Move project save commit planning to app core

docs/modernization/build-inventory.md

@@ -304,8 +304,10 @@ powershell -ExecutionPolicy Bypass -File scripts\automation\apple-remote-build.p
   serialization. The command also reports the app-core write-mode plan for
   direct first saves versus existing-target temporary writes, including the
   retained direct-write fallback when the temporary file cannot be opened, and
-  it is covered by forward-slash, Windows backslash, existing-target, and
-  invalid-path smokes.
+  the app-core commit plan for direct saves, successful temporary swaps,
+  target-remove failures, and rename-after-remove failures. It is covered by
+  forward-slash, Windows backslash, existing-target, remove-failure,
+  rename-failure, and invalid-path smokes.
 - Live equirectangular, layer, animation-frame, and cube-face export adapters
   now prepare and log the same payload-bearing canvas document snapshot plus
   shared paint-renderer export-readiness report.
@@ -1186,7 +1188,10 @@ powershell -ExecutionPolicy Bypass -File scripts\automation\apple-remote-build.p
   app-core pure PPI save-writer route for payload-complete snapshots, log
   generated byte counts, and derive project-save target/tmp/timelapse paths
   plus direct-vs-temporary write-mode decisions through `pp_app_core` before
-  delegating to retained `Canvas::project_save`.
+  delegating to retained `Canvas::project_save`. Direct save, successful
+  temporary swap, remove-failure, and rename-after-remove commit outcomes are
+  now classified by the same app-core planner before retained success metadata
+  mutation.
   Retained legacy UI/canvas
   execution and actual live save serialization remain tracked by `DEBT-0040`,
   `DEBT-0041`, and `DEBT-0042`; the pure snapshot-to-PPI export handoff is

docs/modernization/debt.md

@@ -549,6 +549,16 @@ agent or engineer to remove them without reconstructing context from chat.
   serialization, and `pano_cli plan-canvas-project-save-target` reports it in
   JSON. Actual PPI bytes, temporary-file swap execution, progress/threading,
   timelapse sidecar serialization, and app metadata mutation remain retained.
+- 2026-06-06: DEBT-0040/DEBT-0042 were narrowed again. `pp_app_core` now owns
+  the retained project-save commit outcome policy for direct writes, successful
+  temporary swaps, target-remove failures, and rename-after-remove failures,
+  including an explicit `targetMayBeMissing` flag for failed swaps after the
+  original target was removed. Live `Canvas::project_save_thread` consumes that
+  result before retained success metadata mutation, and
+  `pano_cli plan-canvas-project-save-target` reports the same commit plan.
+  Actual PPI serialization, filesystem remove/rename execution,
+  progress/threading, timelapse sidecar serialization, and app metadata
+  mutation remain retained.
 - 2026-06-05: DEBT-0010/DEBT-0013 were narrowed again. `pp_app_core` now
   exports payload-complete or metadata-only canvas document snapshots through
   the pure `pp_document` PPI writer and rejects snapshots that still require

docs/modernization/roadmap.md

@@ -712,7 +712,10 @@ path planner for target, temporary PPI, and timelapse sidecar paths; live
 app-core boundary now also plans the retained save write mode, distinguishing
 direct first saves from existing-target temporary writes that swap into place
 and preserving the legacy direct-write fallback when the temporary file cannot
-be opened. The same automation now feeds payload-complete snapshots through the
+be opened. The same app-core boundary now also classifies the post-write
+commit result for direct writes, successful temporary swaps, remove failures,
+and rename-after-remove failures before retained save metadata mutation
+continues. The same automation now feeds payload-complete snapshots through the
 shared
 `pp_paint_renderer::prepare_document_frame_export_readiness` report, which
 records renderer-neutral six-face texture upload commands and encodes the
@@ -2320,6 +2323,9 @@ Results:
   It also reports the app-core write-mode plan for direct first saves versus
   existing-target temporary writes, including the retained fallback to direct
   target writes when the temporary file cannot be opened.
+  The command now reports the app-core commit plan for direct saves, successful
+  temporary swaps, target-remove failures, and rename-after-remove failures,
+  including whether the target may be missing after a failed swap.
 - The same payload-complete snapshot automation now uploads the active document
   frame through `pp_paint_renderer::upload_document_frame_faces` and the
   `RecordingRenderDevice`, emitting `rendererUpload` JSON with texture,