iris: a capture cancels every other gesture, and the pointer leaves UiRenderState

Two defects Iris reported from her phone on 2026-09-08, one root cause
each, both in how a gesture ends.

A widget that takes pointer capture cuts every other widget off from the
press completely -- no PressEnd, no Drop -- so anything else tracking it
was left with an open gesture at a stale origin, and the *next* touch
anywhere was measured from that origin. That is the transcript jumping on
a tap after a code fence was panned sideways. CursorSense::Cancel is the
missing state: delivered once to each loser of a capture race, the way
Android sends ACTION_CANCEL and the web sends pointercancel.

And  registered click_or_drag|unclick, which never matches
a Drop, so a Scroll that had captured never saw its own gesture end and
stayed panning from where the finger left. That is the horizontal snap
back. CursorSense::drag_senses() states the rule once for every widget
driving a DragGesture instead of per call site.

The pointer's own state (who holds capture, who is tracking the press) no
longer lives in a Mutex on UiRenderState. It is Event::Global for the
cursor senses -- owned by the event manager that runs the dispatch,
reached by &mut, with a per-dispatch PointerRequests slot for handlers --
per Iris: never reach for locks first, and input-wide state belongs to
the general input handler. What had forced the lock was a Data: Send
bound on task_on that nothing needed; the spawned future never sees the
event's data.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

iris/core/src/event/manager.rs

@@ -79,6 +79,8 @@ type EventData<Rsc, E> = (E, Rc<dyn for<'a> EventFn<Rsc, <E as Event>::Data<'a>>
 pub struct TypeEventManager<Rsc: HasEvents, E: Event> {
     // TODO: reduce visiblity!!
     pub active: HashMap<LayerId, HashMap<WidgetId, E::State>>,
+    /// This event's own input-wide state -- see [`Event::Global`].
+    pub global: E::Global,
     map: HashMap<WidgetId, Vec<EventData<Rsc, E>>>,
 }
 
@@ -107,6 +109,7 @@ impl<Rsc: HasEvents, E: Event> Default for TypeEventManager<Rsc, E> {
     fn default() -> Self {
         Self {
             active: Default::default(),
+            global: Default::default(),
             map: Default::default(),
         }
     }

iris/core/src/event/mod.rs

@@ -9,6 +9,20 @@ pub use rsc::*;
 pub trait Event: Sized + 'static + Clone {
     type Data<'a>: Clone = ();
     type State: Default = ();
+    /// State this event owns that belongs to no single widget -- what the
+    /// thing dispatching the event knows about the *input*, rather than
+    /// about a listener. `()` for almost every event; the cursor's is
+    /// `iris::sense::PointerInput` (which widget holds pointer capture,
+    /// and who is tracking the press in flight).
+    ///
+    /// It lives here so that such state has one owner, reached by `&mut`
+    /// through the event manager, instead of being parked on whatever
+    /// structure a handler happens to be able to reach and guarded with a
+    /// lock. Iris asked for that on 2026-09-08, of the pointer capture
+    /// that used to sit in a `Mutex` on `UiRenderState`: "everything
+    /// global should be stored in the general input handler, not in
+    /// specific senses with locking stuff."
+    type Global: Default = ();
     #[allow(unused_variables)]
     fn should_run<'a>(&self, data: &Self::Data<'a>) -> Option<Self::Data<'a>> {
         Some(data.clone())

iris/core/src/ui/render_state.rs

@@ -57,21 +57,6 @@ pub struct UiRenderState {
     /// ever drawn and was never emptied.
     draw_started: HashSet<WidgetId>,
 
