Route prepared file saves through platform services

docs/modernization/build-inventory.md

@@ -446,14 +446,13 @@ Known local toolchain state:
   platform clipboard bridges.
 - `pp_platform_api` exposes the SDK-free `PlatformServices` interface for
   clipboard text, cursor visibility, virtual-keyboard visibility, external
-  file display, file sharing, and picker callbacks; Windows live app execution
-  now uses injected `WindowsPlatformServices` from
+  file display, file sharing, picker callbacks, and prepared-file
+  save/download handoff; Windows live app execution now uses injected
+  `WindowsPlatformServices` from
   `src/platform_windows/windows_platform_services.*` in `pp_platform_windows`,
   while non-Windows platforms still reach retained platform bridges through
   the debt-tracked adapter isolated in
-  `src/platform_legacy/legacy_platform_services.*`. The iOS/Web
-  save-with-writer overload remains a separate app method until export handoff
-  is isolated.
+  `src/platform_legacy/legacy_platform_services.*`.
 - `pano_cli plan-cloud-upload` exposes `pp_app_core` cloud upload availability,
   new-document warning, publish prompt, and save-before-upload planning as JSON;
   the live cloud upload command consumes the same start contract before

docs/modernization/debt.md

@@ -35,7 +35,7 @@ agent or engineer to remove them without reconstructing context from chat.
 | DEBT-0014 | Open | Modernization | `windows-clangcl-asan` now configures as a headless Ninja/clang-cl preset and uses the release MSVC runtime required by ASan, but local builds still fail because installed clang-cl 18.1.8 is paired with VS 2026-preview STL headers that require Clang 20 or newer | Sanitizer validation should be local and repeatable, but this machine's compiler/header pairing is incompatible | `cmake --fresh --preset windows-clangcl-asan`; `cmake --build --preset windows-clangcl-asan --target pp_foundation` | Install/use Clang 20+ with the VS 2026 STL, or point the preset at a compatible VS 2022 toolchain, then make `platform-build.ps1 -Presets windows-clangcl-asan` pass for the headless matrix |
 | DEBT-0015 | Open | Modernization | Cursor visibility requests now consume pure `pp_app_core` planning through `pano_cli plan-cursor-visibility`, and Windows live execution uses injected `WindowsPlatformServices`, but macOS cursor execution still reaches the retained fallback adapter from `App::show_cursor` and `App::hide_cursor` | Keep canvas cursor behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-cursor-visibility --visible`; `ctest --preset desktop-fast --build-config Debug` | Cursor visibility execution is owned by injected `pp_platform_*` services for every supported platform |
 | DEBT-0016 | Open | Modernization | Clipboard get/set requests now consume pure `pp_app_core` planning through `pano_cli plan-clipboard-read` and `pano_cli plan-clipboard-write`, and Windows live execution uses injected `WindowsPlatformServices`, but Apple/Android clipboard execution still reaches retained fallback adapter branches from `App::clipboard_get_text` and `App::clipboard_set_text` | Keep picker/color text clipboard behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-clipboard-write --text #ff00aa`; `ctest --preset desktop-fast --build-config Debug` | Clipboard execution is owned by injected `pp_platform_*` services for every supported platform |
-| DEBT-0017 | Open | Modernization | `App::clipboard_get_text`, `App::clipboard_set_text`, `App::show_cursor`, `App::hide_cursor`, `App::showKeyboard`, `App::hideKeyboard`, `App::display_file`, `App::share_file`, `App::pick_image`, `App::pick_file`, the non-writer `App::pick_file_save`, and `App::pick_dir` now call the SDK-free `pp::platform::PlatformServices` interface, and Windows injects `WindowsPlatformServices` from `src/platform_windows/windows_platform_services.*`; non-Windows live implementations still use `src/platform_legacy/legacy_platform_services.*`, a named fallback adapter that forwards to retained Apple/Android/Linux/Web bridge functions and retained no-op branches; the iOS/Web save-with-writer overload remains separate until export handoff is isolated | Preserve behavior while moving platform execution behind a testable service boundary before platform shell implementations are injected | `pp_platform_api_tests`; `pp_app_core_document_platform_io_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Replace `src/platform_legacy/legacy_platform_services.*` with injected `pp_platform_*` service implementations owned by each non-Windows platform shell |
+| DEBT-0017 | Open | Modernization | `App::clipboard_get_text`, `App::clipboard_set_text`, `App::show_cursor`, `App::hide_cursor`, `App::showKeyboard`, `App::hideKeyboard`, `App::display_file`, `App::share_file`, `App::pick_image`, `App::pick_file`, the non-writer `App::pick_file_save`, `App::pick_dir`, and prepared-file save/download handoff now call the SDK-free `pp::platform::PlatformServices` interface, and Windows injects `WindowsPlatformServices` from `src/platform_windows/windows_platform_services.*`; non-Windows live implementations still use `src/platform_legacy/legacy_platform_services.*`, a named fallback adapter that forwards to retained Apple/Android/Linux/Web bridge functions and retained no-op branches | Preserve behavior while moving platform execution behind a testable service boundary before platform shell implementations are injected | `pp_platform_api_tests`; `pp_app_core_document_platform_io_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Replace `src/platform_legacy/legacy_platform_services.*` with injected `pp_platform_*` service implementations owned by each non-Windows platform shell |
 
 ## Closed Debt
 

docs/modernization/roadmap.md

@@ -475,9 +475,10 @@ Windows installs an injected `WindowsPlatformServices` implementation from
 `src/platform_windows/windows_platform_services.*` in `pp_platform_windows`;
 other platforms still route through the debt-tracked legacy fallback adapter
 now isolated in `src/platform_legacy/legacy_platform_services.*`, so behavior
-is preserved while their platform shell implementations are extracted. The iOS/Web
-save-with-writer overload remains separate because it writes a
-temporary/exported file before handing control to the platform.
+is preserved while their platform shell implementations are extracted.
+Prepared-file save/download handoff is now also part of the service contract,
+so iOS/Web export completion routes through `PlatformServices` after the app
+writes the temporary/exported payload.
 `pano_cli plan-cloud-upload` exposes the app-core cloud upload decision used by
 the live cloud upload command for missing-canvas, new-document warning, publish
 prompt, and dirty-document save-before-upload states before legacy UI, canvas,
@@ -991,11 +992,11 @@ Results:
 - `pp_platform_api_tests` passed, covering the SDK-free `PlatformServices`
   interface for clipboard read/write, empty clipboard writes, cursor
   visibility dispatch, virtual-keyboard visibility dispatch, external file
-  display dispatch, file sharing dispatch, and picker callback dispatch. The
-  live Windows app now consumes this interface through an injected
-  `WindowsPlatformServices` instance isolated in
-  `src/platform_windows/windows_platform_services.*`; other platforms still
-  use the legacy fallback adapter, now isolated in
+  display dispatch, file sharing dispatch, picker callback dispatch, and
+  prepared-file save/download callback dispatch. The live Windows app now
+  consumes this interface through an injected `WindowsPlatformServices`
+  instance isolated in `src/platform_windows/windows_platform_services.*`;
+  other platforms still use the legacy fallback adapter, now isolated in
   `src/platform_legacy/legacy_platform_services.*` instead of being owned by
   `app_events.cpp`.
 - `panopainter_validate_shaders` passed, validating 25 shader programs and 7