Merge remote-tracking branch 'origin/rustify' into worktree-agent-a1ff0294b6c29127e

# Conflicts:
#	docs/RUST.md

.claude/skills/ai-app-rigs/SKILL.md

@@ -0,0 +1,244 @@
+---
+name: ai-app-rigs
+description: ai-app's test rigs, harness scripts and reference measurements - ui-sandbox.sh, debug-transcript.sh, transcript-bench.sh, stream-bench.sh, trace-draw.sh, the /usage fixture vocabulary, the fake CLI, the rule that no UI-driving script may tap a coordinate, how to test llama.cpp and ssh on this machine, how importing behaves, and the scroll/stream/explorer numbers not worth re-measuring. Read before running or writing a benchmark, driving the app's UI from a script, exercising the session lifecycle, testing a llama or remote session, or touching the import screen.
+---
+
+# ai-app: rigs, harnesses and measurements
+
+Moved out of `AGENTS.md` on 2026-09-04 so it is read when it is relevant
+rather than sent with every request in this repo -- it was 12 KB of the 35 KB
+that file cost on every one. Unchanged in the move, and still the only copy.
+
+## The rigs
+
+Each exists because something was invisible without it.
+
+- **`app/ui-sandbox.sh`** — a second `ai-server` with its own `$HOME`, config
+  and data directory, holding eight invented Claude Code transcripts and a
+  `claude` that is two lines of shell. **That isolation is the point**: the
+  import screen lists whatever is in `~/.claude/projects`, which in this VM is
+  real agent transcripts, so exercising *delete* against the ordinary server
+  deletes somebody's conversation and exercising *import* starts a real
+  `--resume` on the owner's account.
+  Its port and root derive from the checkout's name, so two checkouts'
+  sandboxes cannot reach each other, and its token is generated once into
+  `~/.config/ai-app/sandbox-token` and carried across restarts along with any
+  the enrolment flow appended — so the emulator app is enrolled **once** (the
+  start banner prints the command) and stays enrolled. It shares the real TLS
+  certificates, because the installed APK pins that CA.
+  Driving verbs, so none of this is re-derived per session:
+  `./ui-sandbox.sh spawn [title]` (an echo session, prints its id),
+  `./ui-sandbox.sh send SID text|@file`, and
+  `./ui-sandbox.sh api /path [curl args]`.
+  `./ui-sandbox.sh keep` restarts the server without wiping the sessions and
+  enrolment already there — for when the fixture under test was expensive to
+  build; plain `start` wipes them, which is right for the list-screen
+  fixtures and wrong for that.
+  It passes `--delay` by default, and `AI_SANDBOX_BIG_MB` puts one large
+  transcript among the small ones while `AI_SANDBOX_SPAWN_DELAY` makes the
+  fake CLI slow to start. Both exist because operations that finish in
+  milliseconds have states on the way that nothing can observe, and an
+  unobservable state is one where broken and working look identical.
+  It also builds a fixture tree at the sandbox home's `~/files` for the
+  explorer, holding the states otherwise only reachable by finding a real
+  machine in one: an empty directory, a name with a tab and one with an
+  apostrophe, a binary file, one over `FILE_LIMIT`, one `chmod 000`, a
+  symlink to a directory and a broken one, a source file per language, and
+  the three sizes the limits were measured against (`edit-32k.rs`,
+  `edit-128k.rs`, `big-source.rs`). Point a session at it with
+  `./ui-sandbox.sh api /sessions/<id>/cwd -X POST -H 'content-type: application/json' -d '{"cwd":"~/files"}'`.
+  The explorer's 409 is produced by editing the file on the machine
+  (`printf … > file`) between pressing the pencil and pressing save.
+- **`app/debug-transcript.sh`** — a real conversation on the emulator. The
+  echo driver is the right rig for most things and the wrong one for anything
+  whose cost scales with what was actually written: a real reply is longer,
+  is real markdown, and carries tool calls whose input and output are
+  kilobytes. Two faults were invisible until a real transcript was loaded — a
+  page of history landing mid-fling threw the reader back to the newest end,
+  and parsing one real reply took 51ms against 4.6ms for a synthetic one.
+  `-b` takes the biggest conversation on the machine rather than the newest,
+  which is what a scrolling test wants; `--stop` takes it down.
+  It copies the transcript into `/tmp` and gives the server a `HOME` of its
+  own, so the import can only see the copy — importing spawns `claude
+  --resume`, and against the real file that is a second CLI writing to a
+  conversation somebody may still be in. **A transcript never goes in this
+  repository**: they hold whatever was said, read and written in that
+  session, and `~/repos` is shared with the host besides.
+- **`/usage` in an echo session puts up an invented meter**, which is how the
+  rate-limit screens' states are reached without spending quota: `/usage 42`,
+  `/usage 95 20` (minutes left), `/usage 42 never` (the between-blocks window
+  with no reset time), `/usage 42 unreadable`, `/usage notloggedin`,
+  `/usage unreachable`, `/usage failed`, `/usage off`. The vocabulary is
+  `usage::Fixture`'s, since those are its states. With none set an echo
+  session meters nothing, which is the ordinary case and draws no bar.
+- **A fake CLI exercises the process lifecycle without a token.** Point a
+  `claude_cli` provider's `command` at a two-line script — `#!/bin/sh` and
+  `cat > /dev/null` — and it behaves the way the lifecycle code cares about:
+  it holds the fifo open, records a real pid, writes nothing, and dies on a
+  signal. So adopt, stop, restart and start are all drivable without a real
+  `--resume` and without spending a turn on somebody's account. Reach for
+  this when what is under test is *whether a process is running*, and for
+  `debug-transcript.sh` when it is *what the transcript draws*.
+- **`app/transcript-bench.sh`** is the standard scroll measurement: it opens
+  the first session (or `-k` keeps the current screen), scrolls a fixed
+  gesture loop, and prints the app's render report — the same one the in-app
+  copy button produces, whose `on screen:` line names what the viewport was
+  holding. Compare two runs with the same gestures; the emulator's absolute
+  frame times transfer nothing, the report's accounting does. Run it either
+  side of any change under `Markdown*.kt`, `Transcript*.kt` or
+  `SessionScreen.kt`'s list, and put the report in the commit. The numbers
+  that move first are the worst `record: one block`, the reparse mean while
+  streaming, and the draw phase's accounting line.
+- **`app/stream-bench.sh [-k] FILE`** is that measurement for a reply still
+  arriving. It taps "Jump to latest" so the list is pinned to the newest end,
+  resets the report, sends FILE, waits for the transcript to stop growing,
+  and prints. Both of those are corrections to a first version that measured
+  nothing: a transcript parked further back never redraws while a reply
+  streams into it, and a session is idle at *both* ends of a turn, so polling
+  for idle answers before the turn has started.
+- **`app/trace-draw.sh`** names what a scrolling frame spends inside the
+  framework, from `atrace` text output with no trace processor needed. It is
+  how the cost of a layout node per link was attributed to the framework
+  rather than guessed at.
+
+### Driving the UI
+
+**No script that drives this app's UI presses a coordinate.** Every control
+is found by the name it already carries for assistive technology —
+`ui-trace record --do "tap 'Session settings'"` — which resolves the label
+against the screen at the moment of the gesture and fails the whole run when
+it is not there. `app/bench-lib.sh` is what the bench scripts share for it. A
+coordinate is a position measured once by hand, and anything that moves the
+control makes the tap land on whatever now sits there — the bench then
+reports a number that was never measured, which reads exactly like a result.
+Both bench scripts pressed the render report at `tap 723 205` until that
+button moved into the session settings dialog on 2026-09-03. The check that
+none has crept back:
+
+    grep -n "tap [0-9]" app/*.sh
+
+Swipes are still coordinates, deliberately: a gesture across a scrolling area
+is a distance rather than a control.
+
+**Two traps in the emulator bench loop**, each of which cost a run.
+`adb shell pm clear` removes the enrolment and the notification permission
+along with the saved anchors, so the next run measures a permission dialog —
+re-enrol with the command `ui-sandbox.sh` prints, and
+`pm grant … POST_NOTIFICATIONS`. And a saved scroll anchor is per session id,
+so the only way two builds start a scroll from the same place is a *fresh
+session for each*.
+
+**The emulator is `~/repos/emulator-tools`' business, not this repo's.**
+`emu up` creates and boots the AVD named after this checkout — whatever `emu
+name` prints, never a name typed out here, since this file is the same in
+every clone. `run-android.sh` is that plus a build and an install. The `adb`
+on `PATH` after sourcing `android-env.sh` is that repo's wrapper, which fills
+in `-s` from the same rule. Gradle does not go through it, so a Gradle init
+script from `emulator-tools` runs `emu check` before `installDebug`,
+`uninstallDebug` and `connectedAndroidTest` and fails rather than fanning out
+to every attached device; when it refuses, say which device you mean at the
+moment you use it — `ANDROID_SERIAL=$(emu serial) ./gradlew …`.
+
+### Testing llama.cpp and ssh here
+
+**Both are set up here as of 2026-09-04** and need nothing typed. The
+prebuilt CPU llama.cpp lives outside the repo at `~/.local/opt/llama.cpp`
+(the 15 MB `ubuntu-x64` release asset) and is symlinked as
+`/usr/local/bin/llama-server`, which is what makes **discovery find it over
+ssh**: `~/.local/bin` is not on the PATH a non-interactive ssh session gets.
+It resolves its own libraries through `$ORIGIN`, so no `LD_LIBRARY_PATH` is
+needed. One model is downloaded — `unsloth/Qwen3-0.6B-GGUF/Qwen3-0.6B-Q8_0.gguf`,
+639 MB under `~/.local/share/ai-app/models` — and answers at usable speed on
+this VM's 8 cores. **Do not test with a 2-bit quant**: the
+IQ2_XXS of that model produces fluent nonsense, which reads exactly like a
+broken driver — `llama-cli` produces the same from the file directly, which
+is how to tell the two apart in a hurry.
+
+There is no second machine, so **ssh this VM to itself**. That is set up
+too: the key is `~/.config/ai-app/ssh-self` (its public half is in
+`~/.ssh/authorized_keys`, labelled removable), and the real config carries a
+setup called **"this vm over ssh"** — `bob@127.0.0.1` with that
+`identityFile` plus
+`options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=/tmp/ai-app-known-hosts"]`
+so it touches nothing real — offering `claude-cli` and `llama-cpp`. It is the
+whole rig for "does a remote llama session work", since the far machine is
+this one and the model file is the same file. For a throwaway setup of your
+own, point a provider's `command` at something harmless like `/bin/echo`
+rather than at `claude`: the transport is what is under test, the process
+exiting immediately is the signal, and it costs no tokens. The remote login
+shell here is **fish**; the
+remote script and `ssh.rs`'s POSIX quoting happen to mean the same thing in
+both, but that is luck rather than design, and a shell that is neither is the
+thing to suspect first if a remote spawn ever mangles an argument.
+
+## Importing
+
+The import list reports each session's **size as well as its line count**,
+because the two disagree in the way that matters: these transcripts embed
+screenshots as base64, so one line can be a megabyte. On this machine a 69 MB
+session has 3,427 lines and a 44 MB one has 6,792 — nothing about a line
+count tells you what continuing a session will cost. Shown, not warned about;
+importing a large session is a choice somebody is entitled to make.
+
+**Never import a Claude Code session that is open in a terminal.** The app
+refuses it — see PLAN.md for the incident that made that a refusal rather
+than a warning.
+
+**One Claude Code session id can name two files, and the listing offers it
+once.** Resuming from a different working directory makes the CLI write a
+second transcript with the same id under that directory's project folder — an
+ordinary state of a machine, not corruption. Everything downstream addresses
+a session by id, and the phone keyed its list on it, so two rows sharing one
+**closed the app** on a Compose duplicate-key throw. `parse_listing` keeps
+the copy with the most lines, because the other is usually a few-hundred-byte
+stub and is often the *newer* of the two, so recency is the wrong key.
+Deleting removes every copy rather than the first, or the row came back after
+a delete that reported success. The phone's half is `uniqueItems`, which
+every list keyed on a server-chosen id goes through: a repeat there must
+never be able to close the app, whatever produced it.
+
+**Deleting a session offers to take the machine's own transcript with it** —
+`DELETE /sessions/{id}?deleteForeign=true`, behind a switch in the
+confirmation, and only where the driver keeps a record of its own
+(`keepsOwnTranscript`, which today means Claude Code). Off by default,
+because leaving that copy is what makes an ordinary delete recoverable — and
+the dialog's paragraph is rewritten when it is on rather than appended to,
+since the sentence promising the conversation "should still be there to
+import again" is exactly the one the switch makes false. The server deletes
+the machine's copy *first*, so a machine it cannot reach leaves the session
+where it was instead of half-deleted.
+
+## Measurements worth not re-taking
+
+- **What the transcript screen costs to scroll.** Taken 2026-08-30 on the GPU
+  emulator against a real imported transcript with the server at
+  `--delay 120`. Settled and flinging fast, both into fresh history and back
+  through rows already drawn: **5.2–5.9% janky frames, 99th percentile
+  29–32ms, 0–2 slow UI-thread frames.** The stock Settings app on the same
+  device is 3.3% and 38ms, so this is at the platform floor. The number that
+  is *not* at the floor is the first few seconds after opening a session,
+  where every row on the way is being composed for the first time; that is
+  inherent to a lazy list and it is why a measurement taken before the screen
+  settles reads three times worse. **Settle first, then reset `gfxinfo`.**
+- **The reset path is not reachable by reopening a session.** Measured
+  2026-09-04 against a session streaming at 20 events a second: reopening one
+  with an anchor 1,800 events back connects **87–119 events behind**, well
+  under `CATCH_UP_LIMIT`'s 200, because the restore is two requests — the
+  opening page, then one span covering the whole distance. To exercise the
+  reset at all you have to lower `CATCH_UP_LIMIT` in a throwaway build; at 5
+  the app takes the reset on a live connection, clears, refills and carries
+  on without reconnecting.
+- **The session screen's stream survives backgrounding here** — 20 seconds at
+  the launcher while 415 events were produced brought no reconnect at all,
+  which is not what the comment above that loop expects, and is most likely
+  this emulator being headless rather than the phone's behaviour.
+- **Reopening a cached session costs one request for one event** (the probe),
+  and scrolling the whole conversation back costs nothing more; a cold open
+  of the same 500-event session is two pages, 100 events. Measured
+  2026-09-04 on the emulator against the sandbox.
+- **Reading is cheap and editing is not.** The viewer handles a 1 MiB,
+  28,000-line file because it draws one row per line; the editor is one
+  `BasicTextField`, which costs two seconds a frame at 128 kB and stops the
+  app at 1 MiB, so `EDIT_LIMIT` caps it at 32 kB with the reason said on
+  screen. If you make the editor faster, that number is what to move.
+  EXPLORER.md's "What the measurements said" has the rest.

AGENTS.md

@@ -261,6 +261,13 @@ Each exists because something was invisible without it.
   framework, from `atrace` text output with no trace processor needed. It is
   how the cost of a layout node per link was attributed to the framework
   rather than guessed at.
+- **`iris/android-app/build-apk.sh [debug|release] [--abi ...] [--features
+  ...]`** builds iris-android-app's cdylib (`cargo ndk`) and its APK
+  (Gradle) in one step and verifies the result (`aapt2`/`apksigner`), and
+  **`iris/android-app/run-bench.sh [--apk PATH]`** installs it on this
+  checkout's own emulator, taps "Run benchmark" by label, and prints the
+  report -- written so the P0 build/install/tap/read-report cycle stops
+  being retyped by hand each time (docs/RUST.md's P0 box).
 
 ### Driving the UI
 

DECISIONS.md

@@ -0,0 +1,44 @@
+# Decisions awaiting review
+
+Choices made while working autonomously, for Bryan to keep or change. Each
+says what was picked and why; the detail is in the design doc it names.
+Delete an entry once it has been looked at.
+
+## Subagent views (2026-09-05, `SUBAGENTS.md`)
+
+Made on my own judgement, limited blast radius:
+
+1. **A subagent is a transcript, not a session.** It has no process,
+   controls or settings; it is addressed as `/sessions/{id}/subagents/{sub}`
+   and stored under the session's directory, so deleting the session takes
+   it. Alternative rejected: registering it as a session of its own, which
+   would give it a card in the main list and a driver that can do nothing.
+2. **Read-only view is the session screen minus its controls**, rather than
+   a second, simpler transcript screen. Keeps paging, caching, selection
+   and rendering in one place. Cost: a `readOnly` mode threaded through
+   `SessionScreen`.
+3. **The list only carries a count.** Each session row says how many
+   subagents it has; their titles and statuses are fetched when the card is
+   expanded. Keeps `GET /sessions` from reading every subagent transcript.
+   Consequence: an expanded card's statuses refresh with the list, not live.
+4. **Expanded/collapsed is remembered per session on the phone**, not on
+   the server. Collapsed by default, per the transcript convention that new
+   things arrive collapsed.
+5. **Subagents of imported sessions are not shown.** The import path still
+   skips `isSidechain` records; the CLI's own `subagents/agent-*.jsonl` files
+   are not read. Only subagents run while this backend was watching exist.
+6. **Echo grows `/subagent [n]`** as the test rig, so nothing here needs a
+   paid turn to exercise.
+
+Deferred, because they reach further than this feature:
+
+- **Live status on the list.** Whether the session list should follow a
+  stream at all (it refreshes on demand today) decides whether subagent
+  status can ever be live there. Not changed.
+- **Nested subagents.** A subagent's own Task calls are shown as tool calls
+  in its transcript and are not given transcripts of their own. Supporting
+  that is the same mechanism one level down, but the UI would need nested
+  expanders.
+
+- **The subagent status row says "context unknown".** Nothing measures a
+  subagent's context; the row could leave it out rather than admit it.

SUBAGENTS.md

@@ -0,0 +1,141 @@
+# Subagents
+
+A session's subagents -- the helpers a Claude Code session starts through its
+Task tool -- each get a transcript of their own, listed under the session's
+card and readable in the same transcript view the session has. Designed
+2026-09-05; the decisions Bryan has not yet reviewed are in `DECISIONS.md`.
+
+## What a subagent is here
+
+**A subagent is a second transcript owned by a session, in the same event
+model, with no process and no controls.** It is not a session: it cannot be
+messaged, stopped or started, and it has no setup, model or usage of its
+own. Everything it shares with a session -- the transcript file format, the
+paging routes, the SSE stream, the phone's cache and rendering -- is reused
+by addressing, not by copying.
+
+The CLI reports a subagent's messages on the parent's own stream-json
+output, each carrying `parent_tool_use_id` = the id of the Task `tool_use`
+that started it. Before this the translator dropped those lines
+(`subagent_events_are_not_duplicated_into_the_transcript`); now it routes
+them to that subagent's own translator and transcript. The parent's
+transcript still shows only the Task call itself.
+
+## Storage
+
+Under the session directory:
+
+```
+<session>/subagents/<tool_use_id>/meta.json        {title, created}
+<session>/subagents/<tool_use_id>/transcript.jsonl same SeqEvent lines as the session's
+```
+
+The id is the Task tool_use id (`toolu_…`), which is unique, stable across a
+backend restart, and already the key everything on the parent side uses.
+Only ids matching `[A-Za-z0-9_-]+` are ever created or looked up, since the
+id becomes a path.
+
+The transcript's sequence numbers are its own, starting at 1. `Transcript`,
+`read_window`, `catch_up` and `read_after` work on it unchanged.
+
+Its path out: deleting the session deletes its directory, subagents included.
+There is no separate delete.
+
+## Lifecycle, as events in the subagent's transcript
+
+1. Created on the first child line for an unseen parent id (or, when the
+   parent Task call was seen, at that call). First lines written:
+   `Status Running`, then `UserMessage { text: <the Task's prompt> }` when
+   the prompt is known -- it genuinely is the subagent's first user turn.
+2. Every child line is translated by that subagent's own `Translator`
+   (one per subagent: tool ids are unique but streaming deltas are by
+   content-block index, and parallel subagents interleave).
+3. **The parent's `tool_result` never finishes a subagent.** The Task tool
+   runs in the background by default: the `tool_result` -- "Async agent
+   launched..." -- arrives the moment it *starts*, while the subagent goes
+   on working for however long its own turn takes, sometimes minutes. What
+   ends it is its own turn ending: the raw API's `message_delta` on its
+   stream carrying `stop_reason: "end_turn"` (a `stop_reason` of `tool_use`
+   is the model about to call one, not an end), or a `result` line for its
+   own turn if a future CLI version ever sends one. Either maps to
+   `Status Exited`; the subagent's vocabulary has no `Idle`, so the
+   equivalent event `dispatch` produces for an ordinary session is dropped
+   rather than written. A shipped version of this finished on the
+   `tool_result` instead, which read a running background agent as
+   "finished" with its transcript truncated at the moment it launched.
+4. **A child line for a subagent that already finished reopens it**
+   (`Status Running`) rather than being dropped: a background Task can be
+   sent another message long after its first turn ended, and that is
+   exactly what a further line for it means. Same transcript, same child
+   `Translator`, just picking back up.
+5. When the parent session's process exits (`Status Exited` on the
+   session), every subagent still `Running` gets `Status Exited` too: its
+   process was the parent's.
+
+A subagent that was mid-flight when the backend restarted keeps working:
+the registry reopens the existing transcript on the next child line, and
+the file continues its sequence -- the same reopening #4 describes, whether
+what closed it was a restart or its own `end_turn`. If its turn ended while
+the backend was down nothing recorded that until the next line arrives, so
+its last status stays `Running`, which the list reports as **unknown**
+rather than as running (see the wire shape) until then.
+
+Title: the Task call's `description` input, then ` (<subagent_type>)` when
+one is given; falling back to the tool's name when the child arrives before
+(or without) the parent call being seen.
+
+## Server layout
+
+- `session/subagent.rs` -- the registry: `Subagents` (per session, in
+  `Shared`), `Subagent` (its `Transcript` behind a mutex plus a
+  `broadcast::Sender<SeqEvent>`), `record(id, event)`, `start(id, title,
+  prompt)`, `finish(id)`, `reopen(id)`, `finish_all()`, `list()` from disk. Drivers get an
+  `Arc<Subagents>` beside their `EventSink`; llama ignores it.
+- `session/claude/translate.rs` -- routes child lines by parent id, holds
+  one child `Translator` per subagent, remembers pending Task calls'
+  description/prompt/subagent_type.
+- `session/echo.rs` -- `/subagent [n]`: the test rig. Starts *n* (default 1)
+  subagents at once, each named "helper k". Each writes the prompt as its
+  user message, streams a few words of text, runs one `Bash` tool call, then
+  finishes about three seconds after starting, and the parent's Task calls
+  end when their subagent does. Three seconds so the running state can be
+  seen on the phone.
+- `routes.rs` -- three routes, in the doc table.
+
+## Wire shape
+
+```
+GET /sessions/{id}                       SessionInfo gains `subagents: N` (count, 0 when none)
+GET /sessions                            same field on each row
+GET /sessions/{id}/subagents             [{id, title, status, created, lastActivity}], oldest first
+GET /sessions/{id}/subagents/{sub}/transcript   exactly the session transcript's query and answer
+GET /sessions/{id}/subagents/{sub}/events?after=N  exactly the session events stream
+```
+
+`status` is the transcript's last `Status` event, serialised like a session's
+(`running`, `exited`), except that a subagent whose session is not itself
+running cannot be running: the list answers `unknown` for that one. The
+phone words these as *running*, *finished* and *unknown* on the subcard.
+
+The count on `SessionInfo` is a directory listing, so the list stays cheap.
+The per-subagent status is only read when the list route is asked for.
+
+## Phone
+
+- `SessionSummary.subagents: Int`. A card with a non-zero count ends in an
+  expander row -- a full-width `Chevron(Pointing.Down)` row that flips to
+  `Pointing.Up` -- collapsed by default. Expanding fetches
+  `/sessions/{id}/subagents` and draws one `OutlinedCard` per subagent,
+  indented inside the session card, the way dev-updater draws a project's
+  components: title, then the status word and a relative time. The
+  expansion state is per session id and survives a refresh of the list.
+- Tapping a subcard opens `Screen.Subagent`, which is `SessionScreen` in
+  **read-only** form: the same transcript, paging, cache, selection,
+  images and status row, with the composer, the process button, the model
+  picker, the files button, the settings cog and the usage bar left out.
+  The header shows the subagent's title with the session's title beneath
+  it. Back returns to the list.
+- Addressing: `fetchTranscript`, `EventStream`, `TranscriptSource` and the
+  cache take a transcript address rather than a session id --
+  `sessions/{id}` or `sessions/{id}/subagents/{sub}` -- so the cache nests a
+  subagent's copy under its session's and the same code serves both.

app/androidApp/src/main/kotlin/com/example/aiapp/Api.kt

@@ -142,6 +142,20 @@ data class SessionSummary(
     val keepsOwnTranscript: Boolean,
     /** How much the session asks before acting; null when it was never set. */
     val permissionMode: String?,
+    /**
+     * How hard the model thinks, or null for the CLI's own default.
+     *
+     * Null is a level somebody can choose, not only one to start in -- see [EFFORT_LEVELS]. It is
+     * reported rather than assumed for the same reason [permissionMode] is.
+     */
+    val effort: String?,
+    /**
+     * Whether a thinking level does anything here -- a Claude CLI session, not a llama or echo one.
+     *
+     * Asked of the server rather than worked out from the provider's name, because this is a
+     * property of the driver's *kind* and the phone only has the name.
+     */
+    val takesEffort: Boolean,
     /**
      * Whether this continues a session the machine already had, which changes what deleting means.
      */
@@ -153,6 +167,24 @@ data class SessionSummary(
      * itself from a default is one you can turn off while believing you are reading it.
      */
     val notify: Boolean,
+    /**
+     * Whether this session sends itself a message once its account's usage limit lifts, and what
+     * that message says.
+     *
+     * The message is what the server would actually send, with its own default already filled in,
+     * so the field shows the words rather than an empty box standing for them.
+     */
+    val autoResume: Boolean,
+    val autoResumeMessage: String,
+    /**
+     * When the server next intends to check whether the limit has lifted, in epoch seconds, or null
+     * when nothing is waiting.
+     *
+     * A time to *ask*, not a time to resume: the server checks the meter at that moment and waits
+     * again if the limit is still on. Worded that way wherever it is shown, because a promise this
+     * app cannot keep is worse than no time at all.
+     */
+    val resumeAt: Double?,
     /**
      * The directory the session works in, or null where it was never given one.
      *
@@ -178,8 +210,27 @@ data class SessionSummary(
      * server because that is where a provider's kind is known.
      */
     val maxImageEdge: Int?,
+    /**
+     * Which of `GET /usage`'s snapshots is about this session, and null where nothing meters it.
+     *
+     * The rate-limit bar answers a question about an *account*, and what decides which account --
+     * if any -- is the provider this session runs, not the machine it runs on. Pairing by machine
+     * alone drew the Claude CLI's five-hour window under every echo session on a machine that also
+     * has the CLI: a quota that session cannot spend and could never run down. Decided by the
+     * server for the same reason [maxImageEdge] is -- it is a fact about the provider's kind, and
+     * this app has only its name.
+     */
+    val usageProvider: String?,
     val status: String,
     val lastActivity: Double,
+    /**
+     * How many subagents this session has, however their own status now reads.
+     *
+     * A directory listing on the server rather than a status read per subagent, so the list stays
+     * cheap; the per-subagent state is only fetched when the card is expanded. Zero on a server
+     * that predates subagents, so this app still opens against one.
+     */
+    val subagents: Int,
 )
 
 private fun parseSession(session: JSONObject) =
@@ -192,14 +243,24 @@ private fun parseSession(session: JSONObject) =
         title = session.getString("title"),
         model = session.optString("model").ifEmpty { null },
         permissionMode = session.optString("permissionMode").ifEmpty { null },
+        effort = session.optString("effort").ifEmpty { null },
+        takesEffort = session.optBoolean("takesEffort", false),
         imported = session.optBoolean("imported", false),
         notify = session.optBoolean("notify", true),
+        autoResume = session.optBoolean("autoResume", false),
+        // The server sends its own default rather than nothing, so an empty answer means an older
+        // server -- and this app's word for it is the same word.
+        autoResumeMessage =
+            session.optString("autoResumeMessage").ifEmpty { DEFAULT_RESUME_MESSAGE },
+        resumeAt = if (session.has("resumeAt")) session.getDouble("resumeAt") else null,
         cwd = session.optString("cwd").ifEmpty { null },
         contextTokens =
             if (session.has("contextTokens")) session.getLong("contextTokens") else null,
         maxImageEdge = session.optInt("maxImageEdge", 0).takeIf { it > 0 },
+        usageProvider = session.optString("usageProvider").ifEmpty { null },
         status = session.getString("status"),
         lastActivity = session.getDouble("lastActivity"),
+        subagents = session.optInt("subagents", 0),
     )
 
 fun fetchSessions(settings: ServerSettings): List<SessionSummary> =
@@ -215,6 +276,35 @@ fun fetchSessions(settings: ServerSettings): List<SessionSummary> =
 fun fetchSession(settings: ServerSettings, sessionId: String): SessionSummary =
     requestFromServer(settings, "/sessions/$sessionId") { parseSession(it.jsonObject()) }
 
+/**
+ * One row of `GET /sessions/{id}/subagents`, oldest first.
+ *
+ * A subagent is a second transcript owned by a session -- no process, no controls of its own -- so
+ * this carries only what a card needs to draw and to open it; see SUBAGENTS.md. [status] is
+ * "running", "exited" or "unknown": a subagent whose session is not itself running cannot be
+ * running, and the list says so rather than reporting a state that cannot hold.
+ */
+data class SubagentSummary(
+    val id: String,
+    val title: String,
+    val status: String,
+    val created: Double,
+    val lastActivity: Double,
+)
+
+fun fetchSubagents(settings: ServerSettings, sessionId: String): List<SubagentSummary> =
+    requestFromServer(settings, "/sessions/$sessionId/subagents") {
+        it.jsonObjects { row ->
+            SubagentSummary(
+                id = row.getString("id"),
+                title = row.getString("title"),
+                status = row.getString("status"),
+                created = row.getDouble("created"),
+                lastActivity = row.getDouble("lastActivity"),
+            )
+        }
+    }
+
 // What the server offers, so the spawn screen has no hardcoded lists: a setup added to the server's
 // config.ron appears here with no app rebuild.
 //
@@ -375,6 +465,12 @@ data class SshDetails(
      * Where files attached from here land on that machine; null for the session's own directory.
      */
     val attachmentsDir: String? = null,
+    /**
+     * Where that machine keeps its GGUF models; null for the same place the backend keeps its own
+     * (`~/.local/share/ai-app/models`, read on that machine). A llama.cpp session serves the file
+     * from the machine it runs on, so this is where its models are looked for and listed.
+     */
+    val modelsDir: String? = null,
 )
 
 private fun SshDetails.toJson() =
@@ -382,6 +478,7 @@ private fun SshDetails.toJson() =
         if (port != null) put("port", port)
         if (!identityFile.isNullOrBlank()) put("identityFile", identityFile)
         if (!attachmentsDir.isNullOrBlank()) put("attachmentsDir", attachmentsDir)
+        if (!modelsDir.isNullOrBlank()) put("modelsDir", modelsDir)
     }
 
 /** What a machine turns out to have, without saving anything. */
@@ -450,6 +547,8 @@ fun spawnSession(
     model: String? = null,
     cwd: String? = null,
     permissionMode: String? = null,
+    /** Null for whatever the server's default is; see [fetchDefaultEffort]. */
+    effort: String? = null,
     params: Map<String, String> = emptyMap(),
     /** Continue this Claude Code session instead of starting an empty one. */
     import: String? = null,
@@ -467,6 +566,7 @@ fun spawnSession(
                     if (!model.isNullOrBlank()) put("model", model)
                     if (!cwd.isNullOrBlank()) put("cwd", cwd)
                     if (!permissionMode.isNullOrBlank()) put("permissionMode", permissionMode)
+                    if (!effort.isNullOrBlank()) put("effort", effort)
                     if (!import.isNullOrBlank()) put("import", import)
                     if (params.isNotEmpty()) {
                         put("params", JSONObject(params.toMap<String, Any>()))
@@ -906,7 +1006,7 @@ fun startImport(
  */
 fun fetchTranscript(
     settings: ServerSettings,
-    sessionId: String,
+    address: TranscriptAddress,
     before: Long? = null,
     limit: Int = 80,
     // Count [limit] in rows, not events, joining a reply's streamed deltas into one -- so a page of
@@ -925,7 +1025,7 @@ fun fetchTranscript(
         if (coalesce) append("&coalesce=true")
         if (after != null) append("&after=").append(after)
     }
-    return requestFromServer(settings, "/sessions/$sessionId/transcript$query") { connection ->
+    return requestFromServer(settings, "/${address.urlPath}/transcript$query") { connection ->
         val body = JSONArray(connection.inputStream.bufferedReader().readText())
         // The text as well as the event: the transcript cache stores the one and the fold needs the
         // other, and they have to be the same line.
@@ -973,6 +1073,56 @@ fun setSessionModel(settings: ServerSettings, sessionId: String, model: String)
  */
 val PERMISSION_MODES = listOf("manual", "acceptEdits", "auto", "bypassPermissions", "plan")
 
+/**
+ * What a new session's thinking level is when nothing chose one, or null for the CLI's own.
+ *
+ * Held by the server rather than by this phone, because a second device would otherwise spawn
+ * sessions at a level the first one's owner never picked.
+ */
+fun fetchDefaultEffort(settings: ServerSettings): String? =
+    requestFromServer(settings, "/defaults") {
+        it.jsonObject().optString("effort").ifEmpty { null }
+    }
+
+/** Sets what new sessions start at. Nothing already running changes. */
+fun setDefaultEffort(settings: ServerSettings, level: String?) {
+    requestFromServer(
+        settings,
+        "/defaults",
+        method = "POST",
+        jsonBody = JSONObject().put("effort", level ?: JSONObject.NULL).toString(),
+    ) {}
+}
+
+/**
+ * How hard the model thinks, as `claude --effort` takes them, cheapest first.
+ *
+ * Not offered alongside the model and the permission mode on the session's own bar, because it does
+ * not behave like them: the CLI has a control request for those two and none for this (checked
+ * against 2.1.258), so a level is settled when the process is launched. Changing it therefore stops
+ * the process, which is what the working directory beside it in this dialog does, and why it is
+ * here rather than on a bar whose other controls take effect mid-turn.
+ */
+val EFFORT_LEVELS = listOf("low", "medium", "high", "xhigh", "max")
+
+/** What the picker shows, and sends as null, for a session that has chosen no level. */
+const val DEFAULT_EFFORT = "default"
+
+/**
+ * Records how hard a session thinks and **stops its process**, since the level is read when the
+ * process is launched. The next message, or Start, runs one that has it.
+ *
+ * [level] is null for the CLI's own default.
+ */
+fun setSessionEffort(settings: ServerSettings, sessionId: String, level: String?) {
+    requestFromServer(
+        settings,
+        "/sessions/$sessionId/effort",
+        method = "POST",
+        jsonBody = JSONObject().put("effort", level ?: JSONObject.NULL).toString(),
+    ) {}
+}
+
 /** Switches how much a running session asks before acting, also in place. */
 fun setSessionPermissionMode(settings: ServerSettings, sessionId: String, mode: String) {
     requestFromServer(
@@ -984,6 +1134,36 @@ fun setSessionPermissionMode(settings: ServerSettings, sessionId: String, mode:
 }
 
 /** Turns this session's notifications on or off. Stored on the backend -- see `SessionConfig`. */
+/**
+ * What an auto-resume says when nothing else was typed. Mirrors the server's own default, so a
+ * cleared field shows the word that would actually be sent instead of going blank.
+ */
+const val DEFAULT_RESUME_MESSAGE = "continue"
+
+/**
+ * Turns auto-resume on or off and sets what it would say, in one request because they are one
+ * decision -- see the server's `/sessions/{id}/auto-resume`.
+ */
+fun setSessionAutoResume(
+    settings: ServerSettings,
+    sessionId: String,
+    autoResume: Boolean,
+    message: String?,
+) {
+    requestFromServer(
+        settings,
+        "/sessions/$sessionId/auto-resume",
+        method = "POST",
+        jsonBody =
+            JSONObject()
+                .put("autoResume", autoResume)
+                // Empty means the server's default rather than a session poked with nothing to
+                // read, which is the same rule the server applies to the field.
+                .put("message", message?.trim()?.ifEmpty { null } ?: JSONObject.NULL)
+                .toString(),
+    ) {}
+}
+
 fun setSessionNotify(settings: ServerSettings, sessionId: String, notify: Boolean) {
     requestFromServer(
         settings,
@@ -1074,6 +1254,26 @@ private fun parseDownload(o: JSONObject) =
         error = if (o.has("error")) o.getString("error") else null,
     )
 
+/**
+ * The models on one machine, which is the list a llama.cpp session there can choose from.
+ *
+ * Not [fetchModels], which is what the *backend* has downloaded. A session serves its model from
+ * the machine it runs on, so for a machine reached over ssh those are two different lists -- and
+ * offering the backend's would name files that are not there, turning a choice that cannot work
+ * into a session that fails when it tries to load one.
+ */
+fun fetchSetupModels(settings: ServerSettings, setupId: String): List<LocalModel> =
+    requestFromServer(settings, "/setups/${setupId.urlEncoded()}/models") { connection ->
+        JSONArray(connection.inputStream.bufferedReader().readText()).mapObjects { m ->
+            LocalModel(
+                key = m.getString("key"),
+                repo = m.getString("repo"),
+                file = m.getString("file"),
+                bytes = m.getLong("bytes"),
+            )
+        }
+    }
+
 fun fetchModels(settings: ServerSettings): Models =
     requestFromServer(settings, "/models") { connection ->
         val body = JSONObject(connection.inputStream.bufferedReader().readText())

app/androidApp/src/main/kotlin/com/example/aiapp/AppRoot.kt

@@ -1,7 +1,9 @@
 package com.example.aiapp
 
 import androidx.activity.compose.BackHandler
+import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.imePadding
 import androidx.compose.foundation.layout.padding
 import androidx.compose.material3.AlertDialog
@@ -34,7 +36,23 @@ import kotlinx.coroutines.withContext
  * session, spawning one, and settings.
  */
 private sealed class Screen {
-    data object Main : Screen()
+    /**
+     * The session list, with a subagent's own transcript over it when [subagent] is set.
+     *
+     * A layer on this screen rather than a screen of its own, for the same reason [Session.files]
+     * is: [SessionListScreen] owns which cards are expanded and what each expansion fetched, kept
+     * in `remember`, and a subagent is opened from a card's expander. As a sibling `Screen` it was
+     * disposed and recreated on every return, which lost that state -- an expanded card collapsed
+     * itself the moment its own subagent's view was closed.
+     */
+    data class Main(val subagent: SubagentTarget? = null) : Screen()
+
+    /**
+     * One subagent's own transcript, read-only. See [SessionScreen]'s `subagent` parameter and
+     * SUBAGENTS.md's "Phone". Closing it returns to [Main] under it, not to [Session]: a subagent
+     * is opened from the session list's card rather than from inside the session it belongs to.
+     */
+    data class SubagentTarget(val summary: SessionSummary, val subagent: SubagentSummary)
 
