iris is the framework alone; the app is one crate in app-rust/

Iris: "the organization of the rust rewrite is a mess right now... there
shouldn't be anything related to the app inside of iris. Iris is supposed
to be the UI framework alone." And, on the crate count: "I'm confused why
the app only code needs more than one crate though."

Nine cargo workspaces become three, and the port's project code -- which
sat in five places, four of them inside the framework -- becomes one crate,
`ai-app`, in `app-rust/`:

  client-core                -> app-rust/src/client
  iris/transcript-ui         -> app-rust/src/ui
  iris/transcript-fixture    -> app-rust/src/ui/fixture.rs + tests/ + touch/
  iris/desktop-app           -> app-rust/src/desktop + src/bin_desktop.rs
  iris/android-app           -> app-rust/src/android + android-project/
  android-shell              -> app-rust/src/shell

iris/ keeps core, macro, the iris crate, tabs-ui and rig-input, and now
mentions no session, transcript, setup or server anywhere.

Only two of the old splits had a reason that survived reading. event-model
stays a crate at the repo root because server/ depends on it too, so a
crate is what makes the backend and the app agree by construction. The two
Android .so names looked like a hard constraint -- a package produces one
library artifact -- until P2 turned out to already plan merging those two
Android apps into one; both faces now come out of libai_app.so, picked
apart by features so `--no-default-features --features shell` keeps wgpu,
parley and iris out of the Compose app's APK. docs/RUST.md's "One app
crate" has the rest, including what each remaining feature is for.

DECISIONS.md and SUBAGENTS.md move into docs/ with everything else.

Verified: ./run-tests.sh and `cd iris && cargo test` green, clippy and fmt
clean in all five workspaces, `cargo ndk -t x86_64` links libai_app.so,
build-apk.sh produces an APK that installs and launches on this checkout's
emulator (Gl ... virgl, as expected), and the phone-sized headless
screenshot renders the transcript unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app-rust/tests/catch_a_fling.rs

@@ -0,0 +1,211 @@
+//! Layer 1 of docs/RUST.md's "Three test layers", for catching a fling:
+//! the real transcript screen over the real bench fixture, at the phone's
+//! size and density, with no window, no compositor and no GPU.
+//!
+//! docs/IRIS_TODO.md's 2026-09-07 night report -- "sometimes when I try to
+//! catch it while it's still moving (particularly if I drag) then it fails
+//! to stop & snap to where finger is". The finger goes down on content
+//! that is still travelling and the content does not follow it until
+//! `DRAG_SLOP` has been crossed, which at a fling's speed is several
+//! frames of the content sliding *away* from a finger that is already
+//! down. Compose does not do that: a down while `isScrollInProgress`
+//! starts the drag immediately (`scrollable`'s `startDragImmediately`).
+
+use ai_app::ui::fixture::{PHONE_FRAME_MS, PHONE_SCALE, phone_size};
+use iris::harness::{Harness, TouchAction, TouchScript};
+use iris::prelude::*;
+use iris::sense::DRAG_SLOP;
+
+/// The screen open on the fixture, framed twice -- once to draw, once for
+/// `LazySpan::repair_anchor` to resolve the opening `snap_end` into a real
+/// anchor, which is what every assertion about scroll position reads.
+fn opened() -> (Harness, ai_app::ui::TranscriptScreen) {
+    let mut h = Harness::new(phone_size(), PHONE_SCALE);
+    let opened = ai_app::ui::fixture::open(&mut h.rsc, &mut h.state).expect("the fixture folds");
+    h.frame(0);
+    h.frame(PHONE_FRAME_MS);
+    (h, opened.screen)
+}
+
+/// Where the content is, in window pixels: the top of whichever row is
+/// under the middle of the viewport. `LazySpan` has no travel accessor and
+/// this needs none -- a row's own extent moves exactly as far as the
+/// content does, and the row is picked once so the two readings compare.
+fn tracked_row(h: &mut Harness, screen: &ai_app::ui::TranscriptScreen) -> (RowKey, f32) {
+    let middle = phone_size().y / 2.0;
+    let list = (screen.list)(&mut h.rsc);
+    let key = list.key_at(middle).expect("a row under the viewport");
+    let (top, _) = list.extent(key).expect("that row has an extent");
+    (key, top)
+}
+
+fn row_top(h: &mut Harness, screen: &ai_app::ui::TranscriptScreen, key: RowKey) -> f32 {
+    (screen.list)(&mut h.rsc)
+        .extent(key)
+        .expect("the tracked row is still loaded")
+        .0
+}
+
+/// Three finger samples 8ms apart, each moving `STEP` further down the
+/// screen. `STEP * 3` is deliberately **under** `DRAG_SLOP`: a gesture
+/// this small moves nothing at all on a settled list (the control below),
+/// so anything it moves here is the catch and not the slop being crossed.
+const STEP: f32 = 2.0;
+const SAMPLES: usize = 3;
+const CATCH_X: f32 = 540.0;
+
+/// Feeds the down and its `SAMPLES` moves from `y0` at `t0`, asserting
+/// after each one that the content moved by exactly the finger's own
+/// delta. Returns the release time.
+fn drag_from(
+    h: &mut Harness,
+    screen: &ai_app::ui::TranscriptScreen,
+    key: RowKey,
+    y0: f32,
+    t0: u64,
+    expect_tracking: bool,
+) -> u64 {
+    let before = row_top(h, screen, key);
+    h.touch(TouchAction::Down, Vec2::new(CATCH_X, y0), t0);
+    assert_eq!(
+        row_top(h, screen, key),
+        before,
+        "the down itself must not move the content, only stop it"
+    );
+    let mut t = t0;
+    for i in 1..=SAMPLES {
+        let moved = STEP * i as f32;
+        t = t0 + 8 * i as u64;
+        h.touch(TouchAction::Move, Vec2::new(CATCH_X, y0 + moved), t);
+        let travelled = row_top(h, screen, key) - before;
+        if expect_tracking {
+            assert!(
+                (travelled - moved).abs() < 0.5,
+                "sample {i}: the finger has moved {moved}px since the down and the content \
+                 {travelled:.1}px -- it is not pinned to the finger"
+            );
+        } else {
+            assert!(
+                travelled.abs() < 0.5,
+                "sample {i}: a {moved}px drag is inside DRAG_SLOP ({DRAG_SLOP}px) and must move \
+                 nothing, but the content moved {travelled:.1}px"
+            );
+        }
+    }
+    t += 8;
+    h.touch(
+        TouchAction::Up,
+        Vec2::new(CATCH_X, y0 + STEP * SAMPLES as f32),
+        t,
+    );
+    t
+}
+
+/// The report itself: flick, let the fling run for 150ms, then put a
+/// finger down and drag it a little. From the down onwards the content is
+/// pinned to the finger, sample for sample -- no slop, and no coasting
+/// past the place the finger stopped it.
+#[test]
+fn a_press_on_a_flinging_list_pins_the_content_to_the_finger() {
+    let (mut h, screen) = opened();
+
+    let flick = TouchScript::parse(include_str!("../touch/flick-120hz.touch"))
+        .unwrap_or_else(|e| panic!("flick-120hz.touch: {e}"));
+    h.replay(&flick);
+
+    // Frames, not a file: the second half of this gesture has to arrive
+    // *while* the fling is ticking, and a `.touch` replay inserts no
+    // frames between its samples, so a fling recorded that way would be
+    // running on paper and stationary in fact.
+    let catch_at = flick.end_ms() + 150;
+    h.frames_until(
+        flick.end_ms() + PHONE_FRAME_MS,
+        catch_at - PHONE_FRAME_MS,
+        PHONE_FRAME_MS,
+    );
+    assert!(
+        (screen.list)(&mut h.rsc).is_scrolling(),
+        "the fling must still be running 150ms in, or this test catches nothing"
+    );
+
+    let (key, _) = tracked_row(&mut h, &screen);
+    drag_from(&mut h, &screen, key, 1200.0, catch_at, true);
+}
+
+/// The other half of the same rule: a catch that never moved at all is a
+/// `Released(None)`, not a tap. Compose's scrollable consumes that DOWN,
+/// so no click detector under it ever sees the gesture -- stopping a
+/// fling with a finger must not also follow the link it landed on, and
+/// must not hand the list a velocity to start again with.
+#[test]
+fn a_catch_that_never_moved_is_not_a_tap_and_does_not_fling() {
+    let (mut h, screen) = opened();
+
+    let flick = TouchScript::parse(include_str!("../touch/flick-120hz.touch"))
+        .unwrap_or_else(|e| panic!("flick-120hz.touch: {e}"));
+    h.replay(&flick);
+    let catch_at = flick.end_ms() + 150;
+    h.frames_until(
+        flick.end_ms() + PHONE_FRAME_MS,
+        catch_at - PHONE_FRAME_MS,
+        PHONE_FRAME_MS,
+    );
+    assert!(
+        (screen.list)(&mut h.rsc).is_scrolling(),
+        "the fling must still be running 150ms in, or this test catches nothing"
+    );
+
+    let (key, _) = tracked_row(&mut h, &screen);
+    h.touch(TouchAction::Down, Vec2::new(CATCH_X, 1200.0), catch_at);
+    let stopped_at = row_top(&mut h, &screen, key);
+    h.touch(TouchAction::Up, Vec2::new(CATCH_X, 1200.0), catch_at + 8);
+
+    assert_eq!(
+        (screen.list)(&mut h.rsc).fling_velocity(),
+        None,
+        "a press that stopped a fling and moved nothing must not start another"
+    );
+    h.frames_until(catch_at + 16, catch_at + 500, PHONE_FRAME_MS);
+    assert!(
+        (row_top(&mut h, &screen, key) - stopped_at).abs() < 0.5,
+        "the content moved after a catch was released without moving"
+    );
+    assert_eq!(
+        h.state.opened_urls,
+        Vec::<String>::new(),
+        "a catch is not a tap: nothing under it may be followed"
+    );
+}
+
+/// The half this change had no reason to touch: on a list that is *not*
+/// moving, the same tiny drag is still inside `DRAG_SLOP` and still moves
+/// nothing. Without this, making every press pin the content would pass
+/// the test above and take the slop away from every ordinary press.
+#[test]
+fn the_same_small_drag_on_a_settled_list_moves_nothing() {
+    let (mut h, screen) = opened();
+
+    let flick = TouchScript::parse(include_str!("../touch/flick-120hz.touch"))
+        .unwrap_or_else(|e| panic!("flick-120hz.touch: {e}"));
+    h.replay(&flick);
+    // Long past the spline's own 2071ms for this recording.
+    let settled = h.frames_until(
+        flick.end_ms() + PHONE_FRAME_MS,
+        flick.end_ms() + 4000,
+        PHONE_FRAME_MS,
+    );
+    assert!(
+        !(screen.list)(&mut h.rsc).is_scrolling(),
+        "the fling must have stopped, or this is the same case as the test above"
+    );
+
+    let (key, _) = tracked_row(&mut h, &screen);
+    drag_from(
+        &mut h,
+        &screen,
+        key,
+        1200.0,
+        settled + PHONE_FRAME_MS,
+        false,
+    );
+}

