Document partial-restore teardown hardening (#107)

docs/dev/release-completion.md

@@ -116,6 +116,7 @@ is `docs/dev/macos-moltenvk-decision.md`.
 - [x] Shadow-map correctness and cost rework (phase 0 of the 2026-07-09 shadow plan): the projected caster path now applies a real slope-scale depth offset in the caster shader (the previous `glPolygonOffset` state was silently inert against shader-written depth, which is why no bias cvar combination could resolve acne vs. detachment), point-light casters no longer leave fragment depth undefined on the default path and store slope-biased radial depth in both variants, hardware depth-compare sampling with linearly filtered (hardware PCF) taps is now the default for projected and point paths with PCSS-lite automatically selecting the raw-depth path, caster passes bind their program once per pass instead of per surface, receiver-plane bias derivatives are computed in uniform control flow, the PCSS filter-radius guard uses the correct bound, and `r_shadowMapSkipStencilShadows` (default on) stops generating and linking stencil shadow volumes for lights that will render shadow maps, with a per-light automatic fallback that restores volumes the frame after any shadow-map pass failure or whenever fallback receivers still need stencil shadows.
 - [x] SDL3 Windows startup now keeps the splash screen stable through renderer startup: openQ4 sets DPI awareness before creating the Win32 splash window and removes the splash at the render-window handoff, avoiding the brief scale/position jump when the SDL3 window initializes.
 - [x] Objective popups now preserve retail simple-window clipping behavior, so long stock objective titles such as "Regroup with Rhino Squad" render fully instead of losing their final characters.
+- [x] Failed or incompatible save restores no longer crash a second time while the game tears down a partially restored actor attachment. Cleanup now safely releases an attachment whose physics state was never installed, while preserving the normal visual and collision teardown path for fully restored entities. This fixes the save-load crash reported in GitHub issue #107.
 - [x] Savegame handling is stricter and more recoverable: new saves carry a generated engine/GameLibs source snapshot stamp plus payload sync markers, an end footer, an exact wire-ABI stamp, and whole-file CRC protection; the session save header/description and GameLibs payload writers detect short writes before committing staged files; and staged saves must validate their persistent-player dictionaries, payload version/ABI, CRC, and footer before replacing an existing slot. Generated description sidecars and preview TGA headers are validated before promotion, the load path commits persistent-player state only after the full save header is valid and preflights gameplay compatibility before tearing down the current map, the save/load menu filters malformed save headers and unsafe slot names, description sidecars are read through a bounded parser and must still map back to their save slot, outbound dict/winding/object data is bounded, AI movement path caches are initialized and serialized with bounded live entries, and source stamps are stable across Windows and Unix line endings. Build/source drift is diagnostic for schema-compatible version 3 saves; version 2 requires one of six exact Windows x64 snapshots, and unstamped legacy saves require the current build plus the Windows/MSVC x64 `raw1` ABI. Unsupported or corrupted saves now fail at preflight or the nearest later restore boundary with a clear ABI, checksum, marker, or footer diagnostic instead of surfacing later as invalid AI path lengths or other drift errors.
 - [x] Savegame restore now also bounds SP/MP script interpreter state before rebuilding scripts from disk: call-stack depth, local-stack usage, function indices, statement pointers, stack bases, pop parameters, and multi-frame event names are validated so malformed saves fail at restore with a clear script error instead of indexing fixed interpreter arrays.
 - [x] Savegame restore now rejects malformed SP/MP scalar state before it can steer later arrays or script cleanup: script-program watermarks, actor animation channels, client entity numbers, crawl-effect joint indices, crawl directions, and simple animated-entity counters are range-checked during restore.