Remove legacy platform singleton accessor

docs/modernization/debt.md

@@ -18,6 +18,13 @@ agent or engineer to remove them without reconstructing context from chat.
 
 ## Reductions
 
+- 2026-06-17: `DEBT-0017` was narrowed again.
+  `src/platform_legacy/legacy_platform_services.*` no longer exposes the dead
+  `pp::platform::legacy::platform_services()` fallback singleton; Linux,
+  WebGL, and Android already bind owned `create_platform_services(...)`
+  instances at their entrypoints, so the retained non-Windows debt is now
+  limited to the adapter implementation itself rather than a live global
+  accessor surface.
 - 2026-06-16: `DEBT-0003` was narrowed again. `main.cpp` main-thread queued
   task state now lives behind a narrow retained helper instead of
   `RetainedState.main_tasklist` / `main_task_mutex` directly; broader Win32

docs/modernization/roadmap.md

@@ -70,6 +70,19 @@ What is already real:
 - `pp_app_core`
 
 Latest slice:
+- `src/platform_legacy/legacy_platform_services.*` no longer exposes the dead
+  `pp::platform::legacy::platform_services()` singleton accessor.
+- Linux, WebGL, and Android were already on owned
+  `create_platform_services(...)` instances, so removing that legacy singleton
+  surface does not change the live entrypoint ownership path.
+- `src/platform_windows/windows_runtime_state.*` now owns the Win32 bound-app
+  and bound-tablet bindings beside the retained owned `App`, `AppRuntime*`,
+  and `WacomTablet` objects instead of leaving that binding surface in
+  `windows_runtime_shell.cpp`.
+- `src/platform_windows/windows_runtime_shell.h` is now a thinner runtime
+  entrypoint header that picks up the retained binding surface from
+  `windows_runtime_state.h` instead of declaring a second shell-owned binding
+  API.
 - `src/platform_windows/windows_runtime_session.*` now owns the bound-session
   Win32 runtime loop/startup/shutdown body that had still been sitting inside
   `windows_runtime_flow.cpp`.
@@ -206,8 +219,8 @@ Latest slice:
   `PlatformServices` instance in `android_main()` and binds that owned service
   into `App` instead of binding the process-global fallback directly.
 - `src/platform_legacy/legacy_platform_services.*` now exposes an ownable
-  `create_platform_services()` entrypoint alongside the legacy fallback
-  accessor.
+  `create_platform_services()` entrypoint for explicit per-entrypoint
+  ownership.
 - `linux/src/main.cpp` now owns a local legacy `PlatformServices` instance and
   binds it into `App` explicitly instead of binding the process-global legacy
   accessor directly.
@@ -215,9 +228,8 @@ Latest slice:
   `pp::platform::legacy::platform_services()` when `App` has no bound platform
   services; the live app path now expects explicit platform-service ownership.
 - `linux/src/main.cpp`, `webgl/src/main.cpp`, and `android/src/cpp/main.cpp`
-  now bind `pp::platform::legacy::platform_services()` explicitly at app
-  creation instead of relying on the hidden fallback in `App` event/platform
-  dispatch.
+  now bind owned `create_platform_services(...)` instances at app creation
+  instead of relying on a hidden fallback in `App` event/platform dispatch.
 - `src/platform_windows/windows_runtime_shell.cpp` now owns the Windows tablet
   object directly; the composition edge no longer binds `&WacomTablet::I` into
   the Windows runtime path.

docs/modernization/tasks.md

@@ -78,6 +78,17 @@ Completed, blocked, and superseded task history moved to
   the queue is now ordered by code movement instead.
 
 Current slice:
+- `src/platform_legacy/legacy_platform_services.*` no longer exposes the dead
+  `pp::platform::legacy::platform_services()` singleton accessor.
+- Linux, WebGL, and Android were already on owned
+  `create_platform_services(...)` instances, so removing that singleton does
+  not change the live entrypoint ownership path.
+- `src/platform_windows/windows_runtime_state.*` now also owns the bound
+  Win32 `App*` / tablet binding surface alongside the retained owned `App`,
+  runtime, and tablet objects.
+- `src/platform_windows/windows_runtime_shell.h` is thinner again and now
+  imports that binding surface from `windows_runtime_state.h` instead of
+  declaring shell-owned bind/release accessors itself.
 - `src/platform_windows/windows_runtime_session.*` now owns the bound-session
   Win32 runtime loop/startup/shutdown body.
 - `src/platform_windows/windows_runtime_flow.cpp` is now only a thin handoff
@@ -198,8 +209,8 @@ Current slice:
   `PlatformServices` instance in `android_main()`, replacing the direct bind to
   the process-global fallback accessor.
 - `src/platform_legacy/legacy_platform_services.*` now exposes an ownable
-  `create_platform_services()` entrypoint while keeping the fallback singleton
-  for non-migrated platforms.
+  `create_platform_services()` entrypoint for explicit per-entrypoint
+  ownership.
 - `linux/src/main.cpp` now binds an owned legacy `PlatformServices` instance
   into `App`, making Linux the first explicit per-entrypoint owner of that
   legacy service implementation.
@@ -207,8 +218,8 @@ Current slice:
   `pp::platform::legacy::platform_services()`; touched app platform dispatch
   now expects an explicitly bound platform-services pointer.
 - `linux/src/main.cpp`, `webgl/src/main.cpp`, and `android/src/cpp/main.cpp`
-  now bind `pp::platform::legacy::platform_services()` explicitly at app
-  creation, removing the hidden fallback path from live non-Windows entrypoints.
+  now bind owned `create_platform_services(...)` instances at app creation,
+  removing the hidden fallback path from live non-Windows entrypoints.
 - `src/platform_windows/windows_runtime_shell.cpp` now owns the Windows tablet
   object directly, removing the composition-edge `WacomTablet::I` binding from
   the touched Windows runtime path.