app-rust/tests/fence_fling.rs

@@ -0,0 +1,230 @@
+//! Layer 1 for Iris's 2026-09-08 "flinging doesn't work in horizontal
+//! scroll areas": a real markdown fence in the real transcript screen,
+//! flicked sideways, has to keep moving after the finger leaves.
+//!
+//! The fence is pushed here rather than hunted for in the bench fixture,
+//! so the test knows which row it is pressing and where. The `ScrollArea` it
+//! asserts on is found by walking what is actually drawn -- there is no
+//! handle to it from the outside, and a coordinate would only prove that
+//! *something* moved.
+
+use ai_app::ui::fixture::{PHONE_FRAME_MS, PHONE_SCALE, phone_size};
+use iris::harness::{Harness, TouchAction};
+use iris::prelude::*;
+
+/// The horizontal scroll area drawn inside `top..bottom`, with the box
+/// it was drawn at -- a fence is the only thing in a transcript that pans
+/// sideways. Found by walking what is actually drawn, because there is no
+/// handle to a fence's own `ScrollArea` from the outside and a bare
+/// coordinate would only prove that *something* moved.
+fn fence_scroll_in(h: &Harness, top: f32, bottom: f32) -> Option<(WidgetId, PixelRegion)> {
+    h.render
+        .active
+        .keys()
+        .copied()
+        .filter(|&id| {
+            h.rsc
+                .ui
+                .widgets
+                .get_dyn(id)
+                .and_then(|w| w.as_any().downcast_ref::<ScrollArea>())
+                .is_some_and(|s| s.axis() == Axis::X)
+        })
+        .find_map(|id| {
+            let r = h.render.window_region(&id, &h.rsc)?;
+            (r.top_left.y >= top && r.bot_right.y <= bottom).then_some((id, r))
+        })
+}
+
+fn is_scrolling(h: &Harness, id: WidgetId) -> bool {
+    h.rsc
+        .ui
+        .widgets
+        .get_dyn(id)
+        .and_then(|w| w.as_any().downcast_ref::<ScrollArea>())
+        .expect("the fence's scroll area is still drawn")
+        .is_scrolling()
+}
+
+fn amt(h: &Harness, id: WidgetId) -> f32 {
+    h.rsc
+        .ui
+        .widgets
+        .get_dyn(id)
+        .and_then(|w| w.as_any().downcast_ref::<ScrollArea>())
+        .expect("the fence's scroll area is still drawn")
+        .amt()
+}
+
+#[test]
+fn a_flick_across_a_code_fence_keeps_moving_after_the_finger_leaves() {
+    use ai_app::client::transcript_fold::{TranscriptItem, TranscriptRow};
+
+    let mut h = Harness::new(phone_size(), PHONE_SCALE);
+    let opened = ai_app::ui::fixture::open(&mut h.rsc, &mut h.state).expect("the fixture folds");
+    let screen = opened.screen;
+    h.frame(0);
+    h.frame(PHONE_FRAME_MS);
+
+    let fence = TranscriptRow::Single(TranscriptItem::AssistantMsg {
+        seq: 9_000_000,
+        text: "```\none two three four five six seven eight nine ten eleven twelve \
+               thirteen fourteen fifteen sixteen seventeen eighteen twenty twentyone\n```"
+            .to_string(),
+        settled: true,
+    });
+    screen.push_row(&mut h.rsc, &fence);
+    (screen.list)(&mut h.rsc).jump_to_end();
+    h.frame(100);
+    h.frame(108);
+
+    let key = ai_app::ui::row::row_key(&fence.key());
+    let (top, bottom) = (screen.list)(&mut h.rsc)
+        .extent(key)
+        .expect("the fence row is on screen");
+    let (fence_scroll, box_) = fence_scroll_in(&h, top, bottom)
+        .expect("the pushed fence draws a horizontal scroll area of its own");
+    assert_eq!(amt(&h, fence_scroll), 0.0, "a fence opens at its start");
+
+    // Down the middle of the fence's own box, so the press is on the
+    // text inside the scroll area rather than on the row's sender label.
+    let y = (box_.top_left.y + box_.bot_right.y) / 2.0;
+
+    // A flick sideways: four samples 8ms apart, accelerating, then the
+    // finger leaves.
+    h.touch(TouchAction::Down, Vec2::new(900.0, y), 200);
+    for (i, x) in [860.0, 800.0, 720.0, 620.0].into_iter().enumerate() {
+        h.touch(TouchAction::Move, Vec2::new(x, y), 208 + 8 * i as u64);
+    }
+    h.touch(TouchAction::Up, Vec2::new(620.0, y), 240);
+
+    let at_release = amt(&h, fence_scroll);
+    assert!(
+        at_release > 0.0,
+        "the flick itself must have panned the fence, got {at_release}"
+    );
+
+    // Frames for the next half second, with nothing touching the screen.
+    let mut t = 240;
+    while t <= 740 {
+        h.frame(t);
+        t += PHONE_FRAME_MS;
+    }
+    let coasted = amt(&h, fence_scroll);
+    assert!(
+        coasted > at_release + 1.0,
+        "the fence stopped dead at the release: {at_release} -> {coasted}"
+    );
+
+    // ...and it settles rather than running forever.
+    let settled = coasted;
+    while t <= 4_000 {
+        h.frame(t);
+        t += PHONE_FRAME_MS;
+    }
+    let after = amt(&h, fence_scroll);
+    assert!(
+        after >= settled,
+        "a fling must not run backwards: {settled} -> {after}"
+    );
+    let last = after;
+    h.frame(t);
+    assert_eq!(last, amt(&h, fence_scroll), "the fling never settled");
+}
+
+/// Iris's 2026-09-08 report: "if I try to scroll vertically while a
+/// horizontal scroll animation is still active, it stays locked to the
+/// horizontal scroll. It should let it keep going and instead only affect
+/// vertical scrolling."
+///
+/// Her own diagnosis was the right one -- "tapping outside of something
+/// that a fling is currently active for should have no code in common
+/// with the fling that could influence it" -- and
+/// `sense_tests::a_press_does_not_reach_a_widget_the_pointer_has_just_left`
+/// is the mechanism in isolation. This is the same thing over the real
+/// screen, which is where it was found: the finger goes down on an
+/// ordinary row 500px above a coasting fence, and what must move is the
+/// list, while the fence carries on coasting untouched.
+#[test]
+fn a_drag_away_from_a_coasting_fence_scrolls_the_list_and_leaves_it_coasting() {
+    use ai_app::client::transcript_fold::{TranscriptItem, TranscriptRow};
+
+    let mut h = Harness::new(phone_size(), PHONE_SCALE);
+    let opened = ai_app::ui::fixture::open(&mut h.rsc, &mut h.state).expect("the fixture folds");
+    let screen = opened.screen;
+    h.frame(0);
+    h.frame(PHONE_FRAME_MS);
+
+    let fence = TranscriptRow::Single(TranscriptItem::AssistantMsg {
+        seq: 9_000_000,
+        text: format!(
+            "```\n{}\n```",
+            (1..=200)
+                .map(|i| format!("word{i}"))
+                .collect::<Vec<_>>()
+                .join(" ")
+        ),
+        settled: true,
+    });
+    screen.push_row(&mut h.rsc, &fence);
+    (screen.list)(&mut h.rsc).jump_to_end();
+    h.frame(100);
+    h.frame(108);
+
+    let key = ai_app::ui::row::row_key(&fence.key());
+    let (top, bottom) = (screen.list)(&mut h.rsc)
+        .extent(key)
+        .expect("the fence row is on screen");
+    let (fence_scroll, box_) = fence_scroll_in(&h, top, bottom)
+        .expect("the pushed fence draws a horizontal scroll area of its own");
+    let y = (box_.top_left.y + box_.bot_right.y) / 2.0;
+
+    // Flick the fence sideways and let go, exactly as above.
+    h.touch(TouchAction::Down, Vec2::new(900.0, y), 200);
+    for (i, x) in [860.0, 800.0, 720.0, 620.0].into_iter().enumerate() {
+        h.touch(TouchAction::Move, Vec2::new(x, y), 208 + 8 * i as u64);
+    }
+    h.touch(TouchAction::Up, Vec2::new(620.0, y), 240);
+    h.frame(248);
+    assert!(
+        is_scrolling(&h, fence_scroll),
+        "the fence has to still be coasting for this to be the reported case",
+    );
+
+    // A row well clear of the fence, taken by its own extent rather than
+    // by a coordinate: the gaps between rows are pointer-transparent, so a
+    // y picked by hand lands on nothing often enough to make a green run
+    // meaningless.
+    let probe = box_.top_left.y - 500.0;
+    let row = (screen.list)(&mut h.rsc)
+        .key_at(probe)
+        .expect("a row that far up the screen");
+    let (row_top, row_bottom) = (screen.list)(&mut h.rsc).extent(row).expect("its extent");
+    let from = (row_top + row_bottom) / 2.0;
+
+    let list_before = (screen.list)(&mut h.rsc).anchor_position_display();
+    let fence_before = amt(&h, fence_scroll);
+    h.touch(TouchAction::Down, Vec2::new(540.0, from), 256);
+    let mut t = 264;
+    for i in 1..=8 {
+        h.touch(
+            TouchAction::Move,
+            Vec2::new(540.0, from + 20.0 * i as f32),
+            t,
+        );
+        t += 8;
+    }
+    h.touch(TouchAction::Up, Vec2::new(540.0, from + 160.0), t);
+
+    assert_ne!(
+        list_before,
+        (screen.list)(&mut h.rsc).anchor_position_display(),
+        "the drag was nowhere near the fence, so it belongs to the list",
+    );
+    assert!(
+        amt(&h, fence_scroll) > fence_before,
+        "the fence's fling must carry on through a gesture that was never \
+         its own: {fence_before} -> {}",
+        amt(&h, fence_scroll),
+    );
+}

