Harden app runtime and thin export shell

docs/modernization/roadmap.md

@@ -76,12 +76,12 @@ Current conclusion:
   debt.
 - Renderer API contracts exist, but retained OpenGL resource classes still leak
   into app/UI/document code.
-- `AppRuntime` is a useful step toward owned queues, but thread affinity and
-  shutdown safety are still expressed mostly by convention, mutable booleans,
-  and singleton call sites.
-- Platform extraction improved substantially, but CMake and entrypoint cleanup
-  are not complete. In particular, Web platform sources still appear inside
-  `PP_PANOPAINTER_APP_SOURCES`, even though `pp_platform_web` also exists.
+- `AppRuntime` now owns synchronized running flags and explicit
+  same-thread/post-reject queue behavior, but broader app/runtime singleton
+  reach and retained shell ownership still remain.
+- Platform extraction improved substantially and the root app source group no
+  longer compiles Web platform sources directly, but broader CMake and
+  entrypoint cleanup are not complete.
 
 ## Target Architecture