diff --git a/.gitmodules b/.gitmodules
index d1200a4..46f4ca9 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,4 +4,4 @@
 [submodule "iris"]
 	path = iris
 	url = git@git.arirex.me:iris-ai/iris.git
-	branch = main
+	branch = app-pin
diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
index 87ebc7f..e9e20a0 100644
--- a/docs/HANDOFF.md
+++ b/docs/HANDOFF.md
@@ -40,42 +40,42 @@ names, and the one argument that says them". Bryan settled the API over
 The core design remains sound. Round-to-nearest is still unchanged.
 
 Two checkouts share one Git storage: `/home/bob/repos/iris` is the active
-`layout/one-ask` worktree, and `ai-app-2/iris` stays on `main` at the app's
-`32f6ad8` pin until the integration below is ready.
+`layout/one-ask` worktree, and `ai-app-2/iris` stays on `app-pin` at the
+app's `32f6ad8` pin until the integration below is ready.
 
-### The base is `upstream/main`, not `main`
+### The branch layout, and the trap that used to be here
 
-**Diff this branch against `upstream/main`. The local `main` is the wrong
-base and gives a plausible-looking wrong answer.** PR #19 is
-`iris-ai/iris:layout/one-ask` into `iris/iris:main`, which is the `upstream`
-remote, at `ca2b4b2`. Local `main` tracks `origin/main` -- the *fork's* line,
-which carries the app's own commits, is not an ancestor of upstream's main,
-and sits four merged pull requests behind it (#10 parley text, #12 pointer
-routing, #16 draw/size merge, #17 headless rig).
+`main` is PR #19's base and tracks `upstream/main` (`iris/iris`), so the
+obvious commands are the right ones:
 
-    git diff main...layout/one-ask             # WRONG -- base 7b54aaf
-    git diff upstream/main...layout/one-ask    # right -- base ca2b4b2
+    git merge-base main layout/one-ask      # ca2b4b2, the PR's base
+    git diff main...layout/one-ask          # exactly what #19 changes
 
-`git iris-base` and `git iris-diff` are configured in this checkout and use
-the right one. The authority is gitea, when it matters:
+It was not always so. Until 2026-09-20 `main` tracked `origin/main` -- the
+*fork's* line, which carries the app's 45 commits, is not an ancestor of
+upstream's main, and sat four merged pull requests behind it (#10 parley
+text, #12 pointer routing, #16 draw/size merge, #17 headless rig). Diffing
+against it showed all four as this branch's work, which is how the parley
+migration's undo path kept being reported as #19's; the sixth sweep lost
+half a session to it before Bryan caught it, and the fourth and fifth
+sweeps deleted `Painter::text_data` partly on the same false reading.
 
-    curl -s -H "Authorization: token $(cat ~/.config/gitea/token)" \
-      https://git.arirex.me/api/v1/repos/iris/iris/pulls/19 \
-      | python3 -c 'import json,sys; print(json.load(sys.stdin)["base"]["sha"])'
+Bryan asked for the setup fixed rather than documented. What changed:
 
-Nothing here can be fixed by renaming: `main` is the app submodule
-worktree's checked-out branch at its `32f6ad8` pin, and the two worktrees
-share one ref store. Git has no way to record a pull request's base, so the
-note is the mechanism.
+- The app's line is now the branch **`app-pin`** (`32f6ad8`), pushed to
+  `origin`. That is the name to use for it; it is no longer called `main`.
+- `main` points at and tracks `upstream/main`.
+- `.gitmodules` pins the `iris` submodule to `branch = app-pin`, so
+  `git submodule update --remote` follows the app's line and cannot drag
+  the pin onto upstream.
+- `git iris-base` and `git iris-diff` are still configured and still
+  correct; they now agree with plain `main`.
 
-This has already cost real work. The sixth sweep reviewed against local
-`main` for half a session (Bryan caught it, 2026-09-20), and reported the
-parley migration's undo path as this branch's. The fourth and fifth sweeps
-deleted `Painter::text_data`, `ActiveData::size_deps` and `SizeRule::apply`
-partly on the same false reading; the deletions stand on their own merits --
-`text_data` had no caller at `ca2b4b2` either, and `size_deps` was read there
-and orphaned by this branch's rewrite -- but "arrived on this branch" was not
-the reason for all of them.
+The submodule's recorded commit is unchanged at `32f6ad8`, so nothing about
+the app's pin moved -- only the name it is reachable by. **`origin/main` on
+the fork is still `32f6ad8`**: moving it is a non-fast-forward on a shared
+branch, so it is left for Bryan to decide. Until it moves, a *fresh clone of
+the fork* still gets the old, misleading `main`.
 
 ### How to check a round
 
diff --git a/docs/LAYOUT_LOG.md b/docs/LAYOUT_LOG.md
index 97dff62..ccdcc48 100644
--- a/docs/LAYOUT_LOG.md
+++ b/docs/LAYOUT_LOG.md
@@ -12,7 +12,7 @@ Over what the five earlier rounds did not name -- the WGSL prelude and how
 it is assembled, the position widgets, `orientation/`, and the sensor walk.
 **Scoped against `upstream/main` at `ca2b4b2`, which is PR #19's real base**;
 the first half of this sweep used the local `main` and had to be redone, for
-which see "The base is `upstream/main`" in `docs/HANDOFF.md`. Two findings.
+which see "The branch layout" in `docs/HANDOFF.md`. Two findings.
 The cold dump is byte-identical to `1096c31` and all three seed scans pass
 (400 at depth 5 in 69.07s, 1,000 at depth 6 in 169.29s, 2,000 at depth 4 in
 300.75s).
@@ -175,7 +175,7 @@ throughout, `LayoutLen::{is_px, is_only_leftover, declared, fills}` and
   event including the arrow keys. **`apply_event` is not in this PR's diff at
   all**: it was last touched by #10 and #16, both already on `upstream/main`.
   It keeps resurfacing in sweeps because they diffed against the local `main`
-  -- see "The base is `upstream/main`" in `docs/HANDOFF.md`. Bryan wants the
+  -- see "The branch layout" in `docs/HANDOFF.md`. Bryan wants the
   unbounded push and the clone dealt with as a change of their own
   (2026-09-20).
 - `ActivationState::update` writes four arms where the `Start`/`On` and