Track UI lifetime safety in roadmap

docs/modernization/roadmap.md

@@ -461,7 +461,13 @@ also upload those six composited faces through the renderer-neutral
 explicit-transition command streams.
 `pp_ui_core` has started with XML-layout-facing
 length parsing, color parsing, tinyxml-backed layout XML parsing, and invalid
-input tests.
+input tests. Retained `Node` tree lifetime safety is now an explicit
+modernization track under `DEBT-0063`: the current UI still mixes raw parent
+and lookup pointers, public mutable child ownership, raw callback targets, and
+manual destroy flags. `pp_ui_core` should introduce owned tree/handle APIs,
+scoped callback connections, mutation-safe event dispatch, and focused
+destroy-during-callback tests before broad `NodePanel*`/`NodeDialog*`
+migration accelerates.
 `pano_cli inspect-image` exposes PNG IHDR metadata as JSON,
 `pano_cli import-image` accepts a PNG path and imports decoded RGBA8 pixels
 into a new pure `pp_document` face payload,
@@ -1169,6 +1175,12 @@ Implementation tasks:
   - document/layer model
   - serializer
   - UI core headers
+- Make UI lifetime safety a first-class extraction criterion:
+  - define a `pp_ui_core` ownership model for the retained `Node` tree
+  - replace raw callback targets with scoped connections or checked handles
+  - move panel/dialog side effects toward app-core command dispatch
+  - test destroy-during-callback, capture release, popup close, and layout
+    reload mutation cases before replacing retained UI nodes wholesale
 - Keep facade shims where needed, but debt-track every shim.
 - Avoid large behavioral rewrites during extraction.
 - Each extracted component gets a focused test suite before moving to the next.