@pictor-sdk/video-android 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pictor contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# @pictor-sdk/video-android
+
+Optional Android video playback and export adapter for Pictor. Requires Android API 29+.
+
+Part of [Pictor](https://github.com/zahidhasanaunto/pictor), an MIT-licensed, composable
+photo and video editor SDK for React Native. Public APIs are pre-1.0 and experimental.
+
+## Install
+
+```sh
+pnpm add @pictor-sdk/video-android@0.1.0
+```
+
+Install the package's declared peer dependencies in your app. Keep React, React Native,
+Skia, Reanimated and Worklets single-instance; never install a second renderer stack.
+
+The reference host uses Expo SDK 54, React Native 0.81, React 19.1,
+Skia 2.2.12, Reanimated 4.1 and Worklets 0.5.1 (New Architecture).
+Device acceptance was performed on a Pixel 7; broader peer ranges are not a claim
+of device verification on every supported version/platform.
+
+## Android setup
+
+Android only, API 29+. Requires a native development/release build; Expo Go is not supported.
+Add "@pictor-sdk/video-android" to the Expo app config's plugins array, then run Expo prebuild
+and rebuild your app. Bare React Native hosts must set minSdkVersion to at least 29.
+The package includes its autolinking config, TurboModule specs, Kotlin/C++ sources and CMake build.
+Media3 is pinned to 1.9.4. iOS video playback/export is not provided.
+
+Diagnostics are disabled in ordinary release builds. Do not set the pictorDiagnostics Gradle
+property in a shipped build. The host owns source permissions, durable ingestion and export files.
+
+## Documentation and contributing
+
+- [Repository and example app](https://github.com/zahidhasanaunto/pictor)
+- [Public API inventory](https://github.com/zahidhasanaunto/pictor/blob/main/docs/API-SURFACE.md)
+- [Release and contributor guide](https://github.com/zahidhasanaunto/pictor/blob/main/docs/RELEASING.md)
+
+The original development scope was @pictor/*; public packages use @pictor-sdk/*.
+Use the public scope in all imports and app configuration.

package/android/CMakeLists.txt

@@ -0,0 +1,30 @@
+cmake_minimum_required(VERSION 3.13)
+project(pictor_video)
+
+set(CMAKE_CXX_STANDARD 17)
+
+add_library(pictor_video SHARED
+  src/main/cpp/pictor_videosurface.cpp
+  src/main/cpp/pictor_publish.cpp
+  src/main/cpp/pictor_overlaystage.cpp
+)
+
+# JSI comes from React Native's prefab. Linking it is what lets this library
+# expose a jsi::HostObject, which is the supported route into a worklet runtime.
+find_package(ReactAndroid REQUIRED CONFIG)
+find_library(log-lib log)
+find_library(android-lib android)
+# The presentation surface creates a GL texture in Skia's context.
+find_library(egl-lib EGL)
+find_library(gles-lib GLESv2)
+# CRC32 for the overlay sidecars, the same checksum `OverlayResources.kt` reads.
+find_library(z-lib z)
+
+target_link_libraries(pictor_video
+  ReactAndroid::jsi
+  ${log-lib}
+  ${android-lib}
+  ${egl-lib}
+  ${gles-lib}
+  ${z-lib}
+)

package/android/build.gradle

@@ -0,0 +1,119 @@
+buildscript {
+  repositories { google(); mavenCentral() }
+  dependencies {
+    classpath "com.android.tools.build:gradle:8.6.0"
+    classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:2.0.21"
+  }
+}
+
+apply plugin: "com.android.library"
+apply plugin: "org.jetbrains.kotlin.android"
+apply plugin: "com.facebook.react"
+
+android {
+  namespace "dev.pictor.video"
+  compileSdk 35
+
+  defaultConfig {
+    // 29 is now conservative, and deliberately so.
+    //
+    // It was forced by the retired custom backend: ImageReader.newInstance with
+    // USAGE_GPU_SAMPLED_IMAGE (29), Image.getHardwareBuffer() (28), HardwareBuffer
+    // itself (26). None of that code exists any more. What the Media3 + external-OES
+    // path actually needs is far lower — SurfaceTexture and GL_TEXTURE_EXTERNAL_OES
+    // have been present since API 11 and 8, Media3 1.9.4's own floor is 23, and
+    // React Native 0.76 requires 24 — so 24 is the real requirement.