-    /// The widget currently holding exclusive pointer input, if any --
-    /// `iris::sense::SensorUi::run_sensors` reads and clears this every
-    /// call. Interior mutability (a `Mutex`, not a bare `Cell`, since a
-    /// `CursorData` reaching this through an async `task_on` handler needs
-    /// `Send`/`Sync`) because `run_sensors` takes `&self` (widgets are
-    /// dispatched to, not owned, at that layer) and this render state is
-    /// the one structure both backends (winit, android-view) already hold
-    /// across frames, the same way `old_root`/`resized` are -- see
-    /// `iris::sense`'s pointer-capture doc for why a drag needs this: once
-    /// a gesture has committed to panning or selecting, every later sample
-    /// of it must reach the same widget even if the finger has moved off
-    /// whatever hit region first noticed the press. Never held across an
-    /// await or another lock -- every access here is a single get/set.
-    captured: std::sync::Mutex<Option<WidgetId>>,
-
     /// `Widget::draw` calls and `Primitives::region_mut` rewrites since the
     /// last `take_counters`. LAYOUT.md section 8's pass conditions are
     /// stated in terms of these two: an unchanged frame must cost 0 of
@@ -103,10 +88,9 @@ pub struct UiRenderState {
     /// When the sensor dispatch (`SensorUi::run_sensors`, in the `iris`
     /// crate) last saw an input sample, dated by the sample's own clock
     /// (`CursorState::time`) rather than when the dispatch ran -- same
-    /// reasoning as that field's own doc. A `Mutex` rather than a
-    /// `Cell` for the same reason `captured` is: `run_sensors` takes `&self`
-    /// and this is the one render state both backends already share across
-    /// frames.
+    /// reasoning as that field's own doc. A `Mutex` because `run_sensors`
+    /// takes `&self` and this is the one render state both backends
+    /// already share across frames.
     last_input_at: Mutex<Option<Instant>>,
 }
 
@@ -138,7 +122,6 @@ impl UiRenderState {
             old_root: None,
             resized: false,
             draw_started: Default::default(),
-            captured: Default::default(),
             draw_count: 0,
             region_mut_count: 0,
             mov_count: 0,
@@ -719,11 +702,12 @@ impl UiRenderState {
             if undraw {
                 // A captured widget that goes away mid-gesture (List's
                 // virtualisation retiring a row, a rebuild) must not leave
-                // the pointer permanently captured by an id nothing will
-                // ever draw again -- `captured`'s own path out.
-                if *self.captured.lock().unwrap() == Some(id) {
-                    *self.captured.lock().unwrap() = None;
-                }
+                // the pointer captured by an id nothing will ever draw
+                // again. That path out is the sensor pass's, not this
+                // one's: `iris::sense::SensorUi::run_sensors` releases a
+                // capture whose widget no longer resolves to a region,
+                // which covers this case and every other way an id can
+                // stop being drawn.
                 // Permanent removal: retire this widget's own move slot
                 // (the self-ownership ref taken when it was allocated) and
                 // the up-link ref it held on its parent's slot -- read from
@@ -926,27 +910,6 @@ impl UiRenderState {
         )
     }
 
-    /// Give `id` exclusive pointer input from the next `run_sensors` call
-    /// on -- see `captured`'s field doc. Overwrites any previous capture
-    /// (a gesture that starts a new one has already decided the old one
-    /// is over).
-    pub fn capture_pointer(&self, id: WidgetId) {
-        *self.captured.lock().unwrap() = Some(id);
-    }
-
-    /// Release exclusive pointer input, if any is held -- called once
-    /// `run_sensors` has delivered the terminal `Drop` to the capturing
-    /// widget, or by that widget itself if it decides the gesture is over
-    /// some other way.
-    pub fn release_pointer(&self) {
-        *self.captured.lock().unwrap() = None;
-    }
-
-    /// The widget currently holding exclusive pointer input, if any.
-    pub fn captured_pointer(&self) -> Option<WidgetId> {
-        *self.captured.lock().unwrap()
-    }
-
     pub fn debug(&self, widgets: &Widgets, label: &str) -> impl Iterator<Item = &ActiveData> {
         self.active.iter().filter_map(move |(&id, inst)| {
             let l = widgets.label(id);