Harden app runtime and thin export shell

docs/modernization/debt.md

@@ -18,6 +18,23 @@ agent or engineer to remove them without reconstructing context from chat.
 
 ## Reductions
 
+- 2026-06-17: `DEBT-0003` was narrowed again. `src/app_runtime.cpp` and
+  `src/app_runtime.h` now synchronize render/UI worker running state, reject
+  cross-thread work once those workers stop, and drain queued work through
+  explicit runtime-owned post/shutdown semantics consumed by
+  `src/legacy_app_runtime_shell_services.cpp`; broader singleton reach, app
+  shell ownership, and remaining runtime service adoption still remain.
+- 2026-06-17: `DEBT-0017` was narrowed again.
+  `cmake/PanoPainterSources.cmake` no longer compiles
+  `${PP_PLATFORM_WEB_SOURCES}` into `PP_PANOPAINTER_APP_SOURCES`, so root app
+  source ownership no longer mixes live Web platform implementation files into
+  the retained app group; broader platform entrypoint/package cleanup remains.
+- 2026-06-17: `DEBT-0043` was narrowed again.
+  `src/legacy_canvas_document_io_services.cpp` now delegates the live
+  equirectangular export family through `src/legacy_document_export_services.*`
+  instead of carrying that orchestration inline with the broader canvas
+  document-I/O shell; retained export directory creation, Web handoff, and
+  remaining legacy `Canvas` export execution still remain.
 - 2026-06-17: `DEBT-0003` was narrowed again.
   `src/platform_windows/windows_runtime_flow.*` now owns the live Win32
   startup/session composition flow, including the bound app/session preflight

docs/modernization/roadmap.md

@@ -76,12 +76,12 @@ Current conclusion:
   debt.
 - Renderer API contracts exist, but retained OpenGL resource classes still leak
   into app/UI/document code.
-- `AppRuntime` is a useful step toward owned queues, but thread affinity and
-  shutdown safety are still expressed mostly by convention, mutable booleans,
-  and singleton call sites.
-- Platform extraction improved substantially, but CMake and entrypoint cleanup
-  are not complete. In particular, Web platform sources still appear inside
-  `PP_PANOPAINTER_APP_SOURCES`, even though `pp_platform_web` also exists.
+- `AppRuntime` now owns synchronized running flags and explicit
+  same-thread/post-reject queue behavior, but broader app/runtime singleton
+  reach and retained shell ownership still remain.
+- Platform extraction improved substantially and the root app source group no
+  longer compiles Web platform sources directly, but broader CMake and
+  entrypoint cleanup are not complete.
 
 ## Target Architecture
 

docs/modernization/tasks.md

@@ -55,11 +55,9 @@ Key facts:
 - Raw `Node*` and callback captures remain a dominant UI lifetime risk.
 - `RTT`, `Texture2D`, `Shape`, `Shader`, `Font`, and `CanvasLayer` still route
   render work through `App::I` queues.
-- `AppRuntime` uses `std::jthread`, which is progress, but queue ownership,
-  running flags, thread affinity, and shutdown contracts are not yet component
-  contracts.
-- `PP_PANOPAINTER_APP_SOURCES` still includes `${PP_PLATFORM_WEB_SOURCES}`,
-  which should be removed in favor of concrete `pp_platform_web` ownership.
+- `AppRuntime` now owns synchronized running flags plus explicit post/reject,
+  same-thread execution, and queue-drain behavior, but broader singleton reach
+  and app-shell ownership remain.
 
 ## Parallel Assignment Rules