Centralize legacy app startup

docs/modernization/build-inventory.md

@@ -173,6 +173,12 @@ Known local toolchain state:
   the `pp_app_core` `AppPreferenceServices` contract while retained settings
   persistence, VR start/stop, recording lifecycle, and legacy canvas/UI
   execution remain tracked by `DEBT-0045`.
+- `src/legacy_app_startup_services.*` is the current app-shell bridge for
+  startup preference/runtime execution. It keeps run-counter persistence,
+  startup preference save, auto-timelapse startup, stored VR-controller state,
+  and license-warning decisions on the `pp_app_core` `AppStartupServices`
+  contract while retained `Settings`, `App::rec_start`, and message-box
+  execution remain tracked by `DEBT-0046`.
 - `src/legacy_canvas_tool_services.*` is the current app-shell bridge for
   canvas toolbar tool selection, NodeCanvas stylus/input mode switching, and
   canvas hotkey/touch execution. It keeps those live paths on the `pp_app_core`
@@ -587,6 +593,10 @@ Known local toolchain state:
   timelapse start/stop/no-op decisions, VR mode success/failure dispatch,
   simple stored preferences, and `AppPreferenceServices` execution dispatch for
   options-menu side effects.
+- `pp_app_core_app_startup_tests` covers startup run-counter increment
+  planning, optional auto-timelapse/license/VR-controller decisions, negative
+  and overflow run-counter rejection, stable full startup dispatch ordering,
+  split persistence/runtime dispatch, and malformed startup-plan rejection.
 - `pp_platform_api_tests` covers service dispatch for clipboard read/write,
   empty clipboard writes, cursor visibility, virtual-keyboard visibility,
   external file display, file sharing, and picker callbacks without platform

