[P3] No Web export preset or CI coverage for the localStorage/JavaScriptBridge persistence path

[itsmiso-ai]

Problem: The web persistence path (localStorage via JavaScriptBridge in game_state.gd) is advertised as a supported runtime (README: "save/load through an autoload (user:// on desktop, localStorage on web)"; docs/DESIGN.md documents the web behavior), and the recent XSS fix (#306/#291) touched exactly this code — yet there is no Web export preset in export_presets.cfg, no web export-validation job in test.yml/release.yml, and the only web-related test (tests/test_local_storage_xss.gd) asserts JSON.stringify() escaping in isolation rather than exercising the actual eval'd statements. Regressions in the eval'd JavaScript (like #291's unsanitized key) or in web-only load/save behavior can therefore ship undetected — the CI matrix validates Linux/Windows/macOS exports only.

Evidence:

• export_presets.cfg — presets are Linux/X11, Windows Desktop, macOS only; no Web preset
• README.md / docs/DESIGN.md — document localStorage-on-web as a supported persistence path
• scripts/game_state.gd:28-39,447-448 — live JavaScriptBridge.eval(...) calls behind OS.has_feature("web")
• tests/test_local_storage_xss.gd — tests JSON string escaping only; never builds/evaluates the JS
• .github/workflows/test.yml export-validation jobs: Linux, Windows, macOS only; release.yml uploads no web artifact

Acceptance:

• Add a Web export preset to export_presets.cfg and an export-validation-web CI job (headless export + artifact presence check, mirroring the existing platform jobs), or explicitly feature-gate/drop the web persistence code and update README/DESIGN
• Optionally extend the XSS test to build and assert the exact eval'd statement strings produced by _local_storage_write/_local_storage_read/clear_game

[itsmiso-ai]

Not worth doing yet

Items considered during the 2026-08-05 audit but deliberately left out of scope (weekly audit 2026-08-05):

• Extend the %-formatting cleanup ([P3] Use deprecated GDScript string formatting in game_state.gd print statements #295/Refactor: Replace deprecated % string formatting in game_state.gd print statements #304) to colony_sim.gd event strings. push_event("%s ..." % ...) remains at ~8 sites (scripts/colony_sim.gd lines 102, 120, 124, 132, 153, 176, 296-298, 498) and in game_state.gd validation-reason strings. Pure cosmetic churn with no behavior change; the strings are user-visible log text, not print() diagnostics. Revisit only if a GDScript version actually deprecates the operator.
• Further splitting of main.gd (1,948 lines). Previous audits flagged its size; extraction to ColonySim/TileRender/WorkerRenderer/etc. is ongoing organically and the remaining UI/wiring code has low churn. Diminishing returns on forcing more modules now.
• Automating Godot toolchain bumps via Renovate. The pin lives in a custom godot-toolchain.json with three sha256 checksums; a Renovate custom manager for it would be noisy (checksum re-verification, template re-testing). The manual docs/toolchain-update.md process plus this audit's reminder issue ([P3] Godot engine pinned at 4.2.2 (Dec 2023) — current stable is 4.7.x; documented toolchain bump never executed #314) is adequate cadence.
• Per-frame render_worker_overlay() when the game is inactive. Runs each _process() even at the startup menu; cost is a visibility loop over a handful of nodes. Negligible; would add gating complexity for no measurable win.
• Hardening validate_save_schema() for reserved_resources shape. A non-dictionary reserved_resources in a corrupt save would still fault in get_reserved(). Low value standalone; the web-load-path validation gap ([P2] Web localStorage load path skips save-schema validation and migration #313) is the higher-leverage fix and could absorb this check.
• Removing _LEGACY_GRID_SIZES / old-save migration paths. Still load real historical saves; keep until saves are re-versioned.
• macOS smoke test continue-on-error in test.yml. Deliberate: script tests remain the hard gate on macOS runners. Leave as-is.