Harden runtime flags and thin Apple/canvas seams

docs/modernization/debt.md

@@ -18,6 +18,22 @@ agent or engineer to remove them without reconstructing context from chat.
 
 ## Reductions
 
+- 2026-06-16: `DEBT-0003` was narrowed again. The Windows main-loop run-state
+  and VR worker coordination flags in `src/main.cpp` now use `std::atomic`
+  instead of unsynchronized globals; retained Win32 entrypoint ownership,
+  global app singleton reach, and broader runtime coupling remain.
+- 2026-06-16: `DEBT-0017` was narrowed again. Retained Apple ObjC handles plus
+  storage paths now live behind one local helper in
+  `src/platform_legacy/legacy_platform_services.cpp`, and the iOS SonarPen
+  bridge now starts through that retained Apple state instead of reading
+  `App::I` inside the bridge body; the retained Apple fallback adapter and
+  broader platform-to-app singleton reach remain.
+- 2026-06-16: `DEBT-0036` was narrowed again. `NodeCanvas` smoothing-mask face
+  shader setup plus per-face draw execution now route through
+  `execute_legacy_canvas_draw_merge_smask_faces(...)` in
+  `src/legacy_canvas_draw_merge_services.h` instead of spelling that pass out
+  inline in `NodeCanvas::draw()`; broader canvas draw orchestration and
+  retained GL resource ownership remain.
 - 2026-06-16: `DEBT-0036` was narrowed again. `NodeCanvas` merged-path
   per-plane merged-texture draw execution now routes through
   `execute_legacy_canvas_draw_merge_layer_texture(...)` instead of spelling out

docs/modernization/roadmap.md

@@ -102,7 +102,9 @@ Current architecture mismatches that must be treated as real blockers:
   context hooks plus iOS main-render-target binding now route through the same
   bridge style, as do Apple crash-test, app-close, and iOS SonarPen hooks,
   while Linux/Web GLFW render-context acquire/present and Linux app-close now
-  route through retained local GLFW callback hooks.
+  route through retained local GLFW callback hooks, and retained Apple ObjC
+  handles plus storage paths now sit behind one local `platform_legacy`
+  helper instead of being re-read through `App::I` in each touched path.
 - `src/platform_legacy/legacy_platform_services.*` is still part of the live
   app shell.
 - `pp_panopainter_ui` still depends on `pp_legacy_app`.
@@ -112,8 +114,8 @@ Current architecture mismatches that must be treated as real blockers:
   sequencing, per-layer/per-plane retained draw execution, and shared
   checkerboard background setup now route through retained draw-merge helpers,
   with the cache-to-screen checkerboard-plane callback setup also reduced and
-  the merged-path per-plane merged-texture draw now routed through the same
-  retained helper family.
+  the merged-path per-plane merged-texture draw plus the smoothing-mask face
+  shader/draw pass now routed through the same retained helper family.
 - `app_layout.cpp` and `app_dialogs.cpp` are still mixed shell/controller files
   rather than thin composition/binding surfaces.
 - `App`, `Canvas`, `Node`, retained workers, and platform entrypoints still use
@@ -124,8 +126,9 @@ Current architecture mismatches that must be treated as real blockers:
   `AppRuntime` now owns render/UI workers with explicit `std::jthread`
   shutdown semantics while the Windows splash-dialog and HMD renderer workers
   also use owned `std::jthread` lifecycle, `LogRemote` now uses the same
-  ownership model, and the Windows VR device now has explicit `std::unique_ptr`
-  ownership instead of raw global lifetime.
+  ownership model, the Windows VR device now has explicit `std::unique_ptr`
+  ownership instead of raw global lifetime, and the Windows main-loop/VR
+  coordination flags now use `std::atomic` instead of unsynchronized globals.
 - Modern C++23 usage exists in extracted components, especially `std::span`,
   explicit result/status objects, and a few concepts, but the live app still
   does not consistently express ownership, thread affinity, or renderer

docs/modernization/tasks.md

@@ -143,6 +143,10 @@ Current slice:
   draw, heightmap draw, and current-mode draw now also route through
   `execute_legacy_canvas_draw_merge_post_draw(...)`, but broader canvas draw
   orchestration is still inline.
+- `NodeCanvas` smoothing-mask face shader setup plus per-face draw execution
+  now also route through
+  `execute_legacy_canvas_draw_merge_smask_faces(...)`, but the node still owns
+  the broader canvas draw flow and renderer-state sequencing around that seam.
 - `NodeCanvas` non-`draw_merged` per-layer/per-plane retained draw execution
   now also routes through `execute_legacy_canvas_draw_merge_layer_plane(...)`,
   but the node still owns substantial live layer traversal and renderer state
@@ -335,6 +339,8 @@ Current slice:
   live in `AppRuntime`
 - `AppRuntime` render/UI worker ownership now also uses `std::jthread` plus
   explicit stop requests instead of raw `std::thread`
+- Windows main-loop run-state and VR worker coordination flags in `main.cpp`
+  now use `std::atomic` ownership instead of unsynchronized globals
 - retained `App` composition, task call sites, and platform/runtime entrypoint
   coupling are still not fully reduced behind the runtime contract
 
@@ -604,6 +610,9 @@ Current slice:
 - Apple crash-test, app-close, and iOS SonarPen hooks now also route through
   explicit Apple bridge callbacks instead of direct `App::I` calls in
   `LegacyPlatformServices`
+- retained Apple ObjC handles plus storage paths now live in one local
+  `platform_legacy` helper, and the iOS SonarPen bridge now starts through
+  that retained Apple state instead of reading `App::I` inside the bridge body
 - Linux/Web GLFW render-context acquire/present hooks and Linux app-close now
   also route through retained local GLFW callback hooks instead of direct
   method-body `App::I` access in `LegacyPlatformServices`