Route PPBR export directory policy through platform services

docs/modernization/build-inventory.md

@@ -554,8 +554,9 @@ Known local toolchain state:
   callbacks, recording cleanup, exported-image publishing, persistent storage
   flushing, document browse roots, native UI/window state saving, live
   asset/layout reload policy, diagnostic stacktrace/crash hooks,
-  SonarPen availability/startup, prepared-file writable target selection,
-  network TLS verification policy, and prepared-file save/download handoff; PPBR
+  SonarPen availability/startup, PPBR export data-directory policy,
+  prepared-file writable target selection, network TLS verification policy, and
+  prepared-file save/download handoff; PPBR
   and MP4 export dialogs consume
   the same prepared-file policy at runtime instead of spelling mobile/Web
   branches locally, layer/frame collection export dialogs consume the
@@ -699,12 +700,15 @@ Known local toolchain state:
   between `pp_app_core` PPBR brush package export requests and live
   `NodePanelBrushPreset::export_ppbr` execution. It preserves dialog metadata,
   the retained legacy `Image` header object, desktop worker-thread export,
-  mobile/Web save completion, dialog lifetime, and success messages while brush
-  asset/storage/UI/platform ownership is tracked by `DEBT-0047`.
+  mobile/Web save completion, dialog lifetime, and success messages while the
+  PPBR preview data-directory override now comes from `PlatformServices`;
+  remaining brush asset/storage/UI/platform ownership is tracked by
+  `DEBT-0047`.
 - `src/assets/brush_package.*` owns the first headless PPBR package helpers:
   header validation, legacy-compatible version acceptance, export path
   normalization, preview-data-directory planning, and imported brush
-  tip/pattern image target paths. Live
+  tip/pattern image target paths. Live export maps the active platform PPBR
+  data-directory policy into these helpers, and live
   `NodePanelBrushPreset::export_ppbr`/`import_ppbr` and ABR import image writes
   consume these helpers, but legacy Serializer/Image payload parsing, preview
   rendering, preset storage, duplicate policy, and strict-version cleanup remain