+    //
+    // It stays at 29 because nothing below it has been *run*. The only device here
+    // is API 36 and the one installed system image is incomplete, so 24 would be a
+    // support claim resting on reading API levels rather than on a passing test.
+    // Lower it when an older device or a complete emulator image can prove it.
+    // Installing this package raises a host's minSdk; not installing it leaves
+    // image-only Pictor consumers exactly where they were.
+    minSdk 29
+    externalNativeBuild {
+      cmake {
+        cppFlags "-std=c++17"
+        // React Native's prefab libraries are built against the shared STL, and
+        // linking JSI against a static one fails configuration outright.
+        arguments "-DANDROID_STL=c++_shared"
+      }
+    }
+  }
+
+  externalNativeBuild {
+    cmake {
+      path "CMakeLists.txt"
+      version "3.22.1"
+    }
+  }
+
+  /*
+    The diagnostics boundary is compile-time, not a runtime flag.
+
+    Fault injection, artificial stalls, timing holds, provenance hashing and
+    synthetic heartbeats exist for conformance gates. A shipped build must not
+    be able to reach them by any sequence of calls, so whether they exist at all
+    is decided here and baked into `BuildConfig` — not stored in a mutable field
+    that arbitrary JavaScript could set.
+
+    Off unless a build explicitly asks:
+
+        ./gradlew :app:assembleRelease -PpictorDiagnostics=true
+
+    A debug build gets it for free, because a debug build is already a
+    development artefact. A release build without the property has the constant
+    false, every mutating gate method refuses synchronously, and every site that
+    would act on an injected fault is dead.
+  */
+  buildTypes {
+    debug {
+      buildConfigField "boolean", "PICTOR_DIAGNOSTICS", "true"
+    }
+    release {
+      buildConfigField "boolean", "PICTOR_DIAGNOSTICS",
+        project.hasProperty("pictorDiagnostics") ? "true" : "false"
+    }
+  }
+
+  buildFeatures {
+    buildConfig true
+    // Required to consume React Native's JSI headers and library.
+    prefab true
+  }
+  compileOptions {
+    sourceCompatibility JavaVersion.VERSION_17
+    targetCompatibility JavaVersion.VERSION_17
+  }
+  kotlinOptions { jvmTarget = "17" }
+}
+
+repositories { google(); mavenCentral() }
+
+/**
+ * One Media3 version, everywhere.
+ *
+ * 1.9.4 is the last release that builds against compileSdk 35; 1.10.0 raised
+ * its floor to 36. Revisit when Pictor targets an Expo SDK that compiles
+ * against 36 — see docs/research/media3-mapping.md.
+ *
+ * `media3-transformer` and `media3-effect` arrive here at V3.3, for the
+ * Transformer–Skia GL interoperability gate. They are still weight an optional
+ * adapter's consumers pay for; they are here because the gate needs them, not
+ * in anticipation of a slice that has not started.
+ */
+ext.media3Version = "1.9.4"
+
+dependencies {
+  implementation "com.facebook.react:react-android"
+  implementation "org.jetbrains.kotlin:kotlin-stdlib"
+  implementation "androidx.media3:media3-exoplayer:${project.ext.media3Version}"
+  implementation "androidx.media3:media3-transformer:${project.ext.media3Version}"
+  implementation "androidx.media3:media3-effect:${project.ext.media3Version}"
+  implementation "androidx.media3:media3-common:${project.ext.media3Version}"
+
+  // FrameClock's pairing rules are Kotlin and have no Android dependencies, so
+  // they are tested on the JVM rather than reimplemented in TS to suit the
+  // Node harness. Run with `pnpm test:android`.
+  testImplementation "junit:junit:4.13.2"
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android" />

package/android/src/main/cpp/pictor_overlaystage.cpp

@@ -0,0 +1,372 @@
+/*
+  Staging overlay rasters, synchronously, without a filesystem package in JS.
+
+  ## Why this exists in the adapter
+
+  The export reader that consumes these sidecars is `OverlayResources.kt`, in
+  this package. The writer belongs beside it: a host that had to produce the
+  bytes *and* choose where they live would need a filesystem dependency and a
+  path convention, and the two ends of one format would then be maintained in
+  different repositories.
