fix: 3 P0 audit findings — orphan-file real-delete path, autosave data loss, unreachable import entry point

[KerroKapple]

Summary

Fixes the 3 P0 findings from the 2026-08-31 full-codebase audit (17-window Codex review + code-based UI/UX walkthrough). The audit reports themselves are now committed under docs/review/2026-08-31/ so every claim in the plan and in this description is checkable in-repo.

• P0-1: OrphanFileReaper (documented as read-only/dry-run) contained a real, no-recovery File.delete() branch reachable via a dryRun: false parameter no caller passed. Removed the parameter and the delete implementation entirely — the interface is now genuinely parameterless and delete-free.
• P0-2: The canvas Inspector's debounced autosave silently discarded the user's last edit when switching the selected node within the 500ms debounce window. Two independent mechanisms had this bug (the shared InspectorSubmitController.savePromptDebounced, and ShotConfigInspector's own local Timer) — both fixed by holding a KeepAliveLink for the duration of a pending debounced write. The shot-notes fix generalised the mechanism into a shared saveDebounced(patch) rather than a second widget-local implementation, after the originally planned "flush on dispose" approach turned out to violate a Riverpod framework constraint (confirmed empirically; the plan file now carries an as-built deviation note at Task 3 so nobody re-implements the dead end).
• P0-3: A user whose only InkFrame content was a project archive had no way to import it. Extracted the import flow into a reusable runProjectImportFlow() and wired it into both the zero-project empty state and the Ctrl/Cmd+K command palette.

Adversarial review pass (2026-09-02)

Six independent review lenses over the whole branch, each finding then put to three adversarial verifiers (correctness / reproducibility / scope). Seven findings survived a majority vote and are fixed here:

• P2 the new empty-state Import button's busy gating had zero test coverage (the only mutex test goes through the FAB). Added a regression test and mutation-verified it: dropping the gate turns it red, restoring turns it green.
• P2 the committed plan still described the un-shipped Task 3 design — now marked as an as-built deviation.
• P3 ×5 dead OrphanCandidate.file field (its only reader was the deleted _reapFile), an over-claiming "touches no disk" contract comment (reap() does write a throttle marker), retired "DRY-RUN v1 / flip to real delete later" wording in five places, a stale command-palette docstring, a wrong test count on the BOARD row, and a machine-local absolute path containing the OS username inside a committed audit report.

Docs synced in-branch per the playbook: BOARD gets a landed row plus debt rows for every deliberately deferred item, docs/CLAUDE.md's structure snapshot gains project_import_flow.dart and loses the stale reaper description, and lib/features/studio/README.md lists the new flow.

Deferred, recorded as debt rather than silently dropped: (a) an already in-flight autosave can still overwrite a submit() write; (b) autosave failures are still silently swallowed; (c) InspectorSubmitController keeps one pending debounce slot per node; (d) quitting the app within the debounce window still loses the pending write, because teardown closes the PG pool before disposing the container. All four are in the BOARD debt table.

Test plan

• flutter analyze lib test → No issues found!
• flutter test --exclude-tags golden → 1956 passing / 66 skipped / 0 failing. Baseline at the pre-review branch tip was 1955; the delta is exactly the one test added by the review pass. Two back-to-back runs produced identical counts.
• Golden studio_empty baseline re-minted on the CI ubuntu runner via update-goldens and visually diffed: the only change is the new Import button.
• The new empty-state gating test verified red-before / green-after by mutation.

⚠️ Merge-time obligation

This branch carries the update-goldens bot commit, whose message contains the marker that suppresses CI (the one written as square-bracketed skip-ci). Per docs/EXECUTION-PLAYBOOK.md §2.3, a squash merge folds that into main's commit body and silently skips ci / smoke / secret-scan on main. After merging, re-run them:

gh workflow run ci.yml --ref main
gh workflow run smoke.yml --ref main
gh workflow run secret-scan.yml --ref main

🤖 Generated with Claude Code