.toml --features persistence_warning_gate --lib score_attachment_recovery::tests::'
+      - name: Run Project Persistence content-identity module tests
+        run: 'cargo +1.97.1 test --manifest-path apps/desktop/core/Cargo.toml --features persistence_warning_gate --lib content_sha256::tests::'
+      - name: Run Project Persistence core integration contracts
+        run: 'cargo +1.97.1 test --manifest-path apps/desktop/core/Cargo.toml --features persistence_warning_gate --test content_sha256_shared_kernel --test project_format_resource_admission_handoff --test project_format_v2_fixture --test project_format_v2_playback_preference --test project_format_v3_renderer_source_authority --test project_format_v3_source_reference --test project_migration_receipt_input_binding --test project_persistence_contract --test project_persistence_score_recovery'
+      - name: Prepare compile-only frontendDist fixture
+        run: |
+          mkdir -p apps/desktop/dist
+          printf '%s' '<!doctype html><title>BandScope test fixture</title>' > apps/desktop/dist/index.html
+      - name: Run macOS recovery-cleanup regression
+        run: cargo +1.97.1 test --manifest-path apps/desktop/src-tauri/Cargo.toml --no-default-features --features persistence_warning_gate --tests

.github/workflows/project-persistence-windows-native.yml

@@ -0,0 +1,126 @@
+name: project-persistence-windows-native
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - main
+    paths:
+      - "apps/desktop/core/Cargo.toml"
+      - "apps/desktop/core/src/root.rs"
+      - "apps/desktop/core/src/lib.rs"
+      - "apps/desktop/core/src/crate_root.rs"
+      - "apps/desktop/core/src/content_sha256.rs"
+      - "apps/desktop/core/src/project_format.rs"
+      - "apps/desktop/core/src/project_scoped_score_recovery.rs"
+      - "apps/desktop/core/src/score_attachment_recovery.rs"
+      - "apps/desktop/core/tests/content_sha256_shared_kernel.rs"
+      - "apps/desktop/core/tests/project_persistence*.rs"
+      - "apps/desktop/core/tests/project_format*.rs"
+      - "apps/desktop/core/tests/project_migration*.rs"
+      - "apps/desktop/core/testdata/project-*.json"
+      - "apps/desktop/src/App.tsx"
+      - "apps/desktop/src/App.project-save-source-authority.test.tsx"
+      - "apps/desktop/src/App.score-project-identity.test.tsx"
+      - "apps/desktop/src/features/workspace/SectionRoadmap.tsx"
+      - "apps/desktop/src/lib/analysis.ts"
+      - "apps/desktop/src/lib/analysis.workspace-single-flight.test.ts"
+      - "apps/desktop/src/lib/projectDocumentBridge.test.ts"
+      - "apps/desktop/src/lib/projectDocumentSaveAuthority.test.ts"
+      - "apps/desktop/src-tauri/Cargo.toml"
+      - "apps/desktop/src-tauri/Cargo.lock"
+      - "apps/desktop/src-tauri/src/main.rs"
+      - "apps/desktop/src-tauri/src/project_load.rs"
+      - "apps/desktop/src-tauri/src/project_persistence.rs"
+      - "apps/desktop/src-tauri/src/project_persistence_engine.rs"
+      - "apps/desktop/src-tauri/src/project_root.rs"
+      - "apps/desktop/src-tauri/tests/project_persistence*.rs"
+      - "apps/desktop/src-tauri/tests/project_persistence*.case"
+      - "apps/desktop/src-tauri/tests/project_root_existing_authority.rs"
+      - "docs/traceability/project-persistence-native-ci.md"
+      - "docs/traceability/project-persistence-score-publication-identity.md"
+      - "docs/traceability/project-persistence-score-recovery-project-scope.md"
+      - "docs/traceability/project-persistence-score-recovery-reconciliation.md"
+      - "docs/traceability/project-persistence-shared-song-contract.md"
+      - "docs/traceability/project-persistence-workspace-mutation-admission.md"
+      - ".github/workflows/project-persistence-windows-native.yml"
+      - "services/analysis-engine/tests/test_project_persistence_workflow_policy.py"
+  push:
+    branches:
+      - develop
+      - main
+    paths:
+      - "apps/desktop/core/Cargo.toml"
+      - "apps/desktop/core/src/root.rs"
+      - "apps/desktop/core/src/lib.rs"
+      - "apps/desktop/core/src/crate_root.rs"
+      - "apps/desktop/core/src/content_sha256.rs"
+      - "apps/desktop/core/src/project_format.rs"
+      - "apps/desktop/core/src/project_scoped_score_recovery.rs"
+      - "apps/desktop/core/src/score_attachment_recovery.rs"
+      - "apps/desktop/core/tests/content_sha256_shared_kernel.rs"
+      - "apps/desktop/core/tests/project_persistence*.rs"
+      - "apps/desktop/core/tests/project_format*.rs"
+      - "apps/desktop/core/tests/project_migration*.rs"
+      - "apps/desktop/core/testdata/project-*.json"
+      - "apps/desktop/src/App.tsx"
+      - "apps/desktop/src/App.project-save-source-authority.test.tsx"
+      - "apps/desktop/src/App.score-project-identity.test.tsx"
+      - "apps/desktop/src/features/workspace/SectionRoadmap.tsx"
+      - "apps/desktop/src/lib/analysis.ts"
+      - "apps/desktop/src/lib/analysis.workspace-single-flight.test.ts"
+      - "apps/desktop/src/lib/projectDocumentBridge.test.ts"
+      - "apps/desktop/src/lib/projectDocumentSaveAuthority.test.ts"
+      - "apps/desktop/src-tauri/Cargo.toml"
+      - "apps/desktop/src-tauri/Cargo.lock"
+      - "apps/desktop/src-tauri/src/main.rs"
+      - "apps/desktop/src-tauri/src/project_load.rs"
+      - "apps/desktop/src-tauri/src/project_persistence.rs"
+      - "apps/desktop/src-tauri/src/project_persistence_engine.rs"
+      - "apps/desktop/src-tauri/src/project_root.rs"
+      - "apps/desktop/src-tauri/tests/project_persistence*.rs"
+      - "apps/desktop/src-tauri/tests/project_persistence*.case"
+      - "apps/desktop/src-tauri/tests/project_root_existing_authority.rs"
+      - "docs/traceability/project-persistence-native-ci.md"
+      - "docs/traceability/project-persistence-score-publication-identity.md"
+      - "docs/traceability/project-persistence-score-recovery-project-scope.md"
+      - "docs/traceability/project-persistence-score-recovery-reconciliation.md"
+      - "docs/traceability/project-persistence-shared-song-contract.md"
+      - "docs/traceability/project-persistence-workspace-mutation-admission.md"
+      - ".github/workflows/project-persistence-windows-native.yml"
+      - "services/analysis-engine/tests/test_project_persistence_workflow_policy.py"
+
+permissions:
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  windows-recovery-cleanup:
+    name: test / project-persistence / windows
+    runs-on: windows-2025
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
+      - name: Run Project Persistence recovery module tests
+        run: 'cargo +1.97.1 test --manifest-path apps/desktop/core/Cargo.toml --features persistence_warning_gate --lib score_attachment_recovery::tests::'
+      - name: Run Project Persistence content-identity module tests
+        run: 'cargo +1.97.1 test --manifest-path apps/desktop/core/Cargo.toml --features persistence_warning_gate --lib content_sha256::tests::'
+      - name: Run Project Persistence core integration contracts
+        run: 'cargo +1.97.1 test --manifest-path apps/desktop/core/Cargo.toml --features persistence_warning_gate --test content_sha256_shared_kernel --test project_format_resource_admission_handoff --test project_format_v2_fixture --test project_format_v2_playback_preference --test project_format_v3_renderer_source_authority --test project_format_v3_source_reference --test project_migration_receipt_input_binding --test project_persistence_contract --test project_persistence_score_recovery'
+      - name: Prepare compile-only frontendDist fixture
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force apps/desktop/dist | Out-Null
+          Set-Content -Path apps/desktop/dist/index.html -Value '<!doctype html><title>BandScope test fixture</title>' -NoNewline
+      - name: Run Windows recovery-cleanup regression
+        run: cargo +1.97.1 test --manifest-path apps/desktop/src-tauri/Cargo.toml --no-default-features --features persistence_warning_gate --tests

ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # ARCHITECTURE.md
 
-Last updated: 2026-03-11
+Last updated: 2026-09-06
 
 ## Brand source
 
@@ -111,8 +111,9 @@ Last updated: 2026-03-11
 - Shared contracts live in `packages/shared-types` so the UI can evolve without importing Python internals.
 - Shared contracts should ultimately model section, role, cue, confidence, and export artifacts explicitly enough that desktop UI and analysis outputs do not invent their own parallel schemas.
 - The current shared-types baseline includes a rehearsal-domain fixture that exercises section, role, cue, confidence, provenance, and export-summary fields in the desktop shell before the full analysis pipeline lands.
+- Current Project Persistence writes a strict `projectFormatVersion: 3` envelope around the validated rehearsal song, closed Active Player preference, and optional path-free app-owned audio `sourceReference`; legacy raw-song, v1, and v2 inputs remain readable through ordered migration. Resource Admission materializes the admitted local source as the fixed app-owned `source.<extension>` artifact, verifies publication byte identity, and retains a path-free native identity. Project Persistence injects that identity into Save and re-admits the exact size and SHA-256 on restart; production analysis revalidates the retained identity and decodes a verified private byte snapshot. Source/derived/decision/handoff expansion, autosave/recovery UX, and fresh Active Player audible authority remain follow-up work under #962/#961 rather than parallel stores.
 - Local analysis orchestration uses typed Tauri IPC commands and a Python subprocess over stdin/stdout rather than a loopback HTTP listener.
-- Local audio intake bootstraps a project by validating a user-selected file in Rust, creating app-owned temp/cache/project roots, and referencing the original source file rather than copying it in this phase.
+- Local audio intake validates an OS-selected source in Rust, enforces the canonical resource policy, publishes a no-clobber app-owned `source.<extension>` copy under the minted project aggregate, verifies the published bytes, and exposes only bounded bootstrap/path-free identity evidence to downstream Project Persistence and analysis consumers.
 - Those bootstrap roots should resolve from app-owned Tauri data/cache paths instead of the shared system temp namespace.
 - Product and UX decisions should prefer rehearsal-first simplicity while still maintaining high analytical accuracy.
 - Security decisions should prefer allowlisted narrow capabilities over generic convenience APIs.