     /**
      * One session, with the file explorer over it when [files] is set.
@@ -81,7 +99,7 @@ fun AppRoot(
     val context = LocalContext.current
     val scope = rememberCoroutineScope()
     var settings by remember(settingsVersion) { mutableStateOf(loadServerSettings(context)) }
-    var screen by remember { mutableStateOf<Screen>(Screen.Main) }
+    var screen by remember { mutableStateOf<Screen>(Screen.Main()) }
     // A notification tap this could not follow, and why. Null both before one is asked for and
     // after one succeeds, since success is a screen rather than a message.
     var failedOpen by remember { mutableStateOf<FailedOpen?>(null) }
@@ -96,7 +114,7 @@ fun AppRoot(
             share = shareRequest
             // A session already open takes it. Otherwise the list is where the choice is made,
             // whatever screen was showing: Spawn and Settings have nowhere to put a file.
-            if (screen !is Screen.Session) screen = Screen.Main
+            if (screen !is Screen.Session) screen = Screen.Main()
         }
     }
 
@@ -123,7 +141,7 @@ fun AppRoot(
                 existing = null,
                 onSaved = { saved ->
                     settings = saved
-                    screen = Screen.Main
+                    screen = Screen.Main()
                 },
                 onBack = null,
             )
@@ -136,7 +154,7 @@ fun AppRoot(
     // shows, so it always refetches.
     val goToMain = {
         reloadToken++
-        screen = Screen.Main
+        screen = Screen.Main()
     }
     if (screen !is Screen.Main) {
         BackHandler(onBack = goToMain)
@@ -185,6 +203,9 @@ fun AppRoot(
                     reloadToken = reloadToken,
                     share = share,
                     onOpen = { screen = Screen.Session(it) },
+                    onOpenSubagent = { summary, subagent ->
+                        screen = here.copy(subagent = Screen.SubagentTarget(summary, subagent))
+                    },
                     onSpawn = { screen = Screen.Spawn },
                     onImported = { imported ->
                         reloadToken++
@@ -192,6 +213,27 @@ fun AppRoot(
                     },
                     onSettings = { screen = Screen.Settings },
                 )
+                // Its own back handler is registered after MainScreen's, so it is the one the
+                // platform asks first while a subagent is open -- the same rule the files
+                // explorer's handler follows over its session, below.
+                here.subagent?.let { target ->
+                    BackHandler { screen = here.copy(subagent = null) }
+                    // Its own opaque background: this screen was always the sole content under
+                    // the theme's own Surface before, so it never had to paint one -- stacked over
+                    // the list here, the space between its own cards let the list underneath show
+                    // through without this. The same fix FilesScreen needed over its session.
+                    Box(Modifier.fillMaxSize().background(MaterialTheme.colorScheme.background)) {
+                        key(target.summary.id, target.subagent.id) {
+                            SessionScreen(
+                                settings = current,
+                                summary = target.summary,
+                                onBack = { screen = here.copy(subagent = null) },
+                                onFiles = {},
+                                subagent = target.subagent,
+                            )
+                        }
+                    }
+                }
             }
         is Screen.Session ->
             // Keyed on the id, because a different session is a different screen rather than this

app/androidApp/src/main/kotlin/com/example/aiapp/BenchRun.kt

@@ -3,9 +3,13 @@ package com.example.aiapp
 import android.content.Context
 import android.os.BatteryManager
 import android.os.Process
-import androidx.compose.animation.core.tween
-import androidx.compose.foundation.gestures.animateScrollBy
+import android.view.View
+import androidx.compose.foundation.gestures.FlingBehavior
 import androidx.compose.foundation.lazy.LazyListState
+import androidx.compose.ui.focus.FocusRequester
+import androidx.core.view.ViewCompat
+import androidx.core.view.WindowInsetsCompat
+import androidx.core.view.WindowInsetsControllerCompat
 import java.io.File
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.delay
@@ -19,27 +23,84 @@ import kotlinx.coroutines.launch
  * here against [LazyListState] and [BenchFixture] directly. Only reachable from the `bench` build
  * (see [SessionSettingsDialog]'s `onRunBenchmark`), but compiled into every build for the reason
  * [BenchFixture]'s doc comment gives.
+ *
+ * **v2 (2026-09-06)**, asked for by Iris because the v1 fling was too gentle to stress-test the
+ * scroll path and said nothing about typing or the keyboard. Four phases now, each a slice of the
+ * same [FrameStats] recording ([FrameStats.markPhase]/[FrameStats.phaseLines] -- one recorder, not
+ * two): **fling** (real `FlingBehavior`, not `animateScrollBy`), **stream** (unchanged from v1),
+ * **type** (600 fixed characters into the real composer `TextFieldValue`, then deleted), and
+ * **keyboard** (five show/hide cycles). The exact constants below are also written into
+ * `docs/RUST.md`'s P0 box, "Benchmark v2 (2026-09-06)", so the iris half implements the identical
+ * spec -- changing a number here without updating that box makes the two apps measure different
+ * things while looking like the same benchmark.
  */
 object BenchRun {
-    /** transcript-bench.sh's default: 6 cycles of 4 swipes each, 900px over 200ms, 500ms apart. */
+    /** transcript-bench.sh's default: 6 cycles of 4 swipes each, kept as the pre-v2 comparison. */
     private const val CYCLES = 6
     private const val SWIPE_PX = 900f
     private const val SWIPE_MS = 200
     private const val SWIPE_PAUSE_MS = 500L
 
+    /**
+     * Fling phase (v2): a real fling through the list's own [FlingBehavior], not `animateScrollBy`
+     * -- Iris's ask was that it "travel way faster" than the old tween-based swipe, and a tween can
+     * never exceed the distance it is told to cover in the time it is given, while a real fling
+     * decays from an initial velocity the way a finger flick does. 12,000 px/s is roughly a hard,
+     * fast flick on a ~420dp/in device (about 30 dp/ms-equivalent initial speed); chosen well above
+     * the ~4,500 px/s a moderate `animateScrollBy` swipe implies, so this phase exercises the fast
+     * end of what the platform's fling decay produces rather than the gentle one v1 measured.
+     */
+    private const val FLING_VELOCITY_PX_S = 12_000f
+
+    private const val FLING_COUNT = 8
+    private const val FLING_SETTLE_CAP_MS = 3_000L
+    private const val FLING_PAUSE_MS = 300L
+
     /** stream-bench.sh's shape: a real reply arrives as many small deltas, not one big write. */
     private const val STREAM_EVENTS_PER_SEC = 20
     private const val STREAM_SECONDS = 20
 
     /**
-     * Scrolls, then streams, then returns the extra report lines P0 asked for (CPU time, peak RSS,
-     * battery current) -- [FrameStats] and [DebugStats] are reset first, exactly as
-     * `copyRenderReport` resets them, so the two accountings cover the same stretch of work.
+     * Type phase (v2): sentences built from long, multisyllabic words so the composer actually
+     * wraps across lines rather than fitting one, and long enough (600 chars) that the composer's
+     * own height grows over several frames, pushing the transcript above it upward the same way a
+     * real long message does. Exactly this string is also in `docs/RUST.md`'s P0 box so the iris
+     * half types the identical content.
+     */
+    const val TYPE_TEXT =
+        "Benchmarking this transcript screen requires unusually long, multisyllabic words so " +
+            "wrapping and reflow are properly exercised: internationalization, " +
+            "counterproductiveness, disproportionately, incomprehensibility, " +
+            "deinstitutionalization, uncharacteristically, overenthusiastically, " +
+            "misunderstanding, straightforwardness, telecommunications, and interdisciplinary " +
+            "collaboration all push a narrow composer field to wrap across several lines while " +
+            "the transcript above is pushed upward by the growing keyboard-adjacent box, which " +
+            "is exactly what a real reader typing a long message sees happening now!!!"
+
+    private const val TYPE_CHAR_DELAY_MS = 50L
+
+    /**
+     * Keyboard phase (v2): five show/hide cycles, a second apart, is enough to see whether the
+     * transition is ever actually observed rather than being a one-off fluke either way.
+     */
+    private const val KEYBOARD_CYCLES = 5
+    private const val KEYBOARD_SHOW_WAIT_MS = 1_000L
+    private const val KEYBOARD_HIDE_WAIT_MS = 1_000L
+
+    /**
+     * Scrolls, flings, streams, types and toggles the keyboard, then returns the extra report lines
+     * P0 asked for (per-phase travel/typing/keyboard counts, plus CPU time, peak RSS, battery
+     * current) -- [FrameStats] and [DebugStats] are reset first, exactly as `copyRenderReport`
+     * resets them, so the two accountings cover the same stretch of work.
      */
     suspend fun run(
         context: Context,
         scope: CoroutineScope,
         listState: LazyListState,
+        flingBehavior: FlingBehavior,
+        composerFocus: FocusRequester,
+        setComposerText: (String) -> Unit,
+        view: View,
     ): List<String> {
         FrameStats.reset()
         DebugStats.reset()
@@ -55,34 +116,10 @@ object BenchRun {
             }
         }
 
-        // The swipe loop: transcript-bench.sh's four swipes per cycle are two drags toward newer
-        // content and two back, so a cycle returns to where it started and the whole loop measures
-        // steady-state scrolling rather than travelling somewhere new each time.
-        repeat(CYCLES) {
-            repeat(2) {
-                listState.animateScrollBy(SWIPE_PX, tween(SWIPE_MS))
-                delay(SWIPE_PAUSE_MS)
-            }
-            repeat(2) {
-                listState.animateScrollBy(-SWIPE_PX, tween(SWIPE_MS))
-                delay(SWIPE_PAUSE_MS)
-            }
-        }
-
-        // Pinned to the newest end before streaming starts, the way stream-bench.sh's "Jump to
-        // latest" tap is -- a reply streamed into a list parked further back arrives off-screen and
-        // the report would show nothing happened.
-        listState.scrollToItem(0)
-
-        var sent = 0
-        val total = STREAM_EVENTS_PER_SEC * STREAM_SECONDS
-        while (sent < total && BenchFixture.remainingStreamEvents() > 0) {
-            BenchFixture.pushNextLiveEvent()
-            sent++
-            delay(1000L / STREAM_EVENTS_PER_SEC)
-        }
-        // Lets the last few deltas land and draw before the report is read.
-        delay(300)
+        val travel = runFlingPhase(listState, flingBehavior)
+        val sent = runStreamPhase()
+        runTypePhase(listState, composerFocus, setComposerText, view)
+        val keyboard = runKeyboardPhase(context, view)
 
         samplerJob.cancel()
         val cpuMs = Process.getElapsedCpuTime() - cpuStartMs
@@ -90,13 +127,158 @@ object BenchRun {
         val batteryLine = battery.finish()
 
         return listOf(
-            "  scroll: $CYCLES cycles (${CYCLES * 4} swipes), streamed $sent/$total fixture events",
+            "  fling: $FLING_COUNT flings out + $FLING_COUNT back at" +
+                " ${FLING_VELOCITY_PX_S.toInt()}px/s, travel $travel",
+            "  scroll: $CYCLES cycles (${CYCLES * 4} swipes, legacy tween), " +
+                "streamed $sent/${STREAM_EVENTS_PER_SEC * STREAM_SECONDS} fixture events",
+            "  type: ${TYPE_TEXT.length} characters inserted then deleted, one per" +
+                " ${TYPE_CHAR_DELAY_MS}ms",
+            keyboard,
             "  process CPU time over this run: ${cpuMs}ms",
             rssLine,
             batteryLine,
         )
     }
 
+    /**
+     * Phase 1: starting pinned at the newest end, [FLING_COUNT] flings away from it (toward older
+     * messages) through the list's real fling path, then [FLING_COUNT] back. Positive velocity here
+     * matches this list's existing scroll-offset convention (`TranscriptList`'s `reverseLayout`
+     * pins index 0 -- the newest item -- at the bottom; a positive scroll offset moves the viewport
+     * toward higher indices, i.e. away from the newest end and toward older content), the same sign
+     * the pre-v2 swipe loop below already used for its first two swipes.
+     */
+    private suspend fun runFlingPhase(
+        listState: LazyListState,
+        flingBehavior: FlingBehavior,
+    ): String {
+        FrameStats.markPhase("fling")
+        listState.scrollToItem(0)
+        val start = position(listState)
+        repeat(FLING_COUNT) {
+            listState.scroll { with(flingBehavior) { performFling(FLING_VELOCITY_PX_S) } }
+            waitForSettle(listState)
+            delay(FLING_PAUSE_MS)
+        }
+        val outward = position(listState)
+        repeat(FLING_COUNT) {
+            listState.scroll { with(flingBehavior) { performFling(-FLING_VELOCITY_PX_S) } }
+            waitForSettle(listState)
+            delay(FLING_PAUSE_MS)
+        }
+        val back = position(listState)
+        return "start=$start outward=$outward end=$back"
+    }
+
+    private fun position(listState: LazyListState) =
+        "idx=${listState.firstVisibleItemIndex}/off=${listState.firstVisibleItemScrollOffset}px"
+
+    /** Belt-and-suspenders on top of `performFling` already suspending until its own decay ends. */
+    private suspend fun waitForSettle(listState: LazyListState) {
+        val startedAt = System.currentTimeMillis()
+        while (
+            listState.isScrollInProgress &&
+                System.currentTimeMillis() - startedAt < FLING_SETTLE_CAP_MS
+        ) {
+            delay(16)
+        }
+    }
+
+    /**
+     * Phase 2 (unchanged from v1): pinned to the newest end before streaming starts, the way
+     * stream-bench.sh's "Jump to latest" tap is -- a reply streamed into a list parked further back
+     * arrives off-screen and the report would show nothing happened.
+     */
+    private suspend fun runStreamPhase(): Int {
+        FrameStats.markPhase("stream")
+        var sent = 0
+        val total = STREAM_EVENTS_PER_SEC * STREAM_SECONDS
+        while (sent < total && BenchFixture.remainingStreamEvents() > 0) {
+            BenchFixture.pushNextLiveEvent()
+            sent++
+            delay(1000L / STREAM_EVENTS_PER_SEC)
+        }
+        // Lets the last few deltas land and draw before the next phase starts.
+        delay(300)
+        return sent
+    }
+
+    /**
+     * Phase 3: focuses the real composer, shows the keyboard if the platform allows it, then types
+     * [TYPE_TEXT] one character at a time through the same `TextFieldValue` state a real keystroke
+     * updates, and deletes it the same way -- this is what exercises wrapping and the transcript
+     * being pushed upward, not a single big write.
+     */
+    private suspend fun runTypePhase(
+        listState: LazyListState,
+        composerFocus: FocusRequester,
+        setComposerText: (String) -> Unit,
+        view: View,
+    ) {
+        FrameStats.markPhase("type")
+        listState.scrollToItem(0)
+        composerFocus.requestFocus()
+        showIme(view.context, view)
+        // Lets focus and the keyboard's opening animation land before typing starts, so the frames
+        // this phase records are the wrap/reflow it is measuring, not the keyboard opening.
+        delay(300)
+        var typed = ""
+        for (ch in TYPE_TEXT) {
+            typed += ch
+            setComposerText(typed)
+            delay(TYPE_CHAR_DELAY_MS)
+        }
+        delay(200)
+        while (typed.isNotEmpty()) {
+            typed = typed.dropLast(1)
+            setComposerText(typed)
+            delay(TYPE_CHAR_DELAY_MS)
+        }
+    }
+
+    /**
+     * Phase 4: [KEYBOARD_CYCLES] show/hide cycles through the same [WindowInsetsControllerCompat]
+     * path a real IME toggle goes through, reporting how many of each were actually confirmed by
+     * [android.view.WindowInsets.isVisible] rather than assumed from having asked -- UI_RULES:
+     * never present an inferred value as a measured one. If the platform never shows it even once,
+     * this says so in words rather than reporting a phase with no keyboard in it.
+     */
+    private suspend fun runKeyboardPhase(context: Context, view: View): String {
+        FrameStats.markPhase("keyboard")
+        var shown = 0
+        var hidden = 0
+        repeat(KEYBOARD_CYCLES) {
+            showIme(context, view)
+            delay(KEYBOARD_SHOW_WAIT_MS)
+            if (imeVisible(view)) shown++
+            hideIme(context, view)
+            delay(KEYBOARD_HIDE_WAIT_MS)
+            if (!imeVisible(view)) hidden++
+        }
+        return if (shown == 0) {
+            "  keyboard: could not be shown ($KEYBOARD_CYCLES attempts, 0 confirmed visible)"
+        } else {
+            "  keyboard: shown $shown/$KEYBOARD_CYCLES, hidden $hidden/$KEYBOARD_CYCLES" +
+                " (confirmed via isImeVisible)"
+        }
+    }
+
+    private fun controller(context: Context, view: View): WindowInsetsControllerCompat? {
+        val window = context.activity()?.window ?: return null
+        return WindowInsetsControllerCompat(window, view)
+    }
+
+    private fun showIme(context: Context, view: View) {
+        controller(context, view)?.show(WindowInsetsCompat.Type.ime())
+    }
+
+    private fun hideIme(context: Context, view: View) {
+        controller(context, view)?.hide(WindowInsetsCompat.Type.ime())
+    }
+
+    private fun imeVisible(view: View): Boolean =
+        ViewCompat.getRootWindowInsets(view)?.isVisible(WindowInsetsCompat.Type.ime()) ?: false
+
     /** VmHWM from /proc/self/status: the process's high-water mark, in kB, since it started. */
     private fun peakRssLine(): String {
         val kb =

app/androidApp/src/main/kotlin/com/example/aiapp/DebugStats.kt

@@ -134,6 +134,13 @@ fun debugReport(
      * render-report button reads exactly as it did before this existed.
      */
     extra: List<String> = emptyList(),
+    /**
+     * Bench v2's per-phase frame accounting ([FrameStats.phaseLines]) --
+     * fling/stream/type/keyboard, each a slice of the same frames the whole-run sections below
+     * still cover in full. Empty on every path but the scripted bench run, same reasoning as
+     * [extra].
+     */
+    phaseFrames: List<String> = emptyList(),
 ): String = buildString {
     appendLine("ai-app render report")
     appendLine(device)
@@ -148,6 +155,11 @@ fun debugReport(
     appendLine("transcript:")
     transcript.forEach { appendLine(it) }
     appendLine()
+    if (phaseFrames.isNotEmpty()) {
+        appendLine("per phase:")
+        phaseFrames.forEach { appendLine(it) }
+        appendLine()
+    }
     appendLine("frames:")
     frames.forEach { appendLine(it) }
     appendLine()

app/androidApp/src/main/kotlin/com/example/aiapp/Dividers.kt

@@ -12,6 +12,10 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.unit.dp
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
 
 /**
  * A line across the transcript saying what left the session's context.
@@ -47,3 +51,40 @@ fun TranscriptDivider(text: String, color: Color, modifier: Modifier = Modifier)
 fun ClearedRow(modifier: Modifier = Modifier) {
     TranscriptDivider("Context cleared", clearedColor, modifier)
 }
+
+/**
+ * The mark running out of quota leaves.
+ *
+ * The same red the usage bar takes when a window is spent, because it is the same fact in a second
+ * place: colour by consequence, so "there is nothing left to spend" is learned once.
+ *
+ * A time rather than a countdown. The row is folded once and never re-measured, so a span would go
+ * stale on screen the moment it was drawn; and this is when the *account* said it would reset,
+ * which is not a promise about when the session picks back up. A limit the session was told no
+ * reset time for says nothing about one -- that state has its own words rather than a plausible
+ * number.
+ */
+@Composable
+fun LimitRow(item: TranscriptItem.LimitNote, modifier: Modifier = Modifier) {
+    TranscriptDivider(limitSummary(item.resetsAt, ZoneId.systemDefault()), overLimitColor, modifier)
+}
+
+/**
+ * What the row says. Split out so the wording is testable without a screen, since the two states it
+ * has to keep apart -- a reset time that arrived and one that never did -- are exactly the pair
+ * that reads the same when it goes wrong.
+ *
+ * [zone] is a parameter rather than read here so a test says the same thing wherever it runs.
+ */
+fun limitSummary(resetsAt: Double?, zone: ZoneId): String {
+    val at = resetsAt?.let {
+        try {
+            DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
+                .withZone(zone)
+                .format(Instant.ofEpochSecond(it.toLong()))
+        } catch (_: Exception) {
+            null
+        }
+    }
+    return if (at == null) "Usage limit reached" else "Usage limit reached • resets $at"
+}

app/androidApp/src/main/kotlin/com/example/aiapp/EventStream.kt

@@ -14,7 +14,7 @@ private const val RESET_EVENT = "reset"
  * mean. [close] from any thread ends it, and the caller owns reconnecting -- with the last seq it
  * saw as the new cursor.
  */
-class EventStream(settings: ServerSettings, private val sessionId: String) {
+class EventStream(settings: ServerSettings, private val address: TranscriptAddress) {
     private val stream = Sse(settings)
 
     fun close() = stream.close()
@@ -35,7 +35,7 @@ class EventStream(settings: ServerSettings, private val sessionId: String) {
         // one and the screen folds the other, and they have to be the same line.
         onEvent: (raw: String, event: SeqEvent) -> Unit,
     ) {
-        stream.run("/sessions/$sessionId/events?after=$after", onOpen) { name, data ->
+        stream.run("/${address.urlPath}/events?after=$after", onOpen) { name, data ->
             // A named frame carries no payload and a data frame has no name.
             if (name == RESET_EVENT) onReset()
             else if (data.isNotEmpty()) onEvent(data, parseSeqEvent(data))

app/androidApp/src/main/kotlin/com/example/aiapp/Events.kt

@@ -157,6 +157,18 @@ sealed class SessionEvent {
      */
     data object Cleared : SessionEvent()
 
+    /**
+     * The session stopped because its account's usage limit was reached.
+     *
+     * Its own event rather than an [Error] carrying the CLI's sentence, because it is a state
+     * rather than something that went wrong -- and because the raw sentence is `Claude AI usage
+     * limit reached|1788546972`, which is not readable by the person it is shown to.
+     *
+     * [resetsAt] is epoch seconds and null where the session was told nothing. Only the server acts
+     * on it; what this draws it as is a time, not a countdown, because nothing here re-measures it.
+     */
+    data class LimitReached(val resetsAt: Double?) : SessionEvent()
+
     data class Error(val message: String) : SessionEvent()
 
     /**
@@ -261,6 +273,10 @@ fun parseSeqEvent(json: String): SeqEvent {
                     trigger = body.optString("trigger").ifEmpty { null },
                 )
             "cleared" -> SessionEvent.Cleared
+            "limitReached" ->
+                SessionEvent.LimitReached(
+                    if (body.has("resetsAt")) body.getDouble("resetsAt") else null
+                )
             "error" -> SessionEvent.Error(body.getString("message"))
             else -> SessionEvent.Unknown(type)
         }

app/androidApp/src/main/kotlin/com/example/aiapp/FrameStats.kt

@@ -42,6 +42,21 @@ object FrameStats {
     private val gpu = ArrayList<Long>()
     private var since = System.currentTimeMillis()
 
+    /**
+     * Where a named phase of a scripted run (bench v2's fling/stream/type/keyboard) started, as an
+     * index into [total] and a wall-clock time -- not a second recorder, just a mark on this one,
+     * so a phase's frames are the same [FrameMetrics] the whole-run report already has, sliced.
+     */
+    private data class PhaseMark(val name: String, val startIndex: Int, val startMs: Long)
+
+    private val phaseMarks = ArrayList<PhaseMark>()
+
+    /** Call at the start of each named phase of a scripted run; see [BenchRun]. */
+    @Synchronized
+    fun markPhase(name: String) {
+        phaseMarks += PhaseMark(name, total.size, System.currentTimeMillis())
+    }
+
     @Synchronized
     fun add(metrics: FrameMetrics) {
         // The first frame after a window opens includes inflating it and is nobody's scroll.
@@ -69,6 +84,7 @@ object FrameStats {
         listOf(total, waited, input, animation, layout, draw, sync, issue, swap, gpu).forEach {
             it.clear()
         }
+        phaseMarks.clear()
         since = System.currentTimeMillis()
     }
 
@@ -95,6 +111,38 @@ object FrameStats {
         ) + if (gpu.isEmpty()) emptyList() else listOf(phase("gpu   ", gpu))
     }
 
+    /**
+     * One block per [markPhase] call: how many frames landed between that mark and the next (or the
+     * end of the run, for the last one), how many were late, the total/p50/p90/p99, the worst
+     * single frame, and how long the phase actually ran. Marks with no frames between them (a phase
+     * that finished before a frame was drawn) still get a line rather than being silently dropped
+     * -- UI_RULES' "say what you don't know" applies to a phase as much as to a single number.
+     */
+    @Synchronized
+    fun phaseLines(refreshHz: Float): List<String> {
+        if (phaseMarks.isEmpty()) return emptyList()
+        val budget = if (refreshHz > 0) 1000.0 / refreshHz else 16.7
+        val lines = ArrayList<String>()
+        phaseMarks.forEachIndexed { i, mark ->
+            val endIndex = if (i + 1 < phaseMarks.size) phaseMarks[i + 1].startIndex else total.size
+            val endMs =
+                if (i + 1 < phaseMarks.size) phaseMarks[i + 1].startMs
+                else System.currentTimeMillis()
+            val samples = total.subList(mark.startIndex, endIndex)
+            val seconds = (endMs - mark.startMs) / 1000.0
+            lines += "  ${mark.name}: ${samples.size} frames over ${"%.1f".format(seconds)}s"
+            if (samples.isEmpty()) {
+                lines += "    no frames recorded in this phase"
+            } else {
+                val late = samples.count { it / 1_000_000.0 > budget }
+                lines += "    late: $late (${percent(late, samples.size)})"
+                lines += "    " + phase("total ", samples)
+                lines += "    worst ${"%.1fms".format(samples.max() / 1_000_000.0)}"
+            }
+        }
+        return lines
+    }
+
     /** How long the frames recorded here spent in their draw phase, and how many there were. */
     @Synchronized fun drawPhase(): Pair<Long, Int> = draw.sum() to draw.size
 

app/androidApp/src/main/kotlin/com/example/aiapp/MainActivity.kt

@@ -187,13 +187,20 @@ class MainActivity : ComponentActivity() {
             model = null,
             keepsOwnTranscript = false,
             permissionMode = null,
+            effort = null,
+            takesEffort = false,
             imported = false,
             notify = false,
+            autoResume = false,
+            autoResumeMessage = "",
+            resumeAt = null,
             cwd = null,
             contextTokens = null,
             maxImageEdge = null,
+            usageProvider = null,
             status = "idle",
             lastActivity = 0.0,
+            subagents = 0,
         )
 
     // launchMode="singleTop": an enrollment scan, or a notification tapped while the app is open,

app/androidApp/src/main/kotlin/com/example/aiapp/MainScreen.kt

@@ -48,6 +48,8 @@ fun MainScreen(
     /** What another app shared in and no session has taken yet; see [ShareRequest]. */
     share: ShareRequest? = null,
     onOpen: (SessionSummary) -> Unit,
+    /** Opens one session's subagent, from the expander under its card. */
+    onOpenSubagent: (SessionSummary, SubagentSummary) -> Unit,
     onSpawn: () -> Unit,
     onImported: (SessionSummary) -> Unit,
     onSettings: () -> Unit,
@@ -139,6 +141,7 @@ fun MainScreen(
                     settings = settings,
                     reloadToken = token,
                     onOpen = onOpen,
+                    onOpenSubagent = onOpenSubagent,
                     onSpawn = onSpawn,
                 )
             MainTab.Import ->

app/androidApp/src/main/kotlin/com/example/aiapp/SessionListScreen.kt

@@ -1,7 +1,9 @@
 package com.example.aiapp
 
 import androidx.compose.foundation.ExperimentalFoundationApi
+import androidx.compose.foundation.clickable
 import androidx.compose.foundation.combinedClickable
+import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
@@ -9,6 +11,7 @@ import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.lazy.LazyColumn
@@ -17,6 +20,7 @@ import androidx.compose.material3.Card
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.FloatingActionButton
 import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedCard
 import androidx.compose.material3.Switch
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
@@ -30,6 +34,8 @@ import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.unit.dp
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -47,12 +53,40 @@ fun SessionListScreen(
     settings: ServerSettings,
     reloadToken: Int,
     onOpen: (SessionSummary) -> Unit,
+    /** Opens one session's subagent, from the expander under its card. */
+    onOpenSubagent: (SessionSummary, SubagentSummary) -> Unit,
     onSpawn: () -> Unit,
 ) {
     val scope = rememberCoroutineScope()
     var listState by remember { mutableStateOf<LoadState<List<SessionSummary>>>(LoadState.Loading) }
     var confirmingDelete by remember { mutableStateOf<SessionSummary?>(null) }
 
+    // Which session cards are expanded to show their subagents, and what each expansion fetched.
+    // Ids rather than a flag on the row for the same reason `deleting` is: the rows are rebuilt
+    // from
+    // whatever the server last said, and this belongs to the reader's own choice, which survives a
+    // refresh.
+    var expandedSessions by remember { mutableStateOf(setOf<String>()) }
+    var subagentLoads by remember {
+        mutableStateOf(mapOf<String, LoadState<List<SubagentSummary>>>())
+    }
+
+    fun loadSubagents(sessionId: String) {
+        subagentLoads = subagentLoads + (sessionId to LoadState.Loading)
+        scope.launch {
+            subagentLoads =
+                subagentLoads +
+                    (sessionId to
+                        try {
+                            LoadState.Loaded(
+                                withContext(Dispatchers.IO) { fetchSubagents(settings, sessionId) }
+                            )
+                        } catch (e: ApiException) {
+                            LoadState.failed(e)
+                        })
+        }
+    }
+
     // Failures that belong to one session rather than to the list, keyed by its id and shown on its
     // own card. The two scopes are decided by whether the server answered: it answered and refused,
     // so this says nothing about the other rows.
@@ -84,6 +118,14 @@ fun SessionListScreen(
                     withContext(Dispatchers.IO) {
                         transcriptCache.retainOnly(loaded.value.map { it.id }.toSet())
                     }
+                    // A session gone from this answer cannot still be expanded, and an expanded one
+                    // that is still here asks again -- its subagents may have changed since the
+                    // last
+                    // fetch.
+                    val ids = loaded.value.map { it.id }.toSet()
+                    expandedSessions = expandedSessions intersect ids
+                    subagentLoads = subagentLoads.filterKeys { it in ids }
+                    expandedSessions.forEach(::loadSubagents)
                     loaded
                 } catch (e: ApiException) {
                     LoadState.failed(e)
@@ -127,6 +169,17 @@ fun SessionListScreen(
                                 deleting = session.id in deleting,
                                 onOpen = { onOpen(session) },
                                 onLongPress = { confirmingDelete = session },
+                                expanded = session.id in expandedSessions,
+                                subagents = subagentLoads[session.id],
+                                onToggleSubagents = {
+                                    if (session.id in expandedSessions) {
+                                        expandedSessions = expandedSessions - session.id
+                                    } else {
+                                        expandedSessions = expandedSessions + session.id
+                                        loadSubagents(session.id)
+                                    }
+                                },
+                                onOpenSubagent = { subagent -> onOpenSubagent(session, subagent) },
                             )
                             Spacer(Modifier.height(12.dp))
                         }
@@ -225,7 +278,7 @@ fun SessionListScreen(
                                     deleteSession(settings, session.id, alsoDeleteForeign)
                                     // After it succeeded, not before: a refused delete leaves the
                                     // session exactly as it was, and its transcript with it.
-                                    transcriptCache.session(session.id).purge()
+                                    transcriptCache.session(TranscriptAddress(session.id)).purge()
                                 }
                                 // Only this row, and only what changed. Refetching the list instead
                                 // put every other session back through loading and handed the
@@ -276,6 +329,12 @@ private fun SessionCard(
     deleting: Boolean,
     onOpen: () -> Unit,
     onLongPress: () -> Unit,
+    /** Whether the expander below is open. Collapsed by default; see [SessionListScreen]. */
+    expanded: Boolean,
+    /** What the expander's own fetch answered, or null before it has been asked. */
+    subagents: LoadState<List<SubagentSummary>>?,
+    onToggleSubagents: () -> Unit,
+    onOpenSubagent: (SubagentSummary) -> Unit,
 ) {
     BusyItem(label = if (deleting) "deleting" else null) {
         Card(
@@ -332,11 +391,105 @@ private fun SessionCard(
                         color = MaterialTheme.colorScheme.error,
                     )
                 }
+                // Nothing at all for a card with no subagents: a disabled expander here would be
+                // noise on every ordinary session's card. Its own row at the bottom rather than
+                // beside the title or the machine line, so opening it never displaces text that was
+                // already on screen -- see UI_RULES on a control not displacing the text beside it.
+                if (session.subagents > 0) {
+                    Spacer(Modifier.height(8.dp))
+                    // The platform's minimum touch height, not the chevron's own ten or so dp:
+                    // at the chevron's height a tap meant for it landed on the first subcard
+                    // beneath and opened a subagent instead.
+                    Row(
+                        horizontalArrangement = Arrangement.Center,
+                        verticalAlignment = Alignment.CenterVertically,
+                        modifier =
+                            Modifier.fillMaxWidth()
+                                .heightIn(min = 48.dp)
+                                .clickable(enabled = !deleting, onClick = onToggleSubagents)
+                                .semantics {
+                                    contentDescription =
+                                        if (expanded) "Collapse subagents" else "Expand subagents"
+                                },
+                    ) {
+                        Chevron(if (expanded) Pointing.Up else Pointing.Down)
+                    }
+                    if (expanded) {
+                        Spacer(Modifier.height(4.dp))
+                        Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                            when (subagents) {
+                                null,
+                                is LoadState.Loading ->
+                                    CircularProgressIndicator(
+                                        modifier = Modifier.width(20.dp).height(20.dp),
+                                        strokeWidth = 2.dp,
+                                    )
+                                is LoadState.Error ->
+                                    // Said here rather than left silent: a fetch that failed and an
+                                    // expander that simply found nothing must not look the same --
+                                    // see UI_RULES on designing the unknown state first.
+                                    Text(
+                                        subagents.message,
+                                        style = MaterialTheme.typography.bodySmall,
+                                        color = MaterialTheme.colorScheme.error,
+                                    )
+                                is LoadState.Loaded ->
+                                    subagents.value.forEach { subagent ->
+                                        SubagentCard(
+                                            subagent,
+                                            onClick = { onOpenSubagent(subagent) },
+                                        )
+                                    }
+                            }
+                        }
+                    }
+                }
             }
         }
     }
 }
 