docs/modernization/debt.md

@@ -35,7 +35,7 @@ agent or engineer to remove them without reconstructing context from chat.
 | DEBT-0014 | Open | Modernization | `windows-clangcl-asan` now configures as a headless Ninja/clang-cl preset and uses the release MSVC runtime required by ASan, but local builds still fail because installed clang-cl 18.1.8 is paired with VS 2026-preview STL headers that require Clang 20 or newer | Sanitizer validation should be local and repeatable, but this machine's compiler/header pairing is incompatible | `cmake --fresh --preset windows-clangcl-asan`; `cmake --build --preset windows-clangcl-asan --target pp_foundation` | Install/use Clang 20+ with the VS 2026 STL, or point the preset at a compatible VS 2022 toolchain, then make `platform-build.ps1 -Presets windows-clangcl-asan` pass for the headless matrix |
 | DEBT-0015 | Open | Modernization | Cursor visibility requests now consume pure `pp_app_core` planning through `pano_cli plan-cursor-visibility`, `App::show_cursor`/`App::hide_cursor` dispatch through `PlatformServices` without platform guards, and Windows live execution uses injected `WindowsPlatformServices`, but macOS cursor execution still reaches the retained fallback adapter | Keep canvas cursor behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-cursor-visibility --visible`; `ctest --preset desktop-fast --build-config Debug` | Cursor visibility execution is owned by injected `pp_platform_*` services for every supported platform |
 | DEBT-0016 | Open | Modernization | Clipboard get/set requests now consume pure `pp_app_core` planning through `pano_cli plan-clipboard-read` and `pano_cli plan-clipboard-write`, and Windows live execution uses injected `WindowsPlatformServices`, but Apple/Android clipboard execution still reaches retained fallback adapter branches from `App::clipboard_get_text` and `App::clipboard_set_text` | Keep picker/color text clipboard behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-clipboard-write --text #ff00aa`; `ctest --preset desktop-fast --build-config Debug` | Clipboard execution is owned by injected `pp_platform_*` services for every supported platform |
-| DEBT-0017 | Open | Modernization | Startup storage path preparation, `App::clipboard_get_text`, `App::clipboard_set_text`, `App::show_cursor`, `App::hide_cursor`, `App::showKeyboard`, `App::hideKeyboard`, `App::display_file`, `App::share_file`, native app/window close, UI-thread lifecycle hooks, render-context acquire/release/present hooks, render-target binding hooks, render platform hint hooks, render debug callback hooks, render-capture frame hooks, recording cleanup, live asset/layout reload policy, diagnostic stacktrace/crash hooks, per-frame platform hooks, `App::pick_image`, `App::pick_file`, the non-writer `App::pick_file_save`, `App::pick_dir`, prepared-file save/download handoff, work-directory document export collection policy, app network TLS verification policy, and SonarPen availability/startup now call the SDK-free `pp::platform::PlatformServices` interface, and Windows injects `WindowsPlatformServices` from `src/platform_windows/windows_platform_services.*`; non-Windows live implementations still use `src/platform_legacy/legacy_platform_services.*`, a named fallback adapter that forwards to retained Apple/Android/Linux/Web bridge functions and retained no-op branches, including the retained iOS SonarPen bridge; `pp_platform_api` also owns the default network TLS policy helper consumed by retained curl sites that cannot yet depend on injected services | Preserve behavior while moving platform execution behind a testable service boundary before platform shell implementations are injected | `pp_platform_api_tests`; `pp_app_core_document_export_tests`; `pp_app_core_document_platform_io_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Replace `src/platform_legacy/legacy_platform_services.*` with injected `pp_platform_*` service implementations owned by each non-Windows platform shell |
+| DEBT-0017 | Open | Modernization | Startup storage path preparation, `App::clipboard_get_text`, `App::clipboard_set_text`, `App::show_cursor`, `App::hide_cursor`, `App::showKeyboard`, `App::hideKeyboard`, `App::display_file`, `App::share_file`, native app/window close, UI-thread lifecycle hooks, render-context acquire/release/present hooks, render-target binding hooks, render platform hint hooks, render debug callback hooks, render-capture frame hooks, recording cleanup, live asset/layout reload policy, diagnostic stacktrace/crash hooks, per-frame platform hooks, `App::pick_image`, `App::pick_file`, the non-writer `App::pick_file_save`, `App::pick_dir`, prepared-file save/download handoff, work-directory document export collection policy, app network TLS verification policy, PPBR export data-directory policy, and SonarPen availability/startup now call the SDK-free `pp::platform::PlatformServices` interface, and Windows injects `WindowsPlatformServices` from `src/platform_windows/windows_platform_services.*`; non-Windows live implementations still use `src/platform_legacy/legacy_platform_services.*`, a named fallback adapter that forwards to retained Apple/Android/Linux/Web bridge functions and retained no-op branches, including the retained iOS SonarPen bridge and retained macOS PPBR export directory override; `pp_platform_api` also owns the default network TLS policy helper consumed by retained curl sites that cannot yet depend on injected services | Preserve behavior while moving platform execution behind a testable service boundary before platform shell implementations are injected | `pp_platform_api_tests`; `pp_app_core_document_export_tests`; `pp_app_core_document_platform_io_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Replace `src/platform_legacy/legacy_platform_services.*` with injected `pp_platform_*` service implementations owned by each non-Windows platform shell |
