Fix: Game Save File Corruption on Power Loss

A player saves the game. Their laptop battery dies five seconds later. They charge up, relaunch, and the “Continue” option shows the save but loading it crashes the game — or worse, succeeds with corrupted state. They lose 8 hours of progress because of an unfortunate race between “writing” and “done”.

Why Naive Saves Corrupt

The typical save code:

def save(state):
    with open("save.dat", "wb") as f:
        f.write(serialize(state))

The OS doesn’t flush to disk immediately on close in many cases. Data sits in OS write cache for milliseconds to seconds. If power dies before the cache is committed, the file on disk is truncated, half-written, or unmodified depending on timing. The same applies to fwrite on platforms with buffered I/O.

Fix 1: Atomic Write-Rename

import os, struct, hashlib

def save_atomic(path, data):
    tmp = path + ".tmp"
    with open(tmp, "wb") as f:
        f.write(data)
        f.flush()
        os.fsync(f.fileno())   # force commit to disk
    os.replace(tmp, path)        # atomic rename

Steps:

1. Write all data to a temp file.
2. fsync the file so its contents are on disk, not just in cache.
3. Rename the temp file over the real save. The OS guarantees this rename is atomic.

If power dies mid-write to the temp file, the real save is untouched. If power dies between fsync and rename, the real save is untouched. Only after the rename completes is the new save visible to readers.

Fix 2: Checksum Header

Even with atomic writes, application bugs can produce malformed save data. Detect:

def pack(state) -> bytes:
    body = serialize(state)
    checksum = hashlib.sha256(body).digest()[:8]
    version = struct.pack("<I", SAVE_VERSION)
    return version + checksum + body

def unpack(blob):
    version = struct.unpack("<I", blob[:4])[0]
    checksum = blob[4:12]
    body = blob[12:]
    if hashlib.sha256(body).digest()[:8] != checksum:
        raise CorruptSave()
    return deserialize(body, version)

On load, verify the checksum before deserializing. A corrupted file is detected explicitly rather than crashing the parser deep in nested struct reads.

Fix 3: Double-Buffered Slots

Maintain two save slots and a tiny pointer file:

def save_double_buffered(state):
    cur = read_pointer()      # 0 or 1
    nxt = 1 - cur
    save_atomic(f"save_{nxt}.dat", pack(state))
    save_atomic("save_pointer", struct.pack("<I", nxt))

Loading reads the pointer, tries that slot, falls back to the other if it’s corrupt. Worst case the player loses one save’s worth of progress (a few minutes) but never the entire campaign.

Fix 4: Don’t Save Mid-Frame

If the player presses Save and you read their entity state while another thread is mid-write to that state, you serialize garbage. Snapshot in a single tick before serializing:

def save_snapshot(world):
    snapshot = world.copy_state()   # synchronously, on game thread
    threading.Thread(target=lambda: save_double_buffered(snapshot)).start()

The expensive disk write runs on a background thread; the snapshot is taken atomically on the game thread, eliminating concurrent-mutation corruption.

Verifying

Simulate power loss: kill the game process at a random offset during a save with kill -9. Repeat many times across a save loop. Load after each kill — the load should always succeed, either with the new save or the previous one. If you ever see a load fail or load corrupt data, your atomicity has a hole.

Understanding the issue

Save data is forever. Once a save format ships, players will have that format in their files; you can't take it back. Bugs in save serialization compound over releases.

The specific bug described above is the kind that surfaces during integration rather than unit testing. It depends on a combination of factors: the asset configuration, the runtime state, the platform's specific behavior. In isolation, each piece looks correct; in combination, the bug emerges. This is why thorough integration testing - playing the actual game in realistic conditions - catches things that automated tests miss.

Why this happens

The triage path for this kind of bug is long. The symptom appears in gameplay, but the cause is in a different system. The reporter describes the gameplay effect; the engineer has to translate that into a hypothesis about the underlying cause. Misdirection is common.

At the engine level, the behavior comes from a deliberate design decision in the engine. The engine team chose a particular trade-off - usually performance versus convenience, or generality versus specificity - and that trade-off has consequences when you push against it. Understanding the trade-off is what turns 'this bug is mysterious' into 'this bug is the expected consequence of this design'.