+/**
+ * One subagent, indented inside its session's card -- the way dev-updater draws a project's
+ * components (`ComponentCard`, `UpdaterScreen.kt`): an outlined card, not the session card's own
+ * filled one, so the nesting reads as one step rather than as another session.
+ */
+@Composable
+private fun SubagentCard(subagent: SubagentSummary, onClick: () -> Unit) {
+    OutlinedCard(Modifier.fillMaxWidth().clickable(onClick = onClick)) {
+        Column(Modifier.padding(horizontal = 12.dp, vertical = 8.dp)) {
+            Text(subagent.title, style = MaterialTheme.typography.titleSmall)
+            Spacer(Modifier.height(2.dp))
+            Row(modifier = Modifier.fillMaxWidth()) {
+                Text(
+                    subagentStatusLabel(subagent.status),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    modifier = Modifier.weight(1f),
+                )
+                Text(
+                    relativeTime(subagent.lastActivity),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
+    }
+}
+
+/**
+ * The subcard's word for a subagent's status -- see SUBAGENTS.md's "Wire shape". Its own function
+ * rather than a branch inside [StatusText], because a subagent's three states are not that
+ * composable's five: "exited" reads as "finished" here, since its process was always its parent's
+ * and never something of its own to have merely stopped.
+ */
+private fun subagentStatusLabel(status: String) =
+    when (status) {
+        "running" -> "running"
+        "exited" -> "finished"
+        else -> "unknown"
+    }
+
 @Composable
 fun StatusText(status: String) {
     val (label, color) =

app/androidApp/src/main/kotlin/com/example/aiapp/SessionScreen.kt

@@ -12,6 +12,7 @@ import androidx.activity.result.PickVisualMediaRequest
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
+import androidx.compose.foundation.gestures.ScrollableDefaults
 import androidx.compose.foundation.gestures.awaitEachGesture
 import androidx.compose.foundation.gestures.awaitFirstDown
 import androidx.compose.foundation.layout.Box
@@ -64,12 +65,15 @@ import androidx.compose.runtime.snapshots.Snapshot
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.drawWithContent
+import androidx.compose.ui.focus.FocusRequester
+import androidx.compose.ui.focus.focusRequester
 import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.input.pointer.PointerEventPass
 import androidx.compose.ui.input.pointer.pointerInput
 import androidx.compose.ui.layout.onSizeChanged
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.platform.LocalView
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.text.TextRange
@@ -216,16 +220,33 @@ fun SessionScreen(
     share: ShareRequest? = null,
     /** Said once [share] has been attached here, so it is not attached again. */
     onShareTaken: () -> Unit = {},
+    /**
+     * Draws this screen read-only, on a subagent's own transcript instead of the session's.
+     *
+     * A subagent has no process and no controls of its own -- see SUBAGENTS.md's "Phone" -- so
+     * every gate below keyed on this switches off the composer, the files button, the settings cog,
+     * the usage bar and notifications, while everything that draws a transcript (paging, cache,
+     * selection, images, the status row, stream reconnects) is reused unchanged, pointed at
+     * [address] instead of the session's own.
+     */
+    subagent: SubagentSummary? = null,
 ) {
     DebugStats.count("session screen recomposed")
+    val isSubagent = subagent != null
+    val address = TranscriptAddress(summary.id, subagent?.id)
     val scope = rememberCoroutineScope()
     val topEdgeHeld = remember { TopEdgeHold() }
     var items by remember { mutableStateOf(listOf<TranscriptItem>()) }
-    var status by remember { mutableStateOf(summary.status) }
+    var status by remember { mutableStateOf(subagent?.status ?: summary.status) }
     // Seeded from the row this screen was opened from, so a conversation already under way says how
     // much it is holding before any turn happens here. Null is "nobody has measured it", which is a
     // different answer from an empty context and is drawn differently.
-    var contextTokens by remember(summary.id) { mutableStateOf(summary.contextTokens) }
+    //
+    // A subagent has no context measurement of its own, so it always starts unmeasured rather than
+    // borrowing the parent session's figure -- see UI_RULES on not showing an inferred value as one
+    // that was measured.
+    var contextTokens by
+        remember(address) { mutableStateOf(if (isSubagent) null else summary.contextTokens) }
     // When the current compaction started. The moment comes off the `compacting` status event
     // itself -- the server timestamps every transcript line -- rather than off this device noticing
     // one, which is what makes it survive leaving the session and reopening it.
@@ -241,7 +262,13 @@ fun SessionScreen(
     val context = LocalContext.current
     // Seeded from what was left in the box last time and written back on every keystroke, so
     // leaving the screen does not throw away a half-typed message. See `Drafts.kt`.
-    var input by remember(summary.id) { mutableStateOf(atEnd(loadDraft(context, summary.id))) }
+    //
+    // A subagent has no box to type into, so it never touches a draft at all -- not this session's,
+    // which is what reading one keyed only by `summary.id` would do here.
+    var input by
+        remember(summary.id) {
+            mutableStateOf(if (isSubagent) atEnd("") else atEnd(loadDraft(context, summary.id)))
+        }
     // A model the reader has chosen and not yet confirmed. See [ModelSwitchWarning]: switching
     // makes the session re-read the whole conversation.
     var pendingModel by remember { mutableStateOf<String?>(null) }
@@ -294,27 +321,26 @@ fun SessionScreen(
     // Reload throws away what it was reading from.
     val cache = remember(settings) { TranscriptCache(cacheRoot(context, settings)) }
     val source =
-        remember(summary.id, epoch) {
-            TranscriptSource(settings, summary.id, cache.session(summary.id))
-        }
+        remember(address, epoch) { TranscriptSource(settings, address, cache.session(address)) }
     // Whether the cached tail has been shown to still be the server's own line. Nothing is resumed
     // from a cached cursor until it has, and a probe that could not be made leaves this false for
     // the stream loop to try again.
-    var probePassed by remember(summary.id, epoch) { mutableStateOf(false) }
+    var probePassed by remember(address, epoch) { mutableStateOf(false) }
     // Whether the opening effect is still settling that question. It draws the cached rows and
     // lifts [ready] before the answer arrives, which is the point of the cache -- so the stream
     // below waits for this rather than for `ready`, or it asks the same question twice.
-    var probing by remember(summary.id, epoch) { mutableStateOf(true) }
+    var probing by remember(address, epoch) { mutableStateOf(true) }
     // The oldest sequence number loaded, and whether there is more behind it. Paging backwards is
     // what keeps opening a long session cheap.
     var oldestSeq by remember { mutableLongStateOf(0L) }
-    // Where this session was last being read, from this device's own store. Read once, because the
-    // answer stops being interesting the moment the list is on screen.
-    val savedAnchor = remember(summary.id, epoch) { loadScrollAnchor(context, summary.id) }
+    // Where this transcript was last being read, from this device's own store, keyed by the address
+    // rather than the session id so a subagent's saved position cannot collide with its session's.
+    // Read once, because the answer stops being interesting the moment the list is on screen.
+    val savedAnchor = remember(address, epoch) { loadScrollAnchor(context, address.cachePath) }
     // Whether the saved position is still being put back. Nothing is drawn while it is: opening at
     // the newest end and then travelling to the anchor is exactly the journey a reader must never
     // see.
-    var restoring by remember(summary.id, epoch) { mutableStateOf(savedAnchor != null) }
+    var restoring by remember(address, epoch) { mutableStateOf(savedAnchor != null) }
     // Messages the server has taken and the session has not read yet, by the id that will resolve
     // them. From the event stream rather than from what this screen sent, so they survive leaving
     // the session -- and a message sent from another device is drawn waiting on this one too.
@@ -327,11 +353,22 @@ fun SessionScreen(
     var loadingHistory by remember { mutableStateOf(false) }
     var ready by remember { mutableStateOf(false) }
     // Replies parsed ahead of the rows that draw them; see [ParsedReplies].
-    val replies = remember(summary.id) { ParsedReplies() }
-    // Keyed like everything else describing one session's transcript. `rememberLazyListState` saves
-    // through `rememberSaveable`, and this screen restores by its own anchor instead -- two
-    // restores would fight over the first frame.
-    val listState = remember(summary.id) { LazyListState() }
+    val replies = remember(address) { ParsedReplies() }
+    // Keyed like everything else describing one transcript. `rememberLazyListState` saves through
+    // `rememberSaveable`, and this screen restores by its own anchor instead -- two restores would
+    // fight over the first frame.
+    val listState = remember(address) { LazyListState() }
+    // The list's own fling path -- what a real flick decays through -- captured here so BenchRun's
+    // fling phase can drive `LazyListState.scroll` through exactly the `FlingBehavior` this
+    // screen's
+    // `TranscriptList` already uses by not overriding it (its `LazyColumn` takes no `flingBehavior`
+    // argument, so this is the same default it gets).
+    val flingBehavior = ScrollableDefaults.flingBehavior()
+    // Where BenchRun's type phase focuses before it types, and the view it toggles the keyboard on
+    // -- both bench-only, but cheap enough (a remembered object, a CompositionLocal read) to hold
+    // unconditionally rather than behind a second code path only the bench build compiles.
+    val composerFocus = remember { FocusRequester() }
+    val view = LocalView.current
     // Whether the newest message is on screen right now. The list is reversed, so the newest end is
     // the scrolling start: nothing behind you is exactly being at the bottom. Asked of the scroll
     // state rather than of item indices, because a zero-height first item makes an index ambiguous.
@@ -637,7 +674,7 @@ fun SessionScreen(
     // ended and carries live events only. The window comes from this phone's own copy when there is
     // one, and then costs a single request to check that the server's transcript is still the one
     // it came from. See TRANSCRIPT_CACHE.md.
-    LaunchedEffect(summary.id, epoch) {
+    LaunchedEffect(address, epoch) {
         /**
          * One opening window onto the screen, whichever side it came from.
          *
@@ -667,11 +704,16 @@ fun SessionScreen(
                 // A replay is as old as the last visit; the row this screen was opened from was
                 // fetched moments ago. So the transcript comes from the cache and everything that
                 // is not the transcript comes from the summary -- otherwise a session that finished
-                // an hour ago opens saying "working" until the stream connects.
-                status = summary.status
-                model = summary.model
-                permissionMode = summary.permissionMode ?: "auto"
-                if (summary.status != "compacting") compactingSince = null
+                // an hour ago opens saying "working" until the stream connects. A subagent's status
+                // comes from its own summary, never the parent session's: they are two different
+                // things running or not, and the parent's model and permission mode do not apply to
+                // it at all.
+                status = subagent?.status ?: summary.status
+                if (!isSubagent) {
+                    model = summary.model
+                    permissionMode = summary.permissionMode ?: "auto"
+                }
+                if (status != "compacting") compactingSince = null
                 // Nothing to put back, so these rows are the screen and the probe can return under
                 // them. A restore still has history to fetch and is gated below.
                 if (savedAnchor == null) ready = true
@@ -798,7 +840,7 @@ fun SessionScreen(
     // at the top on their return. Switching apps is a choice somebody made, not a fault to report.
     // Stopping the stream deliberately makes the drop a close rather than an error, and resuming
     // reconnects from the same cursor.
-    LaunchedEffect(summary.id, ready, epoch, lifecycleOwner) {
+    LaunchedEffect(address, ready, epoch, lifecycleOwner) {
         if (!ready) return@LaunchedEffect
         // The opening effect draws cached rows and lifts `ready` *before* it has checked that the
         // cursor under them is still the server's, so `ready` is no longer the whole gate. Without
@@ -868,17 +910,22 @@ fun SessionScreen(
     // The screen going away entirely, which the lifecycle scope above does not cover: a composable
     // can leave the composition while the activity stays started. Keyed on the epoch as well, so
     // Reload's replacement source is the one a later disposal closes.
-    DisposableEffect(summary.id, epoch) { onDispose { source.close() } }
+    DisposableEffect(address, epoch) { onDispose { source.close() } }
 
     // Nothing gets announced about the session somebody is reading; see NotificationService.
     // RESUMED rather than STARTED because "looking at it" means the foreground.
-    LaunchedEffect(summary.id, lifecycleOwner) {
-        lifecycleOwner.repeatOnLifecycle(Lifecycle.State.RESUMED) {
-            NotificationService.showing(context, summary.id)
-            try {
-                awaitCancellation()
-            } finally {
-                NotificationService.stoppedShowing(summary.id)
+    //
+    // Not for a subagent: it has no notifications of its own, and it is not the session this would
+    // otherwise mark as being read.
+    if (!isSubagent) {
+        LaunchedEffect(summary.id, lifecycleOwner) {
+            lifecycleOwner.repeatOnLifecycle(Lifecycle.State.RESUMED) {
+                NotificationService.showing(context, summary.id)
+                try {
+                    awaitCancellation()
+                } finally {
+                    NotificationService.stoppedShowing(summary.id)
+                }
             }
         }
     }
@@ -924,7 +971,7 @@ fun SessionScreen(
                 val (index, offset, awayFromNewest) = settled
                 saveScrollAnchor(
                     context,
-                    summary.id,
+                    address.cachePath,
                     // Nothing to restore at the newest end, which is where a session with no anchor
                     // opens anyway. One *before* the index, because item zero is the "below" slot.
                     if (!awayFromNewest) null
@@ -947,7 +994,7 @@ fun SessionScreen(
     //
     // There is no correction beside this one. Following the newest message is not an effect: the
     // list is reversed, so an arriving message extends the end the viewport is pinned to.
-    val unitSizes = remember(summary.id) { HashMap<Any, Int>() }
+    val unitSizes = remember(address) { HashMap<Any, Int>() }
     LaunchedEffect(listState, moreHistory) {
         snapshotFlow { listState.layoutInfo }
             .collect { info ->
@@ -983,21 +1030,25 @@ fun SessionScreen(
             }
     }
 
-    LaunchedEffect(summary.setupName, summary.provider) {
-        offeredModels =
-            try {
-                withContext(Dispatchers.IO) {
-                    fetchSetups(settings)
-                        .firstOrNull { it.name == summary.setupName }
-                        ?.providers
-                        ?.firstOrNull { it.name == summary.provider }
-                        ?.models
-                        .orEmpty()
+    // Only for the model picker, which a subagent does not have.
+    if (!isSubagent) {
+        LaunchedEffect(summary.setupName, summary.provider) {
+            offeredModels =
+                try {
+                    withContext(Dispatchers.IO) {
+                        fetchSetups(settings)
+                            .firstOrNull { it.name == summary.setupName }
+                            ?.providers
+                            ?.firstOrNull { it.name == summary.provider }
+                            ?.models
+                            .orEmpty()
+                    }
+                } catch (_: Exception) {
+                    // Not worth reporting: the picker simply has nothing to offer, which is
+                    // visible.
+                    emptyList()
                 }
-            } catch (_: Exception) {
-                // Not worth reporting: the picker simply has nothing to offer, which is visible.
-                emptyList()
-            }
+        }
     }
 
     /**
@@ -1148,8 +1199,9 @@ fun SessionScreen(
     }
 
     // One poll for the machines' limits, read by everything on this screen that reports them.
-    val usageFeed = rememberUsageFeed(settings)
-    val usage = usageFeed.forSetup(summary.setup)
+    // Nothing meters a subagent -- it has no account of its own -- so it never starts this poll.
+    val usageFeed = if (isSubagent) null else rememberUsageFeed(settings)
+    val usage = usageFeed?.forSession(summary) ?: SessionUsage.NotMetered
     RecordFrames()
     var usageOpen by remember { mutableStateOf(false) }
     var settingsOpen by remember { mutableStateOf(false) }
@@ -1219,6 +1271,10 @@ fun SessionScreen(
                     FrameStats.drawPhase().let { (nanos, count) -> drawAccounting(nanos, count) },
                 crash = lastCrash(context),
                 extra = extra,
+                // Empty outside a BenchRun.run pass -- copyRenderReport's own reset below clears
+                // the
+                // marks along with everything else, so an ordinary copy never has any to show.
+                phaseFrames = FrameStats.phaseLines(context.refreshHz()),
             )
         context.copyToClipboard("ai-app render report", report)
         // Also to the log, so a session driving the app over adb can read the same report the
@@ -1233,15 +1289,24 @@ fun SessionScreen(
         Toast.makeText(context, "Copied render report", Toast.LENGTH_SHORT).show()
     }
     val copyRenderReport = { buildAndCopyReport() }
-    // Bench build only: P0's scripted scroll-and-stream benchmark (BenchRun.kt), against the
-    // fixture session opened below instead of a real server. Null everywhere else -- see
+    // Bench build only: P0's scripted fling/stream/type/keyboard benchmark (BenchRun.kt), against
+    // the fixture session opened below instead of a real server. Null everywhere else -- see
     // [SessionSettingsDialog]'s onRunBenchmark.
     val runBenchmark: (() -> Unit)? =
         if (BuildConfig.FIXTURE_MODE) {
             {
                 settingsOpen = false
                 scope.launch {
-                    val extra = BenchRun.run(context, scope, listState)
+                    val extra =
+                        BenchRun.run(
+                            context = context,
+                            scope = scope,
+                            listState = listState,
+                            flingBehavior = flingBehavior,
+                            composerFocus = composerFocus,
+                            setComposerText = { text -> input = atEnd(text) },
+                            view = view,
+                        )
                     buildAndCopyReport(extra)
                 }
             }
@@ -1256,20 +1321,35 @@ fun SessionScreen(
                 // A ring's worth, which is what the arrow already keeps on its other three sides.
                 Spacer(Modifier.width(GLYPH_BUTTON_MARGIN))
                 Column(Modifier.weight(1f)) {
-                    Text(title, style = MaterialTheme.typography.titleMedium)
-                    // Machine first, then what runs on it -- the same order and the same wording
-                    // everywhere this pair appears, so it reads as one fact rather than two
-                    // sentences with different grammar.
-                    //
-                    // No model. The picker in the footer already shows what this session is set to,
-                    // and showing it twice means two things to keep in step -- they disagreed for a
-                    // moment on every model change.
-                    Text(
-                        "${summary.setupName} · ${summary.provider}",
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
+                    // A subagent's own title, with the session's beneath it in a smaller style --
+                    // the header says whose conversation this is as well as what it is. Otherwise
+                    // just the session's title, as before.
+                    if (subagent != null) {
+                        Text(subagent.title, style = MaterialTheme.typography.titleMedium)
+                        Text(
+                            title,
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    } else {
+                        Text(title, style = MaterialTheme.typography.titleMedium)
+                        // Machine first, then what runs on it -- the same order and the same
+                        // wording everywhere this pair appears, so it reads as one fact rather than
+                        // two sentences with different grammar.
+                        //
+                        // No model. The picker in the footer already shows what this session is set
+                        // to, and showing it twice means two things to keep in step -- they
+                        // disagreed for a moment on every model change.
+                        Text(
+                            "${summary.setupName} · ${summary.provider}",
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
                 }
+                // None of this is a subagent's: it has no files of its own to browse, no settings,
+                // and nothing meters it -- see SUBAGENTS.md's "Phone".
+                //
                 // Beside the provider it reports on, which is the line directly to its left. Its
                 // real home is this provider's settings, which do not exist yet. A session on a
                 // provider with no such service gets an honest "unavailable" rather than a hidden
@@ -1284,42 +1364,47 @@ fun SessionScreen(
                 // Usage, files, settings -- widest scope first, narrowing to the right, so the cog
                 // stays at the end where every other screen keeps it. Asked for in this order by
                 // Iris on 2026-09-03.
-                Row {
-                    GlyphButton(
-                        USAGE_GLYPH,
-                        "Usage",
-                        { usageOpen = true },
-                        colour = usageGlyphColour(usage),
-                    )
-                    // The machine's files, which is where the answer to "what did it actually
-                    // change" is. It opens *over* this screen rather than replacing it.
-                    GlyphButton(
-                        FOLDER_GLYPH,
-                        "Files",
-                        onClick = {
-                            onFiles(
-                                FilesTarget(
-                                    setup = summary.setup,
-                                    setupName = summary.setupName,
-                                    // Where this session works, and the machine's own home when it
-                                    // was never given a directory -- resolved there rather than
-                                    // guessed at here, since this app does not know that home.
-                                    start = summary.cwd?.takeIf { it.isNotBlank() } ?: "~",
+                if (!isSubagent) {
+                    Row {
+                        GlyphButton(
+                            USAGE_GLYPH,
+                            "Usage",
+                            { usageOpen = true },
+                            colour = usageGlyphColour(usage),
+                        )
+                        // The machine's files, which is where the answer to "what did it actually
+                        // change" is. It opens *over* this screen rather than replacing it.
+                        GlyphButton(
+                            FOLDER_GLYPH,
+                            "Files",
+                            onClick = {
+                                onFiles(
+                                    FilesTarget(
+                                        setup = summary.setup,
+                                        setupName = summary.setupName,
+                                        // Where this session works, and the machine's own home when
+                                        // it was never given a directory -- resolved there rather
+                                        // than guessed at here, since this app does not know that
+                                        // home.
+                                        start = summary.cwd?.takeIf { it.isNotBlank() } ?: "~",
+                                    )
                                 )
-                            )
-                        },
-                    )
-                    // What it opens is about this session, so it sits at the end of the session's
-                    // own row. A cog and not a word because there will be more, and a bar of words
-                    // has nowhere to put it.
-                    GlyphButton(SETTINGS_GLYPH, "Session settings", { settingsOpen = true })
+                            },
+                        )
+                        // What it opens is about this session, so it sits at the end of the
+                        // session's own row. A cog and not a word because there will be more, and a
+                        // bar of words has nowhere to put it.
+                        GlyphButton(SETTINGS_GLYPH, "Session settings", { settingsOpen = true })
+                    }
                 }
             }
 
             // Under the header, above everything the session itself says: it is a fact about the
             // machine rather than a turn in the conversation, and it is the number that decides
-            // whether to keep going.
-            SessionUsageBar(usage)
+            // whether to keep going. Nothing meters a subagent.
+            if (!isSubagent) {
+                SessionUsageBar(usage)
+            }
 
             (streamError ?: actionError)?.let { message ->
                 Text(
@@ -1565,6 +1650,7 @@ fun SessionScreen(
                                                 is TranscriptItem.ClearedNote -> ClearedRow()
                                                 is TranscriptItem.CompactedNote ->
                                                     CompactedRow(item)
+                                                is TranscriptItem.LimitNote -> LimitRow(item)
                                                 // Never reached: a peer message is flattened into
                                                 // its own units. Here because a `when` over the
                                                 // item kinds has to stay exhaustive.
@@ -1663,185 +1749,211 @@ fun SessionScreen(
                 )
             }
 
+            // Kept for a subagent -- see SUBAGENTS.md's "Phone" -- with the wording that turns
+            // "exited" into "finished" for one, since it has no process to leave running or stop.
             SessionStatusRow(
                 status = status,
                 compactingFor = compactingFor,
                 contextTokens = contextTokens,
+                subagent = isSubagent,
             )
 
-            // Between the transcript and the box: above what is being typed, so the list does not
-            // cover the thing the command is about, and below everything that explains it.
-            CommandSuggestions(
-                // Nothing to suggest about a suggestion that was just taken. `/compact` is a whole
-                // command *and* a prefix of itself, so picking it left the list standing there with
-                // the one row already chosen. Held by what was picked rather than by a flag, so
-                // typing anything else brings the list back without a second thing to reset.
-                commands = if (input.text == picked) emptyList() else suggestedCommands(input.text),
-                onPick = { command ->
-                    // At the end of what was inserted, which is where the reader carries on typing:
-                    // a command with an argument is put in the box half-written, and a cursor left
-                    // at the front makes the next keystroke the first character of "/rename".
-                    input = atEnd(command.typed())
-                    picked = command.typed()
-                },
-            )
-
-            // Always enabled -- a send while the session is running becomes a steering message
-            // injected at the next tool boundary, which is the point of the whole app.
-            //
-            // The field gets a row of its own, above the buttons: sharing one put the full width
-            // behind three controls, so the thing being typed into was the narrowest on the row.
-            Column(Modifier.fillMaxWidth().padding(8.dp)) {
-                // Directly above the box they will be sent from, so what is attached is visible
-                // rather than counted: the "+2" on the button below said how many and never which.
-                PendingAttachments(
-                    settings = settings,
-                    sessionId = summary.id,
-                    refs = pendingAttachments,
-                    onRemove = { pendingAttachments = pendingAttachments - it },
-                )
-                OutlinedTextField(
-                    value = input,
-                    onValueChange = {
-                        input = it
-                        saveDraft(context, summary.id, it.text)
+            // Everything from here down is the composer: a subagent cannot be messaged, so none of
+            // it applies -- see SUBAGENTS.md's "Phone".
+            if (!isSubagent) {
+                // Between the transcript and the box: above what is being typed, so the list does
+                // not cover the thing the command is about, and below everything that explains it.
+                CommandSuggestions(
+                    // Nothing to suggest about a suggestion that was just taken. `/compact` is a
+                    // whole command *and* a prefix of itself, so picking it left the list standing
+                    // there with the one row already chosen. Held by what was picked rather than by
+                    // a flag, so typing anything else brings the list back without a second thing
+                    // to
+                    // reset.
+                    commands =
+                        if (input.text == picked) emptyList() else suggestedCommands(input.text),
+                    onPick = { command ->
+                        // At the end of what was inserted, which is where the reader carries on
+                        // typing: a command with an argument is put in the box half-written, and a
+                        // cursor left at the front makes the next keystroke the first character of
+                        // "/rename".
+                        input = atEnd(command.typed())
+                        picked = command.typed()
                     },
-                    modifier = Modifier.fillMaxWidth(),
-                    // No longer "(+image)": the images are on screen above this, and a placeholder
-                    // saying so said it in words beside the thing itself.
-                    placeholder = { Text("Message") },
-                    maxLines = 4,
                 )
-                Row(
-                    verticalAlignment = Alignment.CenterVertically,
-                    modifier = Modifier.fillMaxWidth(),
-                ) {
-                    // Photo or file, asked here rather than by two buttons: the row is full, and
-                    // attaching is one action whichever picker answers it.
-                    var attaching by remember { mutableStateOf(false) }
-                    Box {
-                        // Just "+". The count it used to carry was standing in for showing them.
-                        BubbleButton(onClick = { attaching = true }) { Text("+") }
-                        DropdownMenu(
-                            expanded = attaching,
-                            onDismissRequest = { attaching = false },
-                            // See PickerButton: without this the menu opens a status bar's height
-                            // away from the button in an edge-to-edge activity.
-                            properties = PopupProperties(clippingEnabled = false),
-                            shape = BubbleMenuShape,
-                        ) {
-                            DropdownMenuItem(
-                                text = { Text("Photo") },
-                                onClick = {
-                                    attaching = false
-                                    pickImage.launch(
-                                        PickVisualMediaRequest(
-                                            ActivityResultContracts.PickVisualMedia.ImageOnly
-                                        )
-                                    )
-                                },
-                            )
-                            DropdownMenuItem(
-                                text = { Text("File") },
-                                onClick = {
-                                    attaching = false
-                                    pickFile.launch(arrayOf("*/*"))
-                                },
-                            )
-                        }
-                    }
-                    // The settings share what is left after the actions have taken what they need.
-                    // A Row hands out intrinsic widths in order and clips whatever runs past the
-                    // edge, so with these laid out first the arrival of Stop pushed Send off the
-                    // screen entirely -- the app's central control, gone at the moment it is most
-                    // in use.
+
+                // Always enabled -- a send while the session is running becomes a steering message
+                // injected at the next tool boundary, which is the point of the whole app.
+                //
+                // The field gets a row of its own, above the buttons: sharing one put the full
+                // width
+                // behind three controls, so the thing being typed into was the narrowest on the
+                // row.
+                Column(Modifier.fillMaxWidth().padding(8.dp)) {
+                    // Directly above the box they will be sent from, so what is attached is visible
+                    // rather than counted: the "+2" on the button below said how many and never
+                    // which.
+                    PendingAttachments(
+                        settings = settings,
+                        sessionId = summary.id,
+                        refs = pendingAttachments,
+                        onRemove = { pendingAttachments = pendingAttachments - it },
+                    )
+                    OutlinedTextField(
+                        value = input,
+                        onValueChange = {
+                            input = it
+                            saveDraft(context, summary.id, it.text)
+                        },
+                        // BenchRun's type phase requests focus on this exact field
+                        // (`composerFocus`)
+                        // so it types through the real composer rather than a stand-in.
+                        modifier = Modifier.fillMaxWidth().focusRequester(composerFocus),
+                        // No longer "(+image)": the images are on screen above this, and a
+                        // placeholder saying so said it in words beside the thing itself.
+                        placeholder = { Text("Message") },
+                        maxLines = 4,
+                    )
                     Row(
                         verticalAlignment = Alignment.CenterVertically,
-                        modifier = Modifier.weight(1f),
+                        modifier = Modifier.fillMaxWidth(),
                     ) {
-                        if (offeredModels.isNotEmpty()) {
+                        // Photo or file, asked here rather than by two buttons: the row is full,
+                        // and
+                        // attaching is one action whichever picker answers it.
+                        var attaching by remember { mutableStateOf(false) }
+                        Box {
+                            // Just "+". The count it used to carry was standing in for showing
+                            // them.
+                            BubbleButton(onClick = { attaching = true }) { Text("+") }
+                            DropdownMenu(
+                                expanded = attaching,
+                                onDismissRequest = { attaching = false },
+                                // See PickerButton: without this the menu opens a status bar's
+                                // height away from the button in an edge-to-edge activity.
+                                properties = PopupProperties(clippingEnabled = false),
+                                shape = BubbleMenuShape,
+                            ) {
+                                DropdownMenuItem(
+                                    text = { Text("Photo") },
+                                    onClick = {
+                                        attaching = false
+                                        pickImage.launch(
+                                            PickVisualMediaRequest(
+                                                ActivityResultContracts.PickVisualMedia.ImageOnly
+                                            )
+                                        )
+                                    },
+                                )
+                                DropdownMenuItem(
+                                    text = { Text("File") },
+                                    onClick = {
+                                        attaching = false
+                                        pickFile.launch(arrayOf("*/*"))
+                                    },
+                                )
+                            }
+                        }
+                        // The settings share what is left after the actions have taken what they
+                        // need. A Row hands out intrinsic widths in order and clips whatever runs
+                        // past the edge, so with these laid out first the arrival of Stop pushed
+                        // Send off the screen entirely -- the app's central control, gone at the
+                        // moment it is most in use.
+                        Row(
+                            verticalAlignment = Alignment.CenterVertically,
+                            modifier = Modifier.weight(1f),
+                        ) {
+                            if (offeredModels.isNotEmpty()) {
+                                PickerButton(
+                                    current = modelLabel(model),
+                                    // What the machine offers, plus the state a session is in when
+                                    // it has chosen none of them. The button has always been able
+                                    // to
+                                    // say "default"; until this the list could not, so leaving it
+                                    // was a one-way trip.
+                                    options = listOf(DEFAULT_MODEL) + offeredModels,
+                                    // Not set here. The button follows what the session reports it
+                                    // is set to, which arrives a moment later and is sometimes a
+                                    // different answer -- a name the CLI resolved, or no change at
+                                    // all on a provider whose model is fixed. Asked about first,
+                                    // unless there is nothing to lose by it -- see
+                                    // [ModelSwitchWarning].
+                                    onPick = { chosen ->
+                                        if (
+                                            modelLabel(chosen) == modelLabel(model) ||
+                                                !worthWarningAbout(status, contextTokens, items)
+                                        ) {
+                                            act { setSessionModel(settings, summary.id, chosen) }
+                                        } else {
+                                            pendingModel = chosen
+                                        }
+                                    },
+                                )
+                            }
                             PickerButton(
-                                current = modelLabel(model),
-                                // What the machine offers, plus the state a session is in when it
-                                // has chosen none of them. The button has always been able to say
-                                // "default"; until this the list could not, so leaving it was a
-                                // one-way trip.
-                                options = listOf(DEFAULT_MODEL) + offeredModels,
-                                // Not set here. The button follows what the session reports it is
-                                // set to, which arrives a moment later and is sometimes a different
-                                // answer -- a name the CLI resolved, or no change at all on a
-                                // provider whose model is fixed. Asked about first, unless there is
-                                // nothing to lose by it -- see [ModelSwitchWarning].
+                                current = permissionMode,
+                                options = PERMISSION_MODES,
                                 onPick = { chosen ->
-                                    if (
-                                        modelLabel(chosen) == modelLabel(model) ||
-                                            !worthWarningAbout(status, contextTokens, items)
-                                    ) {
-                                        act { setSessionModel(settings, summary.id, chosen) }
-                                    } else {
-                                        pendingModel = chosen
-                                    }
+                                    act { setSessionPermissionMode(settings, summary.id, chosen) }
                                 },
                             )
                         }
-                        PickerButton(
-                            current = permissionMode,
-                            options = PERMISSION_MODES,
-                            onPick = { chosen ->
-                                act { setSessionPermissionMode(settings, summary.id, chosen) }
-                            },
-                        )
-                    }
-                    // The same filled shape as the button beside it, not an outlined one: these are
-                    // two things you can do about the session, and weighting one as secondary said
-                    // they were a primary action and its qualifier. What separates them is the
-                    // colour and the mark, which is what they mean.
-                    //
-                    // Always here, rather than arriving with the turn as it used to. A control that
-                    // comes and goes makes its own presence the signal, and a button always in the
-                    // same place also cannot push Send off the end of the row by turning up.
-                    val process =
-                        when {
-                            running -> ProcessAction.Pause
-                            status == "exited" -> ProcessAction.Start
-                            else -> ProcessAction.Stop
-                        }
-                    Button(
-                        onClick = {
-                            processInFlight = true
-                            act(onDone = { processInFlight = false }) {
-                                process.perform(settings, summary.id)
+                        // The same filled shape as the button beside it, not an outlined one: these
+                        // are two things you can do about the session, and weighting one as
+                        // secondary said they were a primary action and its qualifier. What
+                        // separates them is the colour and the mark, which is what they mean.
+                        //
+                        // Always here, rather than arriving with the turn as it used to. A control
+                        // that comes and goes makes its own presence the signal, and a button
+                        // always
+                        // in the same place also cannot push Send off the end of the row by turning
+                        // up.
+                        val process =
+                            when {
+                                running -> ProcessAction.Pause
+                                status == "exited" -> ProcessAction.Start
+                                else -> ProcessAction.Stop
                             }
-                        },
-                        enabled = !processInFlight,
-                        colors = actionButtonColors(process.colour()),
-                    ) {
-                        Glyph(
-                            process.glyph,
-                            colour = LocalContentColor.current,
-                            modifier = Modifier.semantics { contentDescription = process.label },
-                        )
-                    }
-                    Spacer(Modifier.width(8.dp))
-                    // The paper plane, with a clock on it while a turn is in flight: sending then
-                    // queues the message for the next tool boundary rather than starting a turn of
-                    // its own, and the two have to be told apart at a glance. The label says the
-                    // same thing to a screen reader.
-                    //
-                    // Disabled while there is nothing to send, rather than pressable and silent:
-                    // `send` has always returned early on an empty composer, so the button promised
-                    // something it would not do. Disabled and not hidden, for the reason above.
-                    Button(
-                        onClick = { send() },
-                        enabled = input.text.isNotBlank() || pendingAttachments.isNotEmpty(),
-                        colors = actionButtonColors(if (running) queueColor else sendColor),
-                    ) {
-                        Glyph(
-                            if (running) QUEUE_GLYPH else SEND_GLYPH,
-                            colour = LocalContentColor.current,
-                            modifier =
-                                Modifier.semantics { contentDescription = sendLabel(running) },
-                        )
+                        Button(
+                            onClick = {
+                                processInFlight = true
+                                act(onDone = { processInFlight = false }) {
+                                    process.perform(settings, summary.id)
+                                }
+                            },
+                            enabled = !processInFlight,
+                            colors = actionButtonColors(process.colour()),
+                        ) {
+                            Glyph(
+                                process.glyph,
+                                colour = LocalContentColor.current,
+                                modifier =
+                                    Modifier.semantics { contentDescription = process.label },
+                            )
+                        }
+                        Spacer(Modifier.width(8.dp))
+                        // The paper plane, with a clock on it while a turn is in flight: sending
+                        // then queues the message for the next tool boundary rather than starting a
+                        // turn of its own, and the two have to be told apart at a glance. The label
+                        // says the same thing to a screen reader.
+                        //
+                        // Disabled while there is nothing to send, rather than pressable and
+                        // silent:
+                        // `send` has always returned early on an empty composer, so the button
+                        // promised something it would not do. Disabled and not hidden, for the
+                        // reason above.
+                        Button(
+                            onClick = { send() },
+                            enabled = input.text.isNotBlank() || pendingAttachments.isNotEmpty(),
+                            colors = actionButtonColors(if (running) queueColor else sendColor),
+                        ) {
+                            Glyph(
+                                if (running) QUEUE_GLYPH else SEND_GLYPH,
+                                colour = LocalContentColor.current,
+                                modifier =
+                                    Modifier.semantics { contentDescription = sendLabel(running) },
+                            )
+                        }
                     }
                 }
             }
@@ -1852,7 +1964,7 @@ fun SessionScreen(
     // is the screen's business rather than any row's. See [SessionImageViewer].
     fullImage?.let { ref -> SessionImageViewer(settings, summary.id, ref) { fullImage = null } }
     if (usageOpen) {
-        UsageDialog(feed = usageFeed, onDismiss = { usageOpen = false })
+        usageFeed?.let { UsageDialog(feed = it, onDismiss = { usageOpen = false }) }
     }
     if (settingsOpen) {
         // Measured when the dialog opens rather than kept up to date: what the reader is being told
@@ -1866,6 +1978,8 @@ fun SessionScreen(
             settings = settings,
             sessionId = summary.id,
             title = title,
+            effort = summary.effort.takeIf { summary.takesEffort },
+            takesEffort = summary.takesEffort,
             cachedBytes = cachedBytes,
             // The purge finishes before the epoch moves, because the relaunched opening effect
             // reads the same directory and would otherwise draw what is about to be deleted. The
@@ -2143,6 +2257,13 @@ private fun SessionStatusRow(
     /** Context the session is holding, or null where nothing has measured it. */
     contextTokens: Long?,
     modifier: Modifier = Modifier,
+    /**
+     * Whether this row is for a subagent rather than a session, which changes only one word:
+     * "exited" reads as "finished" there too, the same as the subagent list's own card -- a
+     * subagent's process was always its parent's, so "exited" would read as a fault rather than the
+     * ordinary way one of these ends.
+     */
+    subagent: Boolean = false,
 ) {
     DebugStats.count("status row recomposed")
     Row(
@@ -2199,7 +2320,7 @@ private fun SessionStatusRow(
                 Text(
                     when (status) {
                         "idle" -> "idle"
-                        "exited" -> "exited"
+                        "exited" -> if (subagent) "finished" else "exited"
                         "awaitingInput" -> "your turn"
                         "unknown" -> "can't tell"
                         else -> status
@@ -2270,7 +2391,7 @@ private const val ONE_TAP_MS = 250L
  * session is set to without spending a second line on saying it.
  */
 @Composable
-private fun PickerButton(current: String, options: List<String>, onPick: (String) -> Unit) {
+fun PickerButton(current: String, options: List<String>, onPick: (String) -> Unit) {
     var open by remember { mutableStateOf(false) }
     // When an outside touch last closed the menu.
     //

app/androidApp/src/main/kotlin/com/example/aiapp/SessionSettingsDialog.kt

@@ -6,8 +6,10 @@ import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.MaterialTheme
@@ -26,6 +28,10 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.input.ImeAction
 import androidx.compose.ui.unit.dp
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
@@ -54,6 +60,16 @@ fun SessionSettingsDialog(
      */
     title: String,
     onRenamed: (String) -> Unit,
+    /**
+     * How hard the model thinks, as the session reports it, or null for the CLI's own default.
+     *
+     * Taken from the row this dialog was opened over rather than fetched, because unlike the
+     * notification switch there is nothing else that changes it: the level is this app's to set and
+     * the server does not resolve it into something else.
+     */
+    effort: String?,
+    /** Whether a level does anything here; the row is left out entirely where it does not. */
+    takesEffort: Boolean,
     /**
      * What this phone is holding of the conversation, or null while that is being measured -- see
      * the Reload row below, which is what would discard it.
@@ -76,6 +92,8 @@ fun SessionSettingsDialog(
 ) {
     val scope = rememberCoroutineScope()
     var name by remember(sessionId) { mutableStateOf(title) }
+    var level by remember(sessionId) { mutableStateOf(effort) }
+    var effortError by remember { mutableStateOf<String?>(null) }
     var saving by remember { mutableStateOf(false) }
     var error by remember { mutableStateOf<String?>(null) }
     // Null until the server has been asked. The row this dialog was opened over is a snapshot of
@@ -84,6 +102,16 @@ fun SessionSettingsDialog(
     // and a spinner sits beside it, which is what not knowing looks like.
     var notify by remember(sessionId) { mutableStateOf<Boolean?>(null) }
     var notifyError by remember { mutableStateOf<String?>(null) }
+    // The same three-state shape the notification switch has, for the same reason: until the
+    // server has answered, the switch is disabled rather than showing a position nothing confirmed.
+    var autoResume by remember(sessionId) { mutableStateOf<Boolean?>(null) }
+    var resumeMessage by remember(sessionId) { mutableStateOf(DEFAULT_RESUME_MESSAGE) }
+    // When the server next intends to ask whether the limit has lifted, or null when nothing is
+    // waiting. Read once with everything else: it moves on the server's schedule, not this
+    // screen's, and a figure that redrew itself here would be this app re-measuring what it was
+    // told.
+    var resumeAt by remember(sessionId) { mutableStateOf<Double?>(null) }
+    var resumeError by remember { mutableStateOf<String?>(null) }
     // Where the session works. Null until the server has been asked, for the same reason the switch
     // above is. An empty answer is a session that was never given a directory, which is not the
     // same as one whose directory is unknown -- the field is only enabled once one of those is
@@ -97,6 +125,9 @@ fun SessionSettingsDialog(
         try {
             val fresh = withContext(Dispatchers.IO) { fetchSession(settings, sessionId) }
             notify = fresh.notify
+            autoResume = fresh.autoResume
+            resumeMessage = fresh.autoResumeMessage
+            resumeAt = fresh.resumeAt
             cwd = fresh.cwd.orEmpty()
             typedCwd = fresh.cwd.orEmpty()
         } catch (e: ApiException) {
@@ -104,6 +135,8 @@ fun SessionSettingsDialog(
             // instead of offering a position nothing confirmed.
             notifyError = e.message
             notify = null
+            resumeError = e.message
+            autoResume = null
         }
     }
 
