Own runtime threads and thin platform/canvas seams

docs/modernization/debt.md

@@ -18,6 +18,24 @@ agent or engineer to remove them without reconstructing context from chat.
 
 ## Reductions
 
+- 2026-06-16: `DEBT-0036` was narrowed again. `NodeCanvas` non-`draw_merged`
+  per-layer/per-plane retained draw execution now routes through
+  `execute_legacy_canvas_draw_merge_layer_plane(...)` in
+  `src/legacy_canvas_draw_merge_services.h` instead of keeping the erase,
+  temporary paint/composite, regular texture, and optional blend path fully
+  inline in `NodeCanvas::draw()`; retained layer traversal and broader canvas
+  renderer orchestration remain.
+- 2026-06-16: `DEBT-0003` was narrowed again. `AppRuntime` now owns its
+  render/UI worker threads as `std::jthread` with explicit stop requests in
+  `src/app_runtime.cpp` and `src/app_runtime.h` instead of raw `std::thread`
+  ownership; retained app task call sites, singleton composition, and broader
+  runtime/platform coupling remain.
+- 2026-06-16: `DEBT-0017`/`DEBT-0053` were narrowed again. iOS virtual-keyboard
+  visibility and prepared-file save handoff now route through explicit Apple
+  bridge callbacks in `src/platform_apple/apple_platform_services.*` consumed
+  by `src/platform_legacy/legacy_platform_services.cpp` instead of direct
+  `App::I` calls in those legacy platform methods; the retained Apple fallback
+  adapter and broader platform singleton reach remain.
 - 2026-06-16: `DEBT-0036` was narrowed again. `NodeCanvas` smoothing-mask
   overlay draw, smoothing-mask face pass, grid keepalive draw, heightmap draw,
   and current-mode draw now route through

docs/modernization/roadmap.md

@@ -97,21 +97,25 @@ Current architecture mismatches that must be treated as real blockers:
 - `src/platform_apple/apple_platform_services.cpp` no longer reaches `App::I`
   directly, and Linux FPS title reporting now uses an injected callback, but
   retained Apple bridging in `platform_legacy` and other platform/app coupling
-  remain.
+  remain, even though iOS keyboard visibility and prepared-file save handoff
+  now also route through explicit Apple bridge callbacks.
 - `src/platform_legacy/legacy_platform_services.*` is still part of the live
   app shell.
 - `pp_panopainter_ui` still depends on `pp_legacy_app`.
 - `Canvas`, `NodeCanvas`, and `NodeStrokePreview` still own too much live
   OpenGL execution around the renderer boundary, even though `NodeCanvas`
-  display resolve, cache-to-screen composite, and post-draw mask/grid/current-
-  mode sequencing now route through retained draw-merge helpers.
+  display resolve, cache-to-screen composite, post-draw mask/grid/current-mode
+  sequencing, and per-layer/per-plane retained draw execution now route
+  through retained draw-merge helpers.
 - `app_layout.cpp` and `app_dialogs.cpp` are still mixed shell/controller files
   rather than thin composition/binding surfaces.
 - `App`, `Canvas`, `Node`, retained workers, and platform entrypoints still use
   global singleton reach, raw observer pointers, retained static worker
   ownership in several app families, and ad hoc mutex/condition-variable
   ownership, even though most previously detached or raw app-facing worker
-  launches now use owned `std::jthread` or service-owned worker queues.
+  launches now use owned `std::jthread` or service-owned worker queues and
+  `AppRuntime` now owns render/UI workers with explicit `std::jthread`
+  shutdown semantics.
 - Modern C++23 usage exists in extracted components, especially `std::span`,
   explicit result/status objects, and a few concepts, but the live app still
   does not consistently express ownership, thread affinity, or renderer

docs/modernization/tasks.md

@@ -137,6 +137,10 @@ Current slice:
   draw, heightmap draw, and current-mode draw now also route through
   `execute_legacy_canvas_draw_merge_post_draw(...)`, but broader canvas draw
   orchestration is still inline.
+- `NodeCanvas` non-`draw_merged` per-layer/per-plane retained draw execution
+  now also routes through `execute_legacy_canvas_draw_merge_layer_plane(...)`,
+  but the node still owns substantial live layer traversal and renderer state
+  orchestration.
 
 Write scope:
 - `src/node_stroke_preview.cpp`
@@ -313,13 +317,21 @@ Mini-model packet:
 
 #### ARC-APP-004 - Move Render/UI Queues Into An Owned App Runtime Service
 
-Status: Ready
+Status: In Progress
 
 Why now:
 `App` still owns static render/UI queues, mutexes, condition variables, and
 thread ids. That makes thread safety hard to reason about and keeps platform
 entrypoints coupled to the singleton.
 
+Current slice:
+- render/UI queues, mutexes, condition variables, and thread identity already
+  live in `AppRuntime`
+- `AppRuntime` render/UI worker ownership now also uses `std::jthread` plus
+  explicit stop requests instead of raw `std::thread`
+- retained `App` composition, task call sites, and platform/runtime entrypoint
+  coupling are still not fully reduced behind the runtime contract
+
 Write scope:
 - `src/app.h`
 - `src/app.cpp`
@@ -570,6 +582,9 @@ Current slice:
 - `LegacyPlatformServices::prepare_storage_paths()` now routes Apple path
   preparation through a narrow local helper instead of reading `App::I`
   directly in that method body
+- iOS virtual-keyboard visibility and prepared-file save handoff now also route
+  through explicit Apple bridge callbacks instead of direct `App::I` calls in
+  `LegacyPlatformServices`
 - retained Apple callback injection and broader `platform_legacy` singleton
   reach are still open