+
+  ## Why JSI rather than a TurboModule method
+
+  The payload is a raster — several megabytes at export scale. Codegen carries
+  numbers, strings and arrays; the only way to move raw bytes through it is
+  base64, which costs a 4/3 expansion, an encode on the JS thread and a decode
+  on the native side, for data that is already contiguous memory. A JSI host
+  function reads the `ArrayBuffer` in place.
+
+  ## Why JS cannot name the destination
+
+  `stage` takes bytes and dimensions and returns a token. The directory is
+  chosen here from the app's own cache path, and the file name is a counter and
+  a random suffix — never anything derived from a document string. An overlay id
+  is author-controlled text; letting it reach a path is how `../` arrives in a
+  filename.
+
+  ## Publication
+
+  Bytes go to `<dir>/<name>.part`, are flushed and fsynced, and only then
+  renamed onto the final name. A reader therefore never opens a file that is
+  still being written: the sidecar either does not exist or is complete, with no
+  state in between for a crash to land in.
+*/
+
+#include <jni.h>
+#include <jsi/jsi.h>
+
+#include <errno.h>
+#include <dirent.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <zlib.h>
+
+#include <memory>
+#include <mutex>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+using namespace facebook;
+
+namespace {
+
+/** The subdirectory this module owns. Nothing outside it is ever swept. */
+constexpr const char *kDirName = "pictor-overlays";
+/** The suffix a published sidecar carries. */
+constexpr const char *kSuffix = ".pictorraster";
+/** The suffix an in-progress write carries. */
+constexpr const char *kPartSuffix = ".part";
+
+/**
+ * The largest raster that will be accepted, in bytes.
+ *
+ * 256 MB is far above any plausible text overlay — a 4096×4096 RGBA raster is
+ * 64 MB — and far below a size that would threaten the process. The point is
+ * not to guess the right maximum but to have one: without it a corrupted or
+ * hostile descriptor turns into an allocation the device cannot satisfy, and
+ * the failure is an abort rather than a refusal.
+ */
+constexpr uint64_t kMaxBytes = 256ull * 1024ull * 1024ull;
+
+/** Bytes per pixel for the one format this stages. */
+constexpr uint64_t kBytesPerPixel = 4;
+
+struct Staged {
+  std::string path;
+  uint64_t byteLength;
+  uint32_t checksum;
+};
+
+class Staging {
+public:
+  explicit Staging(std::string dir) : dir_(std::move(dir)) {
+    ::mkdir(dir_.c_str(), 0700);
+  }
+
+  /**
+   * Write one raster and publish it.
+   *
+   * Every failure path removes whatever it created. A half-written `.part` left
+   * behind would be swept later, but "later" is the next cold start, and an
+   * export that failed is exactly the run nobody comes back to tidy.
+   */
+  bool stage(const uint8_t *bytes, uint64_t length, uint32_t *outChecksum,
+             std::string *outToken, std::string *outPath, std::string *outError) {
+    const uint64_t id = ++counter_;
+    // Never derived from a document string: an overlay id is author-controlled
+    // text, and a path built from one is how `../` arrives in a filename.
+    const std::string name = "ov" + std::to_string(id) + "-" + std::to_string(::getpid()) +
+                             "-" + std::to_string(::rand());
+    const std::string finalPath = dir_ + "/" + name + kSuffix;
+    const std::string partPath = finalPath + kPartSuffix;
+
+    int fd = ::open(partPath.c_str(), O_WRONLY | O_CREAT | O_EXCL, 0600);
+    if (fd < 0) {
+      *outError = "could not create a staging file";
+      return false;
+    }
+
+    uint64_t written = 0;
+    bool ok = true;
+    while (written < length) {
+      const ssize_t n = ::write(fd, bytes + written, static_cast<size_t>(length - written));
+      if (n <= 0) {
+        if (errno == EINTR) continue;
+        ok = false;
+        break;
+      }
+      written += static_cast<uint64_t>(n);
+    }
+    // Durable before the rename: publishing a name that points at unflushed
+    // bytes is the same hazard as publishing a partial file.
