Use CMake fmt compatibility option

CMakeLists.txt

@@ -239,6 +239,8 @@ add_library(pp_platform_api STATIC
     src/platform_api/asset_file_load_policy.h
     src/platform_api/network_tls_policy.cpp
     src/platform_api/network_tls_policy.h
+    src/platform_apple/apple_platform_services.cpp
+    src/platform_apple/apple_platform_services.h
     src/platform_api/platform_policy.cpp
     src/platform_api/platform_policy.h
     src/platform_api/platform_services.cpp
@@ -320,6 +322,11 @@ if(PP_BUILD_APP)
             PUBLIC
                 ${PP_LEGACY_INCLUDE_DIRS})
         file(REMOVE_RECURSE "${CMAKE_CURRENT_BINARY_DIR}/compat/fmt-vs2026")
+        if(MSVC_VERSION GREATER_EQUAL 1945)
+            target_compile_options(pp_legacy_vendor
+                PUBLIC
+                    /U_SECURE_SCL)
+        endif()
         target_compile_definitions(pp_legacy_vendor
             PUBLIC
                 ENUM_BITFIELDS_NOT_SUPPORTED

docs/modernization/debt.md

@@ -20,8 +20,9 @@ agent or engineer to remove them without reconstructing context from chat.
 
 - 2026-06-12: DEBT-0062 was closed. The generated VS 2026 fmt overlay was
   removed from root CMake, reused build trees delete the stale
-  `compat/fmt-vs2026` directory, and the retained vendored fmt header now
+  `compat/fmt-vs2026` directory, and VS 2026 consumers now compile retained fmt
-  avoids the removed `stdext::checked_array_iterator` path directly.
+  with `_SECURE_SCL` undefined so the removed `stdext::checked_array_iterator`
+  path is not selected.
 - 2026-06-12: DEBT-0039, DEBT-0040, and DEBT-0042 were narrowed. Document-open,
   close, save, save-before-workflow, Save As, Save Version, and new-document
   history effects now surface as explicit `pp_app_core` history outputs; the
@@ -956,6 +957,6 @@ agent or engineer to remove them without reconstructing context from chat.
 
 | ID | Status | Owner | Item | Reason | Validation | Removal Condition |
 | --- | --- | --- | --- | --- | --- | --- |
-| DEBT-0062 | Closed | Modernization | VS 2026 builds generated a patched fmt `format.h` overlay in the build tree for `pp_legacy_vendor` | VS 2026's STL no longer exposes the legacy checked-array iterator used by the old fmt release | Closed on 2026-06-12: VS-bundled CMake build of `PanoPainter` and `pp_platform_api_tests`; `ctest --preset desktop-fast --build-config Debug -R pp_platform_api_tests --output-on-failure` | Closed on 2026-06-12: the generated overlay was removed, stale overlay directories are deleted during configure, and vendored fmt now avoids `stdext::checked_array_iterator` directly |
+| DEBT-0062 | Closed | Modernization | VS 2026 builds generated a patched fmt `format.h` overlay in the build tree for `pp_legacy_vendor` | VS 2026's STL no longer exposes the legacy checked-array iterator used by the old fmt release | Closed on 2026-06-12: VS-bundled CMake build of `PanoPainter` and `pp_platform_api_tests`; `ctest --preset desktop-fast --build-config Debug -R pp_platform_api_tests --output-on-failure` | Closed on 2026-06-12: the generated overlay was removed, stale overlay directories are deleted during configure, and VS 2026 consumers compile retained fmt with `_SECURE_SCL` undefined so `stdext::checked_array_iterator` is not selected |
 | DEBT-0006 | Closed | Modernization | `pano_cli create-document` validates and emits JSON command contracts but does not yet invoke the legacy document/app model | The document model had not been extracted from `Canvas`/`App` yet | `ctest --preset desktop-fast --build-config Debug`; `pano_cli_create_document_smoke` | Closed on 2026-05-31: command now constructs a real `pp_document::CanvasDocument` |
 | DEBT-0018 | Closed | Modernization | `pp_renderer_gl` owned a tested `OpenGlInitialState` plan for PanoPainter startup depth/blend policy, but `App::init` still executed the plan through direct OpenGL calls | Preserve behavior while moving renderer policy into the backend boundary before a live `IRenderDevice`/command context owns startup execution | `pp_renderer_gl_capabilities_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Closed on 2026-06-03: `pp_renderer_gl::apply_panopainter_initial_state` now applies the startup state through a tested backend dispatch contract consumed by `App::init` |