docs/modernization/debt.md

@@ -63,6 +63,7 @@ agent or engineer to remove them without reconstructing context from chat.
 | DEBT-0043 | Open | Modernization | Equirectangular, layer, animation-frame, depth, and cube-face export planning/execution dispatch now consumes pure `pp_app_core` through `App::dialog_export`, `App::dialog_export_layers`, `App::dialog_export_anim_frames`, `App::dialog_export_depth`, `App::dialog_export_cube_faces`, `pano_cli plan-export-*`, `DocumentExportServices`, and `src/legacy_document_export_services.*`, but the bridge still calls legacy `Canvas` export methods, owns platform-specific export success messages, creates export directories, handles picker-selected stems, and performs Web prepared-file handoff directly | Preserve current image/collection/depth/cube export behavior while export execution moves toward document/renderer/platform/storage services | `pp_app_core_document_export_tests`; `pano_cli plan-export-start --requires-license --demo`; `pano_cli plan-export-menu --kind layers`; `pano_cli plan-export-target --kind collection --work-dir D:/Paint --doc-name demo --suffix _layers`; `pano_cli simulate-document-export`; `ctest --preset desktop-fast --build-config Debug` | File, collection, stem, depth, and cube export execution, export-directory creation, platform success reporting, Web file handoff, and legacy canvas export calls are owned by injected document/renderer/platform/storage services with export dialogs acting only as UI adapters |
 | DEBT-0044 | Open | Modernization | Timelapse and animation MP4 export execution dispatch now consumes pure `pp_app_core` through `App::dialog_timelapse_export`, `App::dialog_export_mp4`, `pano_cli plan-export-menu`, `pano_cli plan-export-target --kind name`, `DocumentVideoExportServices`, and `src/legacy_document_export_services.*`, but the bridge still launches legacy desktop timelapse worker threads, calls `App::rec_export`, calls `Canvas::export_anim_mp4`, owns mobile/Web save callbacks, and emits success messages directly | Preserve current MP4/timelapse export behavior while video export moves toward app/document/renderer/video/platform/storage services | `pp_app_core_document_export_tests`; `pano_cli plan-export-menu --kind animation-mp4`; `pano_cli plan-export-menu --kind timelapse`; `pano_cli plan-export-target --kind name --doc-name demo --suffix -animation`; `pano_cli plan-export-target --kind name --doc-name demo --suffix -timelapse`; `ctest --preset desktop-fast --build-config Debug` | Timelapse and animation MP4 execution, desktop worker threading, frame readback/video encoding handoff, mobile/Web save callbacks, and success reporting are owned by injected app/document/renderer/video/platform/storage services with export dialogs acting only as UI adapters |
 | DEBT-0045 | Open | Modernization | Options-menu preference execution now consumes pure `pp_app_core` through UI scale, viewport scale, RTL direction, VR mode, VR-controller, auto-timelapse, and canvas cursor-mode callbacks plus `AppPreferenceServices` and `src/legacy_app_preference_services.*`, but the bridge still calls legacy `App::set_ui_scale`, `App::set_ui_rtl`, `App::vr_start`, `App::vr_stop`, `NodeCanvas::set_density`, `NodeCanvas::set_cursor_visibility`, `App::rec_start`, `App::rec_stop`, and `Settings::save` directly | Preserve current options-menu behavior while preferences move toward app/UI/platform/storage services | `pp_app_core_app_preferences_tests`; `pano_cli plan-app-preferences --ui-scale 1.5 --display-density 2 --current-scale 1.6 --scale-option 1 --scale-option 1.5 --rtl`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | Preference persistence, UI/layout direction, viewport density, cursor mode, VR mode start/stop/failure handling, VR-controller state, and auto-timelapse recording side effects are owned by injected app/UI/platform/storage services with options-menu callbacks acting only as UI adapters |
+| DEBT-0046 | Open | Modernization | Startup preference/runtime execution now consumes pure `pp_app_core` through `App::init`, `pano_cli plan-app-startup`, `AppStartupServices`, and `src/legacy_app_startup_services.*`, but the bridge still calls legacy `Settings::set`, `Settings::save`, `App::rec_start`, app VR-controller state mutation, and message-box license warning execution directly | Preserve current startup behavior while app startup moves toward app/preferences/storage/recording/UI services | `pp_app_core_app_startup_tests`; `pano_cli plan-app-startup --run-counter 7 --vr-controllers-disabled --license-invalid`; `pano_cli plan-app-startup --run-counter -1`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | Startup preference persistence, auto-timelapse startup, stored VR-controller state, license validation/warning, and startup UI/runtime side effects are owned by injected app/preferences/storage/recording/UI services with `App::init` acting only as orchestration |
 
 ## Closed Debt
 

docs/modernization/roadmap.md

@@ -183,6 +183,12 @@ contracts. Options-menu preference execution now dispatches through
 `AppPreferenceServices` and `src/legacy_app_preference_services.*` before
 legacy widgets, settings persistence, recording toggles, and canvas cursor
 updates continue.
+It also owns tested startup plans for run-counter increments, preference-save
+intent, auto-timelapse startup, stored VR-controller state, and license-warning
+visibility. `App::init` now plans those decisions before heavy initialization,
+executes run-counter persistence through `src/legacy_app_startup_services.*`
+before asset/layout setup, and executes runtime startup side effects after the
+UI layout and main render target exist.
 It also owns tested app status/display plans for document title text,
 resolution mapping/labels, DPI text, history-memory text, and recording-frame
 status text, plus renderer diagnostic indicator labels for framebuffer fetch
@@ -1358,6 +1364,11 @@ Results:
 - Focused preference CTest coverage passed for
   `pp_app_core_app_preferences_tests` and the app-preferences CLI smoke tests
   after the live bridge split, including VR mode failed-start status coverage.
+- `PanoPainter`, `pp_app_core_app_startup_tests`, and `pano_cli` built after
+  startup preference/runtime execution moved behind app startup services.
+- Focused startup CTest coverage passed for `pp_app_core_app_startup_tests`,
+  `pano_cli_plan_app_startup_smoke`, and
+  `pano_cli_plan_app_startup_rejects_negative_counter`.
 - `pp_app_core_document_recording_tests` passed, covering recording start/stop,
   clear, platform recorded-file cleanup, frame-count reset, export progress
   totals, and oversized progress-total clamping.