Record decided-box oracle blocker

docs/HANDOFF.md

@@ -16,19 +16,20 @@ baseline this work must preserve or improve. `/home/bob/repos/iris-pr18` has
 since moved to a different WIP branch; do not use that checkout as #18.
 
 The continuation is `/home/bob/repos/iris-layout-experiment`, branch
-`wip/transparent-frames`, head **`4328eac`**, five commits over **`34cafb6`**.
-It implements transparent frames, pins the two open failures, and corrects
-`Scroll`'s content length, but it is not ready to replace #18:
+`wip/transparent-frames`, committed head **`4328eac`**, five commits over
+**`34cafb6`**, plus an uncommitted step 3/4 experiment. It implements
+transparent frames, pins the two open failures, and corrects `Scroll`'s
+content length, but it is not ready to replace #18:
 
-- the shrinker disagrees warm versus cold at seed 2 (`repaint`) and seed 108
-  (`reorder`) at depth 5;
+- the uncommitted experiment passes both focused regressions and the 114-test
+  suite, but every non-ignored fast-oracle case stops on a cold-layout
+  placement assertion, usually at `Text`;
 - `many` and `resize` still do more work than #18 on a deep tree;
-- a resolved `leftover` share does not yet narrow its child's frame;
 - step 3 exposed a widget-contract question that must be planned before the
   retained protocol can change; see **Step 3 stop** below.
 
-The app's Iris pin is unchanged. The step 3 experiment described below was
-reverted; the experiment checkout was clean at `4328eac` when last inspected.
+The app's Iris pin is unchanged. Keep the experiment's uncommitted changes as
+evidence; do not commit them as the protocol until the stop below is resolved.
 
 ## The two rules to protect
 
@@ -214,29 +215,40 @@ fresh-answer experiment (seeds 184, 246, 292 and 372).
 
 ### 3. Evaluate children in parent-decided boxes
 
-**STOP: this step needs planning before implementation continues.** A direct
-implementation was tried and fully reverted. It always kept the fresh answer,
-made placement reuse-or-translate (asserting if the retained drawing did not
-hold), asked `Span` children provisionally in the whole box before decided
-placement, gave `Stack` overlays the sizing child's reported box, and changed
-the random `Branch` tail to `Part::Of(40px..FULL)`. Both new focused tests
-passed, but 17 ordinary suite tests failed.
+**STOP: this step needs planning before implementation continues.** The first
+17 suite failures were not sufficient evidence for stopping: most were test
+fixtures that encoded the old paired-draw cost while their empty drawing used
+only the answer. The experiment now separates answer-only pixel reads from
+drawing reads, keeps answer and final-drawing contracts independent, asks
+`Span` children provisionally with `Fill`, re-asks them in their decided
+slots, narrows resolved-share frames, and re-asks local redraws at the
+question their answer came from. It also fixes two real defects found along
+the way: an overfull span falsely pinned itself to `far`, and a narrowed share
+frame omitted a nonzero parent-extent start.
 
-Several failures state a load-bearing contract contrary to this plan rather
-than exposing another container bug. `ReadsBox` and `ReadsWidth` deliberately
-read the offered box, report one quarter of it, and their tests require two
-draws: one to answer and one in the answer-derived box. The tests' own comment
-says those draws come in pairs. `a_widget_asked_again_on_another_layer_is_drawn_there`
-likewise requires a second draw when placement changes the layer. Other
-failures include root resize/one-step validity tests, region-node placement,
-and `a_one_pixel_line_keeps_its_pixel_through_a_chain`.
+That version passes the full 114-test suite, both focused regressions, the
+region-node test, the one-pixel chain, and the wrap-at-remaining-room test.
+The tests were checked individually before migration; geometry assertions
+were retained, and drawing-dependency fixtures still use ordinary `px_len`.
 
-The unresolved decision is therefore public widget semantics, not another
-definition of measurement: either a widget must now guarantee that a drawing
-holds for the answer box it reports (and the contrary tests, documentation,
-and any real widgets must be redesigned), or placement sometimes has to run
-the body in an answer-derived box, contradicting the decided-box rule. Do not
-resume step 3 until that choice and its migration are written into the plan.
+The release fast oracle then stopped in all eleven non-ignored cases during
+*cold layout*, before any warm/cold comparison. The repeated shape is a leaf,
+usually `Text`, asked provisionally in a `Within` box, reporting a smaller
+answer, whose retained drawing contract covers only the provisional pixel
+width. Placement into the reported box therefore hits the new
+reuse-or-translate assertion. One representative assertion shows `Text` with
+an X part of `FULL`, a centered answer span about 89.5 px wide, and a drawing
+extent contract pinned at 45 px. A generated `Stack` also fails after
+reporting a 178x21 px answer from `FULL` while retaining an `extent_len` pin
+to `FULL`.
+
+This is a real public-contract boundary, not a stale oracle: decide whether
+every leaf as well as every container must guarantee that its provisional
+drawing holds in the answer box it reports, and specify how `Text` establishes
+that guarantee, or allow some answer-derived leaf evaluation while keeping
+containers out of their own answers. The latter is a semantic distinction the
+current `Widget` API does not express. Do not weaken the assertion, special
+case `Text`, or resume the oracle until this choice is written into the plan.
 
 Change placement so an answer-derived box never runs a container body.
 Placing becomes reuse-or-translate. Remove the offer/measurement gate and