 | DEBT-0019 | Open | Modernization | Unreferenced-parameter warnings are muted globally through `pp_project_warnings` with MSVC `/wd4100` and Clang/GCC `-Wno-unused-parameter` | Legacy callbacks, virtual hooks, serializer methods, and platform/API compatibility functions carry many intentionally unused parameters during the component split; muting this keeps stricter warning builds focused on higher-signal migration issues | `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset linux-clang --target pp_foundation` | Remove `/wd4100` and `-Wno-unused-parameter`, mark intentionally unused parameters with names/comments or `[[maybe_unused]]`, and make the Windows app plus headless Clang/GCC tests pass without unreferenced-parameter warnings |
 | DEBT-0020 | Open | Modernization | Document resize dialog state, selected-resolution planning, and execution dispatch now consume pure `pp_app_core` through `NodeDialogResize`, `App::dialog_resize`, `pano_cli plan-document-resize`, and the `DocumentResizeServices` boundary, and live resize shares `src/legacy_document_canvas_services.*` with canvas clear commands, but the shared live bridge still calls legacy `Canvas::resize`, updates the legacy app title, and clears legacy `ActionManager` history through the history bridge | Preserve existing layer/frame GPU resize behavior while the document model and canvas execution boundary are extracted incrementally | `pp_app_core_document_resize_tests`; `pano_cli plan-document-resize --current-resolution 2048 --selected-resolution-index 4`; `ctest --preset desktop-fast --build-config Debug` | Document resize execution is owned by injected document/app services with no legacy resize adapter, title shim, or direct `ActionManager` history clearing |
 | DEBT-0021 | Open | Modernization | Layer rename planning/execution dispatch and layer panel operation planning/execution dispatch now consume pure `pp_app_core` through `App::dialog_layer_rename`, `App::init_sidebar` layer callbacks, `pano_cli plan-layer-rename`, `pano_cli plan-layer-operation`, `DocumentLayerRenameServices`, and `DocumentLayerOperationServices`, and the live execution adapters are centralized in `src/legacy_document_layer_services.*`, but that shared bridge still mutates legacy `Canvas` layer state, `NodeLayer`/`NodePanelLayer`, and `ActionManager` undo entries | Preserve existing UI/canvas behavior while document layer commands and undo history are extracted incrementally | `pp_app_core_document_layer_tests`; `pano_cli plan-layer-rename --old-name Base --new-name Paint`; `pano_cli plan-layer-operation --kind add --layer-count 2 --index 1 --name Paint`; `ctest --preset desktop-fast --build-config Debug` | Layer command execution is owned by the document/app command boundary with legacy `Canvas`/UI nodes acting only as adapters or removed entirely |
@@ -64,7 +64,7 @@ agent or engineer to remove them without reconstructing context from chat.
 | DEBT-0044 | Open | Modernization | Timelapse and animation MP4 export execution dispatch now consumes pure `pp_app_core` through `App::dialog_timelapse_export`, `App::dialog_export_mp4`, `pano_cli plan-export-menu`, `pano_cli plan-export-target --kind name`, `DocumentVideoExportServices`, and `src/legacy_document_export_services.*`, but the bridge still launches legacy desktop timelapse worker threads, calls `App::rec_export`, calls `Canvas::export_anim_mp4`, owns mobile/Web save callbacks, and emits success messages directly | Preserve current MP4/timelapse export behavior while video export moves toward app/document/renderer/video/platform/storage services | `pp_app_core_document_export_tests`; `pano_cli plan-export-menu --kind animation-mp4`; `pano_cli plan-export-menu --kind timelapse`; `pano_cli plan-export-target --kind name --doc-name demo --suffix -animation`; `pano_cli plan-export-target --kind name --doc-name demo --suffix -timelapse`; `ctest --preset desktop-fast --build-config Debug` | Timelapse and animation MP4 execution, desktop worker threading, frame readback/video encoding handoff, mobile/Web save callbacks, and success reporting are owned by injected app/document/renderer/video/platform/storage services with export dialogs acting only as UI adapters |
 | DEBT-0045 | Open | Modernization | Options-menu preference execution now consumes pure `pp_app_core` through UI scale, viewport scale, RTL direction, VR mode, VR-controller, auto-timelapse, and canvas cursor-mode callbacks plus `AppPreferenceServices` and `src/legacy_app_preference_services.*`, but the bridge still calls legacy `App::set_ui_scale`, `App::set_ui_rtl`, `App::vr_start`, `App::vr_stop`, `NodeCanvas::set_density`, `NodeCanvas::set_cursor_visibility`, `App::rec_start`, `App::rec_stop`, and `Settings::save` directly | Preserve current options-menu behavior while preferences move toward app/UI/platform/storage services | `pp_app_core_app_preferences_tests`; `pano_cli plan-app-preferences --ui-scale 1.5 --display-density 2 --current-scale 1.6 --scale-option 1 --scale-option 1.5 --rtl`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | Preference persistence, UI/layout direction, viewport density, cursor mode, VR mode start/stop/failure handling, VR-controller state, and auto-timelapse recording side effects are owned by injected app/UI/platform/storage services with options-menu callbacks acting only as UI adapters |
 | DEBT-0046 | Open | Modernization | Startup preference/runtime execution now consumes pure `pp_app_core` through `App::init`, `pano_cli plan-app-startup`, `AppStartupServices`, and `src/legacy_app_startup_services.*`, but the bridge still calls legacy `Settings::set`, `Settings::save`, `App::rec_start`, app VR-controller state mutation, and message-box license warning execution directly | Preserve current startup behavior while app startup moves toward app/preferences/storage/recording/UI services | `pp_app_core_app_startup_tests`; `pano_cli plan-app-startup --run-counter 7 --vr-controllers-disabled --license-invalid`; `pano_cli plan-app-startup --run-counter -1`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | Startup preference persistence, auto-timelapse startup, stored VR-controller state, license validation/warning, and startup UI/runtime side effects are owned by injected app/preferences/storage/recording/UI services with `App::init` acting only as orchestration |
