Redesign span layout around retained placement

AGENTS.md

@@ -443,16 +443,16 @@ Each exists because something was invisible without it.
   `ArrBuf` reallocated on every length change, so adding one glyph made
   the buffer's contents undefined and forced a full rewrite; a redraw
   freed its primitives and pushed new ones, which -- since freed slots
-  are only reusable next frame and `Painter::draw_twice` nests -- grew
+  are only reusable next frame and provisional layout nested -- grew
   the arena to **127,443 slots for 11,569 live primitives**; and nothing
   tracked *which* entries changed. Now: the stream arena is 11,569 slots
   for 11,569 live, and every array uploads within a hair of its floor
-  (fling instances 3.4% against a 3.3% floor, stream glyphs 0.6% against
-  0.6%). The CPU half improved with it, since the freeing and renumbering
+  (fling instances 1.0% against a 0.9% floor, stream instances 71.9%
+  against 71.8%, and stream glyphs 0.6% against 0.6%). The CPU half improved with it, since the freeing and renumbering
   went away: a streamed frame is p50 1.39ms, from 2.20ms.
 
-  **Stream instances sit at 72.7%, which is the floor and not a defect
-  here.** The list is pinned to the newest end, so a growing reply moves
+  **Stream instances sit at 71.9%, against a 71.8% floor, and dirty
+  tracking is not the defect here.** The list is pinned to the newest end, so a growing reply moves
   every row, and a row's instances carry an absolute region. That is a
   `move_offsets` write the layout is not making -- the next thing to look
   at, and a layout question rather than an upload one.
@@ -532,9 +532,7 @@ thing to suspect first if a remote spawn ever mangles an argument.
 
 ## Where things run (host vs this VM)
 
-The machine itself — the two boxes, the shared `~/repos` mount, and why the
-VM is untrusted — is described once in `~/.claude/MACHINE.md`. What that
-means here:
+This checkout runs in a VM while production runs on its host:
 
 - **`ai-server` belongs on the host in production.** That is where the LAN
   address the phone can reach is, and where WireGuard terminates.
@@ -626,8 +624,7 @@ where it was instead of half-deleted.
 
 ## Things that have bitten
 
-Project-specific only — a lesson that would bite any project on this machine
-belongs in `~/.claude/TOOLCHAIN.md` or `~/.claude/MACHINE.md` instead.
+Project-specific only; keep cross-project machine notes out of this file.
 
 - **tracing caches callsite interest process-wide.** A test that hits a
   `tracing::warn!` with no subscriber installed can poison the interest cache