Add multi-frame PPI save automation

docs/modernization/build-inventory.md

@@ -115,7 +115,7 @@ Known local toolchain state:
   frame counts, durations, and decoded face-pixel payloads when present; the
   metadata-only minimal fixture remains covered by
   `pano_cli_load_project_metadata_smoke`.
-- `pano_cli save-project` writes one-layer/one-frame PPI files through
+- `pano_cli save-project` writes single-layer multi-frame PPI files through
   `pp_assets` and is covered by `pano_cli_save_project_roundtrip_smoke` and
   `pano_cli_save_project_payload_roundtrip_smoke`, which reload generated
   metadata-only and dirty-face-payload projects through `pano_cli load-project`.
@@ -275,9 +275,10 @@ Known local toolchain state:
   face-payload attachment through JSON automation and is covered by
   `pano_cli_import_image_rejects_truncated_png`; a checked-in decodable image
   fixture and export/round-trip automation remain future CLI tasks.
-- `pano_cli save-project` exposes one-layer/one-frame PPI writing through JSON
+- `pano_cli save-project` exposes single-layer multi-frame PPI writing through JSON
   automation and is covered by metadata-only and dirty-face-payload round-trip
-  smoke tests; full legacy canvas save parity remains tracked by DEBT-0013.
+  smoke tests; full multi-layer legacy canvas save parity remains tracked by
+  DEBT-0013.
 - `pp_ui_core` consumes vcpkg tinyxml2 only when `PP_USE_VCPKG_TINYXML2=ON`
   through the vcpkg preset; default and Android validation still use the
   retained vendored fallback tracked by DEBT-0012.

docs/modernization/debt.md

@@ -31,7 +31,7 @@ agent or engineer to remove them without reconstructing context from chat.
 | DEBT-0010 | Open | Modernization | `pp_document` is a pure layer/frame/document/undo-history model with alpha-lock metadata, snapshot construction, per-layer frame metadata, and renderer-free RGBA8 face payload storage, but it is not yet wired to legacy `Canvas`, selection masks, save, or legacy action commands | Keep extraction incremental while preserving app behavior | `ctest --preset desktop-fast --build-config Debug`; `pano_cli create-document --width 64 --height 32 --layers 2`; `pano_cli load-project --path tests\data\projects\minimal-project.ppi`; `pp_document_ppi_import_tests` | Legacy document behavior is represented by `pp_document` tests and the app consumes it through a boundary/facade |
 | DEBT-0011 | Open | Modernization | `package-smoke` validates the Windows CMake app artifact only, not AppX/APK/Apple/WebGL package outputs | Platform package targets are not migrated to root CMake yet | `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Package-smoke covers Windows AppX, Android APK variants, Apple bundles, and WebGL output where local toolchains are present |
 | DEBT-0012 | Open | Modernization | `pp_ui_core` uses vcpkg tinyxml2 on `windows-msvc-vcpkg-headless`, but retains `pp_vendor_tinyxml2` for default and unproven platform presets | Mobile/AppX/Apple triplets and app packaging still need validation before removing the vendored fallback | `ctest --preset desktop-fast-vcpkg --build-config Debug`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\platform-build.ps1 -Presets android-arm64` | All supported presets consume vcpkg tinyxml2 or document a permanent vendored exception |
-| DEBT-0013 | Open | Modernization | `pp_assets`, `pano_cli inspect-project`, `pano_cli load-project`, and `pano_cli save-project` validate the fixed PPI header, thumbnail/body byte layout, one-layer/one-frame PPI writing, metadata-only and dirty-face-payload save/load round-trips, layer/frame index, dirty-face descriptors, dirty-face PNG payload metadata, asset-level RGBA PNG payload decoding, and decoded pixel attachment to `pp_document`, but full legacy PPI round-trip parity is not yet extracted | Full PPI save parity requires staged extraction of legacy `Canvas` serialization and image/layer payload handling | `ctest --preset desktop-fast --build-config Debug`; `pp_assets_image_pixels_tests`; `pp_assets_ppi_header_tests`; `pp_document_ppi_import_tests`; `pano_cli_inspect_project_layout_smoke`; `pano_cli_load_project_metadata_smoke`; `pano_cli_save_project_roundtrip_smoke`; `pano_cli_save_project_payload_roundtrip_smoke` | Full PPI load/save fixtures cover thumbnails, decoded layer face payloads attached to documents, frames, metadata, corrupt payloads, dirty-face payload saving, multiple layers/frames, and legacy app round-trip compatibility |
+| DEBT-0013 | Open | Modernization | `pp_assets`, `pano_cli inspect-project`, `pano_cli load-project`, and `pano_cli save-project` validate the fixed PPI header, thumbnail/body byte layout, single-layer multi-frame PPI writing, metadata-only and dirty-face-payload save/load round-trips, layer/frame index, dirty-face descriptors, dirty-face PNG payload metadata, asset-level RGBA PNG payload decoding, and decoded pixel attachment to `pp_document`, but full legacy PPI round-trip parity is not yet extracted | Full PPI save parity requires staged extraction of legacy `Canvas` serialization and image/layer payload handling | `ctest --preset desktop-fast --build-config Debug`; `pp_assets_image_pixels_tests`; `pp_assets_ppi_header_tests`; `pp_document_ppi_import_tests`; `pano_cli_inspect_project_layout_smoke`; `pano_cli_load_project_metadata_smoke`; `pano_cli_save_project_roundtrip_smoke`; `pano_cli_save_project_payload_roundtrip_smoke` | Full PPI load/save fixtures cover thumbnails, decoded layer face payloads attached to documents, frames, metadata, corrupt payloads, dirty-face payload saving, multiple layers, and legacy app round-trip compatibility |
 | DEBT-0014 | Open | Modernization | `windows-clangcl-asan` now configures as a headless Ninja/clang-cl preset and uses the release MSVC runtime required by ASan, but local builds still fail because installed clang-cl 18.1.8 is paired with VS 2026-preview STL headers that require Clang 20 or newer | Sanitizer validation should be local and repeatable, but this machine's compiler/header pairing is incompatible | `cmake --fresh --preset windows-clangcl-asan`; `cmake --build --preset windows-clangcl-asan --target pp_foundation` | Install/use Clang 20+ with the VS 2026 STL, or point the preset at a compatible VS 2022 toolchain, then make `platform-build.ps1 -Presets windows-clangcl-asan` pass for the headless matrix |
 