Verifying the fix

For shipping games, the safest verification is a staged rollout. Apply the fix to 1% of players for 24 hours; watch the affected metric; expand if green. Skipping the staged rollout means the verification is the entire player base, which is too high a stakes for most fixes.

Reproducibility is the prerequisite for verification. If you can't reliably reproduce the bug pre-fix, you can't reliably verify it post-fix. Spend time getting a clean reproduction before you write any fix code. The fix is fast once you understand the reproduction; the reproduction is the slow part.

Variations to watch for

Related bug classes often share the same root cause. If you find yourself fixing this issue, look for cousins: similar symptoms in adjacent systems, the same data flow but a different value, or the same fix pattern in another module. The catalog of 'we've seen this before' becomes valuable institutional knowledge.

Adjacent bugs often share a root cause. After fixing the case you've found, spend an hour searching the codebase for similar patterns. What's the same call with different arguments? The same data flow with a different entity type? The same lifecycle issue in a sibling system? Each match is a candidate for the same fix, or a related fix that prevents future bugs of the same class.

In production

In shipping builds, this issue may interact with other production-only behavior. Stripping, encryption, asset bundling, and platform-specific code paths can each modify the symptoms. When players report a related issue, capture build SHA, platform, and any feature flags - those three fields cover most of the production-only variations.

When triaging a similar issue in production, prioritize gathering data over hypothesizing causes. A player report describes a symptom; what you need is a build SHA, a session timestamp, and ideally a screen recording or session replay. With those, the bug becomes tractable. Without them, you're guessing at hypothetical reproductions that may not match what the player actually hit.

Performance considerations

Performance implications matter when this bug class scales with player count or asset count. A bug that fires once per session is annoying; a bug that fires once per frame compounds. After fixing, profile the affected code path under realistic load. The fix that's correct for one entity may be too slow for ten thousand.

Diagnostic approach

Before applying any fix, gather enough context to be confident you're addressing the actual cause and not a similar-looking symptom. The cheapest diagnostic step is reproducing the bug deterministically - if you can't get the same failure twice in a row, your fix attempts will be hard to evaluate. Lock down the reproduction first.

For the engine-specific diagnostics, the editor's profiler is the canonical starting point. Capture a representative frame with the symptom present; compare against a frame without the symptom; the diff often points directly at the cause. If the symptom is non-deterministic, capture multiple frames and look for the pattern - the cause is usually a state transition or a specific input value rather than a continuous effect.

Tooling and ecosystem

The tooling around this bug class matters as much as the fix itself. Good logging, accessible profilers, and clear error messages turn 30-minute investigations into 5-minute ones. If your project doesn't have visibility into this code path, the first fix should add the visibility - the second fix uses it.

Within the engine, the relevant diagnostic surfaces include the standard frame debugger, memory profiler, and engine-specific debug overlays. Each one shows a different facet of what's happening. The frame debugger reveals draw call ordering and state transitions; the memory profiler shows allocation patterns; the debug overlay reveals per-system state. Bugs that resist one tool usually surrender to another - the trick is knowing which tool to reach for first.

Edge cases and pitfalls

Edge cases for this class of issue often involve specific timing: the first frame after a state change, the last frame before a transition, frames where multiple subsystems update simultaneously. Reproducing these reliably is part of what makes the bug class hard to test.

When writing a regression test for this fix, focus on the boundary conditions that surfaced the original bug. Tests that exercise the happy path catch obvious regressions; tests that exercise the boundary catch the subtler regressions that look like new bugs but are really the original returning. The latter are the tests that earn their keep over the long life of the project.

Team communication

When this bug class affects multiple teams (often the case for cross-system issues), early communication prevents duplicate work. The team that owns the symptom may not own the cause. A 15-minute conversation at the start of triage often saves hours of independent investigation.

If this fix touches a system several engineers work in, a short writeup in the team's engineering channel helps. Not a full design doc - a paragraph explaining what was wrong, what's fixed, and what to watch for. Future engineers encountering similar symptoms will search for the fix; making it findable is a small investment that pays back later.

“Saves should survive every conceivable interruption. Atomic write, checksum, double-buffer — layers of protection are cheap; lost progress is not.”

Include a save corruption automated test in your CI — spawn the game, save, kill at random instants, verify load works. Five minutes of CI catches a year of player complaints.