+    if (ok && ::fsync(fd) != 0) ok = false;
+    ::close(fd);
+
+    if (!ok || written != length) {
+      ::unlink(partPath.c_str());
+      *outError = "the raster could not be written in full";
+      return false;
+    }
+
+    if (::rename(partPath.c_str(), finalPath.c_str()) != 0) {
+      ::unlink(partPath.c_str());
+      *outError = "the raster could not be published";
+      return false;
+    }
+
+    uLong crc = ::crc32(0L, Z_NULL, 0);
+    crc = ::crc32(crc, bytes, static_cast<uInt>(length));
+
+    const std::string token = "stg" + std::to_string(id);
+    {
+      std::lock_guard<std::mutex> lock(mutex_);
+      live_.emplace(token, Staged{finalPath, length, static_cast<uint32_t>(crc)});
+      created_ += 1;
+    }
+    *outChecksum = static_cast<uint32_t>(crc);
+    *outToken = token;
+    *outPath = finalPath;
+    return true;
+  }
+
+  /** Exact and idempotent: releasing twice is not an error and frees once. */
+  bool release(const std::string &token) {
+    std::string path;
+    {
+      std::lock_guard<std::mutex> lock(mutex_);
+      auto it = live_.find(token);
+      if (it == live_.end()) return false;
+      path = it->second.path;
+      live_.erase(it);
+      released_ += 1;
+    }
+    ::unlink(path.c_str());
+    return true;
+  }
+
+  int releaseAll() {
+    std::vector<std::string> tokens;
+    {
+      std::lock_guard<std::mutex> lock(mutex_);
+      tokens.reserve(live_.size());
+      for (const auto &entry : live_) tokens.push_back(entry.first);
+    }
+    int n = 0;
+    for (const auto &t : tokens) {
+      if (release(t)) n += 1;
+    }
+    return n;
+  }
+
+  /**
+   * Remove orphans left by a previous process.
+   *
+   * Scoped to this module's own directory and to its own suffixes, so it can
+   * never take a cache file belonging to anything else. Anything currently live
+   * in *this* process is skipped, which is what makes it safe to call at any
+   * time rather than only before the first export.
+   */
+  int sweep() {
+    std::vector<std::string> livePaths;
+    {
+      std::lock_guard<std::mutex> lock(mutex_);
+      for (const auto &entry : live_) livePaths.push_back(entry.second.path);
+    }
+    DIR *d = ::opendir(dir_.c_str());
+    if (d == nullptr) return 0;
+    int removed = 0;
+    while (dirent *e = ::readdir(d)) {
+      const std::string name = e->d_name;
+      if (name == "." || name == "..") continue;
+      const bool ours = name.size() > 3 && name.compare(0, 2, "ov") == 0 &&
+                        (name.find(kSuffix) != std::string::npos);
+      if (!ours) continue;
+      const std::string path = dir_ + "/" + name;
+      bool isLive = false;
+      for (const auto &p : livePaths) {
+        if (p == path) { isLive = true; break; }
+      }
+      if (isLive) continue;
+      if (::unlink(path.c_str()) == 0) removed += 1;
+    }
+    ::closedir(d);
+    return removed;
+  }
+
+  void ledger(uint64_t *created, uint64_t *released, uint64_t *live) {
+    std::lock_guard<std::mutex> lock(mutex_);
+    *created = created_;
+    *released = released_;
+    *live = live_.size();
+  }
+
+private:
+  std::string dir_;
+  std::mutex mutex_;
+  std::unordered_map<std::string, Staged> live_;
+  uint64_t counter_ = 0;
+  uint64_t created_ = 0;
+  uint64_t released_ = 0;
+};
+
+std::shared_ptr<Staging> gStaging;
+
+/** Is `v` a whole number that fits a positive 32-bit extent? */
+bool wholeExtent(double v, uint64_t *out) {
+  if (!(v > 0) || v != v) return false;             // zero, negative, or NaN
+  if (v > 65536.0) return false;                    // far past any raster
+  const uint64_t n = static_cast<uint64_t>(v);
+  if (static_cast<double>(n) != v) return false;    // not an integer
+  *out = n;
+  return true;
+}
+
+class StagingHostObject : public jsi::HostObject {
+public:
+  jsi::Value get(jsi::Runtime &rt, const jsi::PropNameID &name) override {
+    const std::string prop = name.utf8(rt);
+
+    if (prop == "stage") {
+      return jsi::Function::createFromHostFunction(
+          rt, name, 3,
+          [](jsi::Runtime &rt, const jsi::Value &, const jsi::Value *args,
+             size_t count) -> jsi::Value {
+            if (gStaging == nullptr) throw jsi::JSError(rt, "overlay staging is not installed");
+            if (count < 3) throw jsi::JSError(rt, "stage(bytes, width, height)");
+
+            if (!args[0].isObject() || !args[0].asObject(rt).isArrayBuffer(rt)) {
+              throw jsi::JSError(rt, "stage expects an ArrayBuffer");
+            }
+            uint64_t w = 0, h = 0;
+            if (!wholeExtent(args[1].asNumber(), &w) || !wholeExtent(args[2].asNumber(), &h)) {
+              throw jsi::JSError(rt, "raster dimensions must be whole positive numbers");
+            }
+            /*
+              Overflow-safe before multiplying, not after.
