fix(project): stage new saves without clobbering known-good files

CHANGELOG.md

@@ -14,6 +14,10 @@
 ### Fixed
 
 - Upgraded the local score PDF parser to `pdfjs-dist` 6.2.108, pinned Undici 7.29.0 across the workspace, and constrained PDF loading to copied in-memory bytes with a same-origin bundled worker and npm-generated lock provenance.
+- Stage and sync new project saves before non-clobbering publication, and enforce the existing 5 MiB project limit during the file read itself so a selected project cannot grow past a metadata preflight into an unbounded load allocation.
+- Reject directly selected project symlinks before reading so a chosen `.bscope` path cannot silently redirect the loader to different file content.
+- Reject a symlinked/reparse-point save parent before staging so a selected project path cannot redirect new project publication into a different directory.
+- Fail closed when a selected `.bscope` path changes file identity between preflight and handle acquisition; Windows also opens reparse points without following them before validation.
 
 ## [0.1.3] - 2026-04-29
 

apps/desktop/src-tauri/src/main.rs

@@ -1,5 +1,7 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
+mod project_persistence;
+
 use bandscope_desktop_core::*;
 use rfd::FileDialog;
 use serde_json::{json, Value};
@@ -750,7 +752,7 @@ fn save_project(payload: Value) -> Result<(), String> {
 
     let content = serde_json::to_string_pretty(&parsed)
         .map_err(|_| "Failed to serialize project".to_string())?;
-    std::fs::write(path, content).map_err(|_| "Failed to write file".to_string())?;
+    project_persistence::publish_new_project_file(&path, content.as_bytes())?;
 
     Ok(())
 }
@@ -762,12 +764,7 @@ fn load_project() -> Result<RehearsalSongPayload, String> {
         .pick_file()
         .ok_or_else(|| "User cancelled".to_string())?;
 
-    let metadata = std::fs::metadata(&path).map_err(|_| "Failed to read file".to_string())?;
-    if metadata.len() > 5 * 1024 * 1024 {
-        return Err("Project file is too large (exceeds 5MB limit)".to_string());
-    }
-
-    let content = std::fs::read_to_string(path).map_err(|_| "Failed to read file".to_string())?;
+    let content = project_persistence::read_project_file(&path)?;
     project_payload_from_content(&content)
 }