add unit tests

saveload fixes

docs/CLAUDE.md

@@ -1,10 +1,10 @@
 # CLAUDE.md
 
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+Guidance for Claude Code (claude.ai/code) when working with this repository.
 
 ## Project Overview
 
-"Skelly" is a Godot 4.4 mobile game project featuring multiple gameplay modes within a unified game framework. The project currently supports match-3 puzzle gameplay with planned support for clickomania gameplay. It includes a modular gameplay system, menu system, settings management, audio handling, localization support, and a comprehensive debug system.
+"Skelly" is a Godot 4.4 mobile game project with multiple gameplay modes. Supports match-3 puzzle gameplay with planned clickomania gameplay. Includes modular gameplay system, menu system, settings management, audio handling, localization support, and debug system.
 
 **For detailed project architecture, see `docs/MAP.md`**
 
@@ -41,48 +41,60 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - New translations: Add to `project.godot` internationalization section
 
 ### Asset Management
-- **CRITICAL**: Every asset must be documented in `assets/sources.yaml` before committing
+- **Document every asset** in `assets/sources.yaml` before committing
 - Include source, license, attribution, modifications, and usage information
-- Verify license compatibility with project requirements
-- Commit asset files and sources.yaml together in the same commit
+- Verify license compatibility
+- Commit asset files and sources.yaml together
 
 ## Key Development Guidelines
 
 ### Code Quality & Safety Standards
-- **Memory Management**: Always use `queue_free()` instead of `free()` for node cleanup
-- **Input Validation**: Validate all user inputs with bounds checking and type validation
-- **Error Handling**: Implement comprehensive error handling with fallback mechanisms
+- **Memory Management**: Use `queue_free()` instead of `free()`
+- **Input Validation**: Validate user inputs with bounds checking and type validation
+- **Error Handling**: Implement error handling with fallback mechanisms
 - **Race Condition Prevention**: Use state flags to prevent concurrent operations
 - **No Global State**: Avoid static variables; use instance-based architecture for testability
 
 ### Scene Management
-- **ALWAYS** use `GameManager` for scene transitions - never call `get_tree().change_scene_to_file()` directly
-- Scene paths are defined as constants in GameManager
-- Error handling is built into GameManager for failed scene loads
+- **Use `GameManager` for all scene transitions** - never call `get_tree().change_scene_to_file()` directly
+- Scene paths defined as constants in GameManager
+- Error handling built into GameManager for failed scene loads
 - Use `GameManager.start_game_with_mode(mode)` to launch specific gameplay modes
-- Supported gameplay modes: "match3", "clickomania" (validated with whitelist)
+- Supported modes: "match3", "clickomania" (validated with whitelist)
 - GameManager prevents concurrent scene changes with `is_changing_scene` protection
 
 ### Autoload Usage
 - Use autoloads for global state management only
 - Prefer signals over direct access for loose coupling
 - Don't access autoloads from deeply nested components
-- **SettingsManager**: Features comprehensive input validation and error recovery
+- **SaveManager**: Save system with tamper detection, race condition protection, and permissive validation
+- **SettingsManager**: Features input validation, NaN/Infinity checks, and security hardening
 - **GameManager**: Protected against race conditions with state management
 
+### Save System Security & Data Integrity
+- **SaveManager implements security standards** for data protection
+- **Tamper Detection**: Deterministic checksums detect save file modification or corruption
+- **Race Condition Protection**: Save operation locking prevents concurrent conflicts
+- **Permissive Validation**: Auto-repair system fixes corrupted data instead of rejecting saves
+- **Type Safety**: NaN/Infinity/bounds checking for numeric values
+- **Memory Protection**: File size limits prevent memory exhaustion attacks
+- **Version Migration**: Backward-compatible system handles save format upgrades
+- **Error Recovery**: Multi-layered backup and fallback systems ensure no data loss
+- **Security Logging**: All save operations logged for monitoring and debugging
+
 ### Debug System Integration
 - Connect to `DebugManager.debug_ui_toggled` signal for debug UI visibility
 - Use F12 key for global debug toggle
 - Remove debug prints before committing unless permanently useful
 