app-rust/tests/gesture_cancel.rs

@@ -0,0 +1,206 @@
+//! Layer 1 of docs/RUST.md's "Three test layers" for a gesture the
+//! *platform* takes away, over the real transcript screen and the real
+//! bench fixture.
+//!
+//! Both halves of Iris's 2026-09-08 report about the transcript moving on
+//! its own live here. A cancel is not a release, so nothing may follow it
+//! -- and every widget that was tracking the press has to hear about it,
+//! or the next press anywhere on screen is measured from the origin the
+//! abandoned one left behind.
+
+use ai_app::ui::fixture::{PHONE_FRAME_MS, PHONE_SCALE, phone_size};
+use iris::harness::{Harness, TouchAction, TouchScript};
+use iris::prelude::*;
+
+fn opened() -> (Harness, ai_app::ui::TranscriptScreen) {
+    let mut h = Harness::new(phone_size(), PHONE_SCALE);
+    let opened = ai_app::ui::fixture::open(&mut h.rsc, &mut h.state).expect("the fixture folds");
+    h.frame(0);
+    h.frame(PHONE_FRAME_MS);
+    (h, opened.screen)
+}
+
+fn script(name: &str, text: &str) -> TouchScript {
+    TouchScript::parse(text).unwrap_or_else(|e| panic!("{name}: {e}"))
+}
+
+/// Where the content actually is, in window pixels: the top of whichever
+/// row is under the middle of the viewport, tracked by key. The anchor's
+/// own `idx/off` display is not that -- the list rehomes its anchor to a
+/// different row without the content moving at all -- so a test asserting
+/// "nothing moved" reads a row's own extent, the way `catch_a_fling.rs`
+/// does.
+fn tracked_row(h: &mut Harness, screen: &ai_app::ui::TranscriptScreen) -> (RowKey, f32) {
+    let middle = phone_size().y / 2.0;
+    let list = (screen.list)(&mut h.rsc);
+    let key = list.key_at(middle).expect("a row under the viewport");
+    let (top, _) = list.extent(key).expect("that row has an extent");
+    (key, top)
+}
+
+fn row_top(h: &mut Harness, screen: &ai_app::ui::TranscriptScreen, key: RowKey) -> f32 {
+    (screen.list)(&mut h.rsc)
+        .extent(key)
+        .expect("the tracked row is still loaded")
+        .0
+}
+
+/// The system's own swipe up from the bottom edge to leave the app is
+/// delivered to the app as moves and then `ACTION_CANCEL`. Read as a
+/// release it hands the list that swipe's velocity, and the transcript
+/// flings while nobody is looking -- "leaving and reopening the app also
+/// randomly moved the vertical scroll".
+#[test]
+fn a_cancelled_flick_does_not_fling() {
+    let (mut h, screen) = opened();
+    let flick = script(
+        "flick-cancelled",
+        include_str!("../touch/flick-cancelled.touch"),
+    );
+    h.replay(&flick);
+
+    assert_eq!(
+        (screen.list)(&mut h.rsc).fling_velocity(),
+        None,
+        "a gesture the platform took away must not fling"
+    );
+
+    // ...and it must not be moving on its own over the following second
+    // either, which is what a fling started some other way would look
+    // like.
+    let (key, settled) = tracked_row(&mut h, &screen);
+    let end = flick.end_ms() + 1_000;
+    let mut t = flick.end_ms();
+    while t <= end {
+        h.frame(t);
+        t += PHONE_FRAME_MS;
+    }
+    let now = row_top(&mut h, &screen, key);
+    assert!(
+        (now - settled).abs() < 0.5,
+        "the list kept moving after a cancelled gesture: {settled} -> {now}"
+    );
+}
+
+/// The other half, and the one that made a *later* touch snap: a cancel
+/// has to reach every widget that was handed a frame of the press, so the
+/// gesture it was driving forgets its origin. Without it the arbiter is
+/// still open with the abandoned press's touch-down as its origin, and
+/// the next press is measured from there -- a jump the size of the
+/// distance between two unrelated touches.
+#[test]
+fn a_press_ended_by_a_cancel_leaves_no_origin_for_the_next_one() {
+    let (mut h, screen) = opened();
+
+    // Press near the top of the transcript and let the platform take it.
+    h.touch(TouchAction::Down, Vec2::new(540.0, 700.0), 0);
+    h.touch(TouchAction::Cancel, Vec2::new(540.0, 700.0), 8);
+
+    let (key, before) = tracked_row(&mut h, &screen);
+
+    // A plain tap, a long way down the screen from where that press
+    // started. It must move nothing at all.
+    h.touch(TouchAction::Down, Vec2::new(540.0, 1900.0), 200);
+    h.touch(TouchAction::Up, Vec2::new(540.0, 1900.0), 250);
+
+    let after = row_top(&mut h, &screen, key);
+    assert!(
+        (after - before).abs() < 0.5,
+        "a tap after a cancelled press panned the list by {}px, the distance between them",
+        after - before
+    );
+    assert_eq!(
+        (screen.list)(&mut h.rsc).fling_velocity(),
+        None,
+        "and it must not have flung either"
+    );
+}
+
+/// The report itself: "if I scroll in a horizontal area and then tap in a
+/// vertical area, it seems to snap."
+///
+/// A markdown fence pans sideways through its own `ScrollArea`, which takes
+/// pointer capture the moment it commits. Everything else that was handed
+/// a frame of that press is told so with `CursorSense::Cancel` -- and the
+/// widget the press actually landed on is the fence's own text block,
+/// which drives `ai_app::ui::Selection`'s shared `DragGesture`. A
+/// block that does not register `Cancel` never hears it, so the gesture
+/// stays open with the fence's touch-down as its origin and the next
+/// press anywhere is measured from there.
+///
+/// The fence is pushed here rather than hunted for in the fixture, so the
+/// test knows exactly which row it is pressing and where.
+#[test]
+fn panning_a_code_fence_then_tapping_elsewhere_moves_nothing() {
+    use ai_app::client::transcript_fold::{TranscriptItem, TranscriptRow};
+
+    let (mut h, screen) = opened();
+    let fence = TranscriptRow::Single(TranscriptItem::AssistantMsg {
+        seq: 9_000_000,
+        text: "```\none two three four five six seven eight nine ten eleven twelve\n\
+               thirteen fourteen fifteen sixteen seventeen eighteen nineteen\n```"
+            .to_string(),
+        settled: true,
+    });
+    // A plain paragraph under it, because the tap has to land on
+    // ordinary text: a tap that happens to hit a tool group's header
+    // toggles it, and a row changing height moves the list for a reason
+    // that has nothing to do with this.
+    let para = TranscriptRow::Single(TranscriptItem::AssistantMsg {
+        seq: 9_000_001,
+        text: "A plain paragraph with nothing to tap in it, only words, so that a \
+               press here is a press on ordinary text and nothing else."
+            .to_string(),
+        settled: true,
+    });
+    screen.push_row(&mut h.rsc, &fence);
+    screen.push_row(&mut h.rsc, &para);
+    (screen.list)(&mut h.rsc).jump_to_end();
+    h.frame(100);
+    h.frame(108);
+
+    // Press in the middle of the fence's own row, so the gesture starts on
+    // the text block inside the scroll area rather than in a gap.
+    let key = ai_app::ui::row::row_key(&fence.key());
+    let (top, bottom) = (screen.list)(&mut h.rsc)
+        .extent(key)
+        .expect("the fence row is on screen");
+    let y = (top + bottom) / 2.0;
+    assert!(
+        y > 0.0 && y < phone_size().y,
+        "the fence row has to be on screen to be pressed: {top}..{bottom}"
+    );
+
+    // Sideways, well past `DRAG_SLOP`, so the fence commits and captures.
+    h.touch(TouchAction::Down, Vec2::new(800.0, y), 200);
+    for (i, x) in [760.0, 700.0, 620.0, 540.0].into_iter().enumerate() {
+        h.touch(TouchAction::Move, Vec2::new(x, y), 208 + 8 * i as u64);
+    }
+    h.touch(TouchAction::Up, Vec2::new(540.0, y), 248);
+
+    let (tracked, before) = tracked_row(&mut h, &screen);
+
+    // A tap on the paragraph, a long way down the screen from where that
+    // pan started.
+    let para_key = ai_app::ui::row::row_key(&para.key());
+    let (ptop, pbottom) = (screen.list)(&mut h.rsc)
+        .extent(para_key)
+        .expect("the paragraph row is on screen");
+    h.touch(
+        TouchAction::Down,
+        Vec2::new(540.0, (ptop + pbottom) / 2.0),
+        400,
+    );
+    h.touch(
+        TouchAction::Up,
+        Vec2::new(540.0, (ptop + pbottom) / 2.0),
+        450,
+    );
+
+    let after = row_top(&mut h, &screen, tracked);
+    assert!(
+        (after - before).abs() < 0.5,
+        "a tap after panning a code fence moved the transcript by {}px",
+        after - before
+    );
+}

