docs: the defect pass's findings -- RUST.md boxes, IRIS_TODO ticks, DECISIONS and IRIS entries

docs/RUST.md

@@ -155,7 +155,7 @@ closes it.
       "Docs" section asked for. See `docs/REVIEW-2026-09-06.md`'s own "Fixed, 2026-09-06"
       section for the per-finding account. Committed together with the
       review file.
-- [ ] **Iris's 11:39 phone report on the 02:07 build** (four items,
+- [~] **Iris's 11:39 phone report on the 02:07 build** (four items,
       verbatim in `IRIS_TODO.md`'s "From the phone, 2026-09-06, 11:39"):
       composer floating two thirds down the screen at launch with black
       below it; a swipe starting on the composer held until the finger
@@ -163,15 +163,80 @@ closes it.
       lost on app-switch on the phone despite the emulator-verified
       atlas reset. The first and last are the same class as the next
       box and go to that agent; the middle two are the merge box's.
-- [ ] **Stale primitives and invisible composer text** — the header drawn
-      twice after a keyboard resize, the `Compacted:` row drawn twice on
-      Iris's phone, and typed text never appearing (P0 box item 2). All
-      three sit on the `redraw_updates` targeted-redraw path and may be
-      one bug; the P0 box says the next step is instrumentation inside
-      `Span::draw`/`draw_inner` showing where each placement's
-      primitives actually land on the frame it goes wrong.
-      `list.rs`'s new `replacing_the_last_row_many_times_does_not_leak_
-      primitives` test already pins the widget arena as *not* the leak.
+- [~] **Stale primitives and invisible composer text**, 2026-09-06:
+      **typed text is fixed and was never a renderer bug at all**; the two
+      duplicate-drawing halves are **not reproducible** on this checkout's
+      emulator any more and are recorded below with what changed.
+
+      **1. Typed text (P0 box item 2, `IRIS_TODO.md`'s own item) --
+      fixed.** The composer's buffer was empty the whole time.
+      `TextEditCtx::select` (`iris/src/widget/text/edit.rs`) compared the
+      tap against the *laid-out text's* box and set `selection = None` for
+      anything outside it; an empty field lays out to a zero-width box, so
+      tapping an empty composer granted focus and opened the keyboard with
+      no caret, and `insert_str` returns early without one -- every
+      keystroke was dropped in silence. **Gboard's suggestion strip is
+      Gboard's own composing state, not a read of our buffer**, which is
+      what made the earlier pass conclude the buffer held the text and
+      send the search downstream into the renderer; the `accessibility`
+      dump saying `text=""` for the `Message` node was the first
+      contradicting evidence. Parley clamps a point outside the layout by
+      itself, and a press reaching `select` has already been hit-tested to
+      the widget, so the "outside" branch had nothing left to mean. Three
+      new tests in `edit.rs`, one of which fails on the pre-fix code, plus
+      a `debug_assert!` in `insert_str` so an insert with no caret fails at
+      the mistake rather than dropping input -- it caught
+      `layout_tests::composing_text_after_a_keyboard_resize_...` typing
+      into an unfocused field the moment it was added. **Emulator
+      evidence**: `ui-trace record --do "tap 'Message'"` then `adb shell
+      input text` shows the text in the bar with a caret
+      (`/tmp/final-typing.png`) and logs `iris text render: chars=5 ...
+      glyphs=5`, against `glyphs=0` per keystroke before.
+
+      **2. The header drawn twice after a keyboard resize (this box's own
+      "(a)") no longer has a path to happen on this emulator, for a
+      measured reason**: since `MainActivity.java` went edge-to-edge
+      (`e12c708`), **opening the keyboard no longer resizes the surface at
+      all**. Measured: `render()` reports `out_size=(1080, 2282)` unchanged
+      across an IME open, while the new `iris insets:` line reports
+      `bottom=63 ime_bottom=0` -> `bottom=883 ime_bottom=1`. So the IME is
+      an inset now, not a `surface_changed`, and the two-phase `Span::draw`
+      the duplicate was blamed on is not re-entered. Reproduction attempts
+      this pass, all negative: `tap 'Message'` + `ui-trace elements`
+      (exactly one "Run benchmark" in every frame of the trace), a
+      screenshot with the keyboard open, and a real `adb shell wm size
+      1080x2200` *while the keyboard was open* (a genuine
+      `surface_changed`) -- one header row, no stray copy
+      (`/tmp/resize-dup.png`).
+
+      **3. The `Compacted:` row drawn twice on Iris's phone is still
+      open**, and nothing here reproduces it. What was ruled out this
+      pass: the widget arena (`list.rs`'s
+      `replacing_the_last_row_many_times_does_not_leak_primitives`), the
+      `top_bar` rebuild (`last_top_pad`, a previous pass), and now the
+      keyboard-resize trigger above. One real defect *was* found by
+      reading the path and is fixed, though it cannot be shown to be her
+      bug: `UiRenderState::draw_started` -- the guard whose whole job is
+      "do not redraw a widget an ancestor is drawing right now, or one of
+      the two copies is orphaned" -- **tested its own set after removing
+      the id from it**, so the test was constant `false` and the guard
+      could never fire, while the set grew by one entry per widget ever
+      drawn and was never emptied. It is now inserted around
+      `Widget::draw` and removed when it returns, with a `debug_assert!`
+      at the top of `update` that it is empty between frames. Her build
+      has both.
+
+- [ ] **Stale primitives, the phone's half** — the `Compacted:` row
+      drawn twice, overlapping, and once more below the composer
+      (`docs/bench/iris-phone-v2-2026-09-06.md`). Everything the box
+      above lists as ruled out is ruled out; what is left needs the
+      phone, and it is worth noting the row is drawn *below the
+      composer*, i.e. outside the list's own clip, which points at
+      `List`'s row placement rather than at `Span::draw`'s two-phase
+      placement the earlier passes assumed. The `iris surface:`/`iris
+      insets:` log lines added 2026-09-06 are in the build she is
+      holding, so her next `adb logcat | grep -i iris` says what the
+      frame it happens on was doing.
 - [ ] **Composer touch-drag scroll** for overflowed text — now that
       dragging is a default-input `DragGesture`, `Scroll` should get its
       touch pan from the same mechanism `List` uses, not a copy.
@@ -4858,6 +4923,22 @@ device.
       extended for the longer run (260s poll cap, `-A 60` instead of
       `-A 6`) to fit v2's four phases.
 
+      **Redelivered, 2026-09-06, the defect pass.** `./build-apk.sh
+      release --abi arm64-v8a --features "transcript-screen bench"`
+      (Vulkan, no `force-gles`; the x86_64 `jniLibs` slice from this
+      pass's emulator work was removed first, confirmed arm64-only by
+      listing the APK's `lib/` entries), `apksigner verify` showing the
+      same `CN=ai-app` cert, copied to `~/host/bench/
+      iris-bench-arm64.apk`; that README gained a dated entry naming what
+      to look for. What changed: the composer sits at the bottom of the
+      screen at launch again (the black third was the bench shell's empty
+      report pane, not an inset -- see the plan box above), typing into it
+      works at all (the empty-field caret bug), the keyboard no longer
+      throws up an undismissable diagnostics overlay, and every surface
+      and insets event is logged so a phone `logcat` can answer the
+      app-switch text loss. Not fixable from here and still open: the
+      duplicated `Compacted:` row.
+
       **(a) The header-duplicate bug (found by a concurrent pass on this
       branch): investigated, not fixed.** Reproduced reliably
       (`ui-trace record --do "tap 'Message'"` then `adb exec-out