fix(editor): make session transitions loss-safe

CHANGELOG.md

@@ -9,6 +9,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **Foolproof editor job transitions + Save As.** Opening another feedpak
+  or starting New now offers Save / Don't Save / Cancel when the current
+  job is dirty; a failed save blocks the transition. Active MIDI takes are
+  finalized first, then playback, scheduled voices, pending audio/load
+  requests, drags and the outgoing backend session are stopped before the
+  replacement job is installed. File -> Save As opens the native system
+  picker where available (download fallback) and mirrors later saves to
+  that chosen external copy for the rest of the session.
 - **Authoritative musical-ruler tempo mapping.** Tempo Map's primary action is
   now **Mark barline**: inside the mapped range it preserves the existing split
   behavior, while a mark beyond the final beat closes the open measure at the
@@ -267,6 +275,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Loading a new feedpak while the old recording was playing no longer
+  leaves the old AudioBufferSource sounding under the new song. Audio-less
+  packs also clear the previous decoded buffer, and overlapping load/audio
+  requests cannot install stale results out of order. The same teardown now
+  also runs when a Guitar Pro / EOF **import** replaces the job (it took a
+  different code path than Open feedpak), so an audio-less import can no
+  longer inherit the previous recording, and the outgoing backend session is
+  disposed instead of leaked.
+- The session-transition confirm prompt's Escape listener now rides the
+  screen teardown registry, and dismissing it resolves the pending prompt —
+  a re-injected editor screen can no longer strand an in-flight transition.
+- Choosing the "New" format picker on a dirty job no longer double-prompts to
+  save (the picker already guarded the transition; the format buttons stopped
+  re-guarding).
 - **The screen teardown left the guide/metronome timer running.** The audio
   extraction (below) surfaced it: the old inline teardown cancelled the audio
   source and the rAF frame but not the `setInterval` that schedules guide claps,

routes.py

@@ -3041,6 +3041,44 @@ def _safe_storage_asset(p) -> str:
     global _sessions
     _sessions = sessions
 
+    def _dispose_editor_session(session_id: str) -> bool:
+        session = sessions.pop(session_id, None)
+        if not session:
+            return False
+        # Native sloppak sessions point at the shared extraction cache; never
+        # remove that tree. Archive/create sessions own temporary sandboxes.
+        if session.get("format") != "sloppak":
+            shutil.rmtree(session.get("dir", ""), ignore_errors=True)
+        return True
+
+    @app.post("/api/plugins/editor/session/close")
+    async def close_editor_session(data: dict):
+        session_id = str(data.get("session_id") or "")
+        return {"closed": _dispose_editor_session(session_id)}
+
+    @app.get("/api/plugins/editor/session/export")
+    async def export_editor_session(session_id: str):
+        session = sessions.get(session_id)
+        if not session:
+            return JSONResponse({"error": "No active session"}, 404)
+        filename = str(session.get("filename") or "")
+        dlc_dir = get_dlc_dir()
+        if not filename or not dlc_dir:
+            return JSONResponse({"error": "Session has no saved feedpak"}, 409)
+        root = dlc_dir.resolve()
+        candidate = (root / filename).resolve()
+        try:
+            candidate.relative_to(root)
+        except ValueError:
+            return JSONResponse({"error": "forbidden"}, 403)
+        if not candidate.is_file():
+            return JSONResponse({"error": "Saved feedpak is not a packed file"}, 409)
+        return FileResponse(
+            candidate,
+            media_type="application/zip",
+            filename=candidate.name,
+        )
+
     # Cache compat probes for the slopsmith core converter signatures —
     # each function is stable for the process lifetime, so the
     # inspect.signature call only needs to run once per converter.

src/arrangement.js

@@ -7,7 +7,7 @@
 // stays in main.js (draw, updateStatus, updateArrangementSelector,
 // effectiveAudioOffset) routes through host.
 
-import { S } from './state.js';
+import { S, markSessionDirty } from './state.js';
 import { _editorEscHtml, _editorPromptText, setStatus } from './ui.js';
 import { flattenChords } from './chords.js';
 import { KEYS_PATTERN } from './keys.js';
@@ -188,6 +188,7 @@ export async function editorRemoveArrangement() {
 
     // Then update frontend state
     S.arrangements.splice(removeIdx, 1);
+    markSessionDirty();
     // The splice renumbers every arrangement after removeIdx, so history
     // commands tagged with the old indices (and the note indices inside them)
     // would undo into the wrong arrangement. Same rationale as the

src/audio.js

@@ -36,6 +36,8 @@ import { setStatus } from './ui.js';
 // The rAF handle for the playback loop. Module-scope so playbackTick and
 // teardownAudio share it; main.js reaches the cancel through teardownAudio().
 let rafId = null;
+let audioLoadController = null;
+let audioLoadGeneration = 0;
 