app-rust/tests/input_log_roundtrip.rs

@@ -0,0 +1,192 @@
+//! Layer 1 of docs/RUST.md's "Three test layers", for the diagnostics
+//! themselves rather than a widget: `iris::diagnostics::set_trace` gates
+//! `iris::input`/`iris::frame` (Iris's 2026-09-07 request, "add another
+//! button to copy input event info ... instrument a lot of the code with
+//! timings"), and `docs/REVIEW-2026-09-07.md`'s D1 found that the switch
+//! existed but four older per-frame `debug!` lines were not wired to it,
+//! filling the app's 2000-line log ring with frame spam before `Copy
+//! report` had a chance to include anything else. This is what a fix to
+//! that has to prove, both directions:
+//!
+//! 1. **Off** (the default): replaying a real gesture through a real
+//!    screen leaves the ring holding nothing below `info` -- so the
+//!    lines D1 named, and everything this pass gated the same way, really
+//!    are silent by default rather than merely "usually quiet."
+//! 2. **On**: the same replay produces `iris::input` lines that
+//!    `report_to_touch.py` turns back into the exact `TouchScript` that
+//!    was replayed, and `iris::frame` lines with real, non-zero
+//!    durations dated on the harness's own clock.
+//!
+//! **Single capturing logger, single test function** (this file's only
+//! `#[test]`): `log::set_logger` can succeed exactly once per process, and
+//! AGENTS.md's "tracing caches callsite interest process-wide" lesson is
+//! the general form of why every exercise of a logging path has to share
+//! one subscriber -- so if a second test here ever needs the ring's
+//! contents, it must extend this one rather than install its own.
+
+use std::process::{Command, Stdio};
+use std::sync::{Mutex, OnceLock};
+
+use ai_app::ui::fixture::{PHONE_FRAME_MS, PHONE_SCALE, phone_size};
+use iris::harness::{Harness, TouchScript};
+
+/// Records every line's level and formatted message -- enough to answer
+/// both "is the ring quiet" (no line at `Debug` or below) and "what did
+/// tracing actually write" (the `iris::input` lines, read back by
+/// `report_to_touch.py`).
+struct CaptureLogger {
+    lines: Mutex<Vec<(log::Level, String)>>,
+}
+
+static LOGGER: OnceLock<CaptureLogger> = OnceLock::new();
+
+impl log::Log for CaptureLogger {
+    fn enabled(&self, _metadata: &log::Metadata) -> bool {
+        true
+    }
+    fn log(&self, record: &log::Record) {
+        self.lines
+            .lock()
+            .unwrap()
+            .push((record.level(), record.args().to_string()));
+    }
+    fn flush(&self) {}
+}
+
+/// Installs the capture logger at `Debug` -- the same level
+/// `iris/android-app/src/lib.rs`'s `JNI_OnLoad` installs at, which is
+/// exactly why `iris::diagnostics::trace_enabled` has to be the gate
+/// (its own module doc) rather than the level.
+fn logger() -> &'static CaptureLogger {
+    let logger = LOGGER.get_or_init(|| CaptureLogger {
+        lines: Mutex::new(Vec::new()),
+    });
+    // Ignore "already set": a previous call in this same test binary
+    // already won, and it is the same logger either way.
+    let _ = log::set_logger(logger);
+    log::set_max_level(log::LevelFilter::Debug);
+    logger
+}
+
+fn drain(logger: &CaptureLogger) -> Vec<(log::Level, String)> {
+    std::mem::take(&mut *logger.lines.lock().unwrap())
+}
+
+fn opened() -> (Harness, ai_app::ui::TranscriptScreen) {
+    let mut h = Harness::new(phone_size(), PHONE_SCALE);
+    let opened = ai_app::ui::fixture::open(&mut h.rsc, &mut h.state).expect("the fixture folds");
+    h.frame(0);
+    h.frame(PHONE_FRAME_MS);
+    (h, opened.screen)
+}
+
+#[test]
+fn tracing_is_silent_off_and_round_trips_the_flick_on() {
+    let logger = logger();
+
+    // --- (1) off: a real flick through a real screen leaves the ring
+    // with nothing at `Debug` or below.
+    iris::diagnostics::set_trace(false);
+    drain(logger); // whatever `opened()` itself logged while building
+    let (mut h, screen) = opened();
+    drain(logger); // and whatever opening logged
+    let flick = TouchScript::parse(include_str!("../touch/flick-120hz.touch"))
+        .unwrap_or_else(|e| panic!("flick-120hz.touch: {e}"));
+    h.replay(&flick);
+    let _ = (screen.list)(&mut h.rsc); // touch the screen the same way a real caller would
+    let quiet = drain(logger);
+    let debug_lines: Vec<_> = quiet
+        .iter()
+        .filter(|(level, _)| *level == log::Level::Debug)
+        .collect();
+    assert!(
+        debug_lines.is_empty(),
+        "tracing is off, but the ring would still have held these `debug!` lines: {debug_lines:#?}"
+    );
+
+    // --- (2) on: the same replay, from a fresh screen so the anchor and
+    // sequence numbers match `flick-120hz.touch` exactly again.
+    iris::diagnostics::set_trace(true);
+    let (mut h, screen) = opened();
+    drain(logger);
+    h.replay(&flick);
+    let _ = (screen.list)(&mut h.rsc);
+    let traced = drain(logger);
+    iris::diagnostics::set_trace(false); // leave it off for any test after this one
+
+    let input_lines: Vec<&str> = traced
+        .iter()
+        .filter(|(_, msg)| msg.contains("iris input: action="))
+        .map(|(_, msg)| msg.as_str())
+        .collect();
+    assert_eq!(
+        input_lines.len(),
+        flick.samples.len(),
+        "expected one `iris::input` line per replayed sample, got:\n{input_lines:#?}"
+    );
+    let frame_lines: Vec<&str> = traced
+        .iter()
+        .filter(|(_, msg)| msg.starts_with("iris frame:"))
+        .map(|(_, msg)| msg.as_str())
+        .collect();
+    assert!(
+        !frame_lines.is_empty(),
+        "expected at least one `iris::frame` line once tracing was on"
+    );
+    for line in &frame_lines {
+        // `layout=` and `draw=` are `{:?}`-formatted `Duration`s, so a real
+        // one reads like `12.34µs`/`1.2ms`, never the bare `0ns` a
+        // no-op frame would print.
+        assert!(
+            !line.contains("layout=0ns"),
+            "a frame that redrew should not report zero layout time: {line}"
+        );
+    }
+
+    // --- the round trip: pipe every `iris::input` line through
+    // `report_to_touch.py` and parse the result back into a `TouchScript`,
+    // which must equal the one that was replayed. `report_to_touch.py`
+    // is prefix-agnostic (it `search`es for the marker), so handing it
+    // the bare message is the same as handing it a real ring line.
+    let report = input_lines.join("\n");
+    let script_path = concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../iris/benches/report_to_touch.py"
+    );
+    let mut child = Command::new("python3")
+        .arg(script_path)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .expect("python3 must be on PATH to run report_to_touch.py");
+    {
+        use std::io::Write;
+        child
+            .stdin
+            .take()
+            .unwrap()
+            .write_all(report.as_bytes())
+            .unwrap();
+    }
+    let output = child.wait_with_output().expect("report_to_touch.py exited");
+    assert!(
+        output.status.success(),
+        "report_to_touch.py failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let touch_text = String::from_utf8(output.stdout).expect("report_to_touch.py wrote UTF-8");
+    let round_tripped =
+        TouchScript::parse(&touch_text).unwrap_or_else(|e| panic!("round-tripped script: {e}"));
+
+    assert_eq!(
+        round_tripped.samples.len(),
+        flick.samples.len(),
+        "round trip produced a different number of samples:\n{touch_text}"
+    );
+    for (original, back) in flick.samples.iter().zip(round_tripped.samples.iter()) {
+        assert_eq!(original.t_ms, back.t_ms);
+        assert_eq!(original.action, back.action);
+        assert_eq!(original.pos, back.pos);
+    }
+}

