docs: Iris's second 2026-09-08 phone report, and the workaround list closed

RUST.md gets the report verbatim with what each of the four defects
actually was, the tests that pin them, and two traps worth not
re-finding (a fixed-coordinate tap that "failed" by 544px because it had
toggled a tool group, and a layer-1 repro that only reproduces inside a
`List`). IRIS.md and DECISIONS.md get the design half: one `Flinger`
whose seam puts the sign convention and the content's end with the
caller, a cancel as a first-class end to a gesture, and why a row is
drawn twice on the frame its height changes.

LAYOUT.md gains the two rules those turned on, since both govern the
layout rather than this pass: padding works in any container and is an
inset or an outset depending on how tight the parent's region is (Iris's
own words), and a widget offered a box it does not fit is drawn again at
its true box in the same frame rather than the next one.

IRIS_TODO.md's "worked around in tool.rs rather than fixed here" is gone
-- Iris, 2026-09-08: "There should never be workaround code." Two of the
four entries are ticked; the two that remain are missing capabilities
rather than defects being dodged, and each now carries a diagnosis of
what building it costs instead of a workaround: an overflow ellipsis
needs `TextBuffer` to have a displayed string distinct from its source
(parley has none of its own, and every byte-offset consumer -- spans,
`byte_at`, `Selection`, `apply_delta` -- moves if the buffer is
truncated), and selectable tool-card text needs a register/unregister
lifecycle across the three routes that rebuild a card, which is where a
stale `Selection` handle panics.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -5,6 +5,38 @@ they can be judged and reversed later. Detail lives in RUST.md (and IRIS.md
 for iris API changes); this file is only the summary. Newest first. Items
 marked **DEFERRED** are ones the agent chose not to decide alone.
 
+## 2026-09-08 evening (the fling is shared; a cancel is not a release)
+
+From Iris's four-item phone report; RUST.md's "2026-09-08 (evening)" box
+has the reasoning and the tests, IRIS.md the summary.
+
+- **A `Flinger` that does not know which way the content moves.** Every
+  scroll area flings now, on either axis, as Iris asked -- and the
+  physics is one type shared by `List` and `Scroll` rather than a copy
+  each. The choice worth reviewing is the seam: `Flinger` owns the curve
+  and the clock, and the *caller* owns the sign convention and where the
+  content ends. Rejected: teaching `Flinger` a direction, which would
+  have to be told to it -- and being told is the same thing as not
+  knowing, with an extra field to get wrong.
+- **A cancel is a first-class end to a gesture, not an early release.**
+  `CursorState::cancelled` is new state on the pointer sample, set by
+  Android's `ACTION_CANCEL` and the harness's `TouchAction::Cancel`.
+  Rejected: mapping a cancel to `PressEnd` and having each widget decide
+  what to suppress, which is what shipped and is why leaving the app
+  flung the transcript.
+- **A `DragGesture` ignores a `Cancel` it caused.** One gesture is
+  driven by several widgets, so the widget that was pressed can be a
+  "loser" on the frame its own gesture won. The test is whether the
+  gesture's own capture id is the holder. This is what makes it safe for
+  every widget driving a gesture to register the whole `drag_senses()`
+  set, which is now the rule without exception.
+- **`List::place` draws a resized row twice in one frame.** The old
+  comment accepted a one-frame lag by analogy with `Scroll`'s content
+  length. That analogy was wrong: a stale *length* only misplaces the
+  next thing, while a stale *box* is drawn, because a background fills
+  whatever box it is handed. The extra draw is bounded to frames where a
+  row's height actually changed.
+
 ## 2026-09-08 (iris ships an icon font, and the drawn mark is deleted)
 
 - **Directed by Iris.** Her question on seeing `widget::mark`: "why does