docs: the CA travels in the enrol link, and why not the two alternatives

DECISIONS.md gets the decision with both rejected options and what the
longer link measures (89 -> 652 bytes, a 45x23 QR -> 93x47), RUST.md ticks
the enrolment queue item and marks the log-upload route superseded rather
than editing it, and IRIS.md says what changed for anyone building the
Android app.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/RUST.md

@@ -131,6 +131,13 @@ What exists now:
   how many lines are held and when the last arrived, and what the uploader
   last did.
 
+**Superseded 2026-09-07, and left standing rather than edited**: Dev
+Updater is growing an on-device runtime-log reader, so this whole route --
+`log_upload`, `POST /client-log` and the `AI_APP_LOG_*` baking -- is being
+removed rather than kept current. The app's *server* destination no longer
+comes from any of it: that is the enrolment link (the queue item above).
+What follows describes the route as built.
+
 **How to use it.** Build the APK with the destination in the environment,
 on the machine `ai-server` runs on:
 
@@ -539,24 +546,30 @@ closes it.
   handing its server token to the app it installed (leaks the token
   into every managed app); the app posting to ai-server (needs its own
   enrolment first and puts the phone's logs in the wrong component).
-- [ ] Iris app enrolment (decided 2026-09-07): the bench APK's log
-  destination is baked from `AI_APP_LOG_*` at build time, which cannot
-  work for Iris's phone -- the APK is built in the VM, whose CA and
-  token are not the host's, and no secret may go in a repo or a
-  delivered artifact. Replace with the mechanism the Compose app and
-  `desktop-app` already use: the iris Android app registers the
-  `aiapp://enroll?host&port&token` VIEW intent, stores the enrolment
-  the way `client_core::config` does, pins the CA the same way (the
-  Compose app reads it at build time from the *building* machine, which
-  is the same problem -- so for the phone the CA has to arrive with the
-  link or the build has to happen on the host; check how Dev Updater's
-  Enroll button and `ai-server --enroll-link` present the link and
-  whether the CA fingerprint can ride in it as a query parameter, which
-  `wg-app-link` may already support). `log_upload` then takes its
-  destination from the enrolment at runtime, `AI_APP_LOG_*` is removed,
-  and Dev Updater's enrol screen offers the link as a tappable link so
-  Android hands it to the iris app. Rejected: building the iris APK on
-  the host (needs cargo-ndk and an NDK there, and still bakes a token).
+- [x] Iris app enrolment (**done 2026-09-07**): the iris Android app is
+  told which `ai-server` to talk to by an `aiapp://enroll` link, exactly
+  as the Compose app and `desktop-app` are, instead of having it compiled
+  in. `MainActivity` registers the VIEW intent and hands the URI and the
+  app's private files directory to Rust (`src/enrollment.rs` is the intent
+  plumbing and nothing else); the parsing, the file and its 0600 mode are
+  `client_core::config`'s `EnrolledServer`/`EnrollmentStore`, shared with
+  the desktop app. `build.rs`'s `AI_APP_TRANSCRIPT_HOST`/`_PORT`/`_TOKEN`
+  are gone, and with them a token in a built artifact.
+  **The CA travels with the link** (`&ca=`, base64url of the DER) --
+  docs/DECISIONS.md, 2026-09-07, has the decision, the two rejected
+  alternatives and what the longer link costs a QR code. That is what
+  makes an APK cross-compiled here work against the server on the host.
+  Diagnostics says which of three things is true -- `enrolled: host:port`,
+  `not enrolled -- open the enrol link from Dev Updater`, or
+  `enrolment unreadable: ...` -- because "could not find out" wants a
+  different action from "nothing there yet".
+  Dev Updater needed no change: its Enroll button already opens the minted
+  link with `ACTION_VIEW`, and Android offers the chooser between this app
+  and the Compose one.
+  **The log upload was deliberately left out of it**: Dev Updater is
+  growing an on-device runtime-log reader instead (Iris, 2026-09-07), so
+  `log_upload`, `POST /client-log` and the `AI_APP_LOG_*` baking are on
+  their way out whole rather than being rewired first.
 - [ ] `iris/android-app/build-apk.sh`: clear Gradle's merged-native-libs
   cache when the ABI changes (the x86_64 trap), and make the debug bench
   APK installable (648 MB) -- RUST.md's logging section names both.