+
+              `w * h * 4` in 64 bits cannot overflow for extents capped at
+              65536, but the check is written as a division rather than relying
+              on that cap staying where it is.
+            */
+            if (w > kMaxBytes / kBytesPerPixel / h) {
+              throw jsi::JSError(rt, "raster is larger than staging accepts");
+            }
+            const uint64_t expected = w * h * kBytesPerPixel;
+            if (expected == 0 || expected > kMaxBytes) {
+              throw jsi::JSError(rt, "raster is larger than staging accepts");
+            }
+
+            auto buffer = args[0].asObject(rt).getArrayBuffer(rt);
+            const uint64_t length = static_cast<uint64_t>(buffer.size(rt));
+            if (length != expected) {
+              // The descriptor and the payload disagree; writing either would
+              // publish a sidecar the reader must then reject.
+              throw jsi::JSError(rt, "raster byte length does not match its dimensions");
+            }
+
+            uint32_t checksum = 0;
+            std::string token, path, error;
+            if (!gStaging->stage(buffer.data(rt), length, &checksum, &token, &path, &error)) {
+              // No path in the message: an app-private location is not
+              // something a user-facing error should carry.
+              throw jsi::JSError(rt, error);
+            }
+
+            jsi::Object out(rt);
+            out.setProperty(rt, "token", jsi::String::createFromUtf8(rt, token));
+            out.setProperty(rt, "file", jsi::String::createFromUtf8(rt, path));
+            out.setProperty(rt, "byteLength", jsi::Value(static_cast<double>(length)));
+            out.setProperty(rt, "checksum", jsi::Value(static_cast<double>(checksum)));
+            return out;
+          });
+    }
+
+    if (prop == "release") {
+      return jsi::Function::createFromHostFunction(
+          rt, name, 1,
+          [](jsi::Runtime &rt, const jsi::Value &, const jsi::Value *args,
+             size_t count) -> jsi::Value {
+            if (gStaging == nullptr || count < 1 || !args[0].isString()) return jsi::Value(false);
+            return jsi::Value(gStaging->release(args[0].asString(rt).utf8(rt)));
+          });
+    }
+
+    if (prop == "releaseAll") {
+      return jsi::Function::createFromHostFunction(
+          rt, name, 0,
+          [](jsi::Runtime &, const jsi::Value &, const jsi::Value *, size_t) -> jsi::Value {
+            if (gStaging == nullptr) return jsi::Value(0);
+            return jsi::Value(gStaging->releaseAll());
+          });
+    }
+
+    if (prop == "sweep") {
+      return jsi::Function::createFromHostFunction(
+          rt, name, 0,
+          [](jsi::Runtime &, const jsi::Value &, const jsi::Value *, size_t) -> jsi::Value {
+            if (gStaging == nullptr) return jsi::Value(0);
+            return jsi::Value(gStaging->sweep());
+          });
+    }
+
+    if (prop == "ledger") {
+      return jsi::Function::createFromHostFunction(
+          rt, name, 0,
+          [](jsi::Runtime &rt, const jsi::Value &, const jsi::Value *, size_t) -> jsi::Value {
+            uint64_t created = 0, released = 0, live = 0;
+            if (gStaging != nullptr) gStaging->ledger(&created, &released, &live);
+            jsi::Object out(rt);
+            out.setProperty(rt, "created", jsi::Value(static_cast<double>(created)));
+            out.setProperty(rt, "released", jsi::Value(static_cast<double>(released)));
+            out.setProperty(rt, "live", jsi::Value(static_cast<double>(live)));
+            return out;
+          });
+    }
+
+    return jsi::Value::undefined();
+  }
+};
+
+} // namespace
+
+extern "C" JNIEXPORT jboolean JNICALL
+Java_dev_pictor_video_PictorVideoModule_nativeInstallOverlayStaging(
+    JNIEnv *env, jobject, jlong runtimePtr, jstring cacheDir) {
+  if (runtimePtr == 0 || cacheDir == nullptr) return JNI_FALSE;
+  auto *rt = reinterpret_cast<jsi::Runtime *>(runtimePtr);
+
+  const char *chars = env->GetStringUTFChars(cacheDir, nullptr);
+  if (chars == nullptr) return JNI_FALSE;
+  const std::string dir = std::string(chars) + "/" + kDirName;
+  env->ReleaseStringUTFChars(cacheDir, chars);
+
+  gStaging = std::make_shared<Staging>(dir);
+  rt->global().setProperty(
+      *rt, "__pictorOverlayStaging",
+      jsi::Object::createFromHostObject(*rt, std::make_shared<StagingHostObject>()));
+  return JNI_TRUE;
+}

package/android/src/main/cpp/pictor_publish.cpp

@@ -0,0 +1,87 @@
+/*
+  One syscall, because publication has to survive a power cut.
