Own Android platform services and narrow legacy fallback

docs/modernization/debt.md

@@ -18,6 +18,13 @@ agent or engineer to remove them without reconstructing context from chat.
 
 ## Reductions
 
+- 2026-06-17: `DEBT-0016`/`DEBT-0017` were narrowed again.
+  `src/platform_android/android_platform_services.*` now owns the concrete
+  Android `PlatformServices` implementation and
+  `android/src/cpp/main.cpp` now binds that owned service directly, so
+  `src/platform_legacy/legacy_platform_services.*` no longer carries the
+  Android bridge/configuration surface or the touched Android execution
+  branches.
 - 2026-06-17: `DEBT-0016`/`DEBT-0017`/`DEBT-0050`/`DEBT-0051`/`DEBT-0052`/
   `DEBT-0053` were narrowed again. `src/platform_apple/apple_platform_services.*`
   now owns the concrete Apple `PlatformServices` implementation and
@@ -2397,8 +2404,8 @@ agent or engineer to remove them without reconstructing context from chat.
 | DEBT-0013 | Open | Modernization | `pp_assets`, `pp_document`, `pano_cli inspect-project`, `pano_cli load-project`, and `pano_cli save-project` validate the fixed PPI header, thumbnail/body byte layout, generated multi-layer/multi-frame PPI writing with explicit layer opacity/blend/alpha-lock/visibility metadata, per-layer frame durations, metadata-only and targeted dirty-face-payload save/load round-trips, layer/frame index, dirty-face descriptors, dirty-face PNG payload metadata, asset-level RGBA PNG payload decoding, pure document-to-PPI export, CLI document export automation, file-writing document export automation, stroke-script-generated document payload export, decoded pixel attachment to `pp_document`, live save-path snapshot-readiness reporting, and app-core canvas-snapshot-to-PPI export automation, but full legacy PPI round-trip parity and pure live save writer replacement are not yet extracted | Full PPI save parity requires staged extraction of legacy `Canvas` serialization and image/layer payload handling | `ctest --preset desktop-fast --build-config Debug`; `pp_assets_image_pixels_tests`; `pp_assets_ppi_header_tests`; `pp_document_ppi_import_tests`; `pp_document_ppi_export_tests`; `pano_cli_inspect_project_layout_smoke`; `pano_cli_load_project_metadata_smoke`; `pano_cli_save_project_roundtrip_smoke`; `pano_cli_save_project_payload_roundtrip_smoke`; `pano_cli_simulate_document_export_smoke`; `pano_cli_save_document_project_roundtrip_smoke`; `pano_cli_apply_stroke_script_roundtrip_smoke`; `pano_cli_apply_stroke_script_rejects_tiny_canvas` | Full PPI load/save fixtures cover thumbnails, decoded layer face payloads attached to documents, frames, corrupt payloads, dirty-face payload saving, arbitrary legacy canvas payload/layout combinations, and legacy app round-trip compatibility |
 | DEBT-0014 | Open | Modernization | `windows-clangcl-asan` now configures as a headless Ninja/clang-cl preset and uses the release MSVC runtime required by ASan, but local builds still fail because installed clang-cl 18.1.8 is paired with VS 2026-preview STL headers that require Clang 20 or newer | Sanitizer validation should be local and repeatable, but this machine's compiler/header pairing is incompatible | `cmake --fresh --preset windows-clangcl-asan`; `cmake --build --preset windows-clangcl-asan --target pp_foundation` | Install/use Clang 20+ with the VS 2026 STL, or point the preset at a compatible VS 2022 toolchain, then make `platform-build.ps1 -Presets windows-clangcl-asan` pass for the headless matrix |
 | DEBT-0015 | Open | Modernization | Cursor visibility requests now consume pure `pp_app_core` planning through `pano_cli plan-cursor-visibility`, `App::show_cursor`/`App::hide_cursor` dispatch through `PlatformServices` without platform guards, and Windows live execution uses injected `WindowsPlatformServices`, but macOS cursor execution still reaches the retained fallback adapter | Keep canvas cursor behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-cursor-visibility --visible`; `ctest --preset desktop-fast --build-config Debug` | Cursor visibility execution is owned by injected `pp_platform_*` services for every supported platform |