@@ -132,6 +165,26 @@ fun SessionSettingsDialog(
         }
     }
 
+    /**
+     * Chooses a thinking level, which ends the process the old level was launched with.
+     *
+     * Put back if the request is refused, for the reason the notification switch below gives: a
+     * control that stays where it was put after a refusal is stating something untrue.
+     */
+    fun setEffort(chosen: String?) {
+        val was = level
+        level = chosen
+        effortError = null
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) { setSessionEffort(settings, sessionId, chosen) }
+            } catch (e: ApiException) {
+                level = was
+                effortError = e.message
+            }
+        }
+    }
+
     // Moved optimistically so the switch answers the finger that moved it, and put back if the
     // request is refused -- a switch that waits for a round trip reads as broken on a slow tunnel,
     // and one that stays moved after a refusal lies.
@@ -149,6 +202,39 @@ fun SessionSettingsDialog(
         }
     }
 
+    /**
+     * Turns auto-resume on or off, or changes what it would say.
+     *
+     * One request for both, because the server takes one: switching it on and typing the message
+     * are two halves of the same decision, and sending them separately would leave a moment where
+     * the session is armed with the old words.
+     *
+     * Put back if refused, like the notification switch. Turning it off also clears what was
+     * scheduled -- said here rather than only on the server, or the row would go on naming a time
+     * that no longer exists.
+     */
+    fun setAutoResume(on: Boolean, message: String) {
+        val wasOn = autoResume
+        val wasMessage = resumeMessage
+        val wasAt = resumeAt
+        autoResume = on
+        resumeMessage = message
+        if (!on) resumeAt = null
+        resumeError = null
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) {
+                    setSessionAutoResume(settings, sessionId, on, message)
+                }
+            } catch (e: ApiException) {
+                autoResume = wasOn
+                resumeMessage = wasMessage
+                resumeAt = wasAt
+                resumeError = e.message
+            }
+        }
+    }
+
     // Nothing to do when the name has not changed, so the button says so rather than sending a
     // request whose success would look exactly like the failure of having typed nothing.
     val changed = name.trim().isNotEmpty() && name.trim() != title
@@ -175,7 +261,10 @@ fun SessionSettingsDialog(
         onDismissRequest = onDismiss,
         title = { Text("Session settings") },
         text = {
-            Column {
+            // Scrollable, because this dialog grew past a screenful: a Material dialog constrains
+            // its own height and clips what does not fit, so the last control on the list is one
+            // large system font away from being unreachable with nothing on screen to say so.
+            Column(Modifier.verticalScroll(rememberScrollState())) {
                 OutlinedTextField(
                     value = name,
                     onValueChange = { name = it },
@@ -219,6 +308,70 @@ fun SessionSettingsDialog(
                     )
                 }
                 Spacer(Modifier.height(8.dp))
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Text("Resume after a usage limit", modifier = Modifier.weight(1f))
+                    if (autoResume == null && resumeError == null) {
+                        CircularProgressIndicator(
+                            modifier = Modifier.width(16.dp).height(16.dp),
+                            strokeWidth = 2.dp,
+                        )
+                        Spacer(Modifier.width(8.dp))
+                    }
+                    Switch(
+                        checked = autoResume == true,
+                        onCheckedChange = { setAutoResume(it, resumeMessage) },
+                        enabled = autoResume != null,
+                    )
+                }
+                // Disabled rather than hidden while the switch is off: a field that comes and goes
+                // makes its own presence the signal, and a visible one teaches what the switch will
+                // do. Committed on the keyboard's Done rather than on every keystroke, so typing a
+                // sentence is one request instead of one per letter.
+                OutlinedTextField(
+                    value = resumeMessage,
+                    onValueChange = { resumeMessage = it },
+                    label = { Text("Message to send") },
+                    // What an empty field means, in the field: the server's own word rather than a
+                    // session poked with nothing to read.
+                    placeholder = { Text(DEFAULT_RESUME_MESSAGE) },
+                    singleLine = true,
+                    enabled = autoResume == true,
+                    modifier = Modifier.fillMaxWidth(),
+                    keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                    keyboardActions =
+                        KeyboardActions(onDone = { setAutoResume(true, resumeMessage) }),
+                )
+                // What it does and what it costs, in the order it happens. The last sentence is the
+                // one that matters: the time below is when the server will *ask*, not a promise
+                // about when the session speaks.
+                Text(
+                    "When this session stops because the account is out of quota, the server " +
+                        "checks the limit and sends this message once it has lifted. It checks " +
+                        "again if the limit is still on.",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                // Only where something is actually waiting. Absent is not a state worth a row: a
+                // session that has not hit a limit has nothing scheduled, which the reader can see
+                // from the switch.
+                resumeAt?.let { at ->
+                    Text(
+                        "Waiting now -- next check ${formatCheckTime(at)}.",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                resumeError?.let {
+                    Text(
+                        it,
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
+                Spacer(Modifier.height(8.dp))
                 Row(
                     verticalAlignment = Alignment.CenterVertically,
                     modifier = Modifier.fillMaxWidth(),
@@ -264,6 +417,44 @@ fun SessionSettingsDialog(
                         style = MaterialTheme.typography.bodySmall,
                     )
                 }
+                // Left out rather than disabled, the one place this dialog does that: a disabled
+                // control teaches what the thing can do, and a llama session cannot do this at all
+                // -- the row would be teaching something false about it.
+                if (takesEffort) {
+                    Spacer(Modifier.height(8.dp))
+                    Row(
+                        verticalAlignment = Alignment.CenterVertically,
+                        modifier = Modifier.fillMaxWidth(),
+                    ) {
+                        Text("Thinking", modifier = Modifier.weight(1f))
+                        PickerButton(
+                            current = level ?: DEFAULT_EFFORT,
+                            // The level the CLI picks for itself is in the list as well as in the
+                            // button, so leaving a level is not a one-way trip -- the same
+                            // correction the model picker carries.
+                            options = listOf(DEFAULT_EFFORT) + EFFORT_LEVELS,
+                            onPick = { chosen ->
+                                setEffort(chosen.takeIf { it != DEFAULT_EFFORT })
+                            },
+                        )
+                    }
+                    // What it costs, said where it is about to be pressed, like Move above: the
+                    // CLI reads the level when it launches and has no control request for
+                    // changing one.
+                    Text(
+                        "Changing this stops the session's process. It starts again with the " +
+                            "next message, or with Start.",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    effortError?.let {
+                        Text(
+                            it,
+                            color = MaterialTheme.colorScheme.error,
+                            style = MaterialTheme.typography.bodySmall,
+                        )
+                    }
+                }
                 Spacer(Modifier.height(8.dp))
                 Row(
                     verticalAlignment = Alignment.CenterVertically,
@@ -351,3 +542,21 @@ fun SessionSettingsDialog(
         dismissButton = { TextButton(onClick = onDismiss) { Text("Close") } },
     )
 }
+
+/**
+ * When the server will next look, as a local time.
+ *
+ * A time rather than a countdown, for the reason the transcript's own limit row gives: this screen
+ * reads the figure once, and a span drawn from a value nothing refreshes goes stale while somebody
+ * is looking at it.
+ */
+private fun formatCheckTime(epochSeconds: Double): String =
+    try {
+        DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
+            .withZone(ZoneId.systemDefault())
+            .format(Instant.ofEpochSecond(epochSeconds.toLong()))
+    } catch (_: Exception) {
+        // A time that cannot be read is not a time to show: the sentence above still says a check
+        // is coming, which is the part the reader can act on.
+        "soon"
+    }

app/androidApp/src/main/kotlin/com/example/aiapp/SessionUsageBar.kt

@@ -70,13 +70,22 @@ class UsageFeed(
     /** Ask the backend again now. The dialog's refresh button; the poll does it on its own. */
     val refresh: () -> Unit,
 ) {
-    /** What [setup]'s own limits came back as. See [usageFor] for why the states are these. */
-    fun forSetup(setup: String): SessionUsage =
-        when (val state = snapshots) {
+    /**
+     * What meters [session], and what that meter came back as. See [usageFor] for the states.
+     *
+     * A session rather than a machine, because a machine is not what is metered: one machine runs
+     * the Claude CLI and an echo session side by side, and only the first of them spends anything.
+     */
+    fun forSession(session: SessionSummary): SessionUsage {
+        // Settled without asking anybody: a session nothing meters has nothing to check, and
+        // "checking" is what the fetch's own states would say about it for as long as one is out.
+        val provider = session.usageProvider ?: return SessionUsage.NotMetered
+        return when (val state = snapshots) {
             is LoadState.Loading -> SessionUsage.Waiting
             is LoadState.Error -> SessionUsage.Unavailable(state.message)
-            is LoadState.Loaded -> usageFor(state.value, setup)
+            is LoadState.Loaded -> usageFor(state.value, session.setup, provider)
         }
+    }
 }
 
 /**
@@ -158,9 +167,15 @@ fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
         }
     }
 
-    // Nothing at all for a machine that meters nothing: a row saying "unknown" there would report a
-    // problem about a setup somebody chose, on every screen, forever.
-    if (usage is SessionUsage.NotMetered) {
+    // Nothing at all for a session that meters nothing: a row saying "unknown" there would report
+    // a problem about a setup somebody chose, on every screen, forever.
+    //
+    // And nothing while the first fetch is out, which is a different silence. A request in flight
+    // is not a state to report -- and the session that meters nothing is exactly the one this
+    // cannot yet tell apart, so "5-hour usage: checking" appeared under an echo session for half a
+    // second and was then taken away. A row that has to be withdrawn is worse than one that
+    // arrives late.
+    if (usage is SessionUsage.NotMetered || usage is SessionUsage.Waiting) {
         return
     }
 
@@ -171,9 +186,10 @@ fun SessionUsageBar(usage: SessionUsage, modifier: Modifier = Modifier) {
         // Words, not a colour and not an empty bar: every one of these is a different kind of
         // answer from "this much is used", and only words carry a difference in kind.
         when (val state = usage) {
-            SessionUsage.NotMetered -> Unit
+            // Both handled above, before the row exists at all.
+            SessionUsage.NotMetered,
+            SessionUsage.Waiting -> Unit
             is SessionUsage.Unavailable -> UsageNote("5-hour usage unknown -- ${state.why}")
-            SessionUsage.Waiting -> UsageNote("5-hour usage: checking")
             is SessionUsage.Known -> {
                 val window = state.windows.firstOrNull { it.kind == "session" }
                 if (window == null) {
@@ -234,16 +250,22 @@ private fun fiveHourLabel(window: UsageWindow, now: OffsetDateTime): String {
 }
 
 /**
- * One machine's snapshot, out of every machine's.
+ * One meter's snapshot, out of every machine's: [setup]'s row for [provider].
+ *
+ * Both halves are needed to pick it. A machine can hold more than one meter -- the Claude CLI's
+ * account and, while a test has one set, an echo session's invented one -- and a snapshot is one
+ * service on one machine.
  *
  * Every way of having *failed* to get numbers is [SessionUsage.Unavailable] with the reason in it.
  * None of them may look like zero, and none may look like [SessionUsage.NotMetered], which is the
  * machine having no quota rather than the question going unanswered.
  */
-fun usageFor(snapshots: List<UsageSnapshot>, setup: String): SessionUsage {
-    // No snapshot at all means the backend never asked, which it only does for a machine with
-    // nothing metered on it. That is a different answer from having asked and failed.
-    val mine = snapshots.firstOrNull { it.setup == setup } ?: return SessionUsage.NotMetered
+fun usageFor(snapshots: List<UsageSnapshot>, setup: String, provider: String): SessionUsage {
+    // No snapshot at all means the backend never asked, which it only does where there is nothing
+    // to ask about. That is a different answer from having asked and failed.
+    val mine =
+        snapshots.firstOrNull { it.setup == setup && it.provider == provider }
+            ?: return SessionUsage.NotMetered
     if (mine.state != "ok") {
         return SessionUsage.Unavailable(mine.detail ?: mine.state)
     }

app/androidApp/src/main/kotlin/com/example/aiapp/SetupsScreen.kt

@@ -236,6 +236,7 @@ private fun AddSetupDialog(
     var address by remember { mutableStateOf("") }
     var identity by remember { mutableStateOf("") }
     var attachmentsDir by remember { mutableStateOf("") }
+    var modelsDir by remember { mutableStateOf("") }
     var tested by remember { mutableStateOf<String?>(null) }
     var testing by remember { mutableStateOf(false) }
 
@@ -250,6 +251,7 @@ private fun AddSetupDialog(
                     port = typedPort,
                     identityFile = identity.trim().ifEmpty { null },
                     attachmentsDir = attachmentsDir.trim().ifEmpty { null },
+                    modelsDir = modelsDir.trim().ifEmpty { null },
                 )
             }
 
@@ -293,6 +295,14 @@ private fun AddSetupDialog(
                     label = { Text("Folder for attached files (optional)") },
                     singleLine = true,
                 )
+                // Where that machine's GGUFs are, for a llama.cpp session on it. Blank means
+                // the same place this backend keeps its own downloads, read on that machine.
+                OutlinedTextField(
+                    value = modelsDir,
+                    onValueChange = { modelsDir = it },
+                    label = { Text("Folder for models (optional)") },
+                    singleLine = true,
+                )
                 tested?.let {
                     Spacer(Modifier.height(8.dp))
                     Text(it, style = MaterialTheme.typography.bodySmall)

app/androidApp/src/main/kotlin/com/example/aiapp/SpawnScreen.kt

@@ -61,18 +61,31 @@ fun SpawnScreen(
     // "auto" rather than "manual": on a phone every ask is a round trip to a question card, and
     // answering "allow Bash?" dozens of times per task is what this app exists to avoid.
     var permissionMode by remember { mutableStateOf("auto") }
+    // Null until the server has been asked, and null again if it answers "no level chosen" -- the
+    // two are told apart by [defaultsAsked], because a picker that shows a level before the answer
+    // arrives is one you can spawn at without having chosen it.
+    var effort by remember { mutableStateOf<String?>(null) }
+    var defaultsAsked by remember { mutableStateOf(false) }
     var busy by remember { mutableStateOf(false) }
     // Only the spawn's own failure. The fetch's lives in `options`: this one leaves a filled-in
     // form worth keeping, and that one leaves nothing to fill in.
     var spawnError by remember { mutableStateOf<String?>(null) }
-    // Downloaded models, for a llama provider to choose between. Kept separate from the setups: a
-    // Claude session needs none, so failing to list them must not stop the screen rendering.
+    // The models on the *chosen machine*, for a llama provider to choose between. Kept separate
+    // from the setups: a Claude session needs none, so failing to list them must not stop the
+    // screen rendering. Refetched when the machine changes, because a model is a file on one
+    // machine -- see [fetchSetupModels].
     var models by remember { mutableStateOf<List<LocalModel>>(emptyList()) }
     var modelKey by remember { mutableStateOf<String?>(null) }
     var contextSize by remember { mutableStateOf("") }
     var temperature by remember { mutableStateOf("") }
 
     LaunchedEffect(Unit) {
+        // Separate from the setups fetch below and deliberately not fatal: failing to learn the
+        // default must leave a screen you can still spawn from, so the picker stays on "default"
+        // and says so rather than the whole form refusing to draw.
+        runCatching { withContext(Dispatchers.IO) { fetchDefaultEffort(settings) } }
+            .onSuccess { effort = it }
+        defaultsAsked = true
         options =
             try {
                 val fetched = withContext(Dispatchers.IO) { fetchSetups(settings) }
@@ -83,9 +96,6 @@ fun SpawnScreen(
             } catch (e: ApiException) {
                 LoadState.failed(e)
             }
-        models =
-            runCatching { withContext(Dispatchers.IO) { fetchModels(settings).local } }
-                .getOrDefault(emptyList())
     }
 
     Column(Modifier.fillMaxSize().verticalScroll(rememberScrollState()).padding(16.dp)) {
@@ -115,6 +125,17 @@ fun SpawnScreen(
                 is LoadState.Loaded -> state.value
             }
         val setup = setups.firstOrNull { it.name == setupName }
+        // Whichever machine is chosen now, asked again when that changes. The old machine's list
+        // is dropped first rather than left on screen: a file name from another machine looks
+        // exactly like one from this one.
+        LaunchedEffect(setup?.id) {
+            models = emptyList()
+            modelKey = null
+            val id = setup?.id ?: return@LaunchedEffect
+            models =
+                runCatching { withContext(Dispatchers.IO) { fetchSetupModels(settings, id) } }
+                    .getOrDefault(emptyList())
+        }
         val current = setup?.providers?.firstOrNull { it.name == providerName }
         // Only the Claude CLI has models, a working directory and permission modes; keying the
         // extra fields on the kind rather than the provider name keeps a second Claude provider
@@ -175,12 +196,13 @@ fun SpawnScreen(
         )
 
         if (isLlama) {
-            // A llama session names one of the models this backend has downloaded, so the choice is
-            // that list rather than free text -- a name that is not on disk is a session that
-            // cannot start.
+            // A llama session names one of the models on the machine it will run on, so the
+            // choice is that list rather than free text -- a name that is not on that machine's
+            // disk is a session that cannot start.
             if (models.isEmpty()) {
                 Text(
-                    "No models downloaded yet. Get one from the Models screen first.",
+                    "No models on ${setup?.name ?: "this machine"}. The Models screen downloads " +
+                        "to the backend; another machine needs the file put there itself.",
                     style = MaterialTheme.typography.bodyMedium,
                     color = MaterialTheme.colorScheme.onSurfaceVariant,
                 )
@@ -251,6 +273,19 @@ fun SpawnScreen(
                 selected = permissionMode,
                 onSelect = { permissionMode = it },
             )
+            Spacer(Modifier.height(16.dp))
+
+            // Says what it does to *later* spawns as well, because it does: the level chosen here
+            // is stored as the default, which is the whole way that default is set. A picker that
+            // quietly changed a global would be the same control with the fact left out.
+            ChipGroup(
+                label = "Thinking (kept as the default for new sessions)",
+                options = listOf(DEFAULT_EFFORT) + EFFORT_LEVELS,
+                // The CLI's own default is a level in the list, so this cannot be a one-way trip.
+                // Disabled-looking until the server has answered, for the reason above.
+                selected = if (defaultsAsked) effort ?: DEFAULT_EFFORT else null,
+                onSelect = { chosen -> effort = chosen.takeIf { it != DEFAULT_EFFORT } },
+            )
         }
         Spacer(Modifier.height(24.dp))
 
@@ -268,6 +303,13 @@ fun SpawnScreen(
                     try {
                         val spawned =
                             withContext(Dispatchers.IO) {
+                                // Stored before the spawn and not after it: choosing a level is
+                                // an intent about new sessions in general, so a spawn that then
+                                // fails must not also lose the choice. Non-fatal for the same
+                                // reason the fetch above is -- the session is what was asked for.
+                                if (isClaude) {
+                                    runCatching { setDefaultEffort(settings, effort) }
+                                }
                                 spawnSession(
                                     settings,
                                     // The id, not the label: labels are editable and the server
@@ -280,6 +322,7 @@ fun SpawnScreen(
                                         if (isLlama) modelKey else model.trim().takeIf { isClaude },
                                     cwd = cwd.trim().takeIf { isClaude },
                                     permissionMode = permissionMode.takeIf { isClaude },
+                                    effort = effort.takeIf { isClaude },
                                     // Sent only when set, so blank means "whatever llama.cpp does
                                     // by default" rather than a zero.
                                     params =

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptAddress.kt

@@ -0,0 +1,27 @@
+package com.example.aiapp
+
+/**
+ * Where one transcript lives: a session's own, or one of its subagents'.
+ *
+ * The single mechanism [fetchTranscript], [EventStream], [TranscriptSource] and
+ * [TranscriptCache.session] all take, rather than each growing its own branch between a session and
+ * a subagent -- see SUBAGENTS.md's "Phone" and "Wire shape". A caller that has only a session id
+ * builds one with the one-argument constructor; a subagent's screen supplies both ids.
+ */
+data class TranscriptAddress(val sessionId: String, val subagentId: String? = null) {
+    /** The URL segment naming this transcript, before `/transcript` or `/events`. */
+    val urlPath: String
+        get() =
+            if (subagentId == null) "sessions/$sessionId"
+            else "sessions/$sessionId/subagents/$subagentId"
+
+    /**
+     * Where this transcript's cache lives on the phone, relative to the cache root.
+     *
+     * A subagent's nests under its session's directory rather than sitting beside it, so deleting a
+     * session's cache directory takes its subagents' with it -- the same one-way door the server's
+     * own storage describes.
+     */
+    val cachePath: String
+        get() = if (subagentId == null) sessionId else "$sessionId/subagents/$subagentId"
+}

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptCache.kt

@@ -35,8 +35,15 @@ class TranscriptCache(
     private val root: File,
     private val warn: (String) -> Unit = { Log.w("ai-app", it) },
 ) {
-    /** The cache for one session, whether or not anything has been stored for it yet. */
-    fun session(id: String): SessionCache = SessionCache(File(root, id), warn)
+    /**
+     * The cache for one transcript, whether or not anything has been stored for it yet.
+     *
+     * A subagent's [TranscriptAddress.cachePath] nests it under its session's directory, so
+     * deleting the session (below) takes its subagents' caches with it -- there is no separate
+     * purge for one.
+     */
+    fun session(address: TranscriptAddress): SessionCache =
+        SessionCache(File(root, address.cachePath), warn)
 
     /**
      * Deletes every session directory not in [ids], called after a successful list fetch. The path

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptItems.kt

@@ -175,6 +175,18 @@ sealed class TranscriptItem {
         val preTokens: Long?,
         val postTokens: Long?,
     ) : TranscriptItem()
+
+    /**
+     * The account ran out of quota, so the turn stopped here.
+     *
+     * A divider rather than an error: nothing failed, and what a reader scrolling back needs from
+     * it is the same thing a clear or a compaction gives them -- why the conversation stops at this
+     * line.
+     *
+     * [resetsAt] is epoch seconds and null where the session was told nothing, which is a state the
+     * row has words for rather than a time it invents.
+     */
+    data class LimitNote(override val seq: Long, val resetsAt: Double?) : TranscriptItem()
 }
 
 /**
@@ -458,6 +470,7 @@ fun foldEvent(items: List<TranscriptItem>, entry: SeqEvent): List<TranscriptItem
             } else {
                 items + TranscriptItem.ImageItem(entry.seq, event.ref)
             }
+        is SessionEvent.LimitReached -> items + TranscriptItem.LimitNote(entry.seq, event.resetsAt)
         is SessionEvent.Cleared -> items + TranscriptItem.ClearedNote(entry.seq)
         is SessionEvent.Compacted ->
             items + TranscriptItem.CompactedNote(entry.seq, event.preTokens, event.postTokens)

app/androidApp/src/main/kotlin/com/example/aiapp/TranscriptSource.kt

@@ -18,7 +18,7 @@ import java.util.concurrent.atomic.AtomicReference
  */
 class TranscriptSource(
     private val settings: ServerSettings,
-    private val sessionId: String,
+    private val address: TranscriptAddress,
     val cache: SessionCache,
 ) {
     private val stream = AtomicReference<EventStream?>(null)
@@ -65,7 +65,7 @@ class TranscriptSource(
         val tail = cache.tail() ?: return false
         // `before = seq + 1` is the newest event with seq <= the cursor, which is the event *at*
         // the cursor when the server still has one there.
-        val answer = fetchTranscript(settings, sessionId, before = tail.seq + 1, limit = 1)
+        val answer = fetchTranscript(settings, address, before = tail.seq + 1, limit = 1)
         val matches =
             answer.size == 1 &&
                 try {
@@ -83,7 +83,7 @@ class TranscriptSource(
      */
     suspend fun fetchOpening(): List<SeqEvent> {
         DebugStats.count("transcript page from server")
-        val page = fetchTranscript(settings, sessionId, limit = OPENING_WINDOW)
+        val page = fetchTranscript(settings, address, limit = OPENING_WINDOW)
         page.forEach { (line, entry) -> cache.append(line, entry.seq) }
         cache.flush()
         return page.map { it.second }
@@ -108,7 +108,7 @@ class TranscriptSource(
         val page =
             fetchTranscript(
                 settings,
-                sessionId,
+                address,
                 before = before,
                 limit = limit,
                 coalesce = coalesce,
@@ -131,7 +131,7 @@ class TranscriptSource(
      * well lose.
      */
     fun follow(after: Long, onOpen: () -> Unit, onReset: () -> Unit, onEvent: (SeqEvent) -> Unit) {
-        val opened = EventStream(settings, sessionId)
+        val opened = EventStream(settings, address)
         stream.getAndSet(opened)?.close()
         try {
             opened.run(after, onOpen, onReset) { raw, entry ->

app/androidApp/src/test/kotlin/com/example/aiapp/LimitRowTest.kt

@@ -0,0 +1,32 @@
+package com.example.aiapp
+
+import java.time.ZoneId
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertTrue
+
+/**
+ * What the transcript says where a session ran out of quota.
+ *
+ * The pair worth a test is the one that reads the same when it goes wrong: a reset time that
+ * arrived and one that never did. The second must not turn into a plausible-looking time, because a
+ * reader has no way of telling an invented one from a reported one.
+ */
+class LimitRowTest {
+    private val utc = ZoneId.of("UTC")
+
+    @Test
+    fun `a reported reset time is shown as a time`() {
+        // 2026-09-05T12:00:00Z. Asserted as a prefix and the clock reading rather than as the
+        // whole string: the platform's own short-time format is what this asks for, and it
+        // differs by JDK and locale down to which space character separates the meridiem.
+        val summary = limitSummary(1_788_609_600.0, utc)
+        assertTrue(summary.startsWith("Usage limit reached • resets "), summary)
+        assertTrue(summary.contains("12:00"), summary)
+    }
+
+    @Test
+    fun `a limit with no reset time says only what is known`() {
+        assertEquals("Usage limit reached", limitSummary(null, utc))
+    }
+}

app/androidApp/src/test/kotlin/com/example/aiapp/TranscriptCacheTest.kt

@@ -23,7 +23,7 @@ class TranscriptCacheTest {
 
     private fun cache() = TranscriptCache(File(temp, "v1/host_8443")) { said += it }
 
-    private fun session(id: String = "s") = cache().session(id)
+    private fun session(id: String = "s") = cache().session(TranscriptAddress(id))
 
     private fun line(seq: Long, type: String = "toolStart") =
         """{"seq":$seq,"ts":1.5,"type":"$type","id":"x"}"""

client-core/src/transcript_fold.rs

@@ -112,6 +112,13 @@ pub enum TranscriptItem {
     ClearedNote {
         seq: u64,
     },
+    /// The account's usage limit stopped the turn; `resets_at` is epoch
+    /// seconds when the dialect said when it lifts (`LimitNote` in
+    /// `TranscriptItems.kt`).
+    LimitNote {
+        seq: u64,
+        resets_at: Option<f64>,
+    },
     CompactedNote {
         seq: u64,
         pre_tokens: Option<u64>,
@@ -131,6 +138,7 @@ impl TranscriptItem {
             | Self::CommandRow { seq, .. }
             | Self::Note { seq, .. }
             | Self::ClearedNote { seq }
+            | Self::LimitNote { seq, .. }
             | Self::CompactedNote { seq, .. } => *seq,
             Self::QuestionCard(card) => card.seq,
         }
@@ -525,6 +533,14 @@ pub fn fold_event(items: &[TranscriptItem], entry: &SeqEvent) -> Vec<TranscriptI
             items.push(TranscriptItem::ClearedNote { seq });
             items
         }
+        Event::LimitReached { resets_at } => {
+            let mut items = items.to_vec();
+            items.push(TranscriptItem::LimitNote {
+                seq,
+                resets_at: *resets_at,
+            });
+            items
+        }
         Event::Compacted {
             pre_tokens,
             post_tokens,

docs/DECISIONS.md

@@ -60,6 +60,25 @@ marked **DEFERRED** are ones the agent chose not to decide alone.
   flagged here because it is the first half of something Iris explicitly
   asked to see before P1.
 
+- **P0's iris half is also built and smoke-tested on the emulator,
+  2026-09-05.** A new `bench` Cargo feature on `iris-android-app`, on top
+  of `transcript-screen`: the same checked-in fixture (`include_str!`, no
+  asset pipeline needed), the same 24-swipe scroll loop animated through
+  `List::scroll` and the same 400-event/20s streaming phase through
+  `fold_event`, "Run benchmark"/"Copy report" as named accessible
+  controls, and the same three added report fields (process CPU time,
+  peak RSS, battery current) via direct JNI calls
+  (`bench_jni.rs::PlatformHandle`) since `android_view` has no
+  `BatteryManager`/`ClipboardManager` wrapper of its own. One small public
+  API addition to get there: `AndroidAppState::platform_ready` (`IRIS.md`),
+  a default-no-op lifecycle hook handing an implementor a `JavaVM` +
+  `GlobalRef` it can call Java through from any thread. Packaged with a
+  new `release` build type on `iris-android-app`'s own Gradle project
+  (there was previously only `debug`), signed with the same key
+  `app/build-apk.sh` generates. Smoke run and the full report are in
+  RUST.md's P0 box; not attempted this pass: the real on-phone runs and
+  Iris's pass/fail call, which is the actual gate.
+
 - **The intermittent touch-scroll dropout is root-caused and fixed: a
   missed `ACTION_DOWN` hit-test, not the previously-suspected coalesced
   first `ACTION_MOVE`.** Diagnosed by temporary logcat tracing of every
@@ -245,24 +264,30 @@ marked **DEFERRED** are ones the agent chose not to decide alone.
   | app | build | GPU mode | frames | janky % | p50 | p90 | p99 | worst | cpu p50 | gpu-wait p50 |
   |---|---|---|---|---|---|---|---|---|---|---|
   | Compose (in-app report) | debug | host (virgl) | 1268 | 96.4% late | 20.0ms | 28.4ms | 37.7ms | -- | -- | -- |
-  | iris (`FrameReport`) | **release**, `force-gles` | host (virgl) | 62 | 41.94% | 15.0ms | 21.8ms | 37.1ms | 37.1ms | 0.2ms | 12.9ms |
+  | iris (`FrameReport`), **best of three, 2026-09-05** | release, `force-gles` | host (virgl) | 439 | 46.24% | 15.7ms | 23.3ms | 31.2ms | 57.4ms | 1.2ms | 13.2ms |
 
   Under real GPU rendering iris's median frame is *faster* than
   Compose's, not the 2-3x-slower shape the software-mode table shows. A
   new split inside `FrameReport` (redraw-to-submit vs. submit-to-present,
   commit `e2a1fad`) says why: iris's own CPU work per frame is a median
-  0.2ms -- almost the entire frame is time spent handing the frame to the
+  ~1ms -- almost the entire frame is time spent handing the frame to the
   driver, not in iris's layout/text/primitive code. This is consistent
   with the earlier software-mode gap being mostly SwiftShader's CPU
-  rasterisation cost rather than an iris-specific slowness, but is not
-  proof of it: a same-mode software `force-gles` run to isolate the
-  backend crashed for an unrelated reason (SwiftShader's GL path reports
-  itself as OpenGL ES 3.0, which has no compute shaders, and iris's device
-  request assumes them unconditionally) — real scope to fix, not done
-  here — and the two apps' frame populations still differ in kind the same
-  way the software-mode caveats describe. A real intermittent touch-
-  scroll dropout was also reproduced this pass (six consecutive swipes
-  produced zero redraws while taps kept working; an identical retry then
-  succeeded) and is not explained. RUST.md's I5 box, "Where iris's frame
-  time goes, 2026-09-05, the `-gpu host` pass," has the full account. The
-  iris-vs-Masonry choice itself is still Iris's to make.
+  rasterisation cost rather than an iris-specific slowness. **Still not
+  proof, and now closed as unanswerable rather than merely untaken**: a
+  same-mode software `force-gles` run to isolate the backend was retried
+  2026-09-05 after fixing the compute-limit crash the first attempt hit,
+  and hit a second, structural wall instead — SwiftShader's ES 3.0 GL
+  path has no storage-buffer capacity at all, and `shader.wgsl` reads
+  `var<storage>` buffers unconditionally, so reaching that path needs a
+  shader rewrite, not a limits fix (RUST.md's I5 box, "The three
+  remaining I5 verifications, closed 2026-09-05," item 2). The
+  intermittent touch-scroll dropout this pass also reproduced is
+  root-caused and fixed as of the same date (a missed `ACTION_DOWN` on a
+  row's padding/header left `DragArbiter` stuck in `Idle`); three clean
+  `iris-scroll.sh` runs post-fix each scrolled all 24/24 swipes, replacing
+  the single-attempt 62-frame reading this table used to carry. RUST.md's
+  I5 box, "Where iris's frame time goes, 2026-09-05, the `-gpu host`
+  pass," and "The three remaining I5 verifications, closed 2026-09-05,"
+  have the full account. The iris-vs-Masonry choice itself is still
+  Iris's to make.

docs/IRIS.md

@@ -8,6 +8,89 @@ capability that moved. Small and trivial changes do not go here.
 An entry gives the date, what changed, why, and a short before/after where
 it helps judge the change without the session that made it. Newest first.
 
