Move project save write planning to app core

docs/modernization/build-inventory.md

@@ -301,8 +301,11 @@ powershell -ExecutionPolicy Bypass -File scripts\automation\apple-remote-build.p
   retained project-save target paths, including the requested PPI path,
   temporary `.tmp.ppi` path, and timelapse `.pptl` sidecar path. The live
   `Canvas::project_save_thread` consumes the same planner before retained
-  serialization, and the command is covered by forward-slash, Windows
-  backslash, and invalid-path smokes.
+  serialization. The command also reports the app-core write-mode plan for
+  direct first saves versus existing-target temporary writes, including the
+  retained direct-write fallback when the temporary file cannot be opened, and
+  it is covered by forward-slash, Windows backslash, existing-target, and
+  invalid-path smokes.
 - Live equirectangular, layer, animation-frame, and cube-face export adapters
   now prepare and log the same payload-bearing canvas document snapshot plus
   shared paint-renderer export-readiness report.
@@ -1182,7 +1185,8 @@ powershell -ExecutionPolicy Bypass -File scripts\automation\apple-remote-build.p
   prepare and log a payload-bearing canvas document snapshot report, run the
   app-core pure PPI save-writer route for payload-complete snapshots, log
   generated byte counts, and derive project-save target/tmp/timelapse paths
-  through `pp_app_core` before delegating to retained `Canvas::project_save`.
+  plus direct-vs-temporary write-mode decisions through `pp_app_core` before
+  delegating to retained `Canvas::project_save`.
   Retained legacy UI/canvas
   execution and actual live save serialization remain tracked by `DEBT-0040`,
   `DEBT-0041`, and `DEBT-0042`; the pure snapshot-to-PPI export handoff is

docs/modernization/debt.md

@@ -541,6 +541,14 @@ agent or engineer to remove them without reconstructing context from chat.
   `pano_cli plan-canvas-project-save-target` exposes it for automation. Actual
   PPI serialization, temporary-file swap execution, progress/threading,
   timelapse sidecar serialization, and app metadata mutation remain retained.
+- 2026-06-06: DEBT-0040/DEBT-0042 were narrowed again. The same app-core
+  project-save planner now owns the direct-write versus temporary-write mode
+  decision for new and existing targets, including the retained compatibility
+  fallback to direct target writes when the temporary file cannot be opened.
+  `Canvas::project_save_thread` consumes that policy before retained
+  serialization, and `pano_cli plan-canvas-project-save-target` reports it in
+  JSON. Actual PPI bytes, temporary-file swap execution, progress/threading,
+  timelapse sidecar serialization, and app metadata mutation remain retained.
 - 2026-06-05: DEBT-0010/DEBT-0013 were narrowed again. `pp_app_core` now
   exports payload-complete or metadata-only canvas document snapshots through
   the pure `pp_document` PPI writer and rejects snapshots that still require

docs/modernization/roadmap.md

@@ -709,7 +709,11 @@ save-writer route JSON. `pp_app_core` also owns the retained project-save target
 path planner for target, temporary PPI, and timelapse sidecar paths; live
 `Canvas::project_save_thread` consumes that planner and
 `pano_cli plan-canvas-project-save-target` exposes it for automation. The same
-automation now feeds payload-complete snapshots through the shared
+app-core boundary now also plans the retained save write mode, distinguishing
+direct first saves from existing-target temporary writes that swap into place
+and preserving the legacy direct-write fallback when the temporary file cannot
+be opened. The same automation now feeds payload-complete snapshots through the
+shared
 `pp_paint_renderer::prepare_document_frame_export_readiness` report, which
 records renderer-neutral six-face texture upload commands and encodes the
 active document frame's six composited faces to PNG bytes. This gives CLI
@@ -2313,6 +2317,9 @@ Results:
   temporary `.tmp.ppi` path, and timelapse `.pptl` sidecar. The live
   `Canvas::project_save_thread` consumes the same planner before retained
   serialization, reducing inline path compatibility logic in the legacy writer.
+  It also reports the app-core write-mode plan for direct first saves versus
+  existing-target temporary writes, including the retained fallback to direct
+  target writes when the temporary file cannot be opened.
 - The same payload-complete snapshot automation now uploads the active document
   frame through `pp_paint_renderer::upload_document_frame_faces` and the
   `RecordingRenderDevice`, emitting `rendererUpload` JSON with texture,