The userland surface on Android — what AndroidApp provides and what
ig.run accepts: every service the publicly runnable effects of the package
require, each of them required by at least one such effect or by the launch
the process entries run. The list is the single declaration of the surface
and its type; a type test (android.surface.pin.spec.ts) pins it in both
directions against the package's published declarations — the workspace
barrel still holds the exports the declarations drop (AndroidAppLaunch
requires the whole surface), over which the pin could not fail. The native Transport is deliberately absent — it takes
ready bytes. Open fact:MobileHttpRequest is still in the surface
because facade bricks use it today (PostingLive, the segmented video
upload), so a caller can send an arbitrary request through it; its cost is a
request with caller-chosen headers and host, and closing it needs those
bricks moved to narrow capabilities. MobileProcessMobileConfig is the
same class of membership: the checkpoint requires it (ScreenCheckpointServices
— the checkpoint carries the configs the process has read), while the
reader of a parameter, ReadMobileConfig, is a library-internal seam and is
not re-exported for programs.
The map a program receives is picked from this list alone; the layer's build
context also holds the device, session and application tags and Scope.Scope,
which a program cannot reach.
It lives beside the layer, in its own module, because a screen's continuation
into the launch names the services it needs (the whole userland surface: the
launch runs on the same capabilities the process entry
AndroidIgpapi builds) without naming the internal launch
declaration.
The userland surface on Android — what
AndroidAppprovides and whatig.runaccepts: every service the publicly runnable effects of the package require, each of them required by at least one such effect or by the launch the process entries run. The list is the single declaration of the surface and its type; a type test (android.surface.pin.spec.ts) pins it in both directions against the package's published declarations — the workspace barrel still holds the exports the declarations drop (AndroidAppLaunchrequires the whole surface), over which the pin could not fail. The nativeTransportis deliberately absent — it takes ready bytes. Open fact:MobileHttpRequestis still in the surface because facade bricks use it today (PostingLive, the segmented video upload), so a caller can send an arbitrary request through it; its cost is a request with caller-chosen headers and host, and closing it needs those bricks moved to narrow capabilities.MobileProcessMobileConfigis the same class of membership: the checkpoint requires it (ScreenCheckpointServices— the checkpoint carries the configs the process has read), while the reader of a parameter,ReadMobileConfig, is a library-internal seam and is not re-exported for programs.The map a program receives is picked from this list alone; the layer's build context also holds the device, session and application tags and
Scope.Scope, which a program cannot reach.It lives beside the layer, in its own module, because a screen's continuation into the launch names the services it needs (the whole userland surface: the launch runs on the same capabilities the process entry
AndroidIgpapibuilds) without naming the internal launch declaration.