+## 2026-09-06: `List::fling`, `VelocityTracker`, `FlingCalculator` (IRIS_TODO.md's "swiping has no momentum")
+
+`iris::widget::List` gained a real fling: `fling(velocity_px_per_s)` starts
+one (cancelled by the next touch-down via `cancel_fling`, or automatically
+once it settles or reaches loaded content's start/end), `is_scrolling()`
+reports whether one is running, and `tick_fling(now: Instant) -> bool`
+advances it and returns whether it is still going -- a caller that owns a
+`RequestRedraw` handle can hand it to the list once via the new
+`set_redraw_handle`, after which `List` re-arms its own next frame while
+flinging with no further polling needed; a caller driving a scripted
+benchmark instead calls `tick_fling` itself in a loop, same as it already
+drives `scroll`.
+
+The physics is `iris::sense::FlingCalculator` + `VelocityTracker`
+(`sense.rs`, beside `DragArbiter`): a port of AOSP `SplineOverScroller`'s
+deceleration curve (the same one Compose's own `ScrollableDefaults.
+flingBehavior()` uses), cited at the definition, so a fling here travels
+the same distance a Compose `LazyColumn` would for the same initial
+velocity. `VelocityTracker` estimates that velocity from the drag's last
+~100ms of samples rather than one frame's last delta. Unit-tested:
+velocity from known samples, fling distance/duration against the closed-
+form spline result (within 1%), cancel-on-touch, and the start/end clamp
+(a fling stops rather than scrolling into content that was never loaded).
+
+Before: a touch-drag panned exactly as far as the finger moved and stopped
+dead on release. After: releasing mid-drag continues scrolling and
+decelerates, matching the muscle memory every other Android scroll view
+already trained. `transcript_ui::selection::Selection::drag` wires this in
+-- a release only flings if the gesture had committed to panning
+(`DragArbiter::is_panning`, new), never a selection or an undecided tap.
+
+## 2026-09-06: `UiRenderNode::new` returns `Result`, not `Self` (RUST.md's P0 box, phone-crash fix)
+
+`iris_core::UiRenderNode::new(device, queue, config)` now returns
+`Result<Self, String>` instead of `Self`. Why: it used to let a bind-group-
+layout validation failure reach wgpu's default error handler, which panics
+with no way for a caller to intervene -- exactly what aborted the P0 bench
+APK on Iris's phone with the crash report truncated to "wgpu error:
+Validation Error" and nothing else recoverable. It now runs its creation
+calls inside wgpu error scopes and returns the full error text (wgpu's own
+"Caused by" chain) as `Err` instead.
+
+Both callers changed to match: `android::render::AndroidRenderer::new`
+itself now returns `Result<Self, String>` too, building a fuller report
+(adapter identity, the limits/downlevel flags a layout validates against,
+then wgpu's text) on failure -- its caller,
+`android::view::IrisViewPeer::surface_changed`, logs that report as one
+logcat line and shows it on screen (a new `IrisView.showRendererError`,
+called via an ordinary JNI method call rather than a new `native fn`)
+instead of letting the process abort. `default::render::UiRenderer::new`
+(the winit/desktop backend) still panics on failure -- there is no
+on-screen fallback there -- but the panic message is now the same full
+text rather than whatever wgpu's own handler would have printed.
+
+No change for an app that never constructs a `UiRenderNode` directly (every
+current one goes through `AndroidRenderer`/`UiRenderer`), but anyone who
+does needs an `?`/`.expect()`/`match` at the call site now. Full audit and
+the named hypothesis for what actually failed on the phone are in
+RUST.md's P0 box, "iris bench crash on the phone, 2026-09-06."
+
+## 2026-09-05: `AndroidAppState::platform_ready` (RUST.md's P0 box, iris half)
+
+Added a second, optional lifecycle method to `iris::android::AndroidAppState`
+(`iris/src/android/view.rs`), called once from `new_peer` right after `new`:
+
+```rust
+fn platform_ready(&mut self, rsc: &mut AndroidRsc<Self>, vm: JavaVM, view: GlobalRef) {}
+```
+
+Default does nothing, so every existing implementor (`Client`,
+`TranscriptClient`) is unaffected. It exists for a caller that needs to call
+into Java itself beyond what a `RequestRedraw` handle already covers --
+P0's bench build (`iris-android-app`'s new `bench` feature,
+`bench_client.rs`/`bench_jni.rs`) uses it to hold a `JavaVM` + `GlobalRef`
+to the view so its "Copy report" control and once-a-second battery sampler
+can call `BatteryManager`/`ClipboardManager` through the view's own
+`Context`, from a background tokio task as well as the UI thread. `new`
+itself was not extended with these two parameters: most implementors need
+nothing here, and `new`'s job is building the widget tree, not holding a
+platform handle. `vm`/`view` are independent handles from the ones
+`new_peer` keeps for its own `RequestRedraw` (a fresh `get_java_vm`/
+`new_global_ref` each), so storing them has no effect on that mechanism.
+
 ## 2026-09-05 (later still): `iris_core::device_limits()`, and iris no longer requests compute-shader limits
 
 New public function, `iris_core::device_limits() -> wgpu::Limits`. Why:
@@ -414,3 +497,132 @@ with a number instead of a guess (RUST.md's I5 box).
   blocked handing the frame to the driver," not a confirmed GPU-completion
   time. Enough to separate "iris is slow building the frame" from "iris is
   slow handing it off," not enough to claim an exact GPU budget.
+
+## 2026-09-05: `List::replace_back`/`List::clear`, and `TranscriptScreen::apply`
+
+Fixes the "every client refolds and rebuilds the whole widget tree per
+streamed event" cost RUST.md's P0 box measured (20 events/second against a
+~3,200-row transcript). Two small additions to `iris::widget::List`
+(`iris/src/widget/list.rs`), plus one new method on `transcript-ui`'s
+`TranscriptScreen`.
+
+- **`List::replace_back(row: ListRow) -> Option<ListRow>`**: swaps the
+  *last* row's widget for a new one without moving it — same slot index,
+  so an anchor already pinned there (in particular a list flush with its
+  own end) stays pinned, and a `List` scrolled elsewhere is untouched.
+  `None` if the list is empty. `RowKey` may differ between the old and new
+  row; only `heights`/`extents` care, and both are invalidated for the
+  evicted key the same way `pop_back` already does.
+- **`List::clear()`**: drops every loaded row and resets to `List::new`'s
+  state (`more_before`/`more_after` untouched — a caller that wants those
+  cleared too calls `set_more_before(None)`/`set_more_after(None)` itself).
+  The fallback path for a change that touches more than the tail.
+- **`transcript_ui::TranscriptScreen::apply(&self, rsc, old: &[TranscriptItem], new: &[TranscriptItem])`**:
+  the incremental alternative to rebuilding the whole screen from
+  `transcript_ui::build_tree` on every folded event. Diffs the two
+  `group_tool_runs` outputs and picks the cheapest update: nothing changed
+  (no-op), a pure append (`push_row`, unchanged cost), or — the common
+  streaming case, a delta into a still-open assistant message — a rebuild
+  of just the one changed row via `List::replace_back`, with any further
+  new rows appended after it. A row changing *before* the tail (only
+  `group_tool_runs` retroactively grouping tool calls into a run does
+  this) falls back to `List::clear` plus a full rebuild, counted in
+  `TranscriptScreen::take_rebuilds()`. `bench_client.rs`, `transcript_client.rs`
+  and `desktop-app/app.rs` all call this now instead of rebuilding on every
+  event; only the opening page (and `apply`'s own fallback) still calls
+  `build_tree`.
+- **`TextEditCtx::set_with_spans(text, spans)`**: `set()` plus a fresh
+  `Vec<SpanStyle>` in one call, needed because a streamed row's markdown
+  re-renders to both a new string and a new span list on every delta and
+  the two have to land together — a stale span list drawn against new
+  text can point past its end. `set()` itself is unchanged (still clears
+  spans to none, as before).
+
+Measured on this checkout's emulator (`iris/android-app/run-bench.sh`,
+release, x86_64, `force-gles`): worst-frame and p99 during the streaming
+phase dropped from 369.3ms/284.5ms (full rebuild per event, prior pass) to
+~101–130ms/~76–103ms across three runs (this fix) — see RUST.md's P0 box
+for the full numbers and the comparison's caveats (different AVD
+instances, not a controlled A/B on identical hardware state).
+
+## 2026-09-06: bundled fonts, `content_scale`, `AndroidAppState::on_insets_changed`
+
+From RUST.md's P0 box, working Iris's first real-phone report (font/scale/
+inset bugs the emulator never showed).
+
+- **`TextData` now bundles Noto Sans + Noto Sans Mono** (regular/bold/
+  italic/bold-italic static faces, OFL) and registers them ahead of the
+  platform's own fonts in the `SansSerif`/`Monospace` generic-family
+  lists, rather than relying on the platform's font enumeration alone.
+  `TextData::font_diagnostics() -> FontDiagnostics` reports what was found
+  and what each style axis resolved to — logged once at startup and shown
+  on a screen's Diagnostics page if it has one. Adds ~3.6 MB uncompressed
+  to any binary linking `iris-core`; `build-apk.sh`'s own output says the
+  delivered (compressed) number.
+- **`UiRenderNode::new`/`resize` now take the window size explicitly**
+  (`window_size: impl Into<Vec2>`) instead of deriving it from the
+  surface's physical `SurfaceConfiguration`. Existing callers pass a
+  *logical* size (physical ÷ density/scale-factor) now; this is what makes
+  a `font_size: 16.0` 16 dp instead of 16 raw device pixels on a
+  high-density phone. Before this, `scale_factor` did not exist anywhere
+  in the crate, on either platform.
+- **`AndroidUiState::content_scale: f32`** (`DisplayMetrics.density`, read
+  once in `new_peer`) and the desktop equivalent (`window.scale_factor()`)
+  now divide every physical-pixel number before it reaches layout or
+  touch handling — see `content_scale`'s own field doc for the full list
+  of what depends on it.
+- **New: `AndroidAppState::on_insets_changed(&mut self, rsc, LogicalInsets)`**,
+  a default-no-op hook called from `render()` exactly when
+  `AndroidUiState::insets()` changes. Nothing previously consumed
+  `insets().top` at all; a screen with chrome under the status bar
+  implements this to pad it, in the same logical units `content_scale`
+  converts everything else to.
+- **New: `iris_core::WgpuErrorLog`**, installed via `Device::
+  on_uncaptured_error` on the Android device (wgpu's default handler is an
+  unconditional panic outside `UiRenderNode::new`'s own error scopes).
+  Explicit `Arc`-backed value passed to the callback and kept on
+  `AndroidRenderer`, not a global — a caller wanting one on desktop builds
+  its own the same way.
+
+## 2026-09-06: `Len::dp`, physical pixels throughout, the keyboard glyph wipe
+
+Iris's phone report on build a9232ac (screenshots): text now the right
+size but blurry; the keyboard still wipes every glyph; the header buttons
+have nothing behind them. All three are fixed; this entry is the public
+API side. docs/LAYOUT.md has the layout-side writeup, docs/RUST.md's P0
+box has the full investigation and the phone verification still to do.
+
+- **The keyboard wipe was `surface_changed` rebuilding the whole renderer
+  on every resize**, including an IME-driven one — a fresh, empty glyph
+  atlas while the CPU-side glyph cache kept UV coordinates from the old
+  one. `surface_changed` now calls `AndroidRenderer::resize` (reconfigures
+  the surface and window uniform only) when a renderer is already live,
+  and only builds a new one when there genuinely isn't one yet.
+- **`Len` has a third field, `dp`** (Android's dp / CSS's reference pixel,
+  1/160in), beside the existing `abs` (now explicitly *physical* pixels)
+  and `rel`/`rest`. `len_fns::dp`/`Len::dp` construct one, used exactly
+  like `abs`/`rel`/`rest` — `dp(16)` instead of a bare `16` wherever a
+  size should look the same physical size on any density. This is the
+  unit IRIS_TODO.md's "density-independent length unit" item asked for;
+  it replaces the previous stopgap (the whole rendered scene divided by
+  `content_scale` then implicitly stretched back up), which is also what
+  made text blurry — a glyph rasterised at the small, pre-stretch size and
+  then upscaled onto the real framebuffer.
+- **`UiRenderState`/`Painter` gained `density()`/`set_density()`** (physical
+  pixels per dp). Every place a length resolves (`Len::apply_rest`,
+  `Size::to_uivec2`) now takes it; `Span::gap` and `Padding`'s four sides
+  moved from a bare `f32` to `Len` so they take `dp(...)` too. A bare
+  number anywhere is unaffected — still `abs`, physical pixels.
+- **Text is rasterised at physical resolution now.** `TextBuffer::shape`
+  takes `density` and multiplies `font_size`/`line_height` (and any span
+  override) by it before handing them to parley, so the atlas holds a
+  bitmap at the size it is actually shown at rather than a low-resolution
+  one stretched afterward.
+- **Everything at the Android boundary is physical pixels now** — window
+  size, touch coordinates, insets (`LogicalInsets` renamed
+  `WindowInsets`). The previous "logical" division by `content_scale` is
+  gone; `content_scale` now feeds `set_density` instead.
+- Not yet verified on Iris's actual phone (this pass had no device) —
+  built and checked on this checkout's emulator only. RUST.md's P0 box
+  says what she should check for: crisp text at two densities, the
+  keyboard no longer wiping, and the header's background.

docs/IRIS_TODO.md

@@ -105,6 +105,51 @@ order and what "done" looks like. Tick and date them in place.
   were exactly the same root cause measured two different ways. Frame 2
   now reports 0 (see the numbers above); not a separate fix.
 
+- [ ] **A read-only text display has no widget of its own — P0's bench
+  report area is a `TextEdit` standing in for one (2026-09-05).** The only
+  way to get selectable text on screen today is `.editable(...)` plus
+  `.attr::<Selectable>(())` (`Selectable` is only implemented for
+  `TextEdit`, `iris/src/attr.rs`), which also makes the field focusable —
+  tapping the bench report opens the soft keyboard over text nothing lets
+  you type into. Harmless for a bench-only debug screen (not fixed this
+  pass), but a real "selectable, not editable" text primitive would
+  remove the keyboard side effect and is worth having before another
+  screen wants the same thing (P1's own transcript rows already read
+  their content from a `TextEdit` for the same reason).
+
+## From the phone, 2026-09-06
+
+Found on Iris's own phone while working RUST.md's P0 box's phone-report
+follow-ups. Recorded here rather than fixed in that pass, so a follow-up
+agent takes them without colliding with that pass's `bench_client.rs`/
+`android/view.rs`/`android/sense.rs` changes.
+
+- [x] **Swiping has no momentum, fixed 2026-09-06.** `List::fling`/
+  `VelocityTracker`/`FlingCalculator` (`iris/src/widget/list.rs`,
+  `iris/src/sense.rs`) -- IRIS.md's 2026-09-06 entry has the full account.
+  Wired through `Selection::drag`'s release path, cancelled by the next
+  touch-down, clamped at the loaded content's start/end. Verified by unit
+  test (fling distance against the closed-form spline result, cancel-on-
+  touch, the clamp), not yet by an on-device or emulator feel-check --
+  that is still open.
+- [x] **Scrolling down sometimes jitters the text, fixed 2026-09-06.**
+  Root-caused by reading `DragArbiter::update`'s `Undecided`-to-`Panning`
+  transition rather than by an on-device trace (no emulator was used this
+  pass): it was the first named suspect, not the second. `self.last` stays
+  at the press origin for every `Undecided` frame (nothing pans while the
+  gesture might still be a selection), so the frame that finally crosses
+  `DRAG_SLOP` returned `Pan(dy)` with `dy` measured from `press_start` --
+  the *whole* pre-threshold drag, applied to the list in one step, however
+  many frames it had taken to get there. Fixed by applying only the
+  excess past `DRAG_SLOP` on that one frame (`dy - DRAG_SLOP.copysign
+  (dy)`), the same "consume the slop, don't replay it" rule Android's own
+  touch handling follows. New regression test,
+  `crossing_the_slop_by_a_little_pans_by_a_little` (`iris/src/sense.rs`).
+  **Not yet done**: an emulator trace of the real per-frame offset
+  confirming this was the whole story on real touch input rather than
+  only the arbiter's own unit tests -- worth a follow-up pass before
+  calling it fully closed.
+
 ## Build
 
 - [x] **Benchmarks**, not unit tests, run on demand (2026-09-05; a
@@ -373,3 +418,35 @@ do not duplicate it there.
   redundant. Decide after the layout change lands, by writing a button
   both ways and keeping the one that is shorter to explain; delete the
   other rather than keeping two ways.
+
+## Build (asked for by Iris, 2026-09-06): a density-independent length unit
+
+- [x] **A third length kind beside relative and pixels, so display scales
+  "just work".** Done 2026-09-06 — `Len::dp`/`len_fns::dp`, resolved
+  against `UiRenderState`/`Painter::density()` at `apply_rest` time; text
+  additionally rasterises at the resolved (physical) size instead of
+  scaling a low-resolution bitmap afterward, which was making text blurry.
+  `Span::gap`/`Padding` moved from `f32` to `Len` so they take `dp(...)`
+  too; transcript-ui's row/composer padding and one example migrated.
+  `em` was not added — nothing in this pass needed a text-relative unit,
+  and `dp`'s own doc says why it and physical pixels are kept as separate
+  fields rather than one the caller pre-multiplies. Not yet verified on
+  Iris's own phone at two densities (this pass had no device) — see
+  docs/RUST.md's P0 box and docs/IRIS.md's 2026-09-06 entry for what to
+  check. Iris's words: "another length type similar to absolute &
+  relative, so instead there would be relative, pixels, and another unit
+  like em or whatever is standard. That way different display scales
+  should just work." Today a length is either a fraction of the parent
+  (`rest`/relative) or physical pixels, and the phone drew 16 px text at
+  roughly a third of its intended size until the P0 fixes applied the
+  display's scale factor globally. That global scale is a stopgap for the
+  benchmark; the real shape is a unit resolved against the display's
+  density at layout time — Android's `dp` / CSS's reference pixel is the
+  standard (1 unit = 1/160 in), with `em` as the text-relative option —
+  so a widget author writes `16.dp()` once and never sees the scale.
+  Done when: `Length` (or whatever the enum is called) has the third
+  variant; every place that resolves a length takes the density; the
+  examples and `transcript-ui` use the new unit for text sizes, padding
+  and control sizes; the emulator at two densities and the phone draw the
+  same layout at the same physical size. After the bench setup is
+  finished, before P1 draws any new screen.

docs/LAYOUT.md

@@ -861,6 +861,58 @@ unspecified rather than getting them wrong:
   conditions, so the remaining slack was accepted rather than chased
   further.
 
+## Density: `Len::dp`, resolved at `apply_rest` time (2026-09-06)
+
+Iris asked for a third length kind beside `abs` (physical pixels) and
+`rel`/`rest` (a fraction of the parent) — IRIS_TODO.md's "density-
+independent length unit" — after the P0 phone pass found 16px text
+drawing at roughly a third size on a real phone. The fix that shipped
+first (RUST.md's P0 box) was a global stopgap: divide the whole window
+into a "logical" coordinate space (physical ÷ `content_scale`) and let
+the shader's NDC mapping stretch it back up onto the real framebuffer.
+That fixed the *size* but not the *sharpness* — a glyph rasterised at the
+small, pre-stretch size and then stretched onto more physical pixels than
+it has texels for is blurry, which is exactly what Iris's next report
+said.
+
+**The fix**: `Len` gained a `dp` field, resolved against a `density: f32`
+(physical pixels per dp) at the one place a `Len` becomes a `UiScalar`
+(`Len::apply_rest`) — `abs + dp * density`. `density` lives on
+`UiRenderState` (`set_density`/`density()`) and `Painter` (`density()`),
+set once from `DisplayMetrics.density` in `android::view::new_peer`; the
+desktop backend has no per-monitor density wired up yet and stays at
+`1.0`. Every layout call site that used to call `.apply_rest()`/
+`.to_uivec2()` now passes `painter.density()` (nine call sites — `Span`,
+`Sized`, `MaxSize`, `Aligned`, `Scroll`, `List::place`, and
+`UiRenderState::reposition` itself). This also meant the Android
+boundary's global logical-space stopgap could come out entirely: window
+size, touch coordinates and insets are physical pixels again, matching
+`AndroidRenderer`'s own swapchain resolution, with `dp` doing the
+per-length work the global divide used to do for everything at once.
+
+**Text is the case that needed more than the `Len` plumbing.** A widget's
+`font_size`/`line_height` are plain `f32`, not routed through `Len` at
+all (there is no sensible `rel`/`rest` for a font size). `TextBuffer::
+shape` now takes `density` directly and multiplies `font_size`/
+`line_height` (and any span override) by it before handing them to
+parley — so the size that reaches both the line-breaker and the
+rasteriser (`TextData::place`, which reads back whatever `shape` set) is
+the display's *physical* size, and the glyph atlas holds a bitmap at the
+resolution it is actually shown at. `GlyphKey.size` already keys on the
+resolved size, so a cache entry is naturally per-physical-size with no
+further change. The one caller with no `Painter` to read density from
+(`TextEditCtx::layout`, cursor movement and hit-testing) reads a second
+copy kept directly on `TextData` (`TextData::density`) instead — an
+accepted duplication rather than threading a `Painter` into every input
+handler for one field, the same tradeoff `AndroidRenderer::content_scale`
+already makes for the Diagnostics page.
+
+**What did not change**: `rel`/`rest` are unaffected (already
+resolution-independent, a fraction of the parent). `Span::gap` and
+`Padding`'s four sides moved from bare `f32` to `Len` so `dp(...)` works
+on them the same as any other size; a bare number is still `abs`,
+physical pixels, unchanged.
+
 ## For IRIS.md
 
 When this lands, copy this entry into `IRIS.md` (newest first):

docs/PLAN.md

@@ -147,12 +147,37 @@ turn.
 
 Spawn: `claude -p --verbose --input-format stream-json --output-format
 stream-json --permission-mode <mode>` in the chosen working directory, plus
-`--model`. Wire-format notes are pinned against CLI 2.1.237 in
-`session/claude.rs`'s module doc: permissions need the hidden
-`--permission-prompt-tool stdio` flag, AskUserQuestion answers ride
-`updatedInput.answers` keyed by question text, and `set_model`/`interrupt`
+`--model` and, where one has been chosen, `--effort`. Wire-format notes are
+pinned against CLI 2.1.237 in `session/claude.rs`'s module doc: permissions
+need the hidden `--permission-prompt-tool stdio` flag, AskUserQuestion answers
+ride `updatedInput.answers` keyed by question text, and `set_model`/`interrupt`
 are control requests.
 
+**The thinking level is settled at launch** (added 2026-09-04, because it is
+the largest saving available on a long session: output is about an eighth of
+what a session costs and thinking is the bulk of output, against the ~1.5% that
+is prose). The CLI's only two setting control requests are `set_model` and
+`set_permission_mode` -- checked against the 2.1.258 binary -- so there is no
+way to ask a running process to think differently. `set_session_effort` is
+therefore shaped like `set_session_cwd` rather than like `set_session_model`:
+it records the level and **stops the process**, and the next message or Start
+launches one that has it. It lives in the session settings dialog beside the
+working directory for that reason, not on the session bar beside the model and
+the mode, which do take effect mid-turn. `None` is a level in its own right --
+the CLI's own default -- so the picker can return to it; a level this app named
+as the default instead would be this app choosing one.
+
+**What a new session starts at is `Config::default_effort`**, applied in
+`spawn_session` rather than filled in by the spawn screen, so it holds for an
+import and a bare API call as well. It is set by the spawn screen's own
+picker, whose label says so: one control, where new sessions are made, rather
+than a settings page for a single value. It is not on a provider, because
+providers are discovered and the next rediscovery would erase it, and not on
+the phone, because a second device would then spawn at a level nobody there
+chose. `GET`/`POST /defaults` carry it, as a struct rather than a bare value
+so the permission mode -- still hardcoded to `auto` on the spawn screen -- can
+move there without a second route.
+
 **`--resume` only ever runs when nothing else has that session open.** That
 is the rule behind the import refusal, the single `ClaudeDriver::launch`
 entry point, and the `Exited` correction below; two CLIs on one session file
@@ -169,10 +194,33 @@ deliberate and easy to undo by accident:
   when the process restarts. That leaves the Claude driver as the odd one
   out rather than this one — the CLI's memory is a cache in front of the same
   transcript. Resolve any inconsistency in this direction.
-- **A llama session on an ssh host is refused.** The model is reached over
-  HTTP and forwarding that port is not built, so refusing beats silently
-  talking to the wrong machine. A transport is "run this" plus "reach this
-  port", and only the first half exists.
+- **A llama session runs on whatever machine its setup names** (2026-09-04,
+  the last of phase 5). A transport is "run this" plus "reach this port", and
+  the second half is `Transport::reserve_port` — the port the server binds
+  *there* and the port that reaches it *here*, the same number locally —
+  carried by `Launch::reaching` onto the connection that already runs the
+  command. `llama-server` binds loopback on the far machine, so nothing is
+  served to its network. The far port is a guess from a range below the
+  ephemeral one, because no portable way to ask a machine for a free port
+  avoids racing the bind anyway; a collision is not silent, since the server
+  fails to bind and the readiness poll reports what its log said.
+- **The model file lives on the machine that serves it** (2026-09-04). Each
+  setup names its own models directory (`SshConfig::models_dir`, default
+  `~/.local/share/ai-app/models` expanded *there*), and a spawn resolves the
+  key on that machine — one round trip answering "at /abs/path" or "missing",
+  so a model that is not there is refused at the spawn rather than becoming a
+  server that never becomes ready. The spawn screen offers
+  `GET /setups/{id}/models`, that machine's list, rather than `GET /models`,
+  which is this backend's downloads. Downloading *to* another machine is
+  deliberately not built: a multi-gigabyte transfer with no progress
+  anywhere, and the file gets there however anything else on that machine
+  did.
+- **The readiness poll watches the process, not only the port.** A model that
+  will not load, a port already taken, a flag an older build does not know:
+  all exit within a second and none will ever answer `/health`, so waiting
+  out the 300s timeout turned the server's own account of the problem into
+  "gave up". The failure carries the tail of `llama-server.log`, which on a
+  remote session is the only copy anybody reading the phone can see.
 
 ### Models (2026-08-28)
 
@@ -203,6 +251,13 @@ deliberate and easy to undo by accident:
   A driver says what to run; something above it turns that into a process.
   Otherwise transport knowledge sits inside a translator whose job is a wire
   format, and every future driver has to remember to do the same.
+- **A forwarded launch gets a pty and every other one does not** (measured
+  2026-09-04). Killing the ssh client ends a CLI because it closes the stdin
+  that CLI is reading; `llama-server` never reads its stdin, so the same kill
+  left it running on the far machine with the model loaded — one orphan per
+  stopped session. With `-tt` the far side takes SIGHUP when the connection
+  goes. Its log then arrives through a line discipline, which nothing parses.
+  `-T` stays everywhere else, where a pty would rewrite the JSONL.
 - **`command -v` follows ssh's non-login PATH**, which is narrower than an
   interactive shell's, so a binary somewhere unusual is invisible to
   discovery. Point `command` at an absolute path.
@@ -499,6 +554,25 @@ rate-limited bucket). Poll at ≥180 s, only while a Claude session exists or
 the usage screen is open, and cache the last answer. It is undocumented, so
 `usage.rs` treats every field as optional and degrades rather than erroring.
 
+**Per provider, not per machine (2026-09-04).** A machine is not what is
+metered; the provider a session runs is. One machine offers echo, the Claude
+CLI and a local model side by side, and only the second spends anything — so
+pairing a session with a snapshot by machine alone drew the CLI's five-hour
+window under every echo session on it, a quota that session cannot spend. A
+session now names its meter (`usageProvider`, from
+`DriverKind::usage_provider`, which `usage::providers_for` reads too, so the
+two lists cannot disagree) and `GET /usage` is matched on machine *and*
+provider. `None` is a session that meters nothing, and the phone draws
+nothing at all for it — not a zero, and not "unknown".
+
+`DriverKind::Echo` names a meter of its own that exists only when a test has
+asked for one: `/usage` in an echo session sets an invented answer
+(`usage::Fixture`), and with none set there is no snapshot and no bar. That
+is what makes those screens' states reachable — a number near the top, a
+window between blocks with no reset time, a machine nobody logged into, one
+that could not be reached — without spending real quota to arrange them,
+which is why none of them had ever been looked at.
+
 **Per machine, not per backend (2026-08-29).** The credential store that
 matters is the one on the machine the session runs on, because that is the
 account being billed — and in the layout this aims at, `ai-server` is on the
@@ -522,6 +596,68 @@ always running. So absent means **not running**, and only a timestamp that
 arrives and cannot be parsed is unknown. `WindowEnd` in `ResetCountdown.kt`
 is the one rule both readers go through.
 
+### Auto-resume (2026-09-05)
+
+**A session may pick itself back up when the account's usage limit lifts.**
+Off unless somebody switched that session to it, because it spends quota the
+moment quota exists and does so with nobody looking — that is not a thing a
+default may decide. It sends one message, `continue` unless another was
+typed, and then it is done; there is no retry loop around the conversation
+itself.
+
+**Running out of quota is a state, not an error.** `Event::LimitReached`
+carries the dialect's reset time where it gave one, and recognising it
+belongs to the driver — the Claude CLI ends the turn with `is_error` and
+`Claude AI usage limit reached|1788546972`, and nothing above the driver
+matches on a string. The transcript draws it as a divider, like a clear or a
+compaction: what a reader scrolling back wants from it is why the
+conversation stops at that line.
+
+**The schedule is a plan to ask, never a plan to send.** Every reset time
+available here is untrustworthy in the direction that matters: the dialect's
+is written when the turn fails, and the endpoint's moves when the window
+does. So the wait ends in a question to `usage.rs`, and only `ok` with no
+window at 100% sends anything. A window still spent reschedules to *its own*
+reset time — which is what makes a limit that lifts later than promised wait
+longer, and one that lifts sooner resume sooner. A meter that cannot be
+asked at all is a longer wait too, never a send: "we could not find out"
+must not be able to produce the same action as "there is room".
+
+Bounded, because something has to be: a day after the limit was hit the wait
+stops and says so in the session's own transcript. A machine that can never
+be asked would otherwise be retried for ever with nothing on screen saying
+so.
+
+The schedule is persisted on the session (`resume: Some(ScheduledResume)`),
+not held in memory: a five-hour window routinely outlasts a backend restart,
+and a wait forgotten across one is a session that silently never comes back.
+`resume.rs` is the top layer — it holds the manager and the monitor and
+neither holds it — which is what lets the decision be a pure function of a
+snapshot and a clock. The pump reports limits downward on a broadcast, for
+the reason `Shared` exists: the pump runs underneath the manager.
+
+**Exercised with echo, never with a real account.** `/limit [minutes]` in an
+echo session reports the same event a real driver does, and `/usage` sets
+what the meter answers — deliberately two commands, because the two
+disagreeing is the state the whole design is about. The loop was driven end
+to end that way on 2026-09-05: the wait moved from the dialect's two minutes
+to the meter's seven when the meter changed its mind, and the message went
+out on the first check after the meter came back under the limit.
+
+### Subagents (2026-09-05)
+
+**A subagent is a second transcript owned by a session, in the same event
+model, with no process and no controls of its own.** Full design and wire
+shape in `SUBAGENTS.md`, kept separate because the app half is being built
+against it in parallel and it is the shared contract between the two. The
+one-paragraph reason: a session's Task-tool helpers already speak the common
+event model on the parent's own stdout (each line carrying
+`parent_tool_use_id`), so giving each one its own small transcript — same
+file format, same paging routes, same SSE stream, reused by addressing rather
+than by copying — costs a routing step in the translator and a registry
+(`session/subagent.rs`) rather than a second session type with a driver, a
+process and a config entry it does not need.
+
 ### HTTP surface
 
 **`routes.rs`'s module doc comment is the table.** REST for actions, one SSE
@@ -800,8 +936,9 @@ Noticed and deliberately not fixed, so they are not re-found from scratch.
 
 Phases 1–3 (the skeleton pipe, the full Claude driver, the usage screen) done
 2026-08-24. Phase 4 (llama.cpp: model browsing, downloads, and `llama-server`
-through its OpenAI-compatible endpoint) and phase 5 (ssh) done 2026-08-28.
-The file explorer and the transcript cache followed in September. What is
+through its OpenAI-compatible endpoint) and phase 5 (ssh) done 2026-08-28,
+except for the remote `llama-server` and its port forward, which landed
+2026-09-04. The file explorer and the transcript cache followed in September. What is
 left is real-phone/WireGuard bring-up, which is operational rather than code.
 
 Each phase ended runnable and verified against the real thing. The backend

docs/bench/compose-phone-2026-09-06.md

@@ -0,0 +1,73 @@
+# Compose bench report from Iris's phone, 2026-09-06
+
+The Compose half of P0 (RUST.md), run by Iris on her own phone and pasted
+back verbatim. The iris half's report goes beside it in this directory
+when it exists. Her caveat, worth keeping with the numbers: "I don't think
+this is entirely fair because the UI for iris is more minimal" -- the
+Compose screen also draws the usage bar, the status row and tool cards,
+which the iris bench screen does not yet. Her impression of the iris build
+before its first-touch bug: "it already feels very smooth so far".
+
+What to read first: the phone runs at 120 Hz, so the budget is 8.3 ms;
+`late` is measured against that. Compose's tail is the streaming phase --
+`markdown reparsed while streaming: 396, 8.5ms mean, 25.8ms worst` and
+`record: one block: 398, 6.3ms mean, 19.9ms worst` -- which is exactly the
+path iris's `TranscriptScreen::apply` (replace the last row only) is meant
+to beat. Process CPU over the run is 20.9 s of a 38.5 s run; peak RSS
+587 MB; battery current mean 419 mA.
+
+```
+ai-app render report
+device: Pixel 9 Pro XL (Google), Android 17
+build: release
+
+transcript:
+  43 events, 41 rows, 93 units loaded
+  viewport 1333px, 2 units visible
+  on screen: the list's own 0px, AssistantMsg 24520px
+  0 tool calls and 0 groups open
+
+frames:
+  1613 frames over 38.5s at 120Hz (8.3ms budget)
+  late: 742 (46.0%)
+  total  p50 7.7ms  p90 29.2ms  p99 41.1ms
+  waited p50 0.5ms  p90 12.9ms  p99 27.2ms
+  input  p50 0.0ms  p90 0.0ms  p99 0.0ms
+  anim   p50 1.1ms  p90 5.8ms  p99 9.5ms
+  layout p50 0.0ms  p90 0.1ms  p99 0.2ms
+  draw   p50 0.4ms  p90 15.9ms  p99 27.9ms
+  sync   p50 0.1ms  p90 0.5ms  p99 1.0ms
+  issue  p50 1.1ms  p90 1.7ms  p99 3.0ms
+  swap   p50 0.4ms  p90 0.5ms  p99 0.7ms
+  gpu    p50 1.8ms  p90 2.1ms  p99 6.6ms
+
+where the draw phase went:
+  draw phase 3.83ms per frame, of which:
+    the transcript: 0.25ms (measure 0.15, place 0.10, record 0.00)
+    everything else: 3.58ms (93%)
+
+work since this was last copied:
+  draw: the whole transcript: 12, 0.2ms total, 0.0ms mean, 0.0ms worst
+  grouped tool runs: 398, 10.3ms total, 0.0ms mean, 0.1ms worst
+  markdown cut into pieces: 1, 0.0ms total, 0.0ms mean, 0.0ms worst
+  markdown parsed while composing: 7, 3.0ms total, 0.4ms mean, 0.5ms worst
+  markdown ready: 46
+  markdown reparsed while streaming: 396, 3384.6ms total, 8.5ms mean, 25.8ms worst
+  markdown warmed: 1, 1.4ms total, 1.4ms mean, 1.4ms worst
+  measure: the whole transcript: 957, 248.7ms total, 0.3ms mean, 15.7ms worst
+  message composed: 403
+  message cut into parts: 1, 0.1ms total, 0.1ms mean, 0.1ms worst
+  place: the whole transcript: 1319, 162.4ms total, 0.1ms mean, 1.3ms worst
+  record: one block: 398, 2498.7ms total, 6.3ms mean, 19.9ms worst
+  session screen recomposed: 413
+  status row recomposed: 1
+  unit composed: 538
+  units flattened: 399, 44.3ms total, 0.1ms mean, 0.5ms worst
+  usage bar recomposed: 413
+
+bench:
+  scroll: 6 cycles (24 swipes), streamed 400/400 fixture events
+  process CPU time over this run: 20907ms
+  peak RSS: 587356kB
+  battery current: mean -418509µA over 39 samples (min -1988281, max -107812)
+```

docs/bench/compose-phone-v2-2026-09-06.md

@@ -0,0 +1,93 @@
+# Compose bench v2 report from Iris's phone, 2026-09-06
+
+Bench v2 (fling / stream / type / keyboard, RUST.md's P0 box) on the
+Compose `bench` build, run by Iris on her Pixel 9 Pro XL, verbatim. Note
+the display was at **60 Hz** for this run (16.7 ms budget) where the v1
+run was at 120 Hz -- the phone's adaptive refresh rate decides, and
+`late` is judged against whichever it was, so compare a run with a run at
+the same rate. The iris v2 report goes beside this when it exists.
+
+What it says: fling, type and keyboard are all essentially clean on
+Compose (0.1%, 0.9% and 0% late; fling p50 5.5 ms, p99 11.6 ms). The
+whole tail is the streaming phase again -- 41.9% late, p99 42.5 ms,
+driven by `markdown reparsed while streaming` (8.6 ms mean, 30.3 ms
+worst) and `record: one block` (6.3 ms mean, 25.5 ms worst). Process CPU
+69.6 s over the 125.5 s run; peak RSS 577 MB; battery current mean
+571 mA over 126 samples.
+
+```
+ai-app render report
+device: Pixel 9 Pro XL (Google), Android 17
+build: release
+
+transcript:
+  108 events, 26 rows, 58 units loaded
+  viewport 1531px, 2 units visible
+  on screen: the list's own 0px, AssistantMsg 24520px
+  0 tool calls and 0 groups open
+
+per phase:
+  fling: 3278 frames over 32.7s
+    late: 4 (0.1%)
+      total  p50 5.5ms  p90 8.7ms  p99 11.6ms
+    worst 49.0ms
+  stream: 1041 frames over 21.3s
+    late: 436 (41.9%)
+      total  p50 13.4ms  p90 31.7ms  p99 42.5ms
+    worst 52.5ms
+  type: 2446 frames over 61.5s
+    late: 23 (0.9%)
+      total  p50 7.3ms  p90 13.2ms  p99 16.5ms
+    worst 38.9ms
+  keyboard: 358 frames over 10.0s
+    late: 0 (0.0%)
+      total  p50 6.3ms  p90 8.6ms  p99 11.1ms
+    worst 12.0ms
+
+frames:
+  7122 frames over 125.5s at 60Hz (16.7ms budget)
+  late: 463 (6.5%)
+  total  p50 6.0ms  p90 13.8ms  p99 34.0ms
+  waited p50 0.5ms  p90 1.1ms  p99 19.9ms
+  input  p50 0.0ms  p90 0.0ms  p99 0.0ms
+  anim   p50 0.7ms  p90 4.5ms  p99 7.6ms
+  layout p50 0.1ms  p90 0.1ms  p99 0.2ms
+  draw   p50 0.7ms  p90 2.9ms  p99 21.9ms
+  sync   p50 0.1ms  p90 0.2ms  p99 0.6ms
+  issue  p50 1.4ms  p90 2.4ms  p99 3.2ms
+  swap   p50 0.4ms  p90 0.8ms  p99 1.2ms
+  gpu    p50 1.5ms  p90 2.1ms  p99 6.6ms
+
+where the draw phase went:
+  draw phase 1.74ms per frame, of which:
+    the transcript: 0.24ms (measure 0.10, place 0.14, record 0.00)
+    everything else: 1.51ms (86%)
+
+work since this was last copied:
+  draw: the whole transcript: 280, 1.9ms total, 0.0ms mean, 0.0ms worst
+  grouped tool runs: 407, 18.6ms total, 0.0ms mean, 0.2ms worst
+  markdown cut into pieces: 40, 0.4ms total, 0.0ms mean, 0.0ms worst
+  markdown parsed while composing: 2, 1.6ms total, 0.8ms mean, 1.1ms worst
+  markdown ready: 323
+  markdown reparsed while streaming: 395, 3406.9ms total, 8.6ms mean, 30.3ms worst
+  markdown warmed: 40, 38.2ms total, 1.0ms mean, 4.3ms worst
+  measure: the whole transcript: 1978, 683.9ms total, 0.3ms mean, 15.9ms worst
+  message composed: 397
+  message cut into parts: 40, 2.9ms total, 0.1ms mean, 0.2ms worst
+  place: the whole transcript: 4308, 996.0ms total, 0.2ms mean, 2.4ms worst
+  record: one block: 394, 2472.7ms total, 6.3ms mean, 25.5ms worst
+  session screen recomposed: 1630
+  status row recomposed: 1
+  transcript page from server: 10
+  unit composed: 927
+  units flattened: 408, 85.5ms total, 0.2ms mean, 1.8ms worst
+
+bench:
+  fling: 8 flings out + 8 back at 12000px/s, travel start=idx=0/off=0px outward=idx=188/off=182px end=idx=0/off=0px
+  scroll: 6 cycles (24 swipes, legacy tween), streamed 400/400 fixture events
+  type: 600 characters inserted then deleted, one per 50ms
+  keyboard: shown 5/5, hidden 5/5 (confirmed via isImeVisible)
+  process CPU time over this run: 69564ms
+  peak RSS: 577452kB
+  battery current: mean -571483µA over 126 samples (min -2361718, max -99218)
+```

docs/bench/iris-phone-2026-09-06-before-fixes.md

@@ -0,0 +1,31 @@
+# iris bench report from Iris's phone, 2026-09-06, before the phone fixes
+
+Build 46246ea (Vulkan, bench v1: 24-swipe scroll loop then 400 streamed
+events), run by Iris on her Pixel 9 Pro XL before the first-touch wipe,
+the missing bold faces, the density scale and the status-bar inset were
+fixed -- so the rows were drawn at roughly a third of their intended size
+and the run may have included frames after the wipe. Preliminary, kept
+because it is the first iris number from real hardware. Compare with
+`compose-phone-2026-09-06.md`, taken on the same phone with the same
+fixture and gesture loop.
+
+Reading it: the phone is 120 Hz (8.3 ms budget). `janky%` here counts
+frames over 16.7 ms, so it is not Compose's `late` (over 8.3 ms). Like for
+like: iris p50 6.2 ms vs Compose 7.7 ms; p90 32.0 vs 29.2; p99 42.1 vs
+41.1. `cpu_p50=4.7ms` is iris's own per-frame CPU work on the phone,
+against 0.2-0.4 ms on the emulator's x86 cores. Process CPU 15.6 s vs
+20.9 s, but over a shorter run (692 frames vs 1613 -- iris only renders on
+change and had no fling settle time), so per-second CPU is not directly
+comparable; peak RSS 365 MB vs 587 MB. Battery current mean 563 mA vs
+419 mA is the one figure that reads worse, and it is the least
+comparable: 22 samples vs 39, over runs of different length and different
+idle share. Bench v2's per-phase accounting is what makes these comparable.
+
+```
+iris bench report
+frames=692 janky%=32.37 p50=6.2ms p90=32.0ms p99=42.1ms worst=52.6ms (measures redraw-start to after present() is called, not GPU/compositor completion) cpu_p50=4.7ms gpu_wait_p50=1.3ms (redraw-start-to-submit vs. submit-to-after-present)
+  scroll: 6 cycles (24 swipes), streamed 400/400 fixture events
+  process CPU time over this run: 15554ms
+  peak RSS: 365328kB
+  battery current: mean -563493µA over 22 samples (min -1807812, max -132812)
+```

event-model/src/lib.rs

@@ -305,6 +305,25 @@ pub enum Event {
     /// it, which is why this is written down rather than left to be inferred
     /// from a second example that does not exist.
     Cleared,
+    /// The account behind this session has no quota left, so the turn stopped
+    /// without finishing.
+    ///
+    /// Its own event rather than an [`Event::Error`] carrying the dialect's
+    /// sentence, because two things act on it that cannot read English: the
+    /// transcript draws it as a state the session is in rather than as a
+    /// failure of something it did, and `crate::resume` schedules the message
+    /// that picks the work back up. Recognising it belongs to the driver, which
+    /// is the only layer that knows its dialect's wording -- above here nothing
+    /// matches on strings.
+    ///
+    /// `resets_at` is epoch seconds, and `None` is a real state: the dialect
+    /// said the limit was hit without saying when it lifts. Nothing here
+    /// invents one -- what the wait is actually decided against is the usage
+    /// endpoint, and this is the hint that starts the waiting.
+    LimitReached {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        resets_at: Option<f64>,
+    },
     Error {
         message: String,
     },

iris/Cargo.lock

@@ -1757,6 +1757,7 @@ dependencies = [
  "fxhash",
  "image",
  "parley",
+ "pollster",
  "swash",
  "wgpu",
 ]

iris/android-app/Cargo.lock

@@ -1768,9 +1768,11 @@ dependencies = [
  "client-core",
  "event-model",
  "iris",
+ "libc",
  "log",
  "serde_json",
  "tabs-ui",
+ "tokio",
  "transcript-ui",
 ]
 