 ### Logging System Usage
-- **CRITICAL**: ALL print() and push_error() statements have been migrated to DebugManager
-- **ALWAYS** use `DebugManager` logging functions instead of `print()`, `push_error()`, etc.
-- Use appropriate log levels: INFO for general messages, WARN for issues, ERROR for failures
-- Include meaningful categories to organize log output, eg: `"GameManager"`, `"Match3"`, `"Settings"`, `"DebugMenu"`
-- Leverage structured logging for better debugging and production monitoring
+- **All print() and push_error() statements migrated to DebugManager**
+- Use `DebugManager` logging functions instead of `print()`, `push_error()`, etc.
+- Use log levels: INFO for general messages, WARN for issues, ERROR for failures
+- Include categories to organize log output: `"GameManager"`, `"Match3"`, `"Settings"`, `"DebugMenu"`
+- Use structured logging for better debugging and production monitoring
 - Use `DebugManager.set_log_level()` to control verbosity during development and testing
-- The logging system provides unified output across all game systems
+- Logging system provides unified output across all game systems
 
 ## Important File References
 
@@ -95,10 +107,11 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ### Key Scripts to Understand
 - `src/autoloads/GameManager.gd` - Scene transition patterns with race condition protection
-- `src/autoloads/SettingsManager.gd` - Settings management with comprehensive error handling
+- `src/autoloads/SaveManager.gd` - **Save system with security features**
+- `src/autoloads/SettingsManager.gd` - Settings management with input validation and security
 - `src/autoloads/DebugManager.gd` - Debug system integration
 - `scenes/game/game.gd` - Main game scene with modular gameplay system
-- `scenes/game/gameplays/match3_gameplay.gd` - Memory-safe Match-3 implementation with input validation
+- `scenes/game/gameplays/match3_gameplay.gd` - Match-3 implementation with input validation
 - `scenes/game/gameplays/tile.gd` - Instance-based tile behavior without global state
 - `scenes/ui/DebugMenuBase.gd` - Unified debug menu base class
 - `scenes/ui/SettingsMenu.gd` - Settings UI with input validation
@@ -108,18 +121,21 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 ## Development Workflow
 
 ### Before Making Changes
-1. Check `docs/MAP.md` for architecture understanding
+1. Check `docs/MAP.md` for architecture
 2. Review `docs/CODE_OF_CONDUCT.md` for coding standards
-3. Understand existing patterns before implementing new features
+3. Understand existing patterns before implementing features
 4. If adding assets, prepare `assets/sources.yaml` documentation
 
 ### Testing Changes
 - Run project with F5 in Godot Editor
 - Test debug UI with F12 toggle
-- Verify scene transitions work correctly
+- Verify scene transitions work
 - Check mobile compatibility if UI changes made
-- Use relevant test scripts from `tests/` directory to validate system functionality
-- Run `test_logging.gd` after making changes to the logging system
+- Use test scripts from `tests/` directory to validate functionality
+- Run `test_logging.gd` after logging system changes
+- **Save system testing**: Run save/load test suites after SaveManager changes
+- **Checksum validation**: Test `test_checksum_issue.gd` to verify deterministic checksums
+- **Migration compatibility**: Run `test_migration_compatibility.gd` for version upgrades
 
 ### Common Implementation Patterns
 - **Scene transitions**: Use `GameManager.start_game_with_mode()` with built-in validation
@@ -127,22 +143,23 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - **Logging**: Use `DebugManager.log_*()` functions with appropriate levels and categories
 - **Gameplay modes**: Implement in `scenes/game/gameplays/` directory following modular pattern
 - **Scoring system**: Connect `score_changed` signal from gameplay to main game scene
-- **Settings**: Use `SettingsManager` with automatic input validation and error recovery
+- **Save/Load operations**: Use `SaveManager` with security and validation
+- **Settings**: Use `SettingsManager` with input validation, NaN/Infinity checks, and security hardening
 - **Audio**: Use `AudioManager` for music and sound effects
 - **Localization**: Use `LocalizationManager` for language switching
 - **UI Components**: Extend `DebugMenuBase` for debug menus to avoid code duplication
 - **Value Selection**: Use `ValueStepper` component for discrete option selection (language, resolution, difficulty)
 - **Memory Management**: Use `queue_free()` and await frame completion for safe cleanup
-- **Input Validation**: Always validate user inputs with type checking and bounds validation
+- **Input Validation**: Validate user inputs with type checking and bounds validation
 
 ### Logging Best Practices
 ```gdscript
-# ✅ Good logging practices
+# Good logging
 DebugManager.log_info("Scene transition completed", "GameManager")
 DebugManager.log_warn("Settings file not found, using defaults", "Settings")
 DebugManager.log_error("Failed to load audio resource: " + audio_path, "AudioManager")
 
-# ❌ Avoid these patterns
+# Avoid
 print("debug")  # Use structured logging instead
 push_error("error")  # Use DebugManager.log_error() with category
 ```