app-rust/tests/phone_screen.rs

@@ -0,0 +1,283 @@
+//! Layer 1 of docs/RUST.md's "Three test layers": the real transcript
+//! screen, over the real bench fixture, at the phone's size and density,
+//! driven by `iris::harness` with no window, no compositor and no GPU.
+//!
+//! Every gesture here is a file under `touch/` -- see
+//! `flick-120hz.touch` for why the *shape* of the delivery is the whole
+//! point, and why the emulator cannot produce it (a `ui-trace` swipe is
+//! many evenly-spaced events; a finger at 120Hz is five samples in
+//! 20ms).
+
+use ai_app::ui::fixture::{PHONE_FRAME_MS, PHONE_SCALE, phone_size};
+use iris::harness::{Harness, TouchScript};
+use iris::prelude::*;
+
+/// The screen open on the fixture, framed twice: once to draw, once for
+/// `LazySpan::repair_anchor` to resolve the opening `snap_end` into a real
+/// anchor, which is what every assertion about scroll position reads.
+fn opened() -> (Harness, ai_app::ui::TranscriptScreen) {
+    let mut h = Harness::new(phone_size(), PHONE_SCALE);
+    let opened = ai_app::ui::fixture::open(&mut h.rsc, &mut h.state).expect("the fixture folds");
+    h.frame(0);
+    h.frame(PHONE_FRAME_MS);
+    (h, opened.screen)
+}
+
+fn script(name: &str, text: &str) -> TouchScript {
+    TouchScript::parse(text).unwrap_or_else(|e| panic!("{name}: {e}"))
+}
+
+fn offset(h: &mut Harness, screen: &ai_app::ui::TranscriptScreen) -> String {
+    (screen.list)(&mut h.rsc).anchor_position_display()
+}
+
+/// (a) and (b) together, because the second is only meaningful if the
+/// first happened: the recorded flick must release with a real velocity
+/// (`GestureOutcome::Released(Some(v))`, which is the only thing that
+/// puts a value in `Scroll::fling_velocity`), and the list must then
+/// actually travel and stop on the spline's own schedule.
+#[test]
+fn a_recorded_flick_releases_with_a_velocity_and_flings_the_list() {
+    let (mut h, screen) = opened();
+    let before = offset(&mut h, &screen);
+
+    let flick = script("flick-120hz", include_str!("../touch/flick-120hz.touch"));
+    h.replay(&flick);
+
+    let velocity = (screen.list)(&mut h.rsc)
+        .fling_velocity()
+        .expect("the flick must release as a pan with a velocity, not a tap");
+    // Compose's own answer for this recording's five samples, printed by
+    // `iris/benches/velocity_reference.py` -- not a number read off this
+    // code. **Positive** because the flick runs *down* the screen and a
+    // delta now carries the finger's own direction the whole way, from the
+    // gesture through `Selection::drag` (which passes it straight to
+    // `Scroll::fling`) to the anchor. It read -15250 while the transcript
+    // negated the velocity on its way into a `LazySpan` whose anchor
+    // offset ran the other way; the magnitude is the number that came from
+    // `velocity_reference.py` and it has not changed.
+    // The 2026-09-07 before/after: the old average estimator read
+    // 12250px/s here, which is the fling Iris reported as too slow.
+    assert!(
+        (velocity - 15_250.0).abs() < 20.0,
+        "expected ~15250px/s from velocity_reference.py, got {velocity}"
+    );
+
+    // `iris/benches/fling_spline_reference.py`'s own line for this exact
+    // case -- `density=2.55 v=15250.0: distance=11057.424px
+    // duration=2.0716s`. **Not** `FlingCalculator::new(PHONE_SCALE)`,
+    // which is the calculator under test: bounding a fling with the thing
+    // being measured is the "compared the code with itself" shape 73f956f
+    // found in the spline's own tests, and it left this one able to fail
+    // in the "ran too long" direction only -- never in the "stopped dead"
+    // direction, which is what Iris actually reported
+    // (docs/REVIEW-2026-09-07.md's T1).
+    const REFERENCE_MS: u64 = 2071;
+    const REFERENCE_PX: f32 = 11057.0;
+    let end = flick.end_ms() + REFERENCE_MS * 2;
+    let mut settled_at = None;
+    let mut t = flick.end_ms();
+    // Travel in pixels, measured from a row's own on-screen extent, since
+    // `LazySpan` has no travel accessor and this needs none: follow whatever
+    // row is under the viewport's middle until it leaves, then pick
+    // another. Deliberately an *under*-count -- the frame a row leaves on
+    // contributes nothing -- which is why it is only ever a lower bound.
+    let middle = phone_size().y / 2.0;
+    let mut travelled = 0.0f32;
+    let mut tracked: Option<(RowKey, f32)> = None;
+    while t <= end {
+        h.frame(t);
+        let list = (screen.list)(&mut h.rsc);
+        tracked =
+            match tracked.and_then(|(key, was)| list.extent(key).map(|(now, _)| (key, was, now))) {
+                Some((key, was, now)) => {
+                    travelled += (now - was).abs();
+                    Some((key, now))
+                }
+                None => list
+                    .key_at(middle)
+                    .and_then(|key| list.extent(key).map(|(top, _)| (key, top))),
+            };
+        if settled_at.is_none() && !(screen.list)(&mut h.rsc).is_scrolling() {
+            settled_at = Some(t);
+        }
+        t += PHONE_FRAME_MS;
+    }
+
+    let after = offset(&mut h, &screen);
+    assert_ne!(
+        before, after,
+        "the fling ticks must have moved the list off where the flick left it"
+    );
+    let settled_at = settled_at.expect("the fling must stop on its own, not run forever");
+    let ran_for = settled_at - flick.end_ms();
+    // Both directions. The lower bound is the one that fails when a fling
+    // settles on its first tick; the upper is the one that was here.
+    assert!(
+        ran_for >= REFERENCE_MS - PHONE_FRAME_MS * 2,
+        "the fling stopped after {ran_for}ms against the spline reference's {REFERENCE_MS}ms"
+    );
+    assert!(
+        ran_for <= REFERENCE_MS + PHONE_FRAME_MS * 2,
+        "the fling ran {ran_for}ms against the spline reference's {REFERENCE_MS}ms"
+    );
+    // 80% of the reference, against 10527px measured today -- the 5%
+    // shortfall is the frames a tracked row leaves the screen on. A fling