@@ -1783,6 +1785,7 @@ dependencies = [
  "fxhash",
  "image",
  "parley",
+ "pollster",
  "swash",
  "wgpu",
 ]

iris/android-app/Cargo.toml

@@ -32,6 +32,23 @@ transcript-ui = { path = "../transcript-ui", optional = true }
 client-core = { path = "../../client-core", optional = true }
 event-model = { path = "../../event-model", optional = true }
 serde_json = { version = "1", features = ["float_roundtrip"], optional = true }
+# P0's bench build only (docs/RUST.md): `getrusage(RUSAGE_SELF)` for
+# process CPU time, matching `libc::getrusage`'s mention in that box over
+# parsing `/proc/self/stat` by hand and assuming `USER_HZ`. Already in the
+# workspace's own dependency tree transitively (`iris/Cargo.lock`, pinned
+# at 0.2.179) -- this makes it a direct dependency at the same version
+# rather than a second, possibly-drifting resolution.
+libc = { version = "0.2.179", optional = true }
+# P0's bench build only: the scroll animation and the streaming phase are
+# both a sequence of `sleep`s inside the async task `rsc.spawn_task` already
+# runs on iris's own tokio runtime (`iris/src/task.rs`'s `Tasks::init`), and
+# the battery sampler is a second, concurrent task on that same runtime
+# (`tokio::spawn`) -- so this crate needs `tokio` directly rather than only
+# through `iris`. `rt`+`time` only: no I/O, no macros, nothing this crate
+# doesn't call. Version matches the one `iris`'s own dependency tree already
+# resolves to (`iris/Cargo.lock`), so there is one copy of the runtime, not
+# two.
+tokio = { version = "1.53.1", features = ["rt", "time"], optional = true }
 
 [features]
 default = ["tabs-screen"]
@@ -41,6 +58,14 @@ transcript-screen = ["dep:transcript-ui", "dep:client-core", "dep:event-model",
 # instead of SwiftShader's software Vulkan. See `iris/Cargo.toml`'s own doc
 # on the feature this forwards to.
 force-gles = ["iris/force-gles"]
+# P0's iris half (docs/RUST.md, docs/AGENTS.md's "The rigs"): the same
+# checked-in fixture, scroll loop and streaming phase the Compose `bench`
+# build type drives, run here against `transcript-ui`'s real screen with no
+# server. Depends on `transcript-screen` for `transcript-ui`/`client-core`/
+# `event-model` -- `lib.rs`'s `ActiveClient` selection gives this feature
+# priority over `transcript-screen`'s own `TranscriptClient` when both are
+# listed, which is how this crate's build command names both explicitly.
+bench = ["transcript-screen", "dep:libc", "dep:tokio"]
 
 [profile.release]
 panic = "abort"

iris/android-app/app/build.gradle

@@ -19,9 +19,39 @@ android {
         versionName = "1.0"
     }
 
+    // A release build must be signed, and the key is per machine rather than per repo -- same
+    // reasoning and the same key as `app/build-apk.sh` (the Compose app): it is what a phone
+    // recognises the app by, and a secret never lives in a checkout (the mount is shared with an
+    // untrusted VM). `build-apk.sh` generates this key once and points at it through the
+    // environment; without it a release build here is unsigned, which is fine for everything
+    // except installing.
+    def keystore = System.getenv("AI_APP_KEYSTORE")
+    signingConfigs {
+        if (keystore != null) {
+            release {
+                storeFile = file(keystore)
+                storePassword = System.getenv("AI_APP_KEYSTORE_PASSWORD")
+                keyAlias = "ai-app"
+                keyPassword = storePassword
+            }
+        }
+    }
+
     buildTypes {
         debug {
         }
+        // P0's iris half (docs/RUST.md's P0 box): the build a phone actually runs. The `.so`
+        // itself is built separately with `cargo ndk --release --features "transcript-screen
+        // force-gles bench"` straight into src/main/jniLibs/ (this crate's own Cargo.toml) --
+        // Gradle here only packages and signs whatever is already there, the same division as the
+        // debug/tabs-screen build this project started with. `applicationIdSuffix` keeps it
+        // installable beside a debug build of the tabs demo rather than replacing it.
+        release {
+            applicationIdSuffix ".bench"
+            if (keystore != null) {
+                signingConfig = signingConfigs.release
+            }
+        }
     }
 
     compileOptions {

iris/android-app/app/src/main/java/dev/iris/android/demo/IrisView.java

@@ -1,6 +1,17 @@
 package dev.iris.android.demo;
 
+import android.app.Activity;
+import android.content.ClipData;
+import android.content.ClipboardManager;
 import android.content.Context;
+import android.view.Gravity;
+import android.view.View;
+import android.view.ViewGroup;
+import android.widget.Button;
+import android.widget.FrameLayout;
+import android.widget.LinearLayout;
+import android.widget.ScrollView;
+import android.widget.TextView;
 
 import org.linebender.android.rustview.RustView;
 
@@ -33,4 +44,112 @@ public final class IrisView extends RustView {
         unregisterInsetsNative(mViewPeer);
         super.onDetachedFromWindow();
     }
+
+    /**
+     * Called from the Rust side (iris/src/android/view.rs's
+     * `show_renderer_error`) when `AndroidRenderer::new` fails instead of
+     * drawing -- an ordinary instance method rather than a `native` one,
+     * since this call is Rust reaching into Java rather than the other
+     * direction. Replaces the whole activity content with plain,
+     * selectable, scrollable text rather than leaving the last frame (or a
+     * blank surface) on screen with no way to report what happened:
+     * UI_RULES.md's "a failure is reported where it happened, and says
+     * what to do next." No dialog and no styling beyond what is needed to
+     * read and copy the text -- this path exists for exactly the crash it
+     * replaces, so it must not depend on anything that could itself fail
+     * to render.
+     */
+    void showRendererError(String report) {
+        Context context = getContext();
+        if (!(context instanceof Activity)) {
+            return;
+        }
+        Activity activity = (Activity) context;
+        TextView text = new TextView(activity);
+        text.setText(report);
+        text.setTextIsSelectable(true);
+        text.setGravity(Gravity.TOP | Gravity.START);
+        int pad = (int) (16 * activity.getResources().getDisplayMetrics().density);
+        text.setPadding(pad, pad, pad, pad);
+        ScrollView scroll = new ScrollView(activity);
+        scroll.addView(text);
+        activity.setContentView(scroll);
+    }
+
+    private static final String DIAGNOSTICS_OVERLAY_TAG = "iris-diagnostics-overlay";
+
+    /**
+     * The bench build's keyboard diagnostics capture
+     * (`bench_client.rs`'s `on_insets_changed` /
+     * `capture_keyboard_diagnostics`, via `bench_jni.rs`'s
+     * `PlatformHandle::show_diagnostics_overlay`): unlike
+     * `showRendererError` above, this adds a panel *over* this view
+     * (`MainActivity`'s `FrameLayout` still holds `IrisView` underneath,
+     * running) rather than replacing the activity's content, and gives it
+     * a Copy button and a Close that removes the panel -- so it draws
+     * (and can be read) whether or not iris itself is still putting
+     * anything on screen, without abandoning the session that produced
+     * it. Runs on the UI thread regardless of which thread calls it,
+     * since the call comes from a background task (a delayed capture
+     * after the keyboard opens), and touching the view tree off the UI
+     * thread is undefined.
+     */
+    void showDiagnosticsOverlay(String report) {
+        Context context = getContext();
+        if (!(context instanceof Activity)) {
+            return;
+        }
+        Activity activity = (Activity) context;
+        activity.runOnUiThread(() -> {
+            ViewGroup parent = (ViewGroup) getParent();
+            if (parent == null) {
+                return;
+            }
+            View existing = parent.findViewWithTag(DIAGNOSTICS_OVERLAY_TAG);
+            if (existing != null) {
+                parent.removeView(existing);
+            }
+
+            float density = activity.getResources().getDisplayMetrics().density;
+            int pad = (int) (16 * density);
+
+            LinearLayout overlay = new LinearLayout(activity);
+            overlay.setTag(DIAGNOSTICS_OVERLAY_TAG);
+            overlay.setOrientation(LinearLayout.VERTICAL);
+            overlay.setBackgroundColor(0xEE000000);
+            overlay.setPadding(pad, pad, pad, pad);
+
+            TextView text = new TextView(activity);
+            text.setText(report);
+            text.setTextIsSelectable(true);
+            text.setTextColor(0xFFFFFFFF);
+            ScrollView scroll = new ScrollView(activity);
+            scroll.addView(text);
+            overlay.addView(scroll, new LinearLayout.LayoutParams(
+                    LinearLayout.LayoutParams.MATCH_PARENT, 0, 1f));
+
+            LinearLayout buttonRow = new LinearLayout(activity);
+            buttonRow.setOrientation(LinearLayout.HORIZONTAL);
+            buttonRow.setPadding(0, pad, 0, 0);
+
+            Button copy = new Button(activity);
+            copy.setText("Copy");
+            copy.setOnClickListener(v -> {
+                ClipboardManager clipboard =
+                        (ClipboardManager) activity.getSystemService(Context.CLIPBOARD_SERVICE);
+                if (clipboard != null) {
+                    clipboard.setPrimaryClip(ClipData.newPlainText("iris diagnostics", report));
+                }
+            });
+            Button close = new Button(activity);
+            close.setText("Close");
+            close.setOnClickListener(v -> parent.removeView(overlay));
+            buttonRow.addView(copy);
+            buttonRow.addView(close);
+            overlay.addView(buttonRow);
+
+            parent.addView(overlay, new FrameLayout.LayoutParams(
+                    FrameLayout.LayoutParams.MATCH_PARENT, FrameLayout.LayoutParams.MATCH_PARENT));
+        });
+    }
 }

iris/android-app/build-apk.sh

@@ -0,0 +1,90 @@
+#!/bin/sh
+# Builds iris-android-app end to end: the cdylib (cargo ndk, straight into
+# app/src/main/jniLibs/) then the APK (Gradle). Written to stop re-typing
+# the same incantation by hand every time (ANDROID_HOME/NDK exports, the
+# cargo ndk invocation, the keystore env for a release build, apksigner/
+# aapt2 verification) -- see docs/RUST.md's P0 box. Same shape as `app/
+# build-apk.sh` (the Compose app's own build script) and `app/
+# iris-scroll.sh` (no coordinates, set -eu, exit 0 on success).
+#
+# Usage: ./build-apk.sh [debug|release] [--abi arm64-v8a|x86_64] [--features "a b c"]
+#   debug/release default to debug (matches this-machine-android's "the
+#   emulator stays on debug" rule -- pass `release` explicitly for a phone
+#   build). --abi defaults to arm64-v8a (a phone/real device); pass
+#   x86_64 for this checkout's own AVD. --features defaults to
+#   "transcript-screen bench" -- deliberately *without* `force-gles`, unlike
+#   an earlier version of this default. `force-gles` (`iris/Cargo.toml`'s
+#   own doc) exists only to force the emulator off its default software
+#   Vulkan and onto GLES for one specific measurement (RUST.md's I5, "Where
+#   iris's frame time goes") -- it was never meant to reach a real device,
+#   but this script's old default put it in every arm64 build regardless,
+#   so the P0 bench APK delivered to Iris's phone forced GLES there too.
+#   That is the named hypothesis in RUST.md's P0 box ("iris bench crash on
+#   the phone, 2026-09-06"): a real Vulkan driver is what a phone should
+#   run, and GLES is the backend the same box's own SwiftShader finding
+#   already flagged as the fragile one for this shader's storage buffers.
+#   Pass `--features "transcript-screen force-gles bench"` explicitly for
+#   an emulator backend-isolation run; never for a build meant for a phone.
+set -eu
+cd "$(dirname "$0")"
+
+BUILD_TYPE="debug"
+ABI="arm64-v8a"
+FEATURES="transcript-screen bench"
+case "${1:-}" in
+    debug|release) BUILD_TYPE="$1"; shift ;;
+esac
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --abi) ABI="$2"; shift 2 ;;
+        --features) FEATURES="$2"; shift 2 ;;
+        *) echo "build-apk.sh: unknown argument: $1" >&2; exit 1 ;;
+    esac
+done
+
+SDK_ROOT="$HOME/Android/Sdk"
+export ANDROID_HOME="$SDK_ROOT"
+export ANDROID_SDK_ROOT="$SDK_ROOT"
+NDK_DIR=$(ls -d "$SDK_ROOT"/ndk/*/ 2>/dev/null | sort -V | tail -1)
+if [ -z "$NDK_DIR" ]; then
+    echo "build-apk.sh: no NDK found under $SDK_ROOT/ndk" >&2
+    exit 1
+fi
+export ANDROID_NDK_HOME="$NDK_DIR"
+
+echo "build-apk.sh: cargo ndk -t $ABI build ${BUILD_TYPE:+(${BUILD_TYPE})} --features \"$FEATURES\""
+if [ "$BUILD_TYPE" = "release" ]; then
+    cargo ndk -t "$ABI" -P 26 -o app/src/main/jniLibs/ build --release --features "$FEATURES"
+else
+    cargo ndk -t "$ABI" -P 26 -o app/src/main/jniLibs/ build --features "$FEATURES"
+fi
+
+GRADLE_TASK="assembleDebug"
+APK_DIR="app/build/outputs/apk/debug"
+APK_NAME="app-debug.apk"
+if [ "$BUILD_TYPE" = "release" ]; then
+    GRADLE_TASK="assembleRelease"
+    APK_DIR="app/build/outputs/apk/release"
+    APK_NAME="app-release.apk"
+    # Same key `app/build-apk.sh` (the Compose app) generates once under
+    # ~/.config/ai-app/release.jks -- see AGENTS.md's "Checking your work".
+    export AI_APP_KEYSTORE="$HOME/.config/ai-app/release.jks"
+    if [ ! -f "$AI_APP_KEYSTORE" ]; then
+        echo "build-apk.sh: no release key at $AI_APP_KEYSTORE -- run app/build-apk.sh once first" >&2
+        exit 1
+    fi
+    export AI_APP_KEYSTORE_PASSWORD
+    AI_APP_KEYSTORE_PASSWORD=$(cat "$AI_APP_KEYSTORE.password")
+fi
+
+gradle ":app:$GRADLE_TASK" --console=plain
+
+APK_PATH="$(pwd)/$APK_DIR/$APK_NAME"
+BUILD_TOOLS=$(ls -d "$SDK_ROOT"/build-tools/*/ | sort -V | tail -1)
+echo "--- aapt2 dump badging ---"
+"${BUILD_TOOLS}aapt2" dump badging "$APK_PATH" | head -5
+if [ "$BUILD_TYPE" = "release" ]; then
+    echo "--- apksigner verify ---"
+    "${BUILD_TOOLS}apksigner" verify --print-certs "$APK_PATH"
+fi
+echo "$APK_PATH"

iris/android-app/build.rs

@@ -22,6 +22,14 @@ fn main() {
     if std::env::var_os("CARGO_FEATURE_TRANSCRIPT_SCREEN").is_none() {
         return;
     }
+    // P0's bench build (docs/RUST.md) opens the checked-in fixture with no
+    // server at all -- `bench_client.rs` never references the `pinned`
+    // module this generates, so requiring a live server's host/port/token/
+    // CA to build it (as plain `transcript-screen` does, below) would be a
+    // pointless requirement for a build that talks to nothing.
+    if std::env::var_os("CARGO_FEATURE_BENCH").is_some() {
+        return;
+    }
     println!("cargo:rerun-if-env-changed=AI_APP_TRANSCRIPT_HOST");
     println!("cargo:rerun-if-env-changed=AI_APP_TRANSCRIPT_PORT");
     println!("cargo:rerun-if-env-changed=AI_APP_TRANSCRIPT_TOKEN");

iris/android-app/run-bench.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+# Installs and runs the iris `bench` build on this checkout's own emulator
+# (per this-machine-android's per-checkout-AVD rule; `emu serial` picks it)
+# and prints the report -- the iris half of `app/transcript-bench.sh`'s
+# job. No coordinates: the button is found by its accessibility label
+# through `ui-trace`, per AGENTS.md's "Driving the UI".
+#
+# Usage: ./run-bench.sh [--apk PATH]
+#   Defaults to this checkout's own release APK
+#   (app/build/outputs/apk/release/app-release.apk) if it exists, else the
+#   debug one -- build one first with ./build-apk.sh.
+set -eu
+cd "$(dirname "$0")"
+
+APK=""
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --apk) APK="$2"; shift 2 ;;
+        *) echo "run-bench.sh: unknown argument: $1" >&2; exit 1 ;;
+    esac
+done
+if [ -z "$APK" ]; then
+    if [ -f app/build/outputs/apk/release/app-release.apk ]; then
+        APK=app/build/outputs/apk/release/app-release.apk
+    else
+        APK=app/build/outputs/apk/debug/app-debug.apk
+    fi
+fi
+if [ ! -f "$APK" ]; then
+    echo "run-bench.sh: no APK at $APK -- run ./build-apk.sh first" >&2
+    exit 1
+fi
+
+SERIAL=$(emu serial)
+PKG=$(aapt2 dump badging "$APK" 2>/dev/null | sed -n "s/^package: name='\\([^']*\\)'.*/\\1/p")
+if [ -z "$PKG" ]; then
+    BUILD_TOOLS=$(ls -d "$HOME"/Android/Sdk/build-tools/*/ | sort -V | tail -1)
+    PKG=$("${BUILD_TOOLS}aapt2" dump badging "$APK" | sed -n "s/^package: name='\\([^']*\\)'.*/\\1/p")
+fi
+
+echo "run-bench.sh: installing $APK ($PKG) on $SERIAL"
+adb -s "$SERIAL" install -r "$APK" >/dev/null
+adb -s "$SERIAL" shell am force-stop "$PKG"
+adb -s "$SERIAL" logcat -c
+adb -s "$SERIAL" shell am start -n "$PKG/dev.iris.android.demo.MainActivity" >/dev/null
+
+ui-trace record -s "$SERIAL" -d 3000 --do "tap 'Run benchmark'" -o /tmp/run-bench-tap.txt >/dev/null
+
+# Poll for the report line rather than a fixed sleep -- the run itself is a
+# fixed script (24 swipes + a 20s streaming phase) but device speed varies.
+i=0
+while [ "$i" -lt 90 ]; do
+    LINE=$(adb -s "$SERIAL" logcat -d -s iris-android-app:I 2>/dev/null | grep "iris bench report:" || true)
+    if [ -n "$LINE" ]; then
+        break
+    fi
+    i=$((i + 1))
+    sleep 1
+done
+if [ -z "$LINE" ]; then
+    echo "run-bench.sh: no report after 90s -- check logcat by hand" >&2
+    exit 1
+fi
+adb -s "$SERIAL" logcat -d -s iris-android-app:I | grep -A 6 "iris bench report:"

iris/android-app/src/bench_client.rs

@@ -0,0 +1,609 @@
+//! P0's iris half (docs/RUST.md's P0 box, docs/AGENTS.md's "The rigs"):
+//! the same fixture, scroll loop and streaming phase the Compose `bench`
+//! build type's `BenchRun.kt`/`BenchFixture.kt` drive, run here against
+//! `transcript-ui`'s real screen with no server -- a frame-time comparison
+//! that measures the renderer rather than the data or the network.
+//!
+//! **Reuses `transcript_client.rs`'s shape** (folded items, the same
+//! `TranscriptScreen::apply` incremental update on every event) with the
+//! network half replaced by the checked-in fixture, embedded with
+//! `include_str!` -- `app/bench-fixture/assets/transcript.jsonl`,
+//! 1,915,760 bytes, generated by `app/bench-fixture/generate.py` and never
+//! a real transcript (that file's own README). The first 3,200 lines are
+//! the opening backlog, folded once through
+//! `client_core::transcript_fold::fold_page` exactly as a real
+//! `/transcript` page would be (then a full `transcript_ui::build_tree`,
+//! same as any first load); the remaining ~400 are the streaming tail,
+//! replayed one at a time through `fold_event` -- the same fold path a
+//! live SSE reply arrives on -- by the "Run benchmark" control below.
+//! Streaming through `apply` rather than a full rebuild per event is what
+//! this file exists to measure -- see docs/RUST.md's P0 box for the
+//! before/after report.
+
+use crate::bench_jni::PlatformHandle;
+use android_view::jni::{JavaVM, objects::GlobalRef};
+use client_core::transcript_fold::{TranscriptItem, fold_event, fold_page, group_tool_runs};
+use event_model::SeqEvent;
+use iris::android::{AndroidAppState, AndroidRsc, AndroidUiState, HasAndroidUiState};
+use iris::prelude::*;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::Duration;
+
+/// bench-fixture/README.md: the first `BACKLOG_COUNT` non-blank lines are
+/// the opening window; the rest are the streaming tail. Kept in sync with
+/// `BenchFixture.kt`'s identical constant by hand -- both read the same
+/// checked-in file, so a mismatch would only mean the two apps' bench
+/// builds open a different split of it, not a wrong-vs-right answer.
+const BACKLOG_COUNT: usize = 3200;
+
+/// `BenchRun.kt`'s own constants -- kept identical so the two apps' bench
+/// runs are the same gesture and the same load, which is the entire point
+/// of a shared fixture and a shared scripted loop (P0's pass condition).
+const CYCLES: usize = 6;
+const SWIPE_PX: f32 = 900.0;
+const SWIPE_MS: u64 = 200;
+const SWIPE_PAUSE_MS: u64 = 500;
+const STREAM_EVENTS_PER_SEC: u64 = 20;
+const STREAM_SECONDS: u64 = 20;
+/// One animation step's target cadence -- close enough to 60Hz that a
+/// `List::scroll` swipe is many small moves rather than one jump, so
+/// frames are actually rendered along the way (the point of animating it
+/// at all rather than calling `scroll` once per swipe).
+const ANIM_STEP_MS: u64 = 16;
+
+const FIXTURE_JSONL: &str = include_str!("../../../app/bench-fixture/assets/transcript.jsonl");
+
+pub struct BenchClient {
+    ui_state: AndroidUiState,
+    content: WeakWidget<WidgetPtr>,
+    report_display: WeakWidget<TextEdit>,
+    /// The top button row, in a `WidgetPtr` slot rather than added
+    /// directly (like `content`) so `on_insets_changed` can swap in a
+    /// version padded for the status bar once insets are known -- RUST.md's
+    /// P0 box, "the status-bar inset is not applied," found the row sitting
+    /// directly under it because nothing here read `insets().top` at all.
+    top_bar: WeakWidget<WidgetPtr>,
+    screen: Option<transcript_ui::TranscriptScreen>,
+    items: Vec<TranscriptItem>,
+    /// The events not yet streamed -- consumed by `start_benchmark`'s own
+    /// clone, kept here only as the source a second run would need (the
+    /// button can be pressed more than once; `running` just stops overlap,
+    /// not repeat).
+    stream_tail: Vec<SeqEvent>,
+    platform: Option<Arc<PlatformHandle>>,
+    last_report: Option<String>,
+    running: bool,
+    /// Edge-triggers the keyboard diagnostics capture below -- set on the
+    /// first `on_insets_changed` where `ime_bottom > 0.0`, cleared on the
+    /// first where it is not, so opening the keyboard fires this once
+    /// rather than on every insets update while it stays open (a rotation
+    /// or a status-bar change with the keyboard already up would otherwise
+    /// re-fire it).
+    keyboard_was_visible: bool,
+}
+
+impl HasAndroidUiState for BenchClient {
+    fn android_state(&self) -> &AndroidUiState {
+        &self.ui_state
+    }
+    fn android_state_mut(&mut self) -> &mut AndroidUiState {
+        &mut self.ui_state
+    }
+}
+
+/// Parses the fixture once: `serde_json::Value`s for the backlog
+/// (`fold_page` takes a page of raw wire JSON, same as a real
+/// `/transcript` response) and folded `SeqEvent`s for the tail (`fold_event`
+/// takes one live wire event at a time, same as a real SSE frame).
+fn parse_fixture() -> (Vec<serde_json::Value>, Vec<SeqEvent>) {
+    let lines: Vec<&str> = FIXTURE_JSONL
+        .lines()
+        .filter(|line| !line.trim().is_empty())
+        .collect();
+    let mut backlog = Vec::with_capacity(BACKLOG_COUNT.min(lines.len()));
+    let mut stream_tail = Vec::new();
+    for (i, line) in lines.iter().enumerate() {
+        let value: serde_json::Value =
+            serde_json::from_str(line).expect("bench fixture is generated JSON, always valid");
+        if i < BACKLOG_COUNT {
+            backlog.push(value);
+        } else {
+            let event: SeqEvent = serde_json::from_value(value)
+                .expect("bench fixture event matches event-model's SeqEvent");
+            stream_tail.push(event);
+        }
+    }
+    (backlog, stream_tail)
+}
+
+fn placeholder<Rsc: HasEvents>(rsc: &mut Rsc, message: &str) -> StrongWidget {
+    wtext(message.to_string())
+        .color(Color::WHITE)
+        .wrap(true)
+        .pad(16)
+        .add_strong(rsc)
+        .any()
+}
+
+/// `getrusage(RUSAGE_SELF)`'s user+system time, in ms -- `None` only if
+/// the syscall itself fails, which UI_RULES.md's "never present an
+/// inferred value as a measured one" says to keep apart from a real (and
+/// here, impossible) zero.
+fn process_cpu_ms() -> Option<u64> {
+    // SAFETY: `rusage` is a plain-old-data struct `getrusage` fully
+    // initialises on success; on failure it is never read.
+    unsafe {
+        let mut usage: libc::rusage = std::mem::zeroed();
+        if libc::getrusage(libc::RUSAGE_SELF, &mut usage) != 0 {
+            return None;
+        }
+        let user_ms = usage.ru_utime.tv_sec as u64 * 1000 + usage.ru_utime.tv_usec as u64 / 1000;
+        let sys_ms = usage.ru_stime.tv_sec as u64 * 1000 + usage.ru_stime.tv_usec as u64 / 1000;
+        Some(user_ms + sys_ms)
+    }
+}
+
+/// `VmHWM` from `/proc/self/status` -- the process's peak RSS since it
+/// started, in kB. Same source `BenchRun.kt`'s `peakRssLine` reads, so the
+/// two reports' numbers mean the same thing.
+fn peak_rss_kb() -> Option<u64> {
+    std::fs::read_to_string("/proc/self/status")
+        .ok()?
+        .lines()
+        .find_map(|line| line.strip_prefix("VmHWM:"))
+        .and_then(|rest| rest.trim().strip_suffix("kB"))
+        .and_then(|n| n.trim().parse().ok())
+}
+
+fn battery_line(samples: &[i32]) -> String {
+    if samples.is_empty() {
+        return "  battery current: unavailable on this device".to_string();
+    }
+    let mean = samples.iter().map(|&v| v as i64).sum::<i64>() / samples.len() as i64;
+    let min = samples.iter().min().unwrap();
+    let max = samples.iter().max().unwrap();
+    format!(
+        "  battery current: mean {mean}\u{b5}A over {} samples (min {min}, max {max})",
+        samples.len()
+    )
+}
+
+impl AndroidAppState for BenchClient {
+    fn new(mut ui_state: AndroidUiState, rsc: &mut AndroidRsc<Self>) -> Self {
+        let content = WidgetPtr::new().add(rsc);
+        let loading = placeholder(rsc, "Loading fixture...");
+        content(rsc).set(loading);
+
+        let report_display = wtext("")
+            .editable(EditMode::MultiLine)
+            .text_align(Align::LEFT)
+            .wrap(true)
+            .size(14)
+            .color(Color::WHITE)
+            .attr::<Selectable>(())
+            .label("Benchmark report")
+            .add(rsc);
+
+        let top_bar = WidgetPtr::new().add(rsc);
+        let controls = bench_controls(rsc, 0.0);
+        top_bar(rsc).set(controls);
+        let tree = (
+            top_bar,
+            content.height(rest(2)),
+            report_display.height(rest(1)).pad(dp(8)),
+        )
+            .span(Dir::DOWN)
+            .add_strong(rsc)
+            .any();
+        ui_state.set_root(tree);
+
+        // Startup log line (RUST.md's P0 box, "log once at startup ... the
+        // number of font families found, the default family resolved"):
+        // what font discovery actually found on this device, before
+        // anything is drawn.
+        let font = rsc.ui.text.font_diagnostics();
+        log::info!(
+            "iris fonts: {} families found, default={:?} mono={:?}, resolved regular={:?} \
+             bold={:?} italic={:?} mono={:?}",
+            font.families_found,
+            font.default_family,
+            font.default_mono_family,
+            font.regular_resolved,
+            font.bold_resolved,
+            font.italic_resolved,
+            font.mono_resolved,
+        );
+
+        let mut client = Self {
+            ui_state,
+            content,
+            report_display,
+            top_bar,
+            screen: None,
+            items: Vec::new(),
+            stream_tail: Vec::new(),
+            platform: None,
+            last_report: None,
+            running: false,
+            keyboard_was_visible: false,
+        };
+
+        let (backlog, stream_tail) = parse_fixture();
+        client.stream_tail = stream_tail;
+        match fold_page(&backlog) {
+            Ok(items) => {
+                client.items = items;
+                client.rebuild_transcript(rsc);
+            }
+            Err(message) => {
+                client.show_message(rsc, &format!("Couldn't fold the bench fixture: {message}"))
+            }
+        }
+        client
+    }
+
+    fn platform_ready(&mut self, _rsc: &mut AndroidRsc<Self>, vm: JavaVM, view: GlobalRef) {
+        self.platform = Some(Arc::new(PlatformHandle::new(vm, view)));
+    }
+
+    fn back_pressed(&mut self, _rsc: &mut AndroidRsc<Self>, _render: &mut UiRenderState) -> bool {
+        false
+    }
+
+    /// Pads the top button row by the status-bar inset -- see `top_bar`'s
+    /// field comment. Rebuilds the row rather than mutating a stored
+    /// `Padding` in place, since nothing here holds a handle to one.
+    ///
+    /// **Also the trigger for the keyboard diagnostics capture** (RUST.md's
+    /// P0 box): the IME resizing the surface is exactly the case the
+    /// previous commit found wiped text, and Iris needs a way to get a
+    /// report off the phone even if that (or some other keyboard-triggered
+    /// regression) is still happening on the build she is holding --
+    /// `capture_keyboard_diagnostics` below fires ~500ms after the
+    /// keyboard becomes visible, once per keyboard opening, and shows its
+    /// report in a plain overlay view that draws independently of
+    /// whatever iris itself is doing.
+    fn on_insets_changed(
+        &mut self,
+        rsc: &mut AndroidRsc<Self>,
+        insets: iris::android::WindowInsets,
+    ) {
+        let controls = bench_controls(rsc, insets.top);
+        (self.top_bar)(rsc).set(controls);
+
+        let ime_visible = insets.ime_bottom > 0.0;
+        if ime_visible && !self.keyboard_was_visible {
+            self.keyboard_was_visible = true;
+            let redraw = rsc.tasks.redraw_handle();
+            rsc.spawn_task(async move |mut ctx| {
+                tokio::time::sleep(Duration::from_millis(KEYBOARD_DIAGNOSTICS_DELAY_MS)).await;
+                ctx.update(|state: &mut BenchClient, rsc| {
+                    state.capture_keyboard_diagnostics(rsc);
+                });
+                redraw.request_redraw();
+            });
+        } else if !ime_visible {
+            self.keyboard_was_visible = false;
+        }
+    }
+}
+
+/// How long to wait after the keyboard becomes visible before capturing
+/// diagnostics -- long enough that the resize, the reported wipe (if it is
+/// still happening) and a couple of frames have all had time to land, per
+/// AGENTS.md's "so that operations that finish in milliseconds have states
+/// on the way that nothing can observe" reasoning applied the other way:
+/// this wants to observe the state *after* the transition settles, not
+/// mid-flight.
+const KEYBOARD_DIAGNOSTICS_DELAY_MS: u64 = 500;
+
+type Rsc = AndroidRsc<BenchClient>;
+
+/// The header row's own backdrop -- see `bench_controls`'s doc comment on
+/// why it needs one at all. A dark neutral rather than pure black
+/// (`android::render::CLEAR_COLOR`) so the row reads as a distinct panel
+/// instead of a hole in the background the buttons happen to float in.
+const HEADER_SURFACE: UiColor = UiColor::new(28, 28, 34, 255);
+
+/// `top_pad` is the status-bar inset in physical pixels (0.0 until
+/// `on_insets_changed` has run once) -- folded in here, rather than
+/// exposing the unadded builder for a caller to `.pad()` itself, because
+/// naming that builder's type at each call site is more machinery than a
+/// top-of-screen padding number is worth.
+///
+/// **Backed by an opaque rect the full size of the row, not just the three
+/// buttons.** Iris's phone report (docs/RUST.md's P0 box, screenshots on
+/// build a9232ac): "the header buttons have nothing behind them and
+/// overlap the transcript text" -- before this, only each button's own
+/// `rect(...)` painted anything, so the gaps between and around them (and
+/// the status-bar strip above them) showed whatever was one layer back
+/// (`CLEAR_COLOR`, black), and the row's true height was three
+/// physical-pixel-sized (`abs`, not `dp`) button boxes rather than the
+/// density-correct size the transcript below was already using post-P0 --
+/// exactly what reads as "overlap" once the two disagree. Fixed two ways
+/// together: a `HEADER_SURFACE` rect stacked behind the whole row (this
+/// function), and every size below moved from a bare number (physical
+/// pixels) to `dp(...)` (IRIS_TODO.md's density-independent length unit),
+/// so the row's reserved height in the outer `Span::DOWN`
+/// (`AndroidAppState::new`) matches what is actually painted.
+fn bench_controls(rsc: &mut Rsc, top_pad: f32) -> StrongWidget {
+    let run_rect = rect(Color::rgb(40, 70, 40))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+                ctx.state.start_benchmark(rsc);
+            },
+        )
+        .label("Run benchmark");
+    let run = (
+        run_rect,
+        wtext("Run benchmark").size(18).text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let copy_rect = rect(Color::rgb(50, 50, 60))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, _rsc: &mut Rsc| {
+                ctx.state.copy_report();
+            },
+        )
+        .label("Copy report");
+    let copy = (
+        copy_rect,
+        wtext("Copy report").size(18).text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let diag_rect = rect(Color::rgb(60, 45, 70))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+                ctx.state.show_diagnostics(rsc);
+            },
+        )
+        .label("Diagnostics");
+    let diagnostics = (
+        diag_rect,
+        wtext("Diagnostics").size(18).text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let buttons = (run, copy, diagnostics).span(Dir::RIGHT).add(rsc);
+
+    (rect(HEADER_SURFACE), buttons)
+        .stack()
+        .height(dp(56))
+        .pad(Padding::top(top_pad))
+        .add_strong(rsc)
+        .any()
+}
+
+impl BenchClient {
+    fn show_message(&mut self, rsc: &mut Rsc, message: &str) {
+        let widget = placeholder(rsc, message);
+        (self.content)(rsc).set(widget);
+        self.screen = None;
+    }
+
+    fn rebuild_transcript(&mut self, rsc: &mut Rsc) {
+        let rows = group_tool_runs(&self.items);
+        let (screen, tree) = transcript_ui::build_tree(rsc, rows);
+        (self.content)(rsc).set(tree);
+        self.screen = Some(screen);
+    }
+
+    /// RUST.md's P0 box: "a named `Diagnostics` control ... with 'copy this
+    /// and send it to Iris'." Fills `report_display` (the same TextEdit the
+    /// benchmark report uses) rather than a separate widget, so the
+    /// existing "Copy report" button and clipboard path work on whichever
+    /// text is currently shown -- `last_report` is what `copy_report` reads,
+    /// so it's set here too rather than adding a second copy path.
+    fn show_diagnostics(&mut self, rsc: &mut Rsc) {
+        let font = rsc.ui.text.font_diagnostics();
+        let frame_report = match self.android_state().frame_report.report() {
+            Some(stats) => format!("{stats}"),
+            None => "no frames recorded yet".to_string(),
+        };
+        let report = match &self.android_state().renderer {
+            Some(renderer) => renderer.diagnostics_report(&font, &frame_report),
+            None => "iris diagnostics: no renderer yet (no surface)".to_string(),
+        };
+        self.report_display.edit(rsc).set(&report);
+        self.last_report = Some(report);
+    }
+
+    /// The keyboard's own diagnostics capture -- see `on_insets_changed`'s
+    /// doc comment. Reuses `show_diagnostics`'s exact report (so it is the
+    /// same text the on-screen `Diagnostics` button produces, plus the
+    /// per-frame log `FrameReport` already keeps around the resize --
+    /// `frame_report.report()` above covers "the frames around the
+    /// resize" without a second accounting mechanism), then does three
+    /// things the button does not: logs it (so a `logcat` pull gets it
+    /// even if nothing on screen does), copies it to the clipboard
+    /// unprompted, and shows it in the shell's plain overlay view, which
+    /// draws independently of iris's own renderer -- the whole point,
+    /// since the renderer is exactly what might be in the wiped state
+    /// this exists to report on.
+    fn capture_keyboard_diagnostics(&mut self, rsc: &mut Rsc) {
+        self.show_diagnostics(rsc);
+        let Some(report) = self.last_report.clone() else {
+            return;
+        };
+        log::info!("iris keyboard diagnostics:\n{report}");
+        let Some(platform) = &self.platform else {
+            log::info!("iris keyboard diagnostics: no platform handle, can't reach the shell");
+            return;
+        };
+        if platform.copy_to_clipboard("iris keyboard diagnostics", &report) {
+            log::info!("iris keyboard diagnostics: copied to clipboard");
+        } else {
+            log::info!("iris keyboard diagnostics: clipboard copy failed");
+        }
+        platform.show_diagnostics_overlay(&report);
+    }
+
+    fn copy_report(&mut self) {
+        let Some(report) = &self.last_report else {
+            log::info!("iris bench report: nothing to copy -- run the benchmark first");
+            return;
+        };
+        let Some(platform) = &self.platform else {
+            log::info!("iris bench report: no platform handle, can't reach the clipboard");
+            return;
+        };
+        if platform.copy_to_clipboard("iris bench report", report) {
+            log::info!("iris bench report: copied to clipboard");
+        } else {
+            log::info!("iris bench report: clipboard copy failed");
+        }
+    }
+
+    /// P0's scripted run: `BenchRun.kt`'s scroll loop, then its streaming
+    /// phase, then the report -- run in-process for the same reason that
+    /// file's own doc gives (no usable system tracing on a real phone, no
+    /// agent that can drive one).
+    fn start_benchmark(&mut self, rsc: &mut Rsc) {
+        if self.running {
+            log::info!("iris bench report: already running");
+            return;
+        }
+        self.running = true;
+        self.android_state_mut().frame_report.reset();
+        self.report_display.edit(rsc).set("Running benchmark...");
+
+        let redraw = rsc.tasks.redraw_handle();
+        let platform = self.platform.clone();
+        let stream_tail = self.stream_tail.clone();
+        let cpu_start = process_cpu_ms();
+
+        rsc.spawn_task(async move |mut ctx| {
+            // The swipe loop: two drags toward newer content, two back --
+            // a cycle returns to where it started, so the whole loop
+            // measures steady-state scrolling. `BenchRun.kt`'s own
+            // comment on this shape.
+            for _ in 0..CYCLES {
+                for delta in [SWIPE_PX, SWIPE_PX, -SWIPE_PX, -SWIPE_PX] {
+                    animate_scroll(&mut ctx, &redraw, delta, SWIPE_MS).await;
+                    tokio::time::sleep(Duration::from_millis(SWIPE_PAUSE_MS)).await;
+                }
+            }
+
+            // Pinned to the newest end before streaming starts, matching
+            // `stream-bench.sh`'s "Jump to latest" tap.
+            ctx.update(|state: &mut BenchClient, rsc| {
+                if let Some(screen) = &state.screen {
+                    (screen.list)(rsc).jump_to_end();
+                }
+            });
+            redraw.request_redraw();
+
+            // The battery sampler runs concurrently with the streaming
+            // phase, once a second, the same cadence `BatterySampler` uses
+            // on the Compose side -- via its own JNI-attached thread, not
+            // `ctx.update`, since a sample needs no widget-tree access.
+            let sampler_done = Arc::new(AtomicBool::new(false));
+            let samples = Arc::new(std::sync::Mutex::new(Vec::<i32>::new()));
+            let sampler = platform.clone().map(|platform| {
+                let done = sampler_done.clone();
+                let samples = samples.clone();
+                tokio::spawn(async move {
+                    while !done.load(Ordering::Relaxed) {
+                        if let Some(value) = platform.battery_current_ua() {
+                            samples.lock().unwrap().push(value);
+                        }
+                        tokio::time::sleep(Duration::from_secs(1)).await;
+                    }
+                })
+            });
+
+            let total = (STREAM_EVENTS_PER_SEC * STREAM_SECONDS) as usize;
+            let mut sent = 0usize;
+            for event in stream_tail.into_iter().take(total) {
+                ctx.update(move |state: &mut BenchClient, rsc| {
+                    let old_items = state.items.clone();
+                    state.items = fold_event(&state.items, &event);
+                    match &state.screen {
+                        // The path P0 asked to measure: update only the
+                        // row(s) that changed instead of rebuilding all
+                        // ~3,200 of them per event.
+                        Some(screen) => screen.apply(rsc, &old_items, &state.items),
+                        None => state.rebuild_transcript(rsc),
+                    }
+                });
+                redraw.request_redraw();
+                sent += 1;
+                tokio::time::sleep(Duration::from_millis(1000 / STREAM_EVENTS_PER_SEC)).await;
+            }
+            // Lets the last few deltas land and draw before the report is
+            // read -- `BenchRun.kt`'s own closing delay.
+            tokio::time::sleep(Duration::from_millis(300)).await;
+
+            sampler_done.store(true, Ordering::Relaxed);
+            if let Some(sampler) = sampler {
+                let _ = sampler.await;
+            }
+            let battery = battery_line(&samples.lock().unwrap());
+            let cpu_line = match (cpu_start, process_cpu_ms()) {
+                (Some(start), Some(end)) => {
+                    format!("  process CPU time over this run: {}ms", end.saturating_sub(start))
+                }
+                _ => "  process CPU time over this run: unavailable".to_string(),
+            };
+            let rss_line = match peak_rss_kb() {
+                Some(kb) => format!("  peak RSS: {kb}kB"),
+                None => "  peak RSS: unavailable (/proc/self/status unreadable)".to_string(),
+            };
+
+            ctx.update(move |state: &mut BenchClient, rsc| {
+                state.running = false;
+                let scroll_line = format!(
+                    "  scroll: {CYCLES} cycles ({} swipes), streamed {sent}/{total} fixture events",
+                    CYCLES * 4
+                );
+                let frames_line = match state.android_state().frame_report.report() {
+                    Some(stats) => format!("{stats}"),
+                    None => "no frames recorded".to_string(),
+                };
+                let report = format!(
+                    "iris bench report\n{frames_line}\n{scroll_line}\n{cpu_line}\n{rss_line}\n{battery}"
+                );
+                log::info!("iris bench report: {report}");
+                state.report_display.edit(rsc).set(&report);
+                state.last_report = Some(report);
+            });
+            redraw.request_redraw();
+        });
+    }
+}
+
+/// Moves `List::scroll` by `total_px` over `duration_ms`, in ~60Hz steps,
+/// so the swipe is many rendered frames rather than one jump -- the same
+/// shape `animateScrollBy(SWIPE_PX, tween(SWIPE_MS))` gives on the Compose
+/// side, in the one place the two backends have to differ (iris's `List`
+/// has no built-in tween, so this drives it by hand).
+async fn animate_scroll(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    redraw: &Arc<dyn iris::task::RequestRedraw>,
+    total_px: f32,
+    duration_ms: u64,
+) {
+    let steps = (duration_ms / ANIM_STEP_MS).max(1);
+    let step_px = total_px / steps as f32;
+    for _ in 0..steps {
+        ctx.update(move |state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                (screen.list)(rsc).scroll(step_px);
+            }
+        });
+        redraw.request_redraw();
+        tokio::time::sleep(Duration::from_millis(ANIM_STEP_MS)).await;
+    }
+}

