fix: autosave no longer wipes scenes during the load window

[Snoopy147]

Root-causes the scene-wipe class reported since 2026-08-16 (QA scenes wiped to 0 nodes at v2 after read-only sessions).

The chain (reproduced deterministically 3/3 in dev): useAutoSave subscribes on the initial empty store → useHostPanels' mount effect calls setInstalledPlugins before the scene-load effect runs, marking the store dirty with zero user edits → the load effect empties the store and re-baselines the wipe guard to 0 → the effect cleanup (StrictMode's simulated unmount in dev at t≈0.3s; any real unmount/pagehide during the load window in prod) flushes the autosave: PUT with 0 nodes → 200 → scene wiped. The earlier "readiness timeout" hypothesis was wrong — that timeout is cosmetic and fires ~8s after the wipe.

Fix, defense in depth:

• use-auto-save.ts: the loading flag starts true (autosave arms only after first hydration); exit flushes route through a pure decideExitFlush() that skips whenever a load is in flight.
• scene-loader.tsx: tracks the server's known node count and refuses to PUT a 0-node graph over a populated copy (error banner instead).
• app/api/scenes/[id]/route.ts: a 0-node PUT against a >0-node scene returns 409 empty_graph_rejected unless force: true.

Tests: decideExitFlush matrix including the exact traced wipe sequence; guard unit matrix; real PUT-handler tests against a temp SQLite store (409 body, store untouched, force path). packages/editor 690 pass, apps/editor 35 pass, turbo test 13/13, types + biome clean.

Live verification: isolated dev server from the fix branch — the identical read-only session fires zero PUTs, scene intact; raw empty PUT → 409, force:true → 200.

Follow-up (separate): apps/community's own onSave lacks the node-count guard and its API lacks the 409 layer — layer (a) protects it once this ships, but it should get (b)+(c) too.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes scene persistence and unload flush behavior on a critical data path; normal saves should be unchanged, but mis-tuned loading flags could delay or skip legitimate exit flushes.

Overview
Fixes a scene-wipe bug where autosave could PUT a 0-node graph over a populated scene during the load window (pre-hydration dirty state + unload flush on unmount/navigation).

Editor autosave (use-auto-save): isLoadingSceneRef now starts true until first hydration finishes, and unload/pagehide flushes go through decideExitFlush() so they are skipped while a load is in flight or when a suspicious node drop would flush an empty scaffold.

App save path (scene-loader): tracks the server’s known node count, blocks client PUTs that would empty a populated scene, and treats 409 empty_graph_rejected as a wipe block (not a version conflict).

API (PUT /api/scenes/[id]): rejects empty-over-populated writes with 409 empty_graph_rejected unless the body includes force: true; shared empty-graph-guard helpers drive client and server checks.

Tests cover the guard matrix, decideExitFlush (including the traced wipe sequence), integration against a real SQLite route handler, and test-only store injection / mock cleanup for stable CI.

^{Reviewed by Cursor Bugbot for commit d2200a8. Bugbot is set up for automated code reviews on this repo. Configure here.}