-| DEBT-0047 | Open | Modernization | PPBR brush package export request validation and execution dispatch now consume pure `pp_app_core` through `App::dialog_ppbr_export`, `pano_cli plan-brush-package-export`, `BrushPackageExportServices`, and `src/legacy_brush_package_export_services.*`; PPBR header/path planning now consumes `pp_assets::brush_package`, but the bridge still reads `NodeDialogExportPPBR`, carries the legacy `Image` header object outside the pure request, converts to `NodePanelBrushPreset::PPBRInfo`, calls `NodePanelBrushPreset::export_ppbr`, owns desktop worker-thread dispatch, dialog destruction, mobile/Web completion, and success-message behavior directly | Preserve current PPBR export behavior while brush assets, PPBR serialization, picker completion, and UI lifetime move toward asset/storage/UI/platform services | `pp_assets_brush_package_tests`; `pp_app_core_brush_package_export_tests`; `pano_cli plan-brush-package-export --path D:/Paint/clouds.ppbr --author Artist --dest-path D:/Paint/BrushPreviews --export-data --header-image`; `pano_cli plan-brush-package-export`; `pano_cli plan-brush-package-export --path clouds`; `pano_cli plan-brush-package-export --path D:/Paint/clouds.ppbr --dest-path D:/Paint/BrushPreviews --no-export-data`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | PPBR metadata collection, header-image ownership, serialization, picker-selected path execution, desktop threading, dialog lifetime, and success UI are owned by injected brush asset/storage/UI/platform services with `App::dialog_ppbr_export` acting only as a UI adapter |
+| DEBT-0047 | Open | Modernization | PPBR brush package export request validation and execution dispatch now consume pure `pp_app_core` through `App::dialog_ppbr_export`, `pano_cli plan-brush-package-export`, `BrushPackageExportServices`, and `src/legacy_brush_package_export_services.*`; PPBR header/path planning now consumes `pp_assets::brush_package`, and the macOS data-directory override now routes through `PlatformServices`, but the bridge still reads `NodeDialogExportPPBR`, carries the legacy `Image` header object outside the pure request, converts to `NodePanelBrushPreset::PPBRInfo`, calls `NodePanelBrushPreset::export_ppbr`, owns desktop worker-thread dispatch, dialog destruction, mobile/Web completion, and success-message behavior directly | Preserve current PPBR export behavior while brush assets, PPBR serialization, picker completion, and UI lifetime move toward asset/storage/UI/platform services | `pp_assets_brush_package_tests`; `pp_app_core_brush_package_export_tests`; `pp_platform_api_tests`; `pano_cli plan-brush-package-export --path D:/Paint/clouds.ppbr --author Artist --dest-path D:/Paint/BrushPreviews --export-data --header-image`; `pano_cli plan-brush-package-export`; `pano_cli plan-brush-package-export --path clouds`; `pano_cli plan-brush-package-export --path D:/Paint/clouds.ppbr --dest-path D:/Paint/BrushPreviews --no-export-data`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | PPBR metadata collection, header-image ownership, serialization, picker-selected path execution, desktop threading, dialog lifetime, and success UI are owned by injected brush asset/storage/UI/platform services with `App::dialog_ppbr_export` acting only as a UI adapter |
 | DEBT-0048 | Open | Modernization | ABR/PPBR brush package import execution now consumes pure `pp_app_core` through document-open confirmation callbacks, `pano_cli plan-brush-package-import`, `BrushPackageImportServices`, and `src/legacy_brush_package_import_services.*`; imported brush tip/pattern target paths now consume `pp_assets::brush_package`, but the bridge still launches detached legacy `NodePanelBrushPreset::import_abr`/`import_ppbr` worker threads and depends on the legacy preset panel as the importer/storage owner | Preserve current brush import behavior while brush package parsing, preset storage, progress/error reporting, and UI refresh move toward asset/paint/UI services | `pp_assets_brush_package_tests`; `pp_app_core_brush_package_import_tests`; `pano_cli plan-brush-package-import --kind ppbr --path D:/Paint/Brushes/clouds.ppbr`; `pano_cli plan-brush-package-import --kind abr --path D:/Paint/Brushes/clouds.abr`; `pano_cli plan-brush-package-import --kind ppbr`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | ABR/PPBR parsing, preset creation/storage, import threading/progress, duplicate asset policy, and UI refresh are owned by injected brush asset/paint/UI services with document-open callbacks only confirming user intent |
 | DEBT-0049 | Open | Modernization | `pp_assets::validate_ppbr_header` intentionally preserves the legacy PPBR version check from `NodePanelBrushPreset::import_ppbr`, which accepts files when either major is `0` or minor is `1` instead of requiring exactly version `0.1` | Avoid rejecting existing brush packages before compatibility fixtures prove the stricter rule is safe | `pp_assets_brush_package_tests`; `pano_cli plan-brush-package-export --path D:/Paint/clouds.ppbr`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | Add PPBR compatibility fixtures for accepted/rejected historical package versions, then require canonical `0.1` or an explicit supported-version matrix and update live import accordingly |
 | DEBT-0050 | Open | Modernization | iOS exported-image photo-library publishing and WebGL persistent-storage flushing now dispatch through `PlatformServices`, but non-Windows execution still lives in `src/platform_legacy/legacy_platform_services.*` and forwards to retained `save_image_library`/`webgl_sync` bridges | Preserve current iOS/Web export and save behavior while the Apple/Web platform shells are extracted incrementally | `pp_platform_api_tests`; `ctest --preset desktop-fast --build-config Debug`; platform package smoke once Apple/Web root builds exist | Exported-image publishing and persistent-storage flushing are owned by injected Apple/Web `pp_platform_*` services with no legacy adapter branch |

