Own grid workers and thin Apple platform bridge

docs/modernization/debt.md

@@ -18,6 +18,27 @@ agent or engineer to remove them without reconstructing context from chat.
 
 ## Reductions
 
+- 2026-06-16: `DEBT-0051`/`DEBT-0052`/`DEBT-0055` were narrowed again.
+  `src/platform_apple/apple_platform_services.*` no longer reaches `App::I`
+  for clipboard, display/share, cursor-visibility, or save-ui-state behavior;
+  those calls now flow through narrow injected Apple bridge callbacks from
+  `src/platform_legacy/legacy_platform_services.cpp`, while retained Apple
+  bridge construction and broader platform singleton reach remain.
+- 2026-06-16: `DEBT-0036` was narrowed again. `NodeCanvas` density-resolve
+  display execution now routes through
+  `legacy_canvas_draw_merge_services.h` instead of living inline in
+  `NodeCanvas::draw()`; the cache-to-screen composite block and broader canvas
+  draw orchestration remain retained.
+- 2026-06-16: `DEBT-0053` was narrowed again. `App::pick_file_save(...)` no
+  longer launches a detached worker for background prepared-file writes; it
+  now uses a service-owned `std::jthread` queue and posts prepared-file save
+  completion back to the UI thread, while retained platform save/download
+  handoff execution remains.
+- 2026-06-16: `DEBT-0036` was narrowed again. The retained grid lightmap
+  launch in `src/legacy_grid_ui_services.cpp` no longer uses a detached
+  worker thread; it now uses a service-owned `std::jthread` queue with
+  UI-thread state handoff, while retained bake execution and grid rendering
+  ownership remain.
 - 2026-06-16: `DEBT-0048` was narrowed again. The retained ABR/PPBR import
   bridge in `src/legacy_brush_package_import_services.cpp` no longer launches
   detached worker threads; it now uses a service-owned `std::jthread` queue,

docs/modernization/roadmap.md

@@ -94,10 +94,10 @@ Current architecture mismatches that must be treated as real blockers:
 
 - `pp_platform_api` still compiles Apple implementation files instead of only
   platform-neutral policy and interface code.
-- `src/platform_apple/apple_platform_services.cpp` and
-  parts of the concrete platform layer still reach `App::I`; Linux FPS title
-  reporting now uses an injected callback, but Apple singleton reach and other
-  platform/app coupling remain.
+- `src/platform_apple/apple_platform_services.cpp` no longer reaches `App::I`
+  directly, and Linux FPS title reporting now uses an injected callback, but
+  retained Apple bridging in `platform_legacy` and other platform/app coupling
+  remain.
 - `src/platform_legacy/legacy_platform_services.*` is still part of the live
   app shell.
 - `pp_panopainter_ui` still depends on `pp_legacy_app`.
@@ -107,7 +107,8 @@ Current architecture mismatches that must be treated as real blockers:
   rather than thin composition/binding surfaces.
 - `App`, `Canvas`, `Node`, retained workers, and platform entrypoints still use
   global singleton reach, raw observer pointers, detached `std::thread`
-  launches, and ad hoc mutex/condition-variable ownership.
+  launches in several canvas/export/preview paths, and ad hoc
+  mutex/condition-variable ownership.
 - Modern C++23 usage exists in extracted components, especially `std::span`,
   explicit result/status objects, and a few concepts, but the live app still
   does not consistently express ownership, thread affinity, or renderer

docs/modernization/tasks.md

@@ -42,13 +42,15 @@ Completed, blocked, and superseded task history moved to
   `src/node_canvas.cpp`, `src/app.cpp`, and `src/app_dialogs.cpp`.
 - The platform boundary is not finished:
   - `pp_platform_api` still compiles Apple implementation files
-  - Apple platform services still reach `App::I`
-  - Linux FPS title reporting now uses an injected callback, but broader
-    platform-to-app singleton reach is still open
+  - `platform_apple` no longer reaches `App::I` directly, and Linux FPS title
+    reporting now uses an injected callback, but retained Apple bridging and
+    broader platform-to-app singleton reach are still open in
+    `platform_legacy`
   - `platform_legacy` is still part of the live app shell
 - The app runtime boundary is not finished:
   - render/UI queues are static `App` state
-  - detached workers still launch from canvas, grid, preview, and event code
+  - detached workers still launch from canvas, preview, document export, and
+    recording code
   - thread-affinity rules are enforced by convention and asserts instead of
     explicit runtime contracts
 - The UI ownership boundary is not finished:
@@ -125,6 +127,9 @@ Current slice:
 - `NodeStrokePreview` final composite plus preview-texture copy now route
   through `legacy_node_stroke_preview_execution_services.h`, but the preview
   node still owns most live-pass and retained GL resource execution.
+- `NodeCanvas` display resolve for the `m_density != 1.f` path now routes
+  through `legacy_canvas_draw_merge_services.h`, but the cache-to-screen
+  composite block and broader canvas draw orchestration are still inline.
 
 Write scope:
 - `src/node_stroke_preview.cpp`
@@ -348,7 +353,10 @@ Current slice:
   moving behind owned runtime/service objects
 - brush package import/export now use service-owned `std::jthread` workers and
   UI-thread completion handoff
-- canvas, grid, preview, and event-side detached work is still open
+- prepared-file save work and grid lightmap launch now also use service-owned
+  workers with explicit UI-thread handoff
+- canvas, preview, document export, and recording-side detached work are still
+  open
 
 Write scope:
 - `src/canvas.cpp`
@@ -547,8 +555,10 @@ which means the platform layer is not a platform layer yet.
 Current slice:
 - Linux FPS title updates now route through an injected callback installed from
   `App::set_platform_services()`
-- Apple singleton reach and the remaining platform callback surface are still
-  open
+- `platform_apple` clipboard, display/share, cursor, and save-ui-state calls
+  now route through injected Apple bridge callbacks instead of `App::I`
+- retained Apple callback injection and broader `platform_legacy` singleton
+  reach are still open
 
 Write scope:
 - `src/platform_apple/*`