docs: the phone-logging decision, how to use it, and two build-apk traps

DECISIONS.md gets the route and both rejected alternatives with what each
would have cost; RUST.md gets a "Phone logging" section with the build
command, where to read it on the phone, the end-to-end verification, and
the two rig traps that cost an hour -- Gradle's merged-native-libs cache
surviving build-apk.sh's `rm -rf jniLibs` (a --abi x86_64 APK packaged
arm64 and aborted with what reads exactly like a Vulkan fault), and the
648 MB debug bench APK that cannot be installed at all. IRIS.md gets the
client-core logging API with a before/after.

Queue item ticked.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -39,6 +39,57 @@ marked **DEFERRED** are ones the agent chose not to decide alone.
   why a fix (an OEM-specific named-family pin, or patching around
   fontique) is left as a follow-up rather than done in this pass.
 
+## 2026-09-07 (how a phone log reaches Iris)
+
+- **The app sends its own log to `ai-server`, and Dev Updater shows it as
+  `ai-server`'s runtime log.** Iris has no `adb`/`logcat` on her phone, and
+  Android forbids one app reading another's logcat, so the app has to carry
+  its own copy and post it somewhere. `POST /client-log` on `ai-server`
+  re-emits each line into that server's own `tracing` output; Dev Updater
+  already runs `ai-server` as a `Managed` component, whose stdout its own
+  service script redirects to a file and reports through
+  `GET /apps/{key}/components/{name}/logs?kind=runtime`, which the phone
+  app's log dialog already offers as a **Runtime** tab for a `server`
+  component. So **no change to Dev Updater at all** -- one route on
+  `ai-server`, and the client in `client-core`.
+
+  **Rejected: posting to Dev Updater's own server** (the first candidate).
+  It would need a new authenticated *write* route on a TLS surface whose
+  module doc says every route on it "is, or decides, the bytes that get
+  handed to `REQUEST_INSTALL_PACKAGES` next"; a per-app device-log store;
+  a change to `component_logs` so an APK component can have a runtime log;
+  a change to the phone app's `hasBothKinds = component.kind == "server"`
+  gate and to what `hasRuntimeLogs` means on the wire; and -- the real
+  cost -- a **second** enrollment for the iris app, since it has no CA or
+  token for Dev Updater and Dev Updater mints tokens per device by QR.
+  Five changes across two repos against one route, for the same line
+  landing in the same viewer.
+
+  **Rejected: a share intent from a debug button** (a log file in the app's
+  external files dir, shared by hand). It works today and needs no server,
+  but every line costs Iris a manual export and a message, which is the
+  round trip through a person this was meant to remove. It is still the
+  fallback when the tunnel is down, and GrapheneOS's own per-app log export
+  already covers the crash case (that is how the `ToolInput.highlighted`
+  crash was reported).
+
+- **The ring is in `client-core`, not in the Android crate.** A bounded
+  in-memory ring (2000 lines or 256 KiB, whichever bites first) behind a
+  `log::Log` backend that *forwards* to whichever logger the platform
+  already installed, so `logcat` and a desktop terminal see exactly what
+  they saw before. The platform supplies only its own logger and its
+  destination. `Copy report` appends the ring to what goes on the
+  clipboard, and flushes the uploader first.
+
+- **The destination is baked in at build time, from the build machine's
+  own files** (`AI_APP_LOG_HOST`/`_PORT`/`_TOKEN` plus the pinned CA) --
+  all three or none, never two. The same trust boundary the transcript
+  config and the Compose APK's CA already use: nothing secret is
+  committed, and an APK is good for the server that built it. A build told
+  nothing still keeps its ring and still copies it; the diagnostics pane
+  says which of "not tried yet", "failing -- <why>" and "no server
+  configured" it is, because otherwise all three look like silence.
+
 ## 2026-09-06 (how a tool call looks, P1b)
 
 - **A card that never got a result says "no result", in yellow, and it is