docs/modernization/roadmap.md

@@ -850,6 +850,10 @@ success messages while retained execution remains tracked under `DEBT-0047`.
 PPBR package header validation and export target/data-directory planning now
 live in `pp_assets::brush_package` and are exercised by
 `pp_assets_brush_package_tests` plus `pano_cli plan-brush-package-export`.
+The macOS-specific PPBR preview data-directory override now dispatches through
+`PlatformServices`, so `NodePanelBrushPreset::export_ppbr` no longer spells a
+local `__OSX__` branch while the actual PPBR serialization path remains
+legacy-owned.
 The live PPBR import/export path consumes those helpers, while legacy
 Serializer/Image payload reading, stroke preview generation, preset storage,
 and the historical permissive version check remain tracked under `DEBT-0047`
@@ -1735,7 +1739,8 @@ Results:
   native UI/window state save dispatch, prepared-file writable target dispatch,
   prepared-file export-dialog policy dispatch, work-directory document export
   collection policy dispatch, network TLS verification policy dispatch,
-  default network TLS policy coverage, SonarPen availability/startup dispatch,
+  default network TLS policy coverage, PPBR export data-directory policy
+  dispatch, SonarPen availability/startup dispatch,
   live asset/layout reload policy dispatch,
   diagnostic hook dispatch, per-frame platform hook dispatch, picker callback
   dispatch, and prepared-file save/download callback dispatch. The live Windows

src/app.h

@@ -187,6 +187,7 @@ public:
     [[nodiscard]] bool uses_prepared_file_writes() const;
     [[nodiscard]] bool uses_work_directory_document_export_collections() const;
     [[nodiscard]] bool disables_network_tls_verification() const;
+    [[nodiscard]] bool uses_ppbr_export_data_directory_override() const;
     [[nodiscard]] bool platform_supports_sonarpen() const;
     void start_platform_sonarpen();
     void pick_dir(std::function<void(std::string path)> callback);

src/app_events.cpp

@@ -196,6 +196,11 @@ bool App::disables_network_tls_verification() const
     return active_platform_services().disables_network_tls_verification();
 }
 
+bool App::uses_ppbr_export_data_directory_override() const
+{
+    return active_platform_services().uses_ppbr_export_data_directory_override();
+}
+
 bool App::platform_supports_sonarpen() const
 {
     return active_platform_services().supports_sonarpen();

src/node_panel_brush.cpp

@@ -780,16 +780,14 @@ void NodePanelBrushPreset::add_brush(std::shared_ptr<Brush> brush)
 
 bool NodePanelBrushPreset::export_ppbr(const std::string& path_in, const PPBRInfo& info_data)
 {
+    const auto data_directory_policy = App::I->uses_ppbr_export_data_directory_override()
+        ? pp::assets::PpbrDataDirectoryPolicy::override_directory
+        : pp::assets::PpbrDataDirectoryPolicy::next_to_package;
     const auto export_paths = pp::assets::plan_ppbr_export_paths(
         path_in,
         info_data.dest_path,
         info_data.export_data,
-#if __OSX__
-        pp::assets::PpbrDataDirectoryPolicy::override_directory
-#else
-        pp::assets::PpbrDataDirectoryPolicy::next_to_package
-#endif
-    );
+        data_directory_policy);
     if (!export_paths) {
         LOG("export_ppbr invalid path: %s", export_paths.status().message);
         return false;