-| DEBT-0016 | Open | Modernization | Clipboard get/set requests now consume pure `pp_app_core` planning through `pano_cli plan-clipboard-read` and `pano_cli plan-clipboard-write`; Windows live execution uses injected `WindowsPlatformServices`, Apple clipboard execution now uses `src/platform_apple/apple_platform_services.*`, and Android clipboard execution still reaches the retained non-Windows fallback adapter | Keep picker/color text clipboard behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-clipboard-write --text #ff00aa`; `ctest --preset desktop-fast --build-config Debug` | Clipboard execution is owned by injected `pp_platform_*` services for every supported platform |
-| DEBT-0017 | Open | Modernization | Startup storage path preparation, `App::clipboard_get_text`, `App::clipboard_set_text`, `App::show_cursor`, `App::hide_cursor`, `App::showKeyboard`, `App::hideKeyboard`, `App::display_file`, `App::share_file`, native app/window close, UI-thread lifecycle hooks, render-context acquire/release/present hooks, render-target binding hooks, render platform hint hooks, render debug callback hooks, render-capture frame hooks, recording cleanup, live asset/layout reload policy, diagnostic stacktrace/crash hooks, per-frame platform hooks, `App::pick_image`, `App::pick_file`, the non-writer `App::pick_file_save`, `App::pick_dir`, working-directory picker/display-path policy, canvas input tip/pressure policy, prepared-file save/download handoff, work-directory document export collection policy, app network TLS verification policy, PPBR export data-directory policy, SonarPen availability/startup, and VR mode start/stop now call the SDK-free `pp::platform::PlatformServices` interface. Windows injects `WindowsPlatformServices` from `src/platform_windows/windows_platform_services.*`, Apple now injects `src/platform_apple/apple_platform_services.*`, and the retained non-Windows fallback adapter in `src/platform_legacy/legacy_platform_services.*` is narrowed to Android/Linux/Web bridge functions plus retained no-op branches, including retained iOS canvas tip behavior, retained non-Windows VR unsupported/no-op behavior, and retained macOS PPBR export directory override; `pp_platform_api` also owns the default network TLS policy helper consumed by retained curl sites that cannot yet depend on injected services | Preserve behavior while moving platform execution behind a testable service boundary before platform shell implementations are injected | `pp_platform_api_tests`; `pp_app_core_document_export_tests`; `pp_app_core_document_platform_io_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Replace `src/platform_legacy/legacy_platform_services.*` with injected `pp_platform_*` service implementations owned by each non-Windows platform shell |
+| DEBT-0016 | Open | Modernization | Clipboard get/set requests now consume pure `pp_app_core` planning through `pano_cli plan-clipboard-read` and `pano_cli plan-clipboard-write`; Windows live execution uses injected `WindowsPlatformServices`, Apple clipboard execution now uses `src/platform_apple/apple_platform_services.*`, Android clipboard execution now uses `src/platform_android/android_platform_services.*`, and only Linux/Web fallback behavior still routes through the retained non-Windows adapter | Keep picker/color text clipboard behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-clipboard-write --text #ff00aa`; `ctest --preset desktop-fast --build-config Debug` | Clipboard execution is owned by injected `pp_platform_*` services for every supported platform |
+| DEBT-0017 | Open | Modernization | Startup storage path preparation, `App::clipboard_get_text`, `App::clipboard_set_text`, `App::show_cursor`, `App::hide_cursor`, `App::showKeyboard`, `App::hideKeyboard`, `App::display_file`, `App::share_file`, native app/window close, UI-thread lifecycle hooks, render-context acquire/release/present hooks, render-target binding hooks, render platform hint hooks, render debug callback hooks, render-capture frame hooks, recording cleanup, live asset/layout reload policy, diagnostic stacktrace/crash hooks, per-frame platform hooks, `App::pick_image`, `App::pick_file`, the non-writer `App::pick_file_save`, `App::pick_dir`, working-directory picker/display-path policy, canvas input tip/pressure policy, prepared-file save/download handoff, work-directory document export collection policy, app network TLS verification policy, PPBR export data-directory policy, SonarPen availability/startup, and VR mode start/stop now call the SDK-free `pp::platform::PlatformServices` interface. Windows injects `WindowsPlatformServices` from `src/platform_windows/windows_platform_services.*`, Apple now injects `src/platform_apple/apple_platform_services.