Forced shutdown can cause confirmed saves to be lost or silently overwritten on reopen

[RecursiveRegret]

Issue

A forced shutdown exposed two durability gaps in the current save path:

1. save_file_content may acknowledge a write before the OS flushes to disk, making recent saves non-durable on power loss.

2. On reopen, restoreStateOnReopen replays rawContent from LevelDB tab state, which can diverge from the on-disk file with no conflict detection and no revision trail to fall back to. The combination means a user can lose work with no recovery path.

Context

Markpad was used to edit and save an .md file on Windows, then the PC was force shut down. After reboot, the file contents did not match the version I expected.

• I checked Markpad’s WebView/LevelDB local storage including 000003.ldb, 000006.ldb, 000007.log, LOG, LOG.old, and MANIFEST-000001.

• I searched a copy of that folder for savedTabsData and for a distinctive missing-content token but found no recoverable prior content.

Proposed Fix

1. Add an optional auto-save interval to reduce exposure between manual saves and forced shutdown.
2. Persist a snapshot of tab state to LevelDB on each confirmed save, recoverable across sessions.

[jpadgett314]

I can confirm I also experience this on 2.6.10 on Windows 11 24H2 26100.8457.

Shutting down Windows, while Markpad is open, frequently causes this issue. It can be reproduced reliably:

1. Open Markpad
2. Edit and save any current tab (i.e. already open in Markpad)
3. Shutdown Windows
4. The next time you open Markpad, an old version of the file is shown

A more robust solution would require loading the file from disk on startup.

[PathGao]

Both durability gaps reported here now have fixes:

1. Non-durable writes — save_file_content now writes through a sibling temp file with fsync and an atomic rename (shipped in v2.6.12).
2. Snapshot replay diverging from disk — PR fix: review unsaved tabs one at a time on window close; restore window state only #211 makes the reopen snapshot window-state-only: restored tabs always re-read content from disk, so a stale snapshot can no longer overwrite or misrepresent the on-disk file.

#211 is linked to auto-close this issue when it merges.