Own runtime threads and thin platform/canvas seams

docs/modernization/roadmap.md

@@ -97,21 +97,25 @@ Current architecture mismatches that must be treated as real blockers:
 - `src/platform_apple/apple_platform_services.cpp` no longer reaches `App::I`
   directly, and Linux FPS title reporting now uses an injected callback, but
   retained Apple bridging in `platform_legacy` and other platform/app coupling
-  remain.
+  remain, even though iOS keyboard visibility and prepared-file save handoff
+  now also route through explicit Apple bridge callbacks.
 - `src/platform_legacy/legacy_platform_services.*` is still part of the live
   app shell.
 - `pp_panopainter_ui` still depends on `pp_legacy_app`.
 - `Canvas`, `NodeCanvas`, and `NodeStrokePreview` still own too much live
   OpenGL execution around the renderer boundary, even though `NodeCanvas`
-  display resolve, cache-to-screen composite, and post-draw mask/grid/current-
-  mode sequencing now route through retained draw-merge helpers.
+  display resolve, cache-to-screen composite, post-draw mask/grid/current-mode
+  sequencing, and per-layer/per-plane retained draw execution now route
+  through retained draw-merge helpers.
 - `app_layout.cpp` and `app_dialogs.cpp` are still mixed shell/controller files
   rather than thin composition/binding surfaces.
 - `App`, `Canvas`, `Node`, retained workers, and platform entrypoints still use
   global singleton reach, raw observer pointers, retained static worker
   ownership in several app families, and ad hoc mutex/condition-variable
   ownership, even though most previously detached or raw app-facing worker
-  launches now use owned `std::jthread` or service-owned worker queues.
+  launches now use owned `std::jthread` or service-owned worker queues and
+  `AppRuntime` now owns render/UI workers with explicit `std::jthread`
+  shutdown semantics.
 - Modern C++23 usage exists in extracted components, especially `std::span`,
   explicit result/status objects, and a few concepts, but the live app still
   does not consistently express ownership, thread affinity, or renderer