+    // that moves one row's worth fails this; scaling `tick_fling`'s delta
+    // by 0.01 reports 111px, which is how it was confirmed to fail in the
+    // direction the bug goes.
+    assert!(
+        travelled >= REFERENCE_PX * 0.8,
+        "the fling travelled {travelled:.0}px against the spline reference's {REFERENCE_PX:.0}px"
+    );
+}
+
+/// The half the flick fix had no reason to touch: a tap must decide
+/// `Tapped`, which means no velocity anywhere and nothing moved.
+#[test]
+fn a_tap_on_a_row_moves_nothing() {
+    let (mut h, screen) = opened();
+    let before = offset(&mut h, &screen);
+
+    h.replay(&script("tap", include_str!("../touch/tap.touch")));
+
+    assert_eq!(
+        (screen.list)(&mut h.rsc).fling_velocity(),
+        None,
+        "a tap must not fling"
+    );
+    // Frames it would have moved in, had anything been moving.
+    h.frames_until(100, 400, PHONE_FRAME_MS);
+    assert_eq!(before, offset(&mut h, &screen), "a tap must scroll nothing");
+    assert_eq!(
+        h.state.opened_urls,
+        Vec::<String>::new(),
+        "no link was under this tap"
+    );
+}
+
+/// A press held past `LONG_PRESS` and then dragged selects text rather
+/// than panning -- the other branch of the same arbiter the flick goes
+/// through.
+#[test]
+fn a_long_press_and_drag_selects_text() {
+    let (mut h, screen) = opened();
+    let before = offset(&mut h, &screen);
+
+    h.replay(&script(
+        "long-press",
+        include_str!("../touch/long-press.touch"),
+    ));
+
+    let selected = screen
+        .selected_text(&mut h.rsc)
+        .expect("a long-press then drag must leave text selected");
+    assert!(
+        !selected.trim().is_empty(),
+        "the selection covered no characters: {selected:?}"
+    );
+    assert_eq!(
+        before,
+        offset(&mut h, &screen),
+        "a selection must not also pan the list"
+    );
+}
+
+/// The composer sits on whatever the platform says the bottom of usable
+/// space is -- the keyboard's inset while it is open
+/// (`Composer::set_bottom_inset`, the path Android's
+/// `on_insets_changed` feeds). Checked here rather than on the emulator
+/// because it is a layout fact, and the emulator costs minutes.
+#[test]
+fn the_composer_sits_above_a_simulated_ime_inset() {
+    let (mut h, screen) = opened();
+    let height = h.size().y;
+    let field_bottom = |h: &mut Harness| {
+        h.render
+            .window_region(&screen.composer.field, &h.rsc)
+            .expect("the composer field is on screen")
+            .bot_right
+            .y
+    };
+
+    let closed = field_bottom(&mut h);
+    assert!(
+        closed <= height,
+        "the composer is off the bottom of the window even with no keyboard: {closed} > {height}"
+    );
+
+    // A Gboard-sized keyboard on this surface. Any real number would do;
+    // what matters is that the bar clears it.
+    let ime = 1000.0;
+    screen.composer.set_bottom_inset(&mut h.rsc, ime);
+    h.frame(PHONE_FRAME_MS * 2);
+
+    let open = field_bottom(&mut h);
+    assert!(
+        open <= height - ime,
+        "the keyboard covers the composer: its bottom is at {open}, the IME starts at {}",
+        height - ime
+    );
+    assert!(
+        (closed - open - ime).abs() < 1.0,
+        "the composer moved {} for a {ime}px inset",
+        closed - open
+    );
+}
+
+/// A newline typed into the composer must leave the caret inside the
+/// bar's own padding, not flush against its bottom edge.
+///
+/// Iris's phone, 2026-09-08: "when typing with the keyboard up and
+/// entering enough newlines ... the text drops down close to the bottom
+/// and seems to ignore the padding. If I close (and optionally reopen)
+/// the keyboard it seems to fix itself." The cause was `Scroll::draw`
+/// placing its child against *last* frame's content length and stopping
+/// there: each newline drew the field in a box one line short of its
+/// text, and since the text is centred in its box it hung half a line
+/// past each end, putting the caret's line box a full padding below the
+/// bar's inside edge. Nothing dirtied that subtree again, so the stale
+/// placement was simply the last one drawn -- until the keyboard closed
+/// and the inset rewrite forced a redraw, which is the "fixes itself"
+/// half of the report. No settling frame here on purpose: the placement
+/// is corrected within the frame that typed, so the first frame drawn
+/// after a keystroke is already right.
+#[test]
+fn a_newline_leaves_the_caret_inside_the_composers_padding() {
+    let (mut h, screen) = opened();
+    let height = h.size().y;
+    let ime = 1000.0;
+    screen.composer.set_bottom_inset(&mut h.rsc, ime);
+    h.frame(PHONE_FRAME_MS * 2);
+
+    h.state.set_focus(Some(screen.composer.field));
+    screen.composer.field.edit(&mut h.rsc).set_cursor_byte(0);
+    // Past `composer::MAX_LINES`, so the bar is capped and scrolling
+    // rather than still growing -- the state the report is about.
+    for _ in 0..12 {
+        screen.composer.field.edit(&mut h.rsc).insert("a\n");
+        h.frame(PHONE_FRAME_MS);
+    }
+    // The caret is the last primitive `TextEdit::draw` emits.
+    let caret = {
+        let slot = *h
+            .render
+            .debug(h.rsc.widgets(), "Message")
+            .flat_map(|a| a.primitives.iter().map(|p| p.slot))
+            .collect::<Vec<_>>()
+            .last()
+            .expect("the focused field draws a caret");
+        h.render.primitive_corners(slot, &h.rsc)
+    };
+    // The bar sits directly on the IME, so its inside edge is one
+    // `FIELD_PAD_DP` above `height - ime`. Stated in pixels rather than
+    // read back from the composer, which is the thing under test.
+    let bar_bottom = height - ime;
+    let padding = 12.0 * PHONE_SCALE;
+    assert!(
+        caret.bot_right.y < bar_bottom - padding / 2.0,
+        "the caret is in the bar's bottom padding: it ends at {}, the bar's edge is {bar_bottom} \
+         and its padding is {padding}px",
+        caret.bot_right.y,
+    );
+}

