Record the sixth sweep, and the base every sweep should have used

PR #19's base is upstream/main at ca2b4b2, not the local `main`, which
tracks the fork's divergent line and sits four merged pull requests behind
it. Diffing against `main` shows #10, #12, #16 and #17 as this branch's
work; that is how the parley text migration's undo path kept surfacing in
sweeps. Git cannot record a pull request's base and `main` cannot be
renamed, so the handoff carries the note and the checkout carries
`git iris-base`/`git iris-diff`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/HANDOFF.md

@@ -39,6 +39,40 @@ Two checkouts share one Git storage: `/home/bob/repos/iris` is the active
 `layout/one-ask` worktree, and `ai-app-2/iris` stays on `main` at the app's
 `32f6ad8` pin until the integration below is ready.
 
+### The base is `upstream/main`, not `main`
+
+**Diff this branch against `upstream/main`. The local `main` is the wrong
+base and gives a plausible-looking wrong answer.** PR #19 is
+`iris-ai/iris:layout/one-ask` into `iris/iris:main`, which is the `upstream`
+remote, at `ca2b4b2`. Local `main` tracks `origin/main` -- the *fork's* line,
+which carries the app's own commits, is not an ancestor of upstream's main,
+and sits four merged pull requests behind it (#10 parley text, #12 pointer
+routing, #16 draw/size merge, #17 headless rig).
+
+    git diff main...layout/one-ask             # WRONG -- base 7b54aaf
+    git diff upstream/main...layout/one-ask    # right -- base ca2b4b2
+
+`git iris-base` and `git iris-diff` are configured in this checkout and use
+the right one. The authority is gitea, when it matters:
+
+    curl -s -H "Authorization: token $(cat ~/.config/gitea/token)" \
+      https://git.arirex.me/api/v1/repos/iris/iris/pulls/19 \
+      | python3 -c 'import json,sys; print(json.load(sys.stdin)["base"]["sha"])'
+
+Nothing here can be fixed by renaming: `main` is the app submodule
+worktree's checked-out branch at its `32f6ad8` pin, and the two worktrees
+share one ref store. Git has no way to record a pull request's base, so the
+note is the mechanism.
+
+This has already cost real work. The sixth sweep reviewed against local
+`main` for half a session (Bryan caught it, 2026-09-20), and reported the
+parley migration's undo path as this branch's. The fourth and fifth sweeps
+deleted `Painter::text_data`, `ActiveData::size_deps` and `SizeRule::apply`
+partly on the same false reading; the deletions stand on their own merits --
+`text_data` had no caller at `ca2b4b2` either, and `size_deps` was read there
+and orphaned by this branch's rewrite -- but "arrived on this branch" was not
+the reason for all of them.
+
 ### How to check a round
 
 **Always**, because they cost nothing: format, workspace clippy under