Stabilize startup and cloud dialog runtime

docs/modernization/build-inventory.md

@@ -68,6 +68,7 @@ powershell -ExecutionPolicy Bypass -File scripts\automation\quiet-validate.ps1 -
 powershell -ExecutionPolicy Bypass -File scripts\automation\quiet-validate.ps1 -BuildTargets pp_app_core_app_dialog_tests,pp_ui_core_overlay_lifetime_tests -TestRegex "pp_(app_core_app_dialog|ui_core_(node_lifetime|overlay_lifetime))"
 powershell -ExecutionPolicy Bypass -File scripts\automation\quiet-validate.ps1 -BuildTargets PanoPainter,pano_cli -TestRegex "pp_app_core|pano_cli_plan" -IncludePlatformBuild
 powershell -ExecutionPolicy Bypass -File scripts\automation\quiet-validate.ps1 -BuildTargets PanoPainter,pano_cli -TestRegex "pp_app_core|pano_cli_plan" -IncludePlatformBuild -IncludeAppleRemote
+powershell -ExecutionPolicy Bypass -File scripts\automation\run-debugger.ps1 -BreakOnFirstChanceAccessViolation
 ```
 
 Use the standalone quiet helpers only when you need to isolate those gates from
@@ -75,6 +76,10 @@ the bundled run. `platform-build.ps1 -Quiet` writes per-preset logs under
 `out/logs/platform-build`. `apple-remote-build.ps1 -Quiet` writes the local SSH
 session log under `out/logs/apple-remote-build` and reports the remote
 `out/logs/apple-platform-build-*.log` path in its JSON output.
+`run-debugger.ps1` is the repeatable Windows startup-debug helper for local
+`PanoPainter.exe` sessions; it resolves `cdb.exe`, writes a command file and
+log under `out/logs/debugger`, and can break on first-chance access violations
+without relying on fragile shell quoting.
 
 On Windows, the quiet wrapper is also the safest generator-compatibility path:
 it prefers the VS-bundled CMake that knows the `Visual Studio 18 2026`

docs/modernization/debt.md

@@ -77,6 +77,18 @@ agent or engineer to remove them without reconstructing context from chat.
   through `AppRuntime::canvas_async_task` instead of a file-static worker
   singleton, while retained prompt/progress lifetime, OpenGL context guards,
   thumbnail loading, and transfer execution still remain in the cloud bridge.
+- 2026-06-17: `DEBT-0038` was narrowed again. The retained cloud-browse dialog
+  in `src/node_dialog_cloud.cpp` no longer mutates the legacy UI tree directly
+  from its thumbnail loader worker; file-list population, error text updates,
+  and thumbnail attachment now queue onto `AppRuntime`'s UI task path and drop
+  safely when the dialog is already closed, reducing a cancel-time deadlock
+  risk while the broader retained cloud dialog and transfer flow still remain.
+- 2026-06-17: `DEBT-0031`/`DEBT-0030` were narrowed again.
+  `src/legacy_file_menu_binding_services.cpp` no longer stores File-menu popup
+  callbacks that capture a stack-local binding service object through `this`;
+  retained File-menu and export-submenu actions now capture explicit `App&`,
+  popup root, and overlay handles, removing a startup/runtime lifetime hazard
+  while retained file/export execution still lives in the app shell.
 - 2026-06-17: `DEBT-0048` was narrowed again. The retained ABR/PPBR import path
   in `src/legacy_brush_package_import_services.cpp` now uses
   `AppRuntime::canvas_async_task` instead of a file-static worker singleton,

docs/modernization/roadmap.md

@@ -100,6 +100,12 @@ Current conclusion:
   `src/app_layout_sidebar.cpp`, and `src/app_dialogs_info_openers.cpp` are
   thinner adapters even though broader retained dialog/sidebar execution still
   remains.
+- Startup stability improved materially: the legacy UI loader now uses virtual
+  attribute parsing again, `NodeComboBox` no longer trusts invalid/empty item
+  state, the extracted File-menu binding no longer stores callbacks that capture
+  a dead stack service object, and the cloud-browse dialog now queues thumbnail
+  list/icon updates onto the UI thread instead of mutating the legacy UI tree
+  directly from its worker thread.
 - Platform extraction improved substantially and the root app source group no
   longer compiles Web platform sources directly, but broader CMake and
   entrypoint cleanup are not complete.

docs/modernization/tasks.md

@@ -138,6 +138,12 @@ Key facts:
   document export start/branching flows live in
   `src/legacy_document_export_services.*`, and the PPBR dialog opener now lives
   in `src/legacy_brush_package_export_services.*`.
+- The startup/runtime stability slice narrowed several live risks at once: the
+  legacy UI loader again routes XML attributes through virtual node parsers,
+  `NodeComboBox` now guards empty and out-of-range item state, the extracted
+  File-menu binding no longer leaves click callbacks pointing at a dead stack
+  service object, and the cloud-browse dialog now queues file-list/thumbnail UI
+  updates onto the UI thread instead of mutating nodes directly from its worker.
 
 ## Parallel Assignment Rules