perf(map): bound SMP download memory for large offline maps

Spec (canonical): docs/superpowers/specs/2026-08-27-issue-283-bounded-smp-download.md @ 07251b8 — where issue body and spec file disagree, the spec file at the linked SHA wins.
Reviewed against: main @ 5f5e0685cf88866773e5ed661964debf48013d14 on 2026-08-27 (Opus 5 exact review + all P1/P2 fixes applied 2026-08-29; PR #310 fresh-eyes review round 2: MERGE READY; spec merged in #310 @ 07251b8).

Summary

Bound SMP download memory for large offline maps: stream the final basemap SMP directly into staged 4 MiB IndexedDB chunk generations via StyleDownloader + Writer, remove the basemap global/regional JSZip merge entirely, make all package readers generation-aware (v13/legacy-v14/new-generation compatible), keep #279 authored-layer packaging as the explicit bounded fallback for authoredLayers.length > 0, and gate the entry-cap safety limit with mandatory preflight.

See the linked spec file for the full executable contract: architecture decisions, cancellation/failure semantics, storage quota UX, security/privacy boundaries, backward compatibility, required TDD coverage, and validation checklist.

Acceptance criteria

• Normal basemap download no longer calls collectDownloadChunks(), constructs a package-sized Blob before persistence, or uses JSZip to merge global/regional packages.
• Entry-cap preflight (projected entries from countBboxTiles(), same pass split and buffer as the real download) fails before the first byte when over MAX_BASEMAP_SMP_ENTRIES, and the mid-download cap check remains as a non-bypassable safety net.
• Basemap package payload buffering is fixed-size and does not grow with final SMP bytes; Writer metadata is bounded by MAX_BASEMAP_SMP_ENTRIES (20,000 unless a documented derivation raises it).
• Global z0–3 + regional z4+ behavior is produced in one Writer output and matches current offline rendering/initial-view semantics.
• Final output streams directly into staged 4 MiB IndexedDB rows and becomes active only through one atomic promotion.
• Cancellation/failure/quota exhaustion cannot expose partial bytes as ready or exportable.
• v13, legacy v14, and new generation package storage all remain readable/renderable/exportable.
• Storage preflight, 100 MiB confirmation, non-bypassable resource limits, and runtime quota failure are surfaced clearly to users.
• #279 Writer lifecycle and authored package limits remain intact; authored-layer maps use the explicit bounded #279 fallback rather than a parallel unbounded merger.
• Chromium, Firefox, and WebKit pass deterministic multi-chunk large-package, cancellation/retry, global-overview, and cold-start tests without production network services.
• Existing offline render/export/package-integrity regressions remain green.
• QA runbook + runnable QA helper are included in the implementation PR.

Implementation-start gate

#279 is now merged (PR #287, squash a4a5b38). The target base contains src/lib/map/authored-writer.ts and the authored SMP package APIs. The spec also directs implementers to re-check the constants actually merged by #279 before implementation.

Start with the linked canonical spec, then inspect src/lib/map/authored-writer.ts and the existing StyleDownloader, Writer, collectDownloadChunks(), and countBboxTiles() entry points. Trace how basemap and authored-layer packages are currently written and read. Done means the acceptance criteria pass, including bounded staged storage, cancellation and quota safety, backward compatibility, deterministic tests, and the QA runbook/helper.