src/platform_api/platform_services.h

@@ -66,6 +66,7 @@ public:
     [[nodiscard]] virtual bool uses_prepared_file_writes() = 0;
     [[nodiscard]] virtual bool uses_work_directory_document_export_collections() = 0;
     [[nodiscard]] virtual bool disables_network_tls_verification() = 0;
+    [[nodiscard]] virtual bool uses_ppbr_export_data_directory_override() = 0;
     [[nodiscard]] virtual bool supports_sonarpen() = 0;
     virtual void start_sonarpen() = 0;
     [[nodiscard]] virtual PreparedFileTarget prepare_writable_file(

src/platform_legacy/legacy_platform_services.cpp

@@ -455,6 +455,15 @@ public:
         return pp::platform::default_disables_network_tls_verification();
     }
 
+    [[nodiscard]] bool uses_ppbr_export_data_directory_override() override
+    {
+#if defined(__OSX__)
+        return true;
+#else
+        return false;
+#endif
+    }
+
     [[nodiscard]] bool supports_sonarpen() override
     {
 #if __IOS__

src/platform_windows/windows_platform_services.cpp

@@ -464,6 +464,11 @@ public:
         return pp::platform::default_disables_network_tls_verification();
     }
 
+    [[nodiscard]] bool uses_ppbr_export_data_directory_override() override
+    {
+        return false;
+    }
+
     [[nodiscard]] bool supports_sonarpen() override
     {
         return false;

tests/platform_api/platform_services_tests.cpp

@@ -230,6 +230,12 @@ public:
         return network_tls_verification_disabled;
     }
 
+    [[nodiscard]] bool uses_ppbr_export_data_directory_override() override
+    {
+        ++ppbr_export_data_directory_override_checks;
+        return ppbr_export_data_directory_override;
+    }
+
     [[nodiscard]] bool supports_sonarpen() override
     {
         ++sonarpen_support_checks;
@@ -303,6 +309,7 @@ public:
     int prepared_file_write_policy_checks = 0;
     int document_export_collection_policy_checks = 0;
     int network_tls_policy_checks = 0;
+    int ppbr_export_data_directory_override_checks = 0;
     int sonarpen_support_checks = 0;
     int sonarpen_starts = 0;
     int prepare_writable_file_requests = 0;
@@ -313,6 +320,7 @@ public:
     bool prepared_file_writes = true;
     bool work_directory_document_export_collections = false;
     bool network_tls_verification_disabled = false;
+    bool ppbr_export_data_directory_override = false;
     bool sonarpen_supported = false;
     bool deletes_recorded_files = true;
     bool live_asset_reloading = true;
@@ -660,6 +668,17 @@ void default_network_tls_policy_matches_build_target(pp::tests::Harness& harness
 #endif
 }
 
+void platform_services_dispatch_ppbr_export_directory_policy(pp::tests::Harness& harness)
+{
+    FakePlatformServices fake("unused");
+    pp::platform::PlatformServices& services = fake;
+
+    PP_EXPECT(harness, !services.uses_ppbr_export_data_directory_override());
+    fake.ppbr_export_data_directory_override = true;
+    PP_EXPECT(harness, services.uses_ppbr_export_data_directory_override());
+    PP_EXPECT(harness, fake.ppbr_export_data_directory_override_checks == 2);
+}
+
 void platform_services_dispatch_sonarpen_policy_and_start(pp::tests::Harness& harness)
 {
     FakePlatformServices fake("unused");
@@ -702,6 +721,9 @@ int main()
         platform_services_dispatch_document_export_collection_policy);
     harness.run("platform services dispatch network tls policy", platform_services_dispatch_network_tls_policy);
     harness.run("default network tls policy matches build target", default_network_tls_policy_matches_build_target);
+    harness.run(
+        "platform services dispatch ppbr export directory policy",
+        platform_services_dispatch_ppbr_export_directory_policy);
     harness.run("platform services dispatch sonarpen policy and start", platform_services_dispatch_sonarpen_policy_and_start);
     return harness.finish();
 }