Core Data Automatic Migration for NSPersistentDocument requires saving in place, which won’t work in a sandbox-enabled app (even with Read/Write for user selected files).
This is like the more well-known issue with Core Data and SQLite journal files, except that the filename suffix isn’t predictable. Behind the scenes, Core Data tries to create a file with .migrationdestination_ and a long hex string, and the sandbox denies it. This is not some crazy edge case—it’s the default behavior of Cocoa’s basic class for Core Data documents.
A workaround is to put the database file in a package, but this is not always possible. And, in fact,
NSPersistentDocument does not support packages.