 ## Closed Debt

docs/modernization/roadmap.md

@@ -340,7 +340,7 @@ asset-level decode coverage, and
 `pano_cli load-project` creates a `pp_document` projection with per-layer frame
 counts, durations, and decoded face-pixel payload attachment when PPI image
 payloads are present.
-`pano_cli save-project` writes one-layer/one-frame PPI files through the
+`pano_cli save-project` writes single-layer multi-frame PPI files through the
 extracted `pp_assets` writer and round-trips metadata-only and test
 dirty-face-payload variants through `load-project`.
 `pano_cli create-document` can create simple animation documents with explicit
@@ -717,8 +717,8 @@ Results:
   projection with per-layer frame counts, durations, and zero loaded face
   payloads for the minimal PPI fixture.
 - `pano_cli_save_project_roundtrip_smoke` passed and proves the metadata-only
-  `pp_assets` PPI writer can save a generated PPI and reload it through
-  `pano_cli load-project`.
+  `pp_assets` PPI writer can save a generated multi-frame PPI and reload it
+  through `pano_cli load-project`.
 - `pano_cli_save_project_payload_roundtrip_smoke` passed and proves the
   `pp_assets` PPI writer can save a compressed RGBA PNG dirty-face payload and
   reload it as decoded `pp_document` face-pixel data.
@@ -786,10 +786,10 @@ Results:
   `pp_assets`, attaches them to a pure `pp_document` face payload, and has a
   truncated-PNG rejection smoke test. A checked-in decodable image fixture and
   full export/round-trip automation remain future `pano_cli` tasks.
-- `pano_cli save-project` exposes one-layer/one-frame PPI writing through JSON
+- `pano_cli save-project` exposes single-layer multi-frame PPI writing through JSON
   automation and is covered by metadata-only and dirty-face-payload save/load
-  round-trip smoke tests. Full legacy canvas save parity remains tracked by
-  DEBT-0013.
+  round-trip smoke tests. Full multi-layer legacy canvas save parity remains
+  tracked by DEBT-0013.
 - PowerShell package-smoke wrapper validates the Windows CMake app executable
   and runtime `data/` copy.
 - Android arm64 configured with NDK 29.0.14206865 through the platform-build