Harden runtime flags and thin Apple/canvas seams

docs/modernization/roadmap.md

@@ -102,7 +102,9 @@ Current architecture mismatches that must be treated as real blockers:
   context hooks plus iOS main-render-target binding now route through the same
   bridge style, as do Apple crash-test, app-close, and iOS SonarPen hooks,
   while Linux/Web GLFW render-context acquire/present and Linux app-close now
-  route through retained local GLFW callback hooks.
+  route through retained local GLFW callback hooks, and retained Apple ObjC
+  handles plus storage paths now sit behind one local `platform_legacy`
+  helper instead of being re-read through `App::I` in each touched path.
 - `src/platform_legacy/legacy_platform_services.*` is still part of the live
   app shell.
 - `pp_panopainter_ui` still depends on `pp_legacy_app`.
@@ -112,8 +114,8 @@ Current architecture mismatches that must be treated as real blockers:
   sequencing, per-layer/per-plane retained draw execution, and shared
   checkerboard background setup now route through retained draw-merge helpers,
   with the cache-to-screen checkerboard-plane callback setup also reduced and
-  the merged-path per-plane merged-texture draw now routed through the same
-  retained helper family.
+  the merged-path per-plane merged-texture draw plus the smoothing-mask face
+  shader/draw pass now routed through the same retained helper family.
 - `app_layout.cpp` and `app_dialogs.cpp` are still mixed shell/controller files
   rather than thin composition/binding surfaces.
 - `App`, `Canvas`, `Node`, retained workers, and platform entrypoints still use
@@ -124,8 +126,9 @@ Current architecture mismatches that must be treated as real blockers:
   `AppRuntime` now owns render/UI workers with explicit `std::jthread`
   shutdown semantics while the Windows splash-dialog and HMD renderer workers
   also use owned `std::jthread` lifecycle, `LogRemote` now uses the same
-  ownership model, and the Windows VR device now has explicit `std::unique_ptr`
-  ownership instead of raw global lifetime.
+  ownership model, the Windows VR device now has explicit `std::unique_ptr`
+  ownership instead of raw global lifetime, and the Windows main-loop/VR
+  coordination flags now use `std::atomic` instead of unsynchronized globals.
 - Modern C++23 usage exists in extracted components, especially `std::span`,
   explicit result/status objects, and a few concepts, but the live app still
   does not consistently express ownership, thread affinity, or renderer