docs(stereo-camera): Android design proposal (ownership, browser path, privacy, phases)

[dfattal]

Design proposal, no code: how to bring XR_DXR_stereo_camera (ADR-043) to the Android tablets so the DisplayXR Browser can offer the stereo pair to pages for 3D calls, as it now does on Windows.

New: docs/roadmap/stereo-camera-android.md. Touched: a pointer paragraph in docs/roadmap/stereo-camera-source.md §C, plus an index line in docs/README.md.

Base: main, because ADR-043, the spec and the roadmap are on main. The runtime code it cites is on feat/stereo-camera-r3 @ b567f3203 (#1819), and those citations are marked r3:. The §C pointer touches the same file #1819 edits heavily, so expect a trivial conflict on whichever lands second.

Recommendation

• Rear pair first. It does not conflict with head tracking (measured).
• Front pair, near term: option R. The runtime satellite that weaves for the browser's package owns the Camera2 pair and drives the vendor's in-app tracking from the same capture. Other apps' tracking pauses during a call, and in-process apps are refused the front pair.
• End state: option V. The vendor tracking service owns the pair and shares frames. This is consistent with OEM R7 and multi-app.
• Browser: the B1 factory on Android, with a CAMERA_CONSUMER connection from the capture process. That connection lands in the same satellite, because the slot broker reuses the slot for the same package. CPU NV12 first, AHB later. It is independent of browser-pvt#175.
• Privacy: Android identity is package + signing certificate. R3's executable path does not identify Android apps.

Findings the doc records

• android_package_is_visible reports package visibility, not foreground, so spec §7.1 misuses it.
• pid_has_visible_window() returns true on Android.
• xrt_plugin_stereo_camera_frame has no struct_size. Zero-copy therefore needs an appended stereo_camera_wait_frame2 slot.
• The vendor SDK's C API carries per-camera intrinsics, not only rotations. Whether the devices populate them is open.

Phases

A0a/A0b (cheapest de-risk; tablet) → A1 rear pair → A2 Android privacy → B2a browser rear → A3 front pair (option R; vendor) → B2b product gate → A4 AHB/GPU. Option V runs in parallel. Each phase has a checkable gate.

Checks

• Ran locally: check_doc_paths.py, gen_adr_index.py --check, gen_extensions_index.py --check.
• No device was touched and nothing was built.

🤖 Generated with Claude Code