[Frameforge 3] Implement durable IndexedDB project and Blob storage with stable app origins

[danwalmsley]

Outcome

Frameforge currently falls back to session-only storage. Implement actual IndexedDB persistence for projects and imported Blob media; the same infrastructure should benefit Aureon recovery. This can proceed independently of playback.

Specification and implementation

• Implement IDBFactory.open/versioned upgrades, IDBOpenDBRequest, IDBDatabase/createObjectStore/transaction/close, IDBObjectStore.get/put and requests/transactions with result/error, upgradeneeded, success/error, complete/abort events. Specify and test key validation, structured cloning, transaction active windows, serialization and abort rollback. Audit additional standard methods before exposing a claimed profile; unimplemented operations must not appear successful.
• Persist structured project objects and Blob/File bytes with MIME metadata. Do not store native pointer values, V8 handles or filesystem path tokens as serialized browser values. Reuse safe clone semantics and durable blob ownership.
• Use an asynchronous transactional storage backend; document SQLite or alternative selection, schema upgrades, atomicity, quota accounting and recovery. Keep disk I/O off runtime/UI threads. Provide host-controlled data location and clear-data behavior.
• Fix sample storage identity: the current loopback server chooses a random port on every run, changing the web origin. Design a stable admitted app origin (or stable endpoint with explicit instance-conflict policy) and persistent profile. Do not solve this by merging arbitrary origins or dropping port isolation globally.
• Preserve origin partitioning, opaque-origin behavior, denied/unavailable storage errors and multi-context versionchange/blocked handling; settle callbacks on navigation/shutdown. Keep clear-data and deletion bounded and safe.

Tests and verification

Round-trip nested project data and binary Blobs, cross-process app restart, failed transaction rollback, concurrent writers, upgrade/blocked connections, quota/disk-write failure and origin separation. Test absence of half-written project/media pairs after interruption. Verify same app profile restores while a distinct app/origin cannot read it. Add IndexedDB WPT selections with published exclusions.

Acceptance

• Original imported media and edited autosave restore after quitting/relaunching the packaged app.
• Failure leaves prior committed data intact and emits real request/transaction errors.
• Stable identity is implemented without weakening origin isolation.
• Persistence and clone/blob tests pass in Native AOT; session fallback remains honest when unavailable.

References

IndexedDB standard.

Original application references

• src/storage.js
• src/app.js

Shared delivery requirements

Parent: #53. Baseline: PR #43 / ce56d49; sample experiments/WebScene.Frameforge.
Reference application: https://github.com/wieslawsoltes/Frameforge (pin f414cd44896b659a5c6da2e4fc596a2ded055f2a, includes demo media and THIRD_PARTY_NOTICES.md).
Implement in WebScene, leaving original application JavaScript/WGSL unchanged. No fake capability objects, synthetic successful events or swallowed errors. Keep public contracts cross-platform with isolated backend implementations; qualify macOS arm64 first and explicitly track Windows/Linux follow-up. Production Avalonia 11 must remain supported; only samples opt into Avalonia 12. Native AOT/trim safety is mandatory.
Add focused native/managed regression coverage and a pinned WPT subset or clearly labeled project-owned contract for non-WebGPU behavior. Applicable WebGPU CTS cases belong with GPU work. Record exact revisions, test commands, negative cases and reproducible evidence in the implementation PR. Unsupported functionality cannot be marked passed; distinguish app coverage from standards conformance. Review existing implementation before adding overlapping infrastructure.

[wieslawsoltes]

Code OSS 1.137.0 now provides a second concrete consumer for this capability.

A packaged AppScene/WebScene native run reached LifecyclePhase/Ready, rendered the workbench, authenticated both management and Node extension-host sockets, created an editor model, rendered a typed edit, and undid it. During startup, every VS Code IndexedDB store reported indexedDB is not defined, after which Code OSS selected its in-memory user-data provider.

This means the editor can run, but global/shared/workspace state does not persist through the browser storage contract. The application uses an ephemeral loopback port, so the stable admitted app-origin or host partition-key requirement already described here is directly relevant. The implementation should support Code OSS's vscode-web-state-db-global, vscode-web-state-db-global-shared, and vscode-web-state-db-empty-window open/upgrade/transaction paths without application-owned storage shims.

Evidence is retained in the Code OSS integration repository at WebScene revision 41cf43cc; the smoke passed in 4.1 seconds once the independent HTML content-property issue #79 was diagnosed.

[wieslawsoltes]

The Code OSS-compatible durable storage slice is now in draft PR #94 at 35227864.

It adds atomic asynchronous persistence, stable loopback profile identity, quota and corruption errors, rollback, restart recovery, and cross-process stale-writer protection. The linked V8 gates pass 2/2, the candidate profile passes 11/11 assertions, interruption/stale-lock recovery is covered, and the durable 4 KiB benchmark reaches 2,281.84 commits/second.

