Spielstand bleibt erhalten, wenn das letzte Umbenennen scheitert

SaveStore.write_save verschob die geprüfte Temporärdatei direkt auf
world.grw. Godot löscht unter Windows ein vorhandenes Ziel, bevor es die
Datei verschiebt. Scheiterte die Verschiebung, zum Beispiel weil ein
Virenscanner world.grw.tmp festhielt, war der vorige Spielstand schon weg.

Jetzt wird der vorige Stand zuerst nach world.grw.bak verschoben, dann
rückt die Temporärdatei nach. Scheitert das, kommt der Stand aus der
Sicherung zurück; nach Erfolg wird die Sicherung gelöscht. Bleibt nach
einem Absturz zwischen den beiden Verschiebungen nur world.grw.bak übrig,
holt SaveStore sie beim Öffnen des Ordners zurück.

Neue Tests: ein offenes Handle auf world.grw.tmp, eine blockierte
Sicherung, die Wiederherstellung aus der Sicherung und dass eine
Sicherung einen vorhandenen Stand nie ersetzt.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

game/scripts/save_store.gd

@@ -5,6 +5,8 @@ extends RefCounted
 
 const KEY_FILE := "player.key"
 const SAVE_FILE := "world.grw"
+## Holds the previous save while write_save replaces it.
+const BACKUP_FILE := SAVE_FILE + ".bak"
 const RECORDINGS_DIR := "recordings"
 ## Recordings beyond this number are deleted, oldest first.
 const KEEP_RECORDINGS := 10
@@ -13,9 +15,13 @@ const KEY_BYTES := 16
 var base_dir: String
 
 
+## Opens the folder and creates it if it is missing. If a crash interrupted a
+## save and left only the backup of the previous one (see write_save), the
+## backup becomes the save again.
 func _init(directory: String = "user://") -> void:
 	base_dir = directory
 	DirAccess.make_dir_recursive_absolute(base_dir)
+	_restore_backup()
 
 
 ## The key that identifies this installation in every world. It is created
@@ -41,15 +47,35 @@ func read_save() -> PackedByteArray:
 ## Writes the save through a temporary file, so that a crash or a failed
 ## write never destroys the previous save. Returns false if the new save was
 ## not stored completely; the previous save then stays as it was.
+##
+## The temporary file replaces the previous save in two moves: the previous
+## save becomes the backup, then the temporary file becomes the save. A single
+## move onto the previous save would not be safe, because on Windows Godot
+## deletes the target first and only then moves the file. If that move failed,
+## for example because a virus scanner holds the temporary file, the previous
+## save would already be gone. If the second move fails, the backup is moved
+## back. A crash between the two moves leaves only the backup; the next
+## SaveStore on the folder restores it.
 func write_save(bytes: PackedByteArray) -> bool:
 	if bytes.is_empty():
 		return false
 	var path := base_dir.path_join(SAVE_FILE)
 	var temporary := path + ".tmp"
+	var backup := base_dir.path_join(BACKUP_FILE)
 	if not _write(temporary, bytes) or FileAccess.get_file_as_bytes(temporary) != bytes:
 		DirAccess.remove_absolute(temporary)
 		return false
-	return DirAccess.rename_absolute(temporary, path) == OK
+	var has_previous := FileAccess.file_exists(path)
+	if has_previous and DirAccess.rename_absolute(path, backup) != OK:
+		DirAccess.remove_absolute(temporary)
+		return false
+	if DirAccess.rename_absolute(temporary, path) != OK:
+		if has_previous:
+			DirAccess.rename_absolute(backup, path)
+		return false
+	if has_previous:
+		DirAccess.remove_absolute(backup)
+	return true
 
 
 ## Moves an unusable save out of the way, so that the next save does not
@@ -89,6 +115,16 @@ func recordings() -> PackedStringArray:
 	return names
 
 
+## Moves the backup back to the save if there is no save, see write_save.
+func _restore_backup() -> void:
+	var path := base_dir.path_join(SAVE_FILE)
+	var backup := base_dir.path_join(BACKUP_FILE)
+	if FileAccess.file_exists(path) or not FileAccess.file_exists(backup):
+		return
+	if DirAccess.rename_absolute(backup, path) != OK:
+		push_warning("the previous save could not be restored from %s" % backup)
+
+
 func _write(path: String, bytes: PackedByteArray) -> bool:
 	var file := FileAccess.open(path, FileAccess.WRITE)
 	if file == null: