Validate snapshot face payloads

docs/modernization/roadmap.md

@@ -325,7 +325,8 @@ started with a pure canvas/layer/frame model, alpha-lock metadata, snapshot
 construction, per-layer frame metadata, layer metadata operations, frame
 move/duration queries, renderer-free RGBA8 cube-face payload storage,
 renderer-free alpha8 selection-mask storage, PPI image import/export, and
-layer/frame/undo-redo history invariant tests.
+layer/frame/undo-redo history invariant tests. Snapshot construction validates
+embedded face-pixel payload bounds and byte counts.
 `pp_renderer_api` has started with renderer-neutral
 texture/readback descriptors and validation tests. `pp_paint_renderer` has
 started with deterministic CPU layer compositing over renderer extents using
@@ -693,7 +694,8 @@ Results:
 - `pp_paint_stroke_script_tests` passed.
 - `pp_document_tests` passed, including snapshot construction, alpha-lock
   metadata, per-layer frame metadata, frame move, duration, face-pixel payload
-  storage/replacement/rejection, and history invariants.
+  storage/replacement/rejection, snapshot-embedded face-payload rejection, and
+  history invariants.
 - `pp_document_ppi_import_tests` passed, including decoded PPI dirty-face
   payload attachment to `pp_document` layer/frame storage and out-of-range
   payload rejection.
@@ -812,6 +814,8 @@ Results:
 - `pp_document::export_ppi_project_document` exposes pure document-to-PPI byte
   export through CTest coverage; legacy Canvas save integration remains tracked
   by DEBT-0010/DEBT-0013.
+- Snapshot creation now rejects invalid embedded RGBA8 face payloads before
+  document export or history can persist malformed state.
 - PowerShell package-smoke wrapper validates the Windows CMake app executable
   and runtime `data/` copy.
 - Android arm64 configured with NDK 29.0.14206865 through the platform-build