+
+  `open(O_CREAT|O_EXCL)` then `rename` is race-safe — the kernel decides who
+  claims the name — but it is two operations, and a process that dies between
+  them leaves an empty file that looks claimed. Nothing afterwards can tell that
+  from a destination someone meant to create, so it blocks every later
+  `overwrite: false` export to the same path until a human deletes it.
+
+  `renameat2` with `RENAME_NOREPLACE` is the primitive that does not have that
+  shape: it either publishes the complete staging file or reports `EEXIST`, and
+  there is no state in between for a crash to land in.
+
+  It is reached through `syscall(2)` rather than the libc wrapper. Bionic only
+  exposes `renameat2` from API 30, this module supports older devices, and
+  whether the *kernel* has it is a different question from whether the *headers*
+  do — which is exactly the question that has to be answered on the device
+  rather than at build time.
+*/
+
+#include <jni.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+#ifndef RENAME_NOREPLACE
+#define RENAME_NOREPLACE (1 << 0)
+#endif
+
+/*
+  The syscall numbers, for toolchains whose headers predate the call.
+
+  Stable ABI: a syscall number is part of the kernel's contract with userspace
+  and cannot be renumbered, so hard-coding them is safe in a way that
+  hard-coding almost nothing else is.
+*/
+#ifndef __NR_renameat2
+#if defined(__aarch64__)
+#define __NR_renameat2 276
+#elif defined(__arm__)
+#define __NR_renameat2 382
+#elif defined(__i386__)
+#define __NR_renameat2 353
+#elif defined(__x86_64__)
+#define __NR_renameat2 316
+#endif
+#endif
+
+/**
+ * Publish `from` as `to`, refusing to replace anything.
+ *
+ * Returns 0 on success, or the errno. `ENOSYS` means the kernel has no such
+ * call; `EINVAL` means it has the call and this filesystem will not take the
+ * flag. Both are answers about the destination, not about the caller, and the
+ * Kotlin side reads them as "this filesystem cannot do an atomic no-replace".
+ */
+extern "C" JNIEXPORT jint JNICALL
+Java_dev_pictor_video_GateDestination_nativeRenameNoReplace(
+    JNIEnv *env, jobject /* self */, jstring from, jstring to) {
+#ifndef __NR_renameat2
+  (void)env;
+  (void)from;
+  (void)to;
+  return ENOSYS;
+#else
+  const char *fromPath = env->GetStringUTFChars(from, nullptr);
+  if (fromPath == nullptr) {
+    return EINVAL;
+  }
+  const char *toPath = env->GetStringUTFChars(to, nullptr);
+  if (toPath == nullptr) {
+    env->ReleaseStringUTFChars(from, fromPath);
+    return EINVAL;
+  }
+
+  errno = 0;
+  long result =
+      syscall(__NR_renameat2, AT_FDCWD, fromPath, AT_FDCWD, toPath, RENAME_NOREPLACE);
+  int failure = (result == 0) ? 0 : errno;
+
+  env->ReleaseStringUTFChars(from, fromPath);
+  env->ReleaseStringUTFChars(to, toPath);
+  return failure;
+#endif
+}