Keep this issue open for the broader acceptance criteria: durable Blob/File MIME restoration, indexes/key paths/key generators/IDBKeyRange, reverse and mutating cursors, full transaction timing and cross-realm/process upgrade coordination, released-RID and Native AOT qualification, and packaged application relaunch verification.

[wieslawsoltes]

Packaged Code OSS quit/relaunch verification now passes on the consolidated WebScene branch at bd139b26.

The native host configures webscene_engine_options with a private Application Support storage root, stable partition org.scenetech.code-oss-appscene:default, and a 512 MiB quota. A two-process gate then:

1. waits for the real Code OSS workbench and commits a structured IndexedDB record containing a token and Date;
2. destroys the AppScene/WebScene host and bundled Node server;
3. relaunches both on a different ephemeral loopback port; and
4. reads and type-checks the committed record through the browser-shaped IndexedDB API.

The run passed in 8.758 seconds, moving from 127.0.0.1:54790 to 127.0.0.1:54844. It retained native frame/workbench readiness, exact partition/quota evidence, and durable .wsidb files. The ordinary editor edit/undo smoke still passed in 5.224 seconds after enabling storage. No VS Code OSS source change or application-owned storage shim was required.

This closes the packaged Code OSS restart verification called out in the previous update. The issue should remain open for its broader Blob/File, indexes/key paths/key-generator/IDBKeyRange, cursor, full transaction timing, and cross-context upgrade requirements.

[wieslawsoltes]

Focused PR #94 is now at 2b4d80b4 and remains draft/open.

The IndexedDB WPT profile now has 12/12 passing assertions. New coverage proves put() takes a synchronous snapshot and preserves Date, Map, and typed-array values through close/reopen and a full engine restart.

The current packaged Code OSS gate also passed a true two-process restart in 8.423 seconds: it wrote at 127.0.0.1:57435, destroyed the native host and Node server, relaunched at 127.0.0.1:57495, and restored the structured record from the stable private application partition. The changed port prevents an ephemeral origin from masquerading as persistence.

Exact-head runtime-package CI is running at https://github.com/SceneTech/WebScene/actions/runs/35033284744. The issue remains open for the broader IndexedDB surface and released SDK qualification.

[wieslawsoltes]

Focused durable IndexedDB support merged in #94 at 05d9ad68 (PR head 76282b7d), directly on main 649c2b63, which includes the Web Crypto stack merged at 1c18c70c. The merge does not include consolidation #76.

Delivered and verified in this slice:

• Host-owned storage directory, stable application/profile partition key, origin partitioning, and quota configuration for Avalonia and Uno.
• Asynchronous storage-thread I/O with revision checks, durable temporary-write/flush/atomic-replace commits, rollback preservation, quota errors, corruption rejection, stale-lock recovery, and cross-process stale-writer rejection.
• The Code OSS open/upgrade/versionchange, readonly/readwrite transaction, structured-clone, object-store, request/error, and forward-cursor paths used by vscode-web-state-db-global, vscode-web-state-db-global-shared, and vscode-web-state-db-empty-window.
• Local linked-V8 15.3.10 CTest gates passed 2/2 (webscene_indexeddb_storage_tests and webscene_native_indexeddb_contract). The candidate profile passed 1/1 document and 12/12 subtests against the newly built native library. The durability benchmark measured 1,670.73 durable 4 KiB commits/second against a gate of 100 commits in ten seconds.
• SDK compatibility tests passed 7/7 on .NET 10; Avalonia and Uno backend/SDK builds completed with zero warnings/errors; Node capability contracts passed 3/3.
• Exact-head macOS CI job 105007766343 passed, including the changed SDK/tooling contracts, manifest integrity, and project builds.

The runtime-package workflow did not produce released-RID evidence: its Linux metadata job failed before build/test because setup-dotnet reported an SDK in the runner temp directory but the following step could not find dotnet. A retry reproduced the same runner-state failure. This is why released-RID qualification remains below rather than being claimed by #94.

Keep this issue open for the explicitly unimplemented acceptance surface:

• Durable Blob/File byte, MIME, name, and prototype restoration, including atomic project/media pairs.
• Indexes, key paths, key generators/auto-increment, and IDBKeyRange.
• Reverse cursors and cursor update()/delete().
• Complete transaction active-window timing, cross-realm/process blocked and versionchange coordination, and shutdown/navigation settlement coverage.
• Host-level bounded clear-data coordination beyond individual deleteDatabase() and stopped-engine partition removal.
• Released macOS/Linux/Windows runtime-package qualification and Native AOT/trim evidence.
• Packaged Frameforge import/edit/quit/relaunch restoration of original media and autosave, plus the corresponding Aureon recovery acceptance.