Record Iris review fixes, validation, and consolidated checkout

docs/LAYOUT.md

@@ -302,6 +302,11 @@ physical pixels, unchanged.
 
 ## Masks
 
+This section and "UI ownership and frame access" describe the app's pinned
+Iris implementation. The upstream #19 review branch still has single
+rectangular masks and separate `UiData`/`UiRenderState`; adopting it requires
+integrating the app-side capabilities as well as migrating layout calls.
+
 A `Mask` references a rectangle primitive and its parent mask. Nested masks
 multiply coverage. Plain `.masked()` creates an undrawn rectangle at the
 widget's region; `.masked_by(shape)` draws the shape behind the content and
@@ -489,8 +494,8 @@ of its parent's frame and a local redraw walked back up the parent chain in
   defensively on every use.
 - A retained drawing is reusable only when its `Holds` contains the new box
   on both axes, its parent and region-node choice match, it is on the layer it
-  was drawn on, and the widget is clean. A valid ordinary subtree moves by
-  recursive remap; a region node moves by one entry. A container that draws a
+  was drawn on, its inherited mask matches, and the widget is clean. A valid
+  ordinary subtree moves by recursive remap; a region node moves by one entry. A container that draws a
   child to learn its size uses `Painter::child_layer_at`, the layer the child
   will actually occupy.
 - An answer's validity and its final drawing's validity are independent. A
@@ -506,7 +511,9 @@ of its parent's frame and a local redraw walked back up the parent chain in
   draw it. Dirty size dependencies settle deepest-first.
 - A widget that creates a mask clips to and reports its box. Its own mask and
   its inherited mask are distinct retained state: the former says which mask
-  a move rewrites, while a local redraw receives the latter.
+  a move rewrites, while a local redraw receives the latter. The owner retains
+  one mask reference and reuses its slot across redraws, independently of
+  primitive references; dropping the mask or undrawing the owner releases it.
 - A span's leftover/no-leftover boundary is a strict structural decision, not
   a tolerance. Derive the boundary through the inverse of the expression that
   places children. A cap may not contain `leftover`, because feeding the