*`, Android now injects `src/platform_android/android_platform_services.*`, and the retained non-Windows fallback adapter in `src/platform_legacy/legacy_platform_services.*` is narrowed to Linux/Web behavior plus retained no-op branches, including retained iOS canvas tip behavior, retained non-Windows VR unsupported/no-op behavior, and retained macOS PPBR export directory override; `pp_platform_api` also owns the default network TLS policy helper consumed by retained curl sites that cannot yet depend on injected services | Preserve behavior while moving platform execution behind a testable service boundary before platform shell implementations are injected | `pp_platform_api_tests`; `pp_app_core_document_export_tests`; `pp_app_core_document_platform_io_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Replace `src/platform_legacy/legacy_platform_services.*` with injected `pp_platform_*` service implementations owned by each non-Windows platform shell |
 | DEBT-0019 | Open | Modernization | Unreferenced-parameter warnings are muted globally through `pp_project_warnings` with MSVC `/wd4100` and Clang/GCC `-Wno-unused-parameter` | Legacy callbacks, virtual hooks, serializer methods, and platform/API compatibility functions carry many intentionally unused parameters during the component split; muting this keeps stricter warning builds focused on higher-signal migration issues | `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset linux-clang --target pp_foundation` | Remove `/wd4100` and `-Wno-unused-parameter`, mark intentionally unused parameters with names/comments or `[[maybe_unused]]`, and make the Windows app plus headless Clang/GCC tests pass without unreferenced-parameter warnings |
 | DEBT-0020 | Open | Modernization | Document resize dialog state, selected-resolution planning, and execution dispatch now consume pure `pp_app_core` through `NodeDialogResize`, `App::dialog_resize`, `pano_cli plan-document-resize`, and the `DocumentResizeServices` boundary, and live resize shares `src/legacy_document_canvas_services.*` with canvas clear commands; resize history clearing is an explicit app-core execution output implemented directly by the retained `ActionManager`, but the shared live bridge still calls legacy `Canvas::resize`, updates the legacy app title, and owns the retained `ActionManager` call site | Preserve existing layer/frame GPU resize behavior while the document model and canvas execution boundary are extracted incrementally | `pp_app_core_document_resize_tests`; `pano_cli plan-document-resize --current-resolution 2048 --selected-resolution-index 4`; `ctest --preset desktop-fast --build-config Debug` | Document resize execution is owned by injected document/app services with no legacy resize adapter, title shim, or retained `ActionManager` history clearing |
 | DEBT-0021 | Open | Modernization | Layer rename planning/execution dispatch, layer panel operation planning/execution dispatch, layer panel selected-control/visibility view projection, and explicit layer history-intent helpers now consume pure `pp_app_core` through `App::dialog_layer_rename`, `App::init_sidebar` layer callbacks, `NodePanelLayer::update_attributes()`, `pano_cli plan-layer-rename`, `pano_cli plan-layer-operation`, `pano_cli plan-layer-panel-view`, `DocumentLayerRenameServices`, and `DocumentLayerOperationServices`, and the live execution adapters are centralized in `src/legacy_document_layer_services.*`; rename now records undo before applying the new name through separate app-core service calls, but the shared bridge and panel adapter still mutate legacy `Canvas` layer state, `NodeLayer`/`NodePanelLayer`, and retained `ActionManager` undo entries for add/remove/property-change/clear paths | Preserve existing UI/canvas behavior while document layer commands, panel projection, and undo history are extracted incrementally | `pp_app_core_document_layer_tests`; `pano_cli plan-layer-rename --old-name Base --new-name Paint`; `pano_cli plan-layer-operation --kind add --layer-count 2 --index 1 --name Paint`; `pano_cli plan-layer-panel-view --layer-count 3 --current-index 1 --hidden-index 2 --locked-index 1 --current-opacity 0.25 --current-blend-mode 4`; `ctest --preset desktop-fast --build-config Debug` | Layer command execution and panel state projection are owned by the document/app command boundary with legacy `Canvas`/UI nodes acting only as adapters or removed entirely |