iris/android-app/src/bench_jni.rs

@@ -0,0 +1,161 @@
+//! JNI calls the `bench` feature needs that go through the shell's own
+//! Java side rather than anything `iris`/`android-view` already wraps:
+//! `BatteryManager.getIntProperty(BATTERY_PROPERTY_CURRENT_NOW)` for the
+//! per-second battery sample, and `ClipboardManager.setPrimaryClip` for
+//! the "Copy report" control (P0's iris half, docs/RUST.md). Neither is
+//! part of `android_view::context`'s own `Context`/`Resources` wrappers
+//! (that file's own `// TODO: more methods?`), so this calls them
+//! directly rather than growing that crate's wrapper for two one-off
+//! calls this crate alone needs.
+//!
+//! Holds its own `JavaVM` + `GlobalRef` to the view (handed in through
+//! [`iris::android::AndroidAppState::platform_ready`]) so it can attach
+//! whichever thread calls it -- the battery sampler runs on a background
+//! tokio task, not the UI thread the rest of `IrisViewPeer`'s JNI calls
+//! run on. `JavaVM::attach_current_thread` is safe to call from a thread
+//! already attached (the `jni` crate detects it and does not double
+//! attach), so no caller here needs to know or care which thread it is.
+
+use android_view::jni::{
+    JNIEnv, JavaVM,
+    objects::{GlobalRef, JObject, JValue},
+};
+
+/// `android.os.BatteryManager.BATTERY_PROPERTY_CURRENT_NOW` -- not exposed
+/// as a constant anywhere reachable without the Android SDK jar, so named
+/// here with its source rather than left as a bare `2`.
+const BATTERY_PROPERTY_CURRENT_NOW: i32 = 2;
+
+pub struct PlatformHandle {
+    vm: JavaVM,
+    view: GlobalRef,
+}
+
+impl PlatformHandle {
+    pub fn new(vm: JavaVM, view: GlobalRef) -> Self {
+        Self { vm, view }
+    }
+
+    fn context<'e>(&self, env: &mut JNIEnv<'e>) -> Option<JObject<'e>> {
+        env.call_method(
+            self.view.as_obj(),
+            "getContext",
+            "()Landroid/content/Context;",
+            &[],
+        )
+        .ok()?
+        .l()
+        .ok()
+    }
+
+    fn system_service<'e>(
+        &self,
+        env: &mut JNIEnv<'e>,
+        context: &JObject<'e>,
+        name: &str,
+    ) -> Option<JObject<'e>> {
+        let jname = env.new_string(name).ok()?;
+        env.call_method(
+            context,
+            "getSystemService",
+            "(Ljava/lang/String;)Ljava/lang/Object;",
+            &[JValue::Object(jname.as_ref())],
+        )
+        .ok()?
+        .l()
+        .ok()
+    }
+
+    /// One sample of `BATTERY_PROPERTY_CURRENT_NOW`, in microamps. `None`
+    /// on any JNI failure, on a device with no `BatteryManager` service,
+    /// or when the platform itself answers "not supported" -- `0` or
+    /// `Integer.MIN_VALUE` are both documented SDK answers for that, and
+    /// both would read as a real (and wrong) measurement if folded into an
+    /// average rather than named apart. UI_RULES.md: never present an
+    /// inferred value as a measured one.
+    pub fn battery_current_ua(&self) -> Option<i32> {
+        let mut guard = self.vm.attach_current_thread().ok()?;
+        let env: &mut JNIEnv = &mut guard;
+        let context = self.context(env)?;
+        let battery_manager = self.system_service(env, &context, "batterymanager")?;
+        let value = env
+            .call_method(
+                &battery_manager,
+                "getIntProperty",
+                "(I)I",
+                &[JValue::Int(BATTERY_PROPERTY_CURRENT_NOW)],
+            )
+            .ok()?
+            .i()
+            .ok()?;
+        if value == 0 || value == i32::MIN {
+            None
+        } else {
+            Some(value)
+        }
+    }
+
+    /// Puts `text` on the system clipboard through `ClipboardManager` --
+    /// `true` only if the whole JNI chain (service lookup, `ClipData`,
+    /// `setPrimaryClip`) succeeded.
+    pub fn copy_to_clipboard(&self, label: &str, text: &str) -> bool {
+        self.try_copy_to_clipboard(label, text).is_some()
+    }
+
+    fn try_copy_to_clipboard(&self, label: &str, text: &str) -> Option<()> {
+        let mut guard = self.vm.attach_current_thread().ok()?;
+        let env: &mut JNIEnv = &mut guard;
+        let context = self.context(env)?;
+        let clipboard = self.system_service(env, &context, "clipboard")?;
+        let jlabel = env.new_string(label).ok()?;
+        let jtext = env.new_string(text).ok()?;
+        let clip = env
+            .call_static_method(
+                "android/content/ClipData",
+                "newPlainText",
+                "(Ljava/lang/CharSequence;Ljava/lang/CharSequence;)Landroid/content/ClipData;",
+                &[
+                    JValue::Object(jlabel.as_ref()),
+                    JValue::Object(jtext.as_ref()),
+                ],
+            )
+            .ok()?
+            .l()
+            .ok()?;
+        env.call_method(
+            &clipboard,
+            "setPrimaryClip",
+            "(Landroid/content/ClipData;)V",
+            &[JValue::Object(&clip)],
+        )
+        .ok()?;
+        Some(())
+    }
+
+    /// Shows `report` in the shell's plain-view diagnostics overlay
+    /// (`IrisView.showDiagnosticsOverlay`) -- a real `TextView` plus Copy
+    /// and Close controls, added over whatever iris itself is drawing
+    /// rather than replacing it (unlike `android::view::show_renderer_error`,
+    /// which exists for the case the renderer can never recover from and
+    /// intentionally never returns). Called from a background task after
+    /// the keyboard-open delay (`bench_client.rs`'s `on_insets_changed`),
+    /// so the Java side hops onto the UI thread itself before touching the
+    /// view tree -- see that method's own comment.
+    pub fn show_diagnostics_overlay(&self, report: &str) -> bool {
+        self.try_show_diagnostics_overlay(report).is_some()
+    }
+
+    fn try_show_diagnostics_overlay(&self, report: &str) -> Option<()> {
+        let mut guard = self.vm.attach_current_thread().ok()?;
+        let env: &mut JNIEnv = &mut guard;
+        let jreport = env.new_string(report).ok()?;
+        env.call_method(
+            self.view.as_obj(),
+            "showDiagnosticsOverlay",
+            "(Ljava/lang/String;)V",
+            &[JValue::Object(jreport.as_ref())],
+        )
+        .ok()?;
+        Some(())
+    }
+}

iris/android-app/src/lib.rs

@@ -23,6 +23,18 @@
 //! A build picks one screen or the other, never both, so `Client` and
 //! `TranscriptClient` are cfg-gated apart rather than switched at runtime --
 //! there is no in-app navigation to switch *to* on either side yet.
+//!
+//! **`bench` feature (P0's iris half, docs/RUST.md):** a third
+//! `AndroidAppState`, `bench_client::BenchClient`, on the same axis --
+//! `transcript_ui::build_tree` again, this time against the checked-in
+//! fixture (`app/bench-fixture/assets/transcript.jsonl`) instead of a real
+//! server, with a "Run benchmark" control that drives the same scroll loop
+//! and streaming phase the Compose `bench` build type's `BenchRun.kt`
+//! does. `bench` depends on `transcript-screen` (Cargo.toml) for
+//! `transcript-ui`/`client-core`/`event-model`, so both features end up
+//! enabled together -- `ActiveClient` below gives `bench` priority in that
+//! case, the same way `transcript-screen` already takes priority over the
+//! default `tabs-screen`.
 
 use android_view::{
     Context, View,
@@ -39,7 +51,11 @@ use iris::prelude::*;
 use log::LevelFilter;
 use std::ffi::c_void;
 
-#[cfg(feature = "transcript-screen")]
+#[cfg(feature = "bench")]
+mod bench_client;
+#[cfg(feature = "bench")]
+mod bench_jni;
+#[cfg(all(feature = "transcript-screen", not(feature = "bench")))]
 mod transcript_client;
 
 /// The app's `View` subclass, matching the Java side's package --
@@ -85,8 +101,10 @@ impl AndroidAppState for Client {
 
 #[cfg(not(feature = "transcript-screen"))]
 type ActiveClient = Client;
-#[cfg(feature = "transcript-screen")]
+#[cfg(all(feature = "transcript-screen", not(feature = "bench")))]
 type ActiveClient = transcript_client::TranscriptClient;
+#[cfg(feature = "bench")]
+type ActiveClient = bench_client::BenchClient;
 
 extern "system" fn new_view_peer<'local>(
     env: JNIEnv<'local>,

iris/android-app/src/transcript_client.rs

@@ -20,14 +20,22 @@
 //! **Reuses `iris/desktop-app`'s `app.rs` shape almost exactly** --
 //! `fold_event`/`group_tool_runs`/`fold_page`/`raw_seq` from
 //! `client_core::transcript_fold`, a `generation` counter guarding against
-//! a stale background response, and a full rebuild of the widget tree on
-//! every event (same tradeoff, same reason: `push_row` cannot update a row
-//! already on screen, and this rig's conversations are small). What
-//! differs is only the redraw mechanism: android-view has no
-//! `winit::EventLoopProxy`, so this uses `iris::task::Tasks::redraw_handle`
-//! (new, added alongside this box) to request a frame after each
-//! `TaskCtx::update` instead of relying on `Tasks::spawn`'s single
-//! end-of-future redraw -- see that method's own doc for why.
+//! a stale background response. What differs is only the redraw
+//! mechanism: android-view has no `winit::EventLoopProxy`, so this uses
+//! `iris::task::Tasks::redraw_handle` (new, added alongside this box) to
+//! request a frame after each `TaskCtx::update` instead of relying on
+//! `Tasks::spawn`'s single end-of-future redraw -- see that method's own
+//! doc for why.
+//!
+//! **Streaming no longer costs a full rebuild** (fixed after the P0 gate
+//! showed why it mattered -- 20 events/second means 20 rebuilds/second of
+//! a ~3,200-row transcript otherwise): `apply_event` calls
+//! `transcript_ui::TranscriptScreen::apply` with the item list before and
+//! after `fold_event`, which updates only the row(s) that actually
+//! changed (almost always just the one open assistant message) instead of
+//! refolding and rebuilding every row. `rebuild_transcript` still runs
+//! the whole widget tree once, for the opening page and for `apply`'s own
+//! rare regroup fallback.
 
 use client_core::api::{ApiClient, UreqTransport};
 use client_core::event_stream::{StreamItem, follow_session_events};
@@ -360,8 +368,17 @@ impl TranscriptClient {
     }
 
     fn apply_event(&mut self, rsc: &mut AndroidRsc<Self>, event: &SeqEvent) {
+        let old_items = self.items.clone();
         self.items = fold_event(&self.items, event);
-        self.rebuild_transcript(rsc);
+        match &self.screen {
+            // The common path: update only the row(s) that actually
+            // changed instead of refolding and rebuilding all ~3,200 of
+            // them per event (RUST.md's P0 streaming-phase fix).
+            Some(screen) => screen.apply(rsc, &old_items, &self.items),
+            // No screen yet (the opening page hasn't landed) -- build one
+            // the ordinary way once it has.
+            None => self.rebuild_transcript(rsc),
+        }
     }
 
     fn send_message(&mut self, session_id: String, text: String) {

iris/core/Cargo.toml

@@ -5,6 +5,12 @@ edition.workspace = true
 
 [dependencies]
 wgpu = { workspace = true }
+# Only for `UiRenderNode::new`'s `push_error_scope`/`pop_error_scope` pair
+# (renderer-creation error reporting, RUST.md's P0 phone-crash box) --
+# `block_on` turns that one async pop into the same synchronous call shape
+# `device_limits()`'s two callers already use for `request_adapter`/
+# `request_device`, rather than making this crate's one entry point async.
+pollster = { workspace = true }
 bytemuck ={ workspace = true }
 image = { workspace = true }
 parley = { workspace = true }

iris/core/assets/fonts/OFL.txt

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

iris/core/src/orientation/len.rs

@@ -9,7 +9,31 @@ pub struct Size {
 
 #[derive(Debug, Clone, Copy, PartialEq)]
 pub struct Len {
+    /// Physical pixels -- a raw device pixel, unaffected by the display's
+    /// density. Rare to want directly (a hairline border is the usual
+    /// case); most sizes should be `dp` instead. See `dp`'s own doc for why
+    /// the two are kept separate rather than one field a caller has to
+    /// remember to pre-multiply.
     pub abs: f32,
+    /// Density-independent pixels -- Android's `dp` / CSS's reference pixel
+    /// (1 unit = 1/160in), resolved against the display's density at
+    /// layout time (`apply_rest`'s `density` parameter) rather than at the
+    /// point a widget is built, since density is a property of the device
+    /// this ends up running on, not of the widget tree. This is the unit
+    /// IRIS_TODO.md's "a density-independent length unit" item asked for,
+    /// 2026-09-06: before it existed, every size in the tree was `abs`
+    /// (physical pixels), and the only way to make a 16px design draw at
+    /// the right *size* on a denser display was a single global multiply
+    /// applied to the whole rendered scene after layout -- which is also
+    /// what made text blurry (RUST.md's P0 box, "blurry ... glyphs drawn
+    /// at logical size and stretched by the scale"): a glyph rasterised at
+    /// 16 physical px and then stretched 3x by that global multiply is a
+    /// 48px area sampled from a 16px bitmap. Resolving `dp` per-length at
+    /// layout time instead means the font size handed to the text shaper
+    /// is already the physical size (`16.0.dp() * 3.0`), so the glyph
+    /// atlas rasterises at the display's real resolution and nothing
+    /// downstream needs to stretch anything.
+    pub dp: f32,
     pub rel: f32,
     pub rest: f32,
 }
@@ -67,10 +91,10 @@ impl Size {
         }
     }
 
-    pub fn to_uivec2(self) -> UiVec2 {
+    pub fn to_uivec2(self, density: f32) -> UiVec2 {
         UiVec2 {
-            x: self.x.apply_rest(),
-            y: self.y.apply_rest(),
+            x: self.x.apply_rest(density),
+            y: self.y.apply_rest(density),
         }
     }
 
@@ -98,26 +122,43 @@ impl Size {
 impl Len {
     pub const ZERO: Self = Self {
         abs: 0.0,
+        dp: 0.0,
         rel: 0.0,
         rest: 0.0,
     };
 
     pub const REST: Self = Self {
         abs: 0.0,
+        dp: 0.0,
         rel: 0.0,
         rest: 1.0,
     };
 
-    pub fn apply_rest(&self) -> UiScalar {
+    /// Resolves to a `UiScalar`, folding `dp` into `abs` pixels against
+    /// `density` (physical pixels per dp -- 1.0 on a desktop or an
+    /// unscaled display, `content_scale` on Android; see `dp`'s field
+    /// doc). Every other component of `Len` is already resolution-
+    /// independent (`rel` is a fraction of the parent; `rest` becomes a
+    /// fraction too, below), so `density` only ever touches this one term.
+    pub fn apply_rest(&self, density: f32) -> UiScalar {
         UiScalar {
             rel: self.rel + if self.rest > 0.0 { 1.0 } else { 0.0 },
-            abs: self.abs,
+            abs: self.abs + self.dp * density,
         }
     }
 
     pub fn abs(abs: impl UiNum) -> Self {
         Self {
             abs: abs.to_f32(),
+            dp: 0.0,
+            rel: 0.0,
+            rest: 0.0,
+        }
+    }
+    pub fn dp(dp: impl UiNum) -> Self {
+        Self {
+            abs: 0.0,
+            dp: dp.to_f32(),
             rel: 0.0,
             rest: 0.0,
         }
@@ -125,6 +166,7 @@ impl Len {
     pub fn rel(rel: impl UiNum) -> Self {
         Self {
             abs: 0.0,
+            dp: 0.0,
             rel: rel.to_f32(),
             rest: 0.0,
         }
@@ -132,6 +174,7 @@ impl Len {
     pub fn rest(ratio: impl UiNum) -> Self {
         Self {
             abs: 0.0,
+            dp: 0.0,
             rel: 0.0,
             rest: ratio.to_f32(),
         }
@@ -144,6 +187,15 @@ pub mod len_fns {
     pub fn abs(abs: impl UiNum) -> Len {
         Len {
             abs: abs.to_f32(),
+            dp: 0.0,
+            rel: 0.0,
+            rest: 0.0,
+        }
+    }
+    pub fn dp(dp: impl UiNum) -> Len {
+        Len {
+            abs: 0.0,
+            dp: dp.to_f32(),
             rel: 0.0,
             rest: 0.0,
         }
@@ -151,6 +203,7 @@ pub mod len_fns {
     pub fn rel(rel: impl UiNum) -> Len {
         Len {
             abs: 0.0,
+            dp: 0.0,
             rel: rel.to_f32(),
             rest: 0.0,
         }
@@ -158,14 +211,15 @@ pub mod len_fns {
     pub fn rest(ratio: impl UiNum) -> Len {
         Len {
             abs: 0.0,
+            dp: 0.0,
             rel: 0.0,
             rest: ratio.to_f32(),
         }
     }
 }
 
-impl_op!(Len Add add; abs rel rest);
-impl_op!(Len Sub sub; abs rel rest);
+impl_op!(Len Add add; abs dp rel rest);
+impl_op!(Len Sub sub; abs dp rel rest);
 
 impl_op!(Size Add add; x y);
 impl_op!(Size Sub sub; x y);
@@ -187,6 +241,9 @@ impl std::fmt::Display for Len {
         if self.abs != 0.0 {
             write!(f, "{} abs;", self.abs)?;
         }
+        if self.dp != 0.0 {
+            write!(f, "{} dp;", self.dp)?;
+        }
         if self.rel != 0.0 {
             write!(f, "{} rel;", self.rel)?;
         }

iris/core/src/primitive/text.rs

@@ -2,14 +2,63 @@ use crate::{Align, GlyphAtlas, GlyphKey, PlacedGlyph, RegionAlign, Textures, UiC
 use parley::{
     Alignment, AlignmentOptions, FontContext, FontFamily, FontFamilyName, FontStyle, FontWeight,
     GenericFamily, Layout, LayoutContext, LineHeight, PositionedLayoutItem, StyleProperty,
+    fontique::{Blob, FamilyId},
 };
 use std::ops::Range;
+use std::sync::Arc;
 use swash::{
     FontRef,
     scale::{Render, ScaleContext, Source, StrikeWith},
     zeno::{Format, Vector},
 };
 
+/// Bundled fonts, registered over the system collection rather than relied
+/// on alone -- see `TextData::register_bundled_fonts`'s doc comment for
+/// why. Static weight/style cuts, not a variable font: parley/fontique
+/// resolve a variable font's weight axis by picking normalized coordinates
+/// on whatever single face registers for the family, and a phone whose
+/// system "Roboto" is actually the variable "Roboto Flex" is exactly the
+/// device class this sidesteps, rather than depends on working correctly.
+/// Noto Sans, OFL-licensed (`assets/fonts/OFL.txt`), chosen for coverage
+/// breadth (a transcript's content is not known in advance) over a
+/// smaller-footprint alternative -- see the doc comment for the size this
+/// added.
+const NOTO_SANS_REGULAR: &[u8] = include_bytes!("../../assets/fonts/NotoSans-Regular.ttf");
+const NOTO_SANS_BOLD: &[u8] = include_bytes!("../../assets/fonts/NotoSans-Bold.ttf");
+const NOTO_SANS_ITALIC: &[u8] = include_bytes!("../../assets/fonts/NotoSans-Italic.ttf");
+const NOTO_SANS_BOLD_ITALIC: &[u8] = include_bytes!("../../assets/fonts/NotoSans-BoldItalic.ttf");
+const NOTO_SANS_MONO_REGULAR: &[u8] = include_bytes!("../../assets/fonts/NotoSansMono-Regular.ttf");
+const NOTO_SANS_MONO_BOLD: &[u8] = include_bytes!("../../assets/fonts/NotoSansMono-Bold.ttf");
+
+/// What starting up found about text rendering, for the on-screen
+/// Diagnostics page and the one startup log line (RUST.md's P0 box, "log
+/// once at startup ... the number of font families found, the default
+/// family resolved"). Built once by `TextData::font_diagnostics` --
+/// `Default::default` still exists for callers (tests, examples) that
+/// don't need the report.
+#[derive(Clone, Debug)]
+pub struct FontDiagnostics {
+    /// `Collection::family_names().count()` after registering the bundled
+    /// fonts -- system families plus the two bundled ones.
+    pub families_found: usize,
+    /// The family `GenericFamily::SansSerif` resolves to first -- the
+    /// bundled "Noto Sans" unless registration itself failed.
+    pub default_family: Option<String>,
+    /// The family `GenericFamily::Monospace` resolves to first.
+    pub default_mono_family: Option<String>,
+    /// One resolved family name per style axis this crate actually uses
+    /// (`SpanStyle::bold`/`italic`), so a report can say plainly whether a
+    /// bold/italic request is landing on a real face rather than being
+    /// silently absorbed by whatever the sans-serif default resolves to
+    /// for every weight (RUST.md's P0 box, "bold words render as blank
+    /// gaps" -- a family that resolves but has no distinct bold face is
+    /// exactly what produced that).
+    pub regular_resolved: Option<String>,
+    pub bold_resolved: Option<String>,
+    pub italic_resolved: Option<String>,
+    pub mono_resolved: Option<String>,
+}
+
 /// Everything text needs that outlives one string: the font collection, the
 /// layout scratch space, the glyph rasteriser and the atlas they fill.
 pub struct TextData {
@@ -17,15 +66,182 @@ pub struct TextData {
     pub layout_cx: LayoutContext<UiColor>,
     scale_cx: ScaleContext,
     pub atlas: GlyphAtlas,
+    /// Physical pixels per dp -- a second copy of
+    /// `UiRenderState::density`, kept here too because `TextEditCtx::layout`
+    /// (cursor movement and hit-testing, `widget/text/edit.rs`) shapes text
+    /// from an event callback that has a `TextData` but no `Painter`, so it
+    /// has nowhere else to read the display's density from. Both copies are
+    /// set together, from the one place either backend learns the real
+    /// value (`android::view::new_peer`); this is the same accepted
+    /// duplication as `AndroidRenderer::content_scale`; a single source of
+    /// truth would mean carrying a `Painter` (or output size) into every
+    /// input handler for the sake of one field.
+    pub density: f32,
 }
 
 impl Default for TextData {
     fn default() -> Self {
-        Self {
+        let mut data = Self {
             font_cx: FontContext::new(),
             layout_cx: LayoutContext::new(),
             scale_cx: ScaleContext::new(),
             atlas: GlyphAtlas::default(),
+            density: 1.0,
+        };
+        data.register_bundled_fonts();
+        data
+    }
+}
+
+impl TextData {
+    /// Registers Noto Sans (regular/bold/italic/bold-italic) and Noto Sans
+    /// Mono (regular/bold) as static faces, and puts them **first** in the
+    /// `SansSerif`/`Monospace` generic-family fallback lists -- ahead of,
+    /// not instead of, whatever the platform already found, so a script
+    /// Noto Sans lacks (CJK, emoji, ...) still falls through to the system
+    /// font the same as before this existed.
+    ///
+    /// Exists because text rendering must not depend on the platform's own
+    /// font enumeration succeeding or resolving weight/style the way this
+    /// crate assumes: RUST.md's P0 box found bold spans on a real phone
+    /// rendering as blank gaps of the correct advance width (the glyph
+    /// simply wasn't rasterised -- `TextData::place`'s `None` arm), while
+    /// the emulator's system fonts happened to resolve every style. A
+    /// bundled, static-per-style family removes fontique's Android font
+    /// scan (`fontique::backend::android::SystemFonts::new`, which parses
+    /// `/system/fonts` and `/system/etc/fonts.xml`) from the path a glyph
+    /// has to survive to reach the screen at all.
+    ///
+    /// Cost: six static `.ttf`s, ~3.6 MB uncompressed
+    /// (`iris/core/assets/fonts/`), landing in the APK compressed --
+    /// `build-apk.sh`'s own output is what says the delivered number, not
+    /// this comment.
+    fn register_bundled_fonts(&mut self) {
+        fn register(cx: &mut FontContext, bytes: &'static [u8]) -> Option<FamilyId> {
+            let blob = Blob::new(Arc::new(bytes));
+            cx.collection
+                .register_fonts(blob, None)
+                .into_iter()
+                .map(|(id, _)| id)
+                .next()
+        }
+        let sans_id = register(&mut self.font_cx, NOTO_SANS_REGULAR);
+        register(&mut self.font_cx, NOTO_SANS_BOLD);
+        register(&mut self.font_cx, NOTO_SANS_ITALIC);
+        register(&mut self.font_cx, NOTO_SANS_BOLD_ITALIC);
+        let mono_id = register(&mut self.font_cx, NOTO_SANS_MONO_REGULAR);
+        register(&mut self.font_cx, NOTO_SANS_MONO_BOLD);
+
+        if let Some(sans_id) = sans_id {
+            let existing: Vec<_> = self
+                .font_cx
+                .collection
+                .generic_families(GenericFamily::SansSerif)
+                .collect();
+            self.font_cx.collection.set_generic_families(
+                GenericFamily::SansSerif,
+                std::iter::once(sans_id).chain(existing),
+            );
+            let existing: Vec<_> = self
+                .font_cx
+                .collection
+                .generic_families(GenericFamily::SystemUi)
+                .collect();
+            self.font_cx.collection.set_generic_families(
+                GenericFamily::SystemUi,
+                std::iter::once(sans_id).chain(existing),
+            );
+        }
+        if let Some(mono_id) = mono_id {
+            let existing: Vec<_> = self
+                .font_cx
+                .collection
+                .generic_families(GenericFamily::Monospace)
+                .collect();
+            self.font_cx.collection.set_generic_families(
+                GenericFamily::Monospace,
+                std::iter::once(mono_id).chain(existing),
+            );
+        }
+    }
+
+    /// Builds the startup report -- see `FontDiagnostics`. Queries the
+    /// collection directly (`fontique::Query`) rather than shaping a real
+    /// string, since all that's needed is which family each axis lands on.
+    pub fn font_diagnostics(&mut self) -> FontDiagnostics {
+        use parley::fontique::{Attributes, FontWidth, QueryStatus};
+        let families_found = self.font_cx.collection.family_names().count();
+        let default_family_id = self
+            .font_cx
+            .collection
+            .generic_families(GenericFamily::SansSerif)
+            .next();
+        let default_family = default_family_id
+            .and_then(|id| self.font_cx.collection.family_name(id).map(str::to_string));
+        let default_mono_family_id = self
+            .font_cx
+            .collection
+            .generic_families(GenericFamily::Monospace)
+            .next();
+        let default_mono_family = default_mono_family_id
+            .and_then(|id| self.font_cx.collection.family_name(id).map(str::to_string));
+
+        // Resolves the family a (generic family, weight, style) query lands
+        // on, without holding the `Query`'s borrow of `collection` across
+        // the `family_name` lookup that needs it back -- the `FamilyId` is
+        // captured out of the closure first, then looked up once `query`
+        // (and its borrow) has been dropped.
+        let mut resolve_family =
+            |generic: GenericFamily, weight: FontWeight, style: FontStyle| -> Option<String> {
+                let mut family_id = None;
+                {
+                    let mut query = self
+                        .font_cx
+                        .collection
+                        .query(&mut self.font_cx.source_cache);
+                    query.set_families([generic]);
+                    query.set_attributes(Attributes {
+                        width: FontWidth::NORMAL,
+                        style,
+                        weight,
+                    });
+                    query.matches_with(|font| {
+                        family_id = Some(font.family.0);
+                        QueryStatus::Stop
+                    });
+                }
+                family_id.and_then(|id| self.font_cx.collection.family_name(id).map(str::to_string))
+            };
+
+        let regular_resolved = resolve_family(
+            GenericFamily::SansSerif,
+            FontWeight::NORMAL,
+            FontStyle::Normal,
+        );
+        let bold_resolved = resolve_family(
+            GenericFamily::SansSerif,
+            FontWeight::BOLD,
+            FontStyle::Normal,
+        );
+        let italic_resolved = resolve_family(
+            GenericFamily::SansSerif,
+            FontWeight::NORMAL,
+            FontStyle::Italic,
+        );
+        let mono_resolved = resolve_family(
+            GenericFamily::Monospace,
+            FontWeight::NORMAL,
+            FontStyle::Normal,
+        );
+
+        FontDiagnostics {
+            families_found,
+            default_family,
+            default_mono_family,
+            regular_resolved,
+            bold_resolved,
+            italic_resolved,
+            mono_resolved,
         }
     }
 }
@@ -159,7 +375,7 @@ pub struct TextBuffer {
     /// `set_spans` forces `shaped` to `None` directly, the same way `edit`
     /// does, since spans change far less often than a naive equality check
     /// on the whole `Vec` would cost to compute every frame.
-    shaped: Option<(TextAttrs, Option<f32>)>,
+    shaped: Option<(TextAttrs, Option<f32>, f32)>,
 }
 
 impl TextBuffer {
@@ -215,19 +431,42 @@ impl TextBuffer {
         Vec2::new(self.layout.width(), self.layout.height())
     }
 