app-rust/tests/top_edge.rs

@@ -0,0 +1,340 @@
+//! Layer 1 of docs/RUST.md's "Three test layers", for the transcript's
+//! own edges: the real screen over the real fixture, under a header bar
+//! like the bench app's, driven by `iris::harness`.
+//!
+//! What these are about is docs/IRIS_TODO.md's 2026-09-07 phone report --
+//! rows scrolled above the viewport still drawn, over the header, and a
+//! blank band where the row straddling the top edge should be. Both are
+//! one rule (`LazySpan::intersects_viewport`): a row is drawn if any part of
+//! it is inside the list's own box, and nothing outside that box reaches
+//! the screen.
+
+use ai_app::ui::fixture::{PHONE_FRAME_MS, PHONE_SCALE, phone_size};
+use iris::harness::Harness;
+use iris::prelude::*;
+
+/// A header band above the transcript, as `bench_client.rs` puts one --
+/// the surface the rows were drawing over on the phone. Its exact height
+/// does not matter; what matters is that the list's own box does not
+/// start at the top of the window, so "above the viewport" and "off the
+/// screen" are different places.
+const HEADER_H: f32 = 300.0;
+const HEADER: UiColor = UiColor::new(28, 28, 34, 255);
+
+fn opened() -> (Harness, ai_app::ui::TranscriptScreen) {
+    let mut h = Harness::new(phone_size(), PHONE_SCALE);
+    let (opened, tree) = ai_app::ui::fixture::build_screen(&mut h.rsc).expect("the fixture folds");
+    let content = WidgetPtr::new().add(&mut h.rsc);
+    content(&mut h.rsc).set(tree);
+    let root = (rect(HEADER).height(abs(HEADER_H)), content.height(rest(1)))
+        .span(Dir::DOWN)
+        .add_strong(&mut h.rsc)
+        .any();
+    h.state.set_root(root);
+    h.frame(0);
+    h.frame(PHONE_FRAME_MS);
+    (h, opened.screen)
+}
+
+/// The list's own on-screen box, in window pixels.
+fn list_box(h: &Harness, screen: &ai_app::ui::TranscriptScreen) -> PixelRegion {
+    h.render
+        .window_region(&screen.list.id(), &h.rsc)
+        .expect("the list is on screen")
+}
+
+/// Every row the list drew this frame, as `(top, bottom)` window pixels,
+/// topmost first. A `LazySpan`'s direct children are exactly its rows, and
+/// `draw_inner`'s old-children diffing means a row it did not place this
+/// frame is not among them.
+fn drawn_rows(h: &Harness, screen: &ai_app::ui::TranscriptScreen) -> Vec<(f32, f32)> {
+    let mut rows: Vec<(f32, f32)> = h
+        .render
+        .active
+        .get(&screen.list.id())
+        .expect("the list is drawn")
+        .children
+        .iter()
+        .filter_map(|id| h.render.window_region(id, &h.rsc))
+        .map(|px| (px.top_left.y, px.bot_right.y))
+        .collect();
+    rows.sort_by(|a, b| a.0.total_cmp(&b.0));
+    rows
+}
+
+/// Scrolls `amount` and runs the frame it asks for, returning the time of
+/// the next one. **Positive walks back through older rows** -- the
+/// finger's own direction, and `Scroll::scroll`'s, which is the one
+/// convention a delta has anywhere in iris since the transcript's scroll
+/// position lives in the `LazySpan`'s own `ScrollController`.
+/// It used to be the opposite here, because a `LazySpan`'s anchor offset
+/// ran the other way.
+fn scrolled(h: &mut Harness, screen: &ai_app::ui::TranscriptScreen, amount: f32, t: u64) -> u64 {
+    (screen.list)(&mut h.rsc).scroll(amount);
+    h.frame(t);
+    t + PHONE_FRAME_MS
+}
+
+/// (a) of docs/IRIS_TODO.md's reproduction: with a row across the top
+/// edge, that row is placed -- the viewport's first pixel belongs to
+/// something. A rule that culled a row once its *top* left the viewport
+/// would leave a blank band here, which is the second of Iris's two
+/// screenshots.
+#[test]
+fn the_row_across_the_top_edge_is_drawn() {
+    let (mut h, screen) = opened();
+    let top = list_box(&h, &screen).top_left.y;
+    let mut t = PHONE_FRAME_MS * 2;
+
+    // 40px a frame, the shape a finger pan arrives in, through a straddle
+    // and out the other side of it many times over.
+    for _ in 0..60 {
+        t = scrolled(&mut h, &screen, 40.0, t);
+        let rows = drawn_rows(&h, &screen);
+        let first = *rows.first().expect("something is on screen");
+        assert!(
+            first.0 <= top + 0.5,
+            "a band of {:.1}px under the header belongs to no row: rows start at {:.1}, the list \
+             at {top:.1}",
+            first.0 - top,
+            first.0,
+        );
+        assert!(
+            first.1 > top,
+            "the row across the top edge was culled: it ends at {:.1}, above the list's own \
+             {top:.1}",
+            first.1,
+        );
+    }
+}
+
+/// (b): what falls outside the list's box is clipped rather than drawn
+/// over whatever is there. The straddling row above is drawn *in full*,
+/// so the only thing between its earlier lines and the header bar is this
+/// mask -- with none, the phone drew `version = "0.1.0"` behind the "Run
+/// benchmark" button.
+///
+/// The clip is one the screen **opted into** (`build_tree`'s `.masked()`),
+/// so this reads the mask the list *inherited*. A `LazySpan` sets none of
+/// its own -- masking is opt-in, like scrolling (Iris, 2026-09-08) -- so
+/// this is also the test that the transcript is still asking for one.
+#[test]
+fn the_list_is_clipped_to_its_own_box() {
+    let (h, screen) = opened();
+    let active = h.render.active.get(&screen.list.id()).expect("drawn");
+    assert!(
+        active.mask != MaskIdx::NONE,
+        "the transcript's list is drawn with nothing clipping it",
+    );
+    let clip = h.render.mask_region(active.mask, &h.rsc);
+    let list = list_box(&h, &screen);
+    assert!(
+        clip.top_left.y >= list.top_left.y - 0.5 && clip.bot_right.y <= list.bot_right.y + 0.5,
+        "the clip {clip:?} reaches outside the list's own box {list:?}, so a row straddling an \
+         edge still draws past it",
+    );
+
+    // And the mask has to *reach* what the rows draw. The two above say a
+    // mask exists and sits in the right place; neither says any primitive
+    // references it, so a broken `Mask::parent` chain -- what d507ae4
+    // introduced -- would leave them green while a code fence inside a row
+    // drew unclipped again (docs/REVIEW-2026-09-07.md's T3).
+    let rows = h
+        .render
+        .active
+        .get(&screen.list.id())
+        .expect("the list is drawn")
+        .children
+        .clone();
+    let mut checked = 0;
+    for row in rows {
+        for prim in primitives_under(&h, row) {
+            assert!(
+                mask_chain(&h, prim).contains(&active.mask),
+                "a primitive of row {row:?} clips to {:?}, a chain that never reaches the list's \
+                 own mask {:?}",
+                mask_chain(&h, prim),
+                active.mask,
+            );
+            checked += 1;
+        }
+    }
+    assert!(
+        checked > 0,