docs/modernization/roadmap.md

@@ -70,6 +70,20 @@ What is already real:
 - `pp_app_core`
 
 Latest slice:
+- `src/platform_android/android_platform_services.*` now owns the concrete
+  Android `PlatformServices` implementation and `create_platform_services()`
+  instead of leaving the live Android execution surface inside
+  `platform_legacy`.
+- `android/src/cpp/main.cpp` now binds that owned Android `PlatformServices`
+  instance into `App` directly at the Android entrypoint.
+- The touched Android clipboard, keyboard visibility, JNI thread
+  attach/detach, async render-context, and file-picker execution now route
+  through `src/platform_android/android_platform_services.*` instead of the
+  cross-platform fallback adapter.
+- `src/platform_legacy/legacy_platform_services.*` no longer carries the
+  Android bridge/configuration surface or the touched Android method branches,
+  so the retained fallback adapter is narrower again and now focused on the
+  Linux/Web path plus generic fallback policy.
 - `src/platform_apple/apple_platform_services.*` now owns the concrete Apple
   `PlatformServices` implementation plus the `create_apple_platform_services()`
   factory instead of leaving the live Apple execution surface inside
@@ -86,15 +100,6 @@ Latest slice:
   document-service provider/configuration surface or the touched Apple method
   branches, so the retained fallback adapter is narrower and now focused on the
   Android/Linux/Web path.
-- `src/platform_legacy/legacy_platform_services.*` now takes an explicit
-  Android bridge through `create_platform_services(...)` instead of declaring
-  Android JNI/EGL/clipboard/file-picker hooks directly inside the legacy
-  adapter.
-- `android/src/cpp/main.cpp` now seeds that Android-owned bridge into its
-  owned legacy `PlatformServices` instance.
-- The touched Android clipboard, keyboard visibility, JNI thread attach/detach,
-  async render-context, and file-picker ownership now sit at the Android
-  entrypoint instead of the cross-platform fallback adapter body.
 - `src/platform_legacy/legacy_platform_services.*` now takes an explicit
   `WebPlatformServices*` dependency through `create_platform_services(...)`
   instead of routing WebGL publish/flush/default-canvas/save-prepared-file

docs/modernization/tasks.md

@@ -51,8 +51,9 @@ Completed, blocked, and superseded task history moved to
     `src/platform_apple/apple_platform_state.cpp` and
     `src/platform_apple/apple_platform_services.*`, and the live Apple
     `PlatformServices` surface now binds directly from those Apple-owned files,
-    but the broader non-Windows fallback adapter still exists for
-    Android/Linux/Web
+    and Android now also binds directly from
+    `src/platform_android/android_platform_services.*`, but the broader
+    non-Windows fallback adapter still exists for Linux/Web
   - `platform_legacy` is still part of the live app shell
 - The app runtime boundary is not finished:
   - render/UI queues are static `App` state
@@ -80,6 +81,20 @@ Completed, blocked, and superseded task history moved to
   the queue is now ordered by code movement instead.
 
 Current slice:
+- `src/platform_android/android_platform_services.*` now owns the concrete
+  Android `PlatformServices` implementation and `create_platform_services()`
+  instead of leaving the live Android execution surface in
+  `platform_legacy`.
+- `android/src/cpp/main.cpp` now binds that owned Android `PlatformServices`
+  instance into `App` directly at the Android entrypoint.
+- The touched Android clipboard, keyboard visibility, JNI thread
+  attach/detach, async render-context, and file-picker execution now route
+  through `src/platform_android/android_platform_services.*` instead of the
+  cross-platform fallback adapter.
+- `src/platform_legacy/legacy_platform_services.*` no longer carries the
+  Android bridge/configuration surface or the touched Android method branches,
+  so the retained fallback adapter is narrower again and now focused on the
+  Linux/Web path plus generic fallback policy.
 - `src/platform_apple/apple_platform_services.*` now owns the concrete Apple
   `PlatformServices` implementation plus the `create_apple_platform_services()`
   factory instead of leaving the live Apple execution surface in
@@ -96,15 +111,6 @@ Current slice:
   document-service provider/configuration surface or the touched Apple method
   branches, so the retained fallback adapter is narrower and now focused on the
   Android/Linux/Web path.
-- `src/platform_legacy/legacy_platform_services.*` now takes an explicit
-  Android bridge through `create_platform_services(...)` instead of declaring
-  Android JNI/EGL/clipboard/file-picker hooks directly inside the legacy
-  adapter.
-- `android/src/cpp/main.cpp` now seeds that Android-owned bridge into its
-  owned legacy `PlatformServices` instance.
-- The touched Android clipboard, keyboard visibility, JNI thread attach/detach,
-  async render-context, and file-picker ownership now sit at the Android
-  entrypoint instead of the cross-platform fallback adapter body.
 - `src/platform_legacy/legacy_platform_services.*` now takes an explicit
   `WebPlatformServices*` dependency through `create_platform_services(...)`
   instead of routing WebGL publish/flush/default-canvas/save-prepared-file