 // Lazily create the shared AudioContext. Compose mode never decodes a
 // recording (loadAudio is the only other creation site), yet the transport
@@ -52,20 +54,37 @@ function _ensureAudioCtx() {
 }
 
 export async function loadAudio(url) {
-    if (!url) return;
+    if (!url) return false;
+    cancelAudioLoad();
+    const generation = audioLoadGeneration;
+    audioLoadController = typeof AbortController === 'function' ? new AbortController() : null;
     try {
         _ensureAudioCtx();
-        const resp = await fetch(url);
+        const resp = await fetch(url, audioLoadController ? { signal: audioLoadController.signal } : undefined);
         const buf = await resp.arrayBuffer();
-        S.audioBuffer = await S.audioCtx.decodeAudioData(buf);
+        const decoded = await S.audioCtx.decodeAudioData(buf);
+        if (generation !== audioLoadGeneration) return false;
+        S.audioBuffer = decoded;
         S.duration = S.audioBuffer.duration;
         // A new recording is loaded — re-arm the hearing-safety fade so it
         // applies to this recording too, not just the session's first one.
         _mixResetFirstPlay();
         host.editorApplyScrollBounds();
         computeWaveform();
+        return true;
     } catch (e) {
-        console.error('Audio load error:', e);
+        if (e && e.name !== 'AbortError') console.error('Audio load error:', e);
+        return false;
+    } finally {
+        if (generation === audioLoadGeneration) audioLoadController = null;
+    }
+}
+
+export function cancelAudioLoad() {
+    audioLoadGeneration++;
+    if (audioLoadController) {
+        try { audioLoadController.abort(); } catch (_) {}
+        audioLoadController = null;
     }
 }
 
@@ -1175,6 +1194,7 @@ export function initAudio() {
 // S.playing and syncing drops it — _guideTimerSync stops the timer when nothing
 // wants it — and _guideCancelVoices silences any queued oscillators (Codex).
 export function teardownAudio() {
+    cancelAudioLoad();
     try { if (S.audioSource) { S.audioSource.stop(); S.audioSource = null; } } catch (_) { /* already stopped */ }
     try { if (rafId) { cancelAnimationFrame(rafId); rafId = null; } } catch (_) { /* no frame queued */ }
     S.playing = false;

src/create.js

@@ -28,7 +28,8 @@
 import { host } from './host.js';
 import { KEYS_PATTERN, isKeysMode, updatePianoRange } from './keys.js';
 import { _seedExtendedStringsFromTuning } from './lanes.js';
-import { S } from './state.js';
+import { S, markSessionDirty } from './state.js';
+import { disposeBackendSession, stopSessionProcesses } from './session-lifecycle.js';
 import { _liftAllBeats, _restoreBeatLocks, _syncAppliedMessagePure } from './tempo.js';
 import { _editorEscHtml, _installModalKeyboard, setStatus } from './ui.js';
 
@@ -88,13 +89,15 @@
         '🎵  Blank — start from audio',
         'Audio + an empty arrangement (drum tab optional). Chart it yourself '
         + 'in the editor. No Guitar Pro / XML needed.',
-        () => { window.editorShowCreateModal(); window.editorSetCreateMode('blank'); },
+        // Raw opener, not window.editorShowCreateModal: the transition was
+        // already guarded when this picker opened; the wrapper would re-prompt.
+        () => { editorShowCreateModal(); window.editorSetCreateMode('blank'); },
     ));
     inner.appendChild(mkBtn(
         '🎸  Import from Guitar Pro',
         'Build a chart from a Guitar Pro file (.gp3–.gp8), saved as a native '
         + '.feedpak.',
-        () => { window.editorShowCreateModal(); window.editorSetCreateMode('gp'); },
+        () => { editorShowCreateModal(); window.editorSetCreateMode('gp'); },
     ));
 
     const cancel = document.createElement('div');
@@ -426,7 +429,7 @@
             // Open the freshly-written sloppak via the existing load
             // path so the editor state initialises identically to a
             // normal sloppak load.
-            await host.loadCDLC(data.filename);
+            await host.loadCDLC(data.filename, { skipGuard: true });
         } catch (e) {
             status.textContent = 'Failed: ' + e.message;
             status.className = 'text-xs mb-2 min-h-[1em] text-red-400';
@@ -1572,7 +1575,7 @@
 // Left in place rather than deleted, because deleting them is a separate change
 // from the bug fix that made them redundant. They arrived with the same
 // half-wired Create-New redesign (977ec65, #45).
 function _populateCreateArrButtons() {
     const wrap = document.getElementById('editor-create-arr-buttons');
     if (!wrap) return;
     wrap.replaceChildren();
@@ -1745,7 +1748,7 @@
             createState.lastSync = { ...createState.lastSync, ...data };
         }
         return data;
     } catch (e) {
         return null;
     }
 }
@@ -2119,7 +2122,7 @@
         }
         editorHideCreateModal();
         host.kickLibraryRescan();
-        await host.loadCDLC(data.filename);
+        await host.loadCDLC(data.filename, { skipGuard: true });
     } catch (e) {
         if (status) status.textContent = 'Failed: ' + e.message;
         if (btn) btn.disabled = false;
@@ -2136,10 +2139,23 @@
 
     // Load into editor
     window.editorHideCreateModal();
+    // Same outgoing-job teardown loadCDLC performs: stop the old playback,
+    // the pending audio load and any drag, and drop the decoded buffer. An
+    // audio-less import skips the loadAudio() branch below, so without this the
+    // previous recording keeps sounding under the new chart and S.audioBuffer
+    // stays stale. Dispose the old backend session too so its sandbox isn't leaked.
+    const oldSessionId = S.sessionId;
+    stopSessionProcesses();   // also cancels the outgoing audio load
+    S.audioBuffer = null;
+    S.waveformPeaks = null;
     S.title = data.title || '';
     S.artist = data.artist || '';
     S.filename = '';
     S.sessionId = data.session_id;
+    if (oldSessionId && oldSessionId !== data.session_id) {
+        await disposeBackendSession(oldSessionId);
+    }
+    markSessionDirty();
     S.format = 'sloppak';
     S.arrangements = data.arrangements || [];
     // Create-mode import — the source builds tuning to the actual string count,