+        "no row primitive was checked, so this test asserted nothing",
+    );
+}
+
+/// Every primitive `id` and its descendants drew, as `MaskIdx`es -- images
+/// excluded, since they live in a separate instance array with their own
+/// indices (`Primitives::free`).
+fn primitives_under(h: &Harness, id: WidgetId) -> Vec<MaskIdx> {
+    let Some(active) = h.render.active.get(&id) else {
+        return Vec::new();
+    };
+    let mut out: Vec<MaskIdx> = active
+        .primitives
+        .iter()
+        .filter(|p| p.binding != IMAGE_BINDING)
+        .map(|p| h.render.primitives.instance(p.slot).mask_idx)
+        .collect();
+    for child in &active.children {
+        out.extend(primitives_under(h, *child));
+    }
+    out
+}
+
+/// The chain the fragment stage walks from `mask`, outermost last.
+fn mask_chain(h: &Harness, mask: MaskIdx) -> Vec<MaskIdx> {
+    let mut chain = Vec::new();
+    let mut at = mask;
+    while at != MaskIdx::NONE {
+        assert!(
+            !chain.contains(&at),
+            "the mask chain from {mask:?} loops back to {at:?}",
+        );
+        chain.push(at);
+        at = h.rsc.ui.masks[at.idx()].parent;
+    }
+    chain
+}
+
+/// A row that has left the viewport entirely is not drawn at all. Before
+/// the fix the walk ran from the anchor -- which `scroll` leaves wherever
+/// it was, however far outside the viewport that ends up -- and drew
+/// every row on the way: 8 scrolls of 3000px left **64 rows** placed for
+/// a 2012px viewport, ~59 of them off screen and painting over the
+/// header.
+///
+/// The box is asserted on every leg *except the first*, because a row
+/// whose height has never been measured has to be drawn to be measured
+/// (`LazySpan::place`'s doc), which on the first walk back is every row
+/// entering from the top. Every later leg crosses the same rows with
+/// every height already known -- including the second walk *back*, which
+/// is there because a regression that draws rows in the wrong place while
+/// travelling backwards would otherwise be checked only by the row count
+/// (docs/REVIEW-2026-09-07.md's T2). That is also the ordinary state of a
+/// transcript being panned around in. The bound on how many rows are
+/// placed at once holds on all three.
+#[test]
+fn rows_that_have_left_the_viewport_are_not_drawn() {
+    let (mut h, screen) = opened();
+    let list = list_box(&h, &screen);
+    let mut t = PHONE_FRAME_MS * 2;
+    let bounded = |rows: &[(f32, f32)], leg: &str, step: usize| {
+        // A handful of rows whatever distance has been travelled -- the
+        // module doc's own claim about this widget.
+        assert!(
+            rows.len() <= 24,
+            "{leg} {step}: {} rows drawn for one 2012px viewport",
+            rows.len(),
+        );
+    };
+    let inside = |rows: &[(f32, f32)], leg: &str, step: usize| {
+        for &(top, bottom) in rows {
+            assert!(
+                bottom > list.top_left.y - 0.5 && top < list.bot_right.y + 0.5,
+                "{leg} {step}: a row at ({top:.1}, {bottom:.1}) is outside the list's box \
+                 {list:?} and was drawn anyway",
+            );
+        }
+    };
+
+    for step in 0..40 {
+        t = scrolled(&mut h, &screen, 400.0, t);
+        bounded(&drawn_rows(&h, &screen), "measuring", step);
+    }
+    for step in 0..40 {
+        t = scrolled(&mut h, &screen, -400.0, t);
+        let rows = drawn_rows(&h, &screen);
+        bounded(&rows, "forward", step);
+        inside(&rows, "forward", step);
+    }
+    for step in 0..40 {
+        t = scrolled(&mut h, &screen, 400.0, t);
+        let rows = drawn_rows(&h, &screen);
+        bounded(&rows, "back", step);
+        inside(&rows, "back", step);
+    }
+}
+
+/// The end the fix had no reason to touch: the row across the *bottom*
+/// edge, where the composer starts. Same rule, other direction -- and the
+/// list opens pinned there, so this is the ordinary state of the screen
+/// rather than a scrolled-to one.
+#[test]
+fn the_row_across_the_bottom_edge_is_drawn() {
+    let (mut h, screen) = opened();
+    let list = list_box(&h, &screen);
+    let mut t = PHONE_FRAME_MS * 2;
+
+    for _ in 0..40 {
+        t = scrolled(&mut h, &screen, 37.0, t);
+        let rows = drawn_rows(&h, &screen);
+        let last = *rows.last().expect("something is on screen");
+        assert!(
+            last.1 >= list.bot_right.y - 0.5,
+            "a band of {:.1}px above the composer belongs to no row",
+            list.bot_right.y - last.1,
+        );
+        assert!(
+            last.0 < list.bot_right.y,
+            "the row across the bottom edge was culled: it starts at {:.1}, below the list's own \
+             {:.1}",
+            last.0,
+            list.bot_right.y,
+        );
+    }
+}
+
+/// Panning past the first row settles *on* it rather than beyond it. The
+/// list is scrolled far further back than the fixture is long, which is
+/// what a hard fling toward the top does; before the clamp existed it
+/// stayed wherever that left it -- the phone's "black from the header
+/// down", and a whole blank screen in `iris`'s own
+/// `fling_toward_the_start_stops_at_the_first_row`.
+#[test]
+fn scrolling_past_the_first_row_settles_on_it() {
+    let (mut h, screen) = opened();
+    let list = list_box(&h, &screen);
+    let mut t = PHONE_FRAME_MS * 2;
+
+    for _ in 0..60 {
+        t = scrolled(&mut h, &screen, 100_000.0, t);
+    }
+    // No settling frame on purpose: the draw that discovers the gap gives
+    // it back inside that same frame (`LazySpan::overscroll_gap`), so the last
+    // frame `scrolled` drew is already flush with the first row. Adding
+    // one here would hide a regression to the old next-frame correction.
+    let rows = drawn_rows(&h, &screen);
+    let first = *rows.first().expect("the first row is on screen");
+    assert!(
+        (first.0 - list.top_left.y).abs() < 0.5,
+        "the transcript is parked {:.1}px past its own first row, so the top of the list is blank",
+        first.0 - list.top_left.y,
+    );
+}
+
+/// The same clamp at the other end, which is where Iris met it second
+/// ("you shouldn't be able to scroll below the bottom (or above top)").
+/// The list opens flush with its newest row, so this drags *forward* off
+/// the end of the content and back.
+#[test]
+fn scrolling_past_the_last_row_settles_on_it() {
+    let (mut h, screen) = opened();
+    let list = list_box(&h, &screen);
+    let mut t = PHONE_FRAME_MS * 2;
+
+    for _ in 0..20 {
+        t = scrolled(&mut h, &screen, -100_000.0, t);
+    }
+
+    let rows = drawn_rows(&h, &screen);
+    let last = *rows.last().expect("the last row is on screen");
+    assert!(
+        (last.1 - list.bot_right.y).abs() < 0.5,
+        "the transcript is parked {:.1}px past its own last row, so the bottom of the list is \
+         blank",
+        list.bot_right.y - last.1,
+    );
+}