-    /// Lay the text out, unless it is already laid out for these attributes and
-    /// this width.
-    pub fn shape(&mut self, data: &mut TextData, attrs: &TextAttrs, width: Option<f32>) {
-        if self.shaped.as_ref() == Some(&(attrs.clone(), width)) {
+    /// Lay the text out, unless it is already laid out for these
+    /// attributes, this width and this density.
+    ///
+    /// **`attrs.font_size`/`line_height` and every span's own `font_size`
+    /// are density-independent (dp) units, multiplied by `density` here --
+    /// the one place text crosses from the widget tree's dp sizes into the
+    /// physical pixels the shaper and rasteriser (`TextData::place`) both
+    /// then work in.** This is what makes glyphs sharp on a dense display:
+    /// before this existed, `font_size` was already a physical-pixel value
+    /// (RUST.md's P0 box's global-scale stopgap resolved density by
+    /// stretching the whole rendered frame afterward instead), so a glyph
+    /// was rasterised small and then upscaled by whatever the display's
+    /// scale factor was -- exactly the blur Iris's report described.
+    /// Multiplying here instead means the font size hitting `ScaleContext`
+    /// in `place` below is already the display's real physical size, so
+    /// the atlas holds a bitmap at the resolution it is actually shown at.
+    /// `GlyphKey.size` already keys on that resolved `font_size`
+    /// (`(font_size * 16.0).round()`), so a cache entry is naturally per
+    /// physical size with no change needed there.
+    pub fn shape(
+        &mut self,
+        data: &mut TextData,
+        attrs: &TextAttrs,
+        width: Option<f32>,
+        density: f32,
+    ) {
+        if self.shaped.as_ref() == Some(&(attrs.clone(), width, density)) {
             return;
         }
         let mut builder = data
             .layout_cx
             .ranged_builder(&mut data.font_cx, &self.text, 1.0, true);
         builder.push_default(StyleProperty::FontFamily(attrs.family.family()));
-        builder.push_default(StyleProperty::FontSize(attrs.font_size));
+        builder.push_default(StyleProperty::FontSize(attrs.font_size * density));
         builder.push_default(StyleProperty::LineHeight(LineHeight::Absolute(
-            attrs.line_height,
+            attrs.line_height * density,
         )));
         builder.push_default(StyleProperty::Brush(attrs.color));
         for span in &self.spans {
@@ -239,7 +478,7 @@ impl TextBuffer {
                 builder.push(StyleProperty::FontFamily(family.family()), range.clone());
             }
             if let Some(size) = span.font_size {
-                builder.push(StyleProperty::FontSize(size), range.clone());
+                builder.push(StyleProperty::FontSize(size * density), range.clone());
             }
             if span.bold {
                 builder.push(StyleProperty::FontWeight(FontWeight::BOLD), range.clone());
@@ -255,7 +494,7 @@ impl TextBuffer {
         self.layout.break_all_lines(width);
         self.layout
             .align(Alignment::Start, AlignmentOptions::default());
-        self.shaped = Some((attrs.clone(), width));
+        self.shaped = Some((attrs.clone(), width, density));
     }
 }
 
@@ -372,8 +611,9 @@ impl TextData {
         attrs: &TextAttrs,
         width: Option<f32>,
         textures: &mut Textures,
+        density: f32,
     ) -> RenderedText {
-        buffer.shape(self, attrs, width);
+        buffer.shape(self, attrs, width, density);
         let glyphs = self.place(buffer, textures);
         RenderedText {
             glyphs: std::sync::Arc::new(glyphs),

iris/core/src/render/mod.rs

@@ -4,6 +4,7 @@ use crate::{
     util::{HashMap, Vec2},
 };
 use data::WindowUniform;
+use pollster::FutureExt;
 use wgpu::{
     util::{BufferInitDescriptor, DeviceExt},
     *,
@@ -65,6 +66,57 @@ pub fn device_limits() -> Limits {
     }
 }
 
+/// A capped log of wgpu's *uncaptured* errors -- everything that reaches
+/// `Device::on_uncaptured_error` rather than one of `UiRenderNode::new`'s
+/// own error scopes, i.e. every wgpu error raised outside device/pipeline
+/// creation: a validation failure during an ordinary frame's `update`/
+/// `draw`, for instance. wgpu's default handler for these is `panic!` with
+/// no caller able to intervene -- exactly what aborted the P0 bench APK
+/// once already (this file's `UiRenderNode::new` doc comment) -- so both
+/// platform backends install a handler here instead of leaving the default
+/// in place, per RUST.md's P0 box ("every wgpu uncaptured error ... it
+/// must never panic in release").
+///
+/// Cheap to `Clone` (an `Arc` around the real storage) rather than a
+/// process-wide static, so a caller builds one alongside its `Device`,
+/// hands one clone to `on_uncaptured_error`'s closure and keeps the other
+/// for the Diagnostics page to read -- context passed explicitly, per
+/// AGENTS.md/CODE_RULES.md's "no globals" rather than reached for through a
+/// `OnceLock`.
+#[derive(Clone)]
+pub struct WgpuErrorLog {
+    errors: std::sync::Arc<std::sync::Mutex<std::collections::VecDeque<String>>>,
+}
+
+/// How many uncaptured errors the log keeps -- old ones drop off the front
+/// rather than being trimmed on read, so a build spraying errors every
+/// frame doesn't grow this without bound.
+const WGPU_ERROR_LOG_CAP: usize = 20;
+
+impl Default for WgpuErrorLog {
+    fn default() -> Self {
+        Self {
+            errors: std::sync::Arc::new(std::sync::Mutex::new(std::collections::VecDeque::new())),
+        }
+    }
+}
+
+impl WgpuErrorLog {
+    pub fn record(&self, error: impl std::fmt::Display) {
+        let mut errors = self.errors.lock().unwrap();
+        if errors.len() >= WGPU_ERROR_LOG_CAP {
+            errors.pop_front();
+        }
+        errors.push_back(error.to_string());
+    }
+
+    /// A snapshot for the Diagnostics page -- cloned rather than held,
+    /// since the lock must not outlive one call.
+    pub fn snapshot(&self) -> Vec<String> {
+        self.errors.lock().unwrap().iter().cloned().collect()
+    }
+}
+
 pub struct UiRenderNode {
     uniform_group: BindGroup,
     primitive_layout: BindGroupLayout,
@@ -152,7 +204,7 @@ impl UiRenderNode {
         queue: &Queue,
         ui: &mut UiData,
         ui_render: &mut UiRenderState,
-    ) {
+    ) -> FrameUpdateStats {
         self.active.clear();
         for (i, primitives) in ui_render.layers.iter_mut() {
             self.active.push(i);
@@ -236,6 +288,10 @@ impl UiRenderNode {
         if rebuild_main {
             self.rsc_group = Self::rsc_group(device, &self.rsc_layout, &self.textures);
         }
+        FrameUpdateStats {
+            masks_resized,
+            moves_resized,
+        }
     }
 
     /// Takes a size rather than a window type: this is the only thing the
@@ -251,26 +307,69 @@ impl UiRenderNode {
         queue.write_buffer(&self.window_buffer, 0, bytemuck::cast_slice(slice));
     }
 
-    pub fn new(device: &Device, queue: &Queue, config: &SurfaceConfiguration) -> Self {
+    /// Builds every bind group layout, the pipeline, and the two storage
+    /// buffers this needs -- fallibly, since this is exactly the call that
+    /// aborted the process on Iris's phone in a release build with no
+    /// message beyond "wgpu error: Validation Error" (RUST.md's P0 box,
+    /// "iris bench crash on the phone, 2026-09-06"). wgpu's own default
+    /// behaviour for an uncaptured error is `panic!` with no caller able to
+    /// intervene, so every `create_bind_group_layout`/`create_render_pipeline`
+    /// call below runs inside three nested error scopes (one per
+    /// `ErrorFilter`) instead: whichever scope catches something, its
+    /// `wgpu::Error`'s `Display` is wgpu-core's own `format_error` output
+    /// (`"Validation Error\n\nCaused by:\n  ..."`, the same text the panic
+    /// would have printed before Android's crash reporter truncated it) and
+    /// becomes this function's `Err`. Both callers
+    /// (`android::render::AndroidRenderer::new`, `default::render::
+    /// UiRenderer::new`) already call `Device`-creation with
+    /// `pollster::block_on`, so returning a plain `Result` here rather than
+    /// making this `async fn` keeps that same synchronous shape.
+    pub fn new(
+        device: &Device,
+        queue: &Queue,
+        config: &SurfaceConfiguration,
+        window_size: impl Into<Vec2>,
+    ) -> Result<Self, String> {
+        // Popped in reverse of this order, once every creation call below
+        // has run -- `Device::push_error_scope`'s own contract.
+        let oom_scope = device.push_error_scope(ErrorFilter::OutOfMemory);
+        let validation_scope = device.push_error_scope(ErrorFilter::Validation);
+        let internal_scope = device.push_error_scope(ErrorFilter::Internal);
+
         let shader = device.create_shader_module(ShaderModuleDescriptor {
             label: Some("UI Shape Shader"),
             source: ShaderSource::Wgsl(SHAPE_SHADER.into()),
         });
 
-        // Seeded from the surface's own size, not `WindowUniform::default()`
-        // (0, 0): the vertex shader divides by `window.dim` to reach clip
-        // space, so a window this buffer disagrees with means every
-        // primitive's position is NaN/Inf and is dropped before
-        // rasterization -- the clear colour still reaches the screen (the
-        // pass runs regardless) while nothing drawn on top of it ever does.
-        // winit's backend gets away with the old default because winit
-        // fires an initial `WindowEvent::Resized` that calls `resize()`
-        // before the first frame; android-view has no such automatic
-        // event, so `AndroidRenderer::new` built a node whose window buffer
-        // was never corrected -- this is I2's "nothing draws" bug (RUST.md).
-        let window_uniform = WindowUniform {
-            width: config.width as f32,
-            height: config.height as f32,
+        // Seeded from the caller's own reported size, not
+        // `WindowUniform::default()` (0, 0): the vertex shader divides by
+        // `window.dim` to reach clip space, so a window this buffer
+        // disagrees with means every primitive's position is NaN/Inf and is
+        // dropped before rasterization -- the clear colour still reaches
+        // the screen (the pass runs regardless) while nothing drawn on top
+        // of it ever does. winit's backend gets away with the old default
+        // because winit fires an initial `WindowEvent::Resized` that calls
+        // `resize()` before the first frame; android-view has no such
+        // automatic event, so `AndroidRenderer::new` built a node whose
+        // window buffer was never corrected -- this is I2's "nothing draws"
+        // bug (RUST.md).
+        //
+        // **Deliberately not `config.width`/`config.height`**: those are
+        // the surface's *physical* pixel size, which the swapchain needs,
+        // but everything downstream of this uniform (layout, hit-testing,
+        // glyph/rect positions) works in the caller's own units -- on
+        // Android that's *logical* (physical / density) since RUST.md's P0
+        // box ("text is far too small"), on desktop it's whatever
+        // `default::render::UiRenderer::new` already divides by
+        // `window.scale_factor()`. Passing it in explicitly, rather than
+        // deriving it from `config` here, is what keeps this crate from
+        // needing to know either platform's notion of density at all.
+        let window_uniform = {
+            let size = window_size.into();
+            WindowUniform {
+                width: size.x,
+                height: size.y,
+            }
         };
         let window_buffer = device.create_buffer_init(&BufferInitDescriptor {
             label: Some("window"),
@@ -373,7 +472,18 @@ impl UiRenderNode {
             cache: None,
         });
 
-        Self {
+        // Reverse of the push order above. Only one of these should ever be
+        // `Some` in practice -- three separate scopes exist to name *which*
+        // kind of error it was, not because more than one is expected at
+        // once.
+        let internal_err = internal_scope.pop().block_on();
+        let validation_err = validation_scope.pop().block_on();
+        let oom_err = oom_scope.pop().block_on();
+        if let Some(err) = validation_err.or(oom_err).or(internal_err) {
+            return Err(err.to_string());
+        }
+
+        Ok(Self {
             uniform_group,
             primitive_layout,
             rsc_layout,
@@ -387,7 +497,7 @@ impl UiRenderNode {
             move_offsets,
             masks_layout,
             masks_group,
-        }
+        })
     }
 
     fn bind_group_0(
@@ -554,4 +664,26 @@ impl UiRenderNode {
     pub fn take_image_bind_group_creates(&mut self) -> u64 {
         self.textures.take_bind_group_creates()
     }
+
+    /// Atlas-array `grow_array` calls since the last call -- same calling
+    /// convention as `take_image_bind_group_creates` (call once per frame,
+    /// before `update()`, to read exactly the previous frame's tally). Part
+    /// of the Diagnostics page's per-frame report (RUST.md's P0 box, "the
+    /// first input frame" investigation): if a report ever shows a grow
+    /// landing on the same frame the glyphs vanished, that is the
+    /// coincidence to chase first.
+    pub fn take_atlas_pages_grown(&mut self) -> u64 {
+        self.textures.take_pages_grown()
+    }
+}
+
+/// What `UiRenderNode::update` changed this frame that a caller building a
+/// per-frame diagnostic report cares about -- see `take_image_bind_group_creates`/
+/// `take_atlas_pages_grown` for the two counters this doesn't carry (they
+/// use the existing "call before update()" convention instead, so as not
+/// to disturb `bench_images`' documented counts).
+#[derive(Clone, Copy, Debug, Default)]
+pub struct FrameUpdateStats {
+    pub masks_resized: bool,
+    pub moves_resized: bool,
 }

iris/core/src/render/texture.rs

@@ -67,6 +67,12 @@ pub struct GpuTextures {
     /// unchanging image list is zero, the same way `UiRenderState`'s
     /// `draw_count`/`region_mut_count` prove the layout side.
     bind_group_creates: u64,
+    /// `grow_array` calls since the last `take_pages_grown` -- the
+    /// Diagnostics page's per-frame report (RUST.md's P0 box, "the first
+    /// input frame" investigation) reads this alongside `bind_group_creates`
+    /// to say whether *this* frame's glyph disappearance, if any, coincided
+    /// with the atlas array being recreated.
+    pages_grown: u64,
 }
 
 impl GpuTextures {
@@ -226,6 +232,7 @@ impl GpuTextures {
     /// array's view, which invalidates every bind group that referenced it,
     /// so this also rebuilds all of them before returning.
     fn grow_array(&mut self, rsc_layout: &BindGroupLayout) {
+        self.pages_grown += 1;
         let new_capacity = self.array_capacity * 2;
         let new_texture = Self::create_array_texture(&self.device, new_capacity);
         if self.page_count > 0 {
@@ -392,6 +399,7 @@ impl GpuTextures {
             sampler,
             null_view,
             bind_group_creates: 0,
+            pages_grown: 0,
         }
     }
 
@@ -402,6 +410,12 @@ impl GpuTextures {
         std::mem::take(&mut self.bind_group_creates)
     }
 
+    /// Reads and zeroes the atlas-array-grow counter -- see `pages_grown`'s
+    /// field comment.
+    pub fn take_pages_grown(&mut self) -> u64 {
+        std::mem::take(&mut self.pages_grown)
+    }
+
     pub fn array_view(&self) -> &TextureView {
         &self.array_view
     }

iris/core/src/ui/painter.rs

@@ -165,8 +165,10 @@ impl<'a> Painter<'a> {
         attrs: &TextAttrs,
         width: Option<f32>,
     ) -> RenderedText {
+        let density = self.state.density;
         let ui = self.rsc.ui_mut();
-        ui.text.render(buffer, attrs, width, &mut ui.textures)
+        ui.text
+            .render(buffer, attrs, width, &mut ui.textures, density)
     }
 
     /// Draw a laid-out string: one quad per glyph, all sampling the atlas.
@@ -210,6 +212,12 @@ impl<'a> Painter<'a> {
         self.state.output_size
     }
 
+    /// Physical pixels per `dp` -- see `UiRenderState::density`'s field
+    /// doc. What `Len::dp`'s `apply_rest` call resolves against.
+    pub fn density(&self) -> f32 {
+        self.state.density
+    }
+
     pub fn px_size(&mut self) -> Vec2 {
         self.region.size().to_abs(self.state.output_size)
     }

iris/core/src/ui/render_state.rs

@@ -9,6 +9,12 @@ pub struct UiRenderState {
     pub active: HashMap<WidgetId, ActiveData>,
     pub layers: PrimitiveLayers,
     pub(super) output_size: Vec2,
+    /// Physical pixels per `dp` -- see `Len::dp`'s field doc. `1.0` (an
+    /// unscaled display) until a backend that knows its own density calls
+    /// `set_density` (Android's `content_scale`, read at `surface_changed`
+    /// time); the winit backend has no analogous per-monitor value wired up
+    /// yet and stays at the default.
+    pub(super) density: f32,
 
     old_root: Option<WidgetId>,
     resized: bool,
@@ -35,6 +41,7 @@ impl UiRenderState {
             active: Default::default(),
             layers: Default::default(),
             output_size: Vec2::ZERO,
+            density: 1.0,
             old_root: None,
             resized: false,
             draw_started: Default::default(),
@@ -60,6 +67,20 @@ impl UiRenderState {
         self.resized = true;
     }
 
+    /// Sets the physical-pixels-per-dp ratio every `Len::dp` in the tree
+    /// resolves against from the next layout pass on -- see `density`'s
+    /// field doc. Not folded into `resize` because the two change on
+    /// different triggers (a surface resize on every rotation or keyboard
+    /// open; a density change only if the app follows the display to a
+    /// different screen, which Android surfaces separately).
+    pub fn set_density(&mut self, density: f32) {
+        self.density = density;
+    }
+
+    pub fn density(&self) -> f32 {
+        self.density
+    }
+
     pub fn update<'a>(&mut self, root: impl Into<Option<&'a StrongWidget>>, rsc: &mut dyn UiRsc) {
         // safety mechanism for memory leaks; might wanna return a result instead so user can
         // decide whether to panic or not
@@ -311,7 +332,7 @@ impl UiRenderState {
         };
         let from = active
             .size
-            .to_uivec2()
+            .to_uivec2(self.density)
             .align(RegionAlign::TOP_LEFT)
             .within(&active.region);
         let slot = active.move_slot;

iris/desktop-app/src/app.rs

@@ -15,23 +15,19 @@
 //! +-----------+--------------------------------------+
 //! ```
 //!
-//! **Deliberately left simple, and why**: every incoming SSE event refolds
-//! the *entire* transcript (`client_core::transcript_fold::fold_event` is
-//! already `O(items)` and a desktop session's conversation is small) and
-//! rebuilds the whole right-hand widget tree from scratch, rather than
-//! reaching for `TranscriptScreen::push_row`'s incremental append.
-//! `push_row` cannot update a row already on screen -- only append a new
-//! one -- and a streaming assistant reply is exactly a row whose *text*
-//! keeps changing after it first appears (see `transcript-ui`'s own doc on
-//! `fold_event` folding deltas into one growing item). A full rebuild
-//! shows that growth correctly at the cost of redrawing everything each
-//! time; fine for this proof, wrong for a long, fast-streaming transcript
-//! -- the incremental path that fixes it needs `transcript-ui` to expose
-//! updating a row in place, which it does not yet. The composer's
-//! in-progress text survives a rebuild (`rebuild_transcript`'s
-//! `in_progress` local) since the user typing a followup while a reply
-//! streams in is the one case a naive rebuild would otherwise lose data
-//! on.
+//! **Incoming SSE events go through `TranscriptScreen::apply`**, not a
+//! full rebuild: `client_core::transcript_fold::fold_event` folds the new
+//! item list as before, then `apply` updates only the row(s) that actually
+//! changed (almost always the one still-open assistant message a delta
+//! landed in) instead of rebuilding the whole right-hand widget tree from
+//! scratch. `rebuild_transcript` still runs the whole tree once, for a
+//! freshly loaded/selected session and for `apply`'s own rare
+//! full-rebuild fallback (a `group_tool_runs` regroup touching a row
+//! before the tail). The composer's in-progress text survives a rebuild
+//! (`rebuild_transcript`'s `in_progress` local) since the user typing a
+//! followup while a reply streams in is the one case a naive rebuild
+//! would otherwise lose data on -- `apply`'s own path never touches the
+//! composer at all, so this only matters on the fallback.
 //!
 //! Background network I/O (`client_core::api`/`event_stream`, both
 //! blocking by design -- see `client-core`'s `Cargo.toml`) runs on plain
@@ -209,8 +205,12 @@ impl DefaultAppState for Client {
                 event,
             } => {
                 if self.current(&session_id, generation) {
+                    let old_items = self.items.clone();
                     self.items = fold_event(&self.items, &event);
-                    self.rebuild_transcript(rsc);
+                    match &self.screen {
+                        Some(screen) => screen.apply(rsc, &old_items, &self.items),
+                        None => self.rebuild_transcript(rsc),
+                    }
                 }
             }
             AppEvent::StreamEnded {

iris/examples/message_list.rs

@@ -68,12 +68,15 @@ fn build_row<Rsc: UiRsc + 'static>(rsc: &mut Rsc, i: usize) -> StrongWidget {
         let mut span = Span::empty(Dir::DOWN);
         span.push(text);
         span.push(img);
-        span.pad(8.0).background(rect(tint)).add_strong(rsc).any()
+        span.pad(dp(8.0))
+            .background(rect(tint))
+            .add_strong(rsc)
+            .any()
     } else {
         wtext(row_text(i))
             .wrap(true)
             .color(text_color)
-            .pad(8.0)
+            .pad(dp(8.0))
             .background(rect(tint))
             .add_strong(rsc)
             .any()

iris/src/android/mod.rs

@@ -23,7 +23,8 @@ mod view;
 pub use insets::Insets;
 pub use render::AndroidRenderer;
 pub use view::{
-    AndroidAppState, AndroidRsc, AndroidUiState, HasAndroidUiState, IrisViewPeer, new_peer,
+    AndroidAppState, AndroidRsc, AndroidUiState, HasAndroidUiState, IrisViewPeer, WindowInsets,
+    new_peer,
 };
 
 /// Registers the extra native methods this backend needs beyond what

iris/src/android/render.rs

@@ -48,10 +48,65 @@ pub struct AndroidRenderer {
     config: SurfaceConfiguration,
     encoder: CommandEncoder,
     pub ui: UiRenderNode,
+    /// The adapter identity, kept past `new()` for the Diagnostics page --
+    /// `Adapter` itself is not `Clone`, so the three fields the page shows
+    /// are copied out once here rather than holding the adapter.
+    pub adapter_name: String,
+    pub adapter_backend: Backend,
+    pub adapter_driver: String,
+    /// Every uncaptured wgpu error since this renderer was created -- see
+    /// `iris_core::WgpuErrorLog`'s doc comment. Installed on `device` in
+    /// `new()`, kept here so the Diagnostics page and the per-frame log in
+    /// `update()` can both read it without a global.
+    pub wgpu_errors: iris_core::WgpuErrorLog,
+    /// Frames drawn on this surface -- what gates the first-10-frames log
+    /// `update()` writes (RUST.md's P0 box, "the first input frame"
+    /// investigation): a fresh surface is exactly what Iris's own report
+    /// says renders correctly at first, so the frames that matter are the
+    /// first several after each `surface_changed`, not an arbitrary window
+    /// during a long-running session.
+    frame_count: u64,
+    /// Physical pixels per dp -- see `android::view::AndroidUiState::
+    /// content_scale`'s field comment for what this feeds.
+    content_scale: f32,
+}
+
+/// One frame's worth of the counters `render/mod.rs`'s doc comments on
+/// `FrameUpdateStats`/`take_image_bind_group_creates`/
+/// `take_atlas_pages_grown` describe -- assembled here because the three
+/// live on two different calling conventions (`FrameUpdateStats` from this
+/// exact `update()` call; the other two describe the *previous* frame,
+/// same as `bench_images`' existing use of them) and a diagnostic reader
+/// should not have to know that split.
+#[derive(Clone, Copy, Debug, Default)]
+pub struct FrameDiagnostics {
+    pub masks_resized: bool,
+    pub moves_resized: bool,
+    /// From the previous frame's `update()` -- see the struct doc.
+    pub atlas_pages_grown_prev: u64,
+    pub image_bind_group_creates_prev: u64,
 }
 
 impl AndroidRenderer {
-    pub fn new(window: NativeWindow, width: u32, height: u32) -> Self {
+    /// `Err` holds a full, human-readable report -- wgpu's own error text
+    /// (`UiRenderNode::new`'s doc comment) plus the adapter identity and
+    /// the limits/downlevel flags bind-group-layout validation checks
+    /// against -- rather than the panic wgpu's default error handler would
+    /// otherwise raise with no caller able to see it. This is what aborted
+    /// the P0 bench APK on Iris's phone with only "wgpu error: Validation
+    /// Error" surviving into the crash report (RUST.md's P0 box, "iris
+    /// bench crash on the phone, 2026-09-06"): `create_bind_group_layout`
+    /// validates against *this* adapter's downlevel capabilities and
+    /// limits, which a desktop GPU and the emulator's software renderers
+    /// never exercised. The caller (`android::view::IrisViewPeer::
+    /// surface_changed`) logs this one-line-flattened and shows it on
+    /// screen instead of aborting the process.
+    pub fn new(
+        window: NativeWindow,
+        width: u32,
+        height: u32,
+        content_scale: f32,
+    ) -> Result<Self, String> {
         // `force-gles` (RUST.md's I5 "Where iris's frame time goes") swaps
         // the software-Vulkan (SwiftShader) path for GLES/virgl on the same
         // build, to isolate whether the backend itself explains the frame
@@ -84,6 +139,18 @@ impl AndroidRenderer {
             .block_on()
             .expect("Could not get adapter!");
 
+        // Requesting the device itself still panics on failure: that is a
+        // `RequestDeviceError` (a limit or feature the adapter cannot grant
+        // at all), a different and already-diagnosable failure from the one
+        // this function now recovers from -- `RUST.md`'s "Software mode ...
+        // crashes for a third, different reason" is exactly that class, and
+        // its message already names the limit and the requested/allowed
+        // values with no truncation risk (it never reaches wgpu's
+        // uncaptured-error path). What this function's `Result` return
+        // covers is the *next* class of failure: the adapter grants the
+        // device, and validation only fails once a specific bind group
+        // layout is checked against it.
+
         // Same request as the winit backend's `UiRenderer::new` -- no
         // binding-array features, see TEXTURES.md's "Recommended shape".
         // `iris_core::device_limits()` is shared between the two backends;
@@ -96,6 +163,30 @@ impl AndroidRenderer {
             .block_on()
             .expect("Could not get device!");
 
+        // wgpu's default handler for an error raised outside `UiRenderNode::
+        // new`'s own error scopes (i.e. everything past device creation --
+        // an ordinary frame's `update`/`draw`) is `panic!`, unconditionally,
+        // with no caller able to intervene: the same mechanism that aborted
+        // the P0 bench APK once already, just at a different call site. Log
+        // and record instead of letting that default stand -- RUST.md's P0
+        // box, "every wgpu uncaptured error ... it must never panic in
+        // release".
+        let wgpu_errors = iris_core::WgpuErrorLog::default();
+        let wgpu_errors_for_handler = wgpu_errors.clone();
+        device.on_uncaptured_error(std::sync::Arc::new(move |error| {
+            log::error!("iris wgpu uncaptured error: {error}");
+            wgpu_errors_for_handler.record(error);
+        }));
+
+        let info = adapter.get_info();
+        let adapter_name = info.name.clone();
+        let adapter_backend = info.backend;
+        let adapter_driver = if info.driver_info.is_empty() {
+            info.driver.clone()
+        } else {
+            format!("{} {}", info.driver, info.driver_info)
+        };
+
         let surface_caps = surface.get_capabilities(&adapter);
         let surface_format = surface_caps
             .formats
@@ -117,16 +208,121 @@ impl AndroidRenderer {
         surface.configure(&device, &config);
 
         let encoder = Self::create_encoder(&device);
-        let ui = UiRenderNode::new(&device, &queue, &config);
+        // Physical pixels, matching the swapchain's own `width`/`height`
+        // exactly -- see `android::view::AndroidUiState::content_scale`'s
+        // field comment for why this is no longer divided into a separate
+        // logical space (that stopgap is what made text blurry, RUST.md's
+        // P0 box). `Len::dp` folds the density in at layout time instead,
+        // so nothing here needs to know it at all.
+        let window_size = iris_core::util::Vec2::new(width as f32, height as f32);
+        let ui = match UiRenderNode::new(&device, &queue, &config, window_size) {
+            Ok(ui) => ui,
+            Err(wgpu_error) => return Err(Self::diagnostic(&adapter, &wgpu_error)),
+        };
 
-        Self {
+        Ok(Self {
             surface,
             device,
             queue,
             config,
             encoder,
             ui,
-        }
+            adapter_name,
+            adapter_backend,
+            adapter_driver,
+            wgpu_errors,
+            frame_count: 0,
+            content_scale,
+        })
+    }
+
+    /// The adapter identity plus every limit and downlevel flag
+    /// `create_bind_group_layout` validates a storage buffer or texture
+    /// binding against, followed by wgpu's own error text -- everything a
+    /// person reading this off a screenshot needs to tell "this adapter
+    /// lacks X" from "this is a bug in the layout." Named explicitly rather
+    /// than `{limits:?}`/`{flags:?}` wholesale, because `Limits` alone is
+    /// dozens of fields nobody asked for -- these are exactly the ones
+    /// `UiRenderNode::new`'s layouts (`rsc_layout`, `masks_layout`,
+    /// `primitive_layout`) can fail against, per `CreateBindGroupLayoutError`
+    /// (`wgpu-core::binding_model`) and its downlevel-flag checks
+    /// (`wgpu-core::device::resource`, `VERTEX_STORAGE` in particular --
+    /// the one storage buffer here, `move_offsets`, that is visible to the
+    /// vertex stage).
+    fn diagnostic(adapter: &Adapter, wgpu_error: &str) -> String {
+        let info = adapter.get_info();
+        let limits = adapter.limits();
+        let downlevel = adapter.get_downlevel_capabilities();
+        format!(
+            "iris could not start rendering. Copy this text and send it to Iris.\n\n\
+             adapter: {name} ({backend:?}), driver: {driver} {driver_info}\n\
+             limits: max_storage_buffers_per_shader_stage={max_storage_buffers} \
+             max_sampled_textures_per_shader_stage={max_sampled_textures} \
+             max_bind_groups={max_bind_groups} \
+             max_bindings_per_bind_group={max_bindings} \
+             max_storage_buffer_binding_size={max_storage_binding} \
+             min_storage_buffer_offset_alignment={min_storage_align}\n\
+             downlevel flags: {flags:?}\n\n\
+             {wgpu_error}",
+            name = info.name,
+            backend = info.backend,
+            driver = info.driver,
+            driver_info = info.driver_info,
+            max_storage_buffers = limits.max_storage_buffers_per_shader_stage,
+            max_sampled_textures = limits.max_sampled_textures_per_shader_stage,
+            max_bind_groups = limits.max_bind_groups,
+            max_bindings = limits.max_bindings_per_bind_group,
+            max_storage_binding = limits.max_storage_buffer_binding_size,
+            min_storage_align = limits.min_storage_buffer_offset_alignment,
+            flags = downlevel.flags,
+        )
+    }
+
+    /// The Diagnostics page's whole report: adapter identity, font
+    /// resolution, the atlas's own view count, every uncaptured wgpu error
+    /// so far, and the frame report -- RUST.md's P0 box, "a named
+    /// `Diagnostics` control ... adapter info, limits, fonts found, atlas
+    /// format/pages, wgpu errors so far, frame report". One string rather
+    /// than a struct the caller formats, since the only consumer is a
+    /// plain `TextView` with a "copy this and send it to Iris" affordance,
+    /// the same shape `surface_changed`'s crash report already uses
+    /// (UI_RULES.md: a failure -- or here, a state worth reporting --
+    /// carries enough to act on where it's shown).
+    pub fn diagnostics_report(
+        &self,
+        font: &iris_core::FontDiagnostics,
+        frame_report: &str,
+    ) -> String {
+        let errors = self.wgpu_errors.snapshot();
+        let errors_text = if errors.is_empty() {
+            "none".to_string()
+        } else {
+            errors.join("\n  ")
+        };
+        format!(
+            "iris diagnostics. Copy this text and send it to Iris.\n\n\
+             adapter: {name} ({backend:?}), driver: {driver}\n\
+             content_scale: {content_scale}\n\
+             atlas format: Rgba8Unorm, views live: {views}\n\
+             fonts: {families_found} families found, default={default_family:?} \
+             mono={default_mono_family:?}\n\
+             fonts resolved: regular={regular:?} bold={bold:?} italic={italic:?} \
+             mono={mono:?}\n\
+             wgpu errors since surface creation:\n  {errors_text}\n\n\
+             {frame_report}",
+            name = self.adapter_name,
+            backend = self.adapter_backend,
+            driver = self.adapter_driver,
+            content_scale = self.content_scale,
+            views = self.ui.view_count(),
+            families_found = font.families_found,
+            default_family = font.default_family,
+            default_mono_family = font.default_mono_family,
+            regular = font.regular_resolved,
+            bold = font.bold_resolved,
+            italic = font.italic_resolved,
+            mono = font.mono_resolved,
+        )
     }
 
     fn create_encoder(device: &Device) -> CommandEncoder {
@@ -135,8 +331,31 @@ impl AndroidRenderer {
         })
     }
 
-    pub fn update(&mut self, ui: &mut UiData, render: &mut UiRenderState) {
-        self.ui.update(&self.device, &self.queue, ui, render);
+    /// Returns what changed this frame -- see `FrameDiagnostics`'s doc
+    /// comment for why two of its four fields describe the *previous*
+    /// frame rather than this one. `IrisViewPeer::render` logs this for
+    /// the first `DIAGNOSTIC_FRAMES` frames after each `surface_changed`,
+    /// per RUST.md's P0 box ("the first input frame" investigation): the
+    /// glyph-wipe Iris reported happens on the first tap or scroll after a
+    /// fresh surface, so that is exactly the window a report needs to
+    /// cover, not an arbitrary slice of a long session.
+    pub fn update(&mut self, ui: &mut UiData, render: &mut UiRenderState) -> FrameDiagnostics {
+        let atlas_pages_grown_prev = self.ui.take_atlas_pages_grown();
+        let image_bind_group_creates_prev = self.ui.take_image_bind_group_creates();
+        let stats = self.ui.update(&self.device, &self.queue, ui, render);
+        self.frame_count += 1;
+        FrameDiagnostics {
+            masks_resized: stats.masks_resized,
+            moves_resized: stats.moves_resized,
+            atlas_pages_grown_prev,
+            image_bind_group_creates_prev,
+        }
+    }
+
+    /// Frames drawn on this surface so far -- see `frame_count`'s field
+    /// comment.
+    pub fn frame_count(&self) -> u64 {
+        self.frame_count
     }
 
     /// Draws and presents one frame, returning the time spent in
@@ -179,15 +398,27 @@ impl AndroidRenderer {
         submit_start.elapsed()
     }
 
+    /// Physical pixels -- the unit layout and hit-testing use, matching
+    /// the window uniform's own units. See
+    /// `android::view::AndroidUiState::content_scale`'s field comment.
     pub fn size(&self) -> iris_core::util::Vec2 {
-        (self.config.width, self.config.height).into()
+        iris_core::util::Vec2::new(self.config.width as f32, self.config.height as f32)
     }
 
+    /// Reconfigures the surface and rewrites the window uniform for a new
+    /// physical size -- deliberately the *only* two things this does.
+    /// `device`, `ui`'s atlas, buffers and bind groups are untouched, so a
+    /// call here (as opposed to a fresh `AndroidRenderer::new`) never
+    /// invalidates a glyph the CPU-side cache already placed in the atlas.
+    /// See `android::view::IrisViewPeer::surface_changed`'s doc comment for
+    /// why that distinction matters -- it is what keeps text on screen
+    /// across an IME resize.
     pub fn resize(&mut self, width: u32, height: u32) {
         self.config.width = width;
         self.config.height = height;
         self.surface.configure(&self.device, &self.config);
-        self.ui.resize((width, height), &self.queue);
+        let size = iris_core::util::Vec2::new(width as f32, height as f32);
+        self.ui.resize(size, &self.queue);
     }
 }
 

iris/src/android/view.rs

@@ -4,7 +4,11 @@ use accesskit_android::Adapter as AccessAdapter;
 use android_view::{
     AccessibilityNodeInfo, AccessibilityNodeProvider, Bundle, CallbackCtx, Context,
     InputConnection, KeyEvent, MotionEvent, Rect, View, ViewPeer,
-    jni::{JNIEnv, sys::jint},
+    jni::{
+        JNIEnv, JavaVM,
+        objects::{GlobalRef, JValue},
+        sys::jint,
+    },
     ndk::event::{Keycode, MotionAction},
 };
 // `marker::Sized` explicitly: `crate::prelude::*` below also brings in the
@@ -29,6 +33,10 @@ use super::{
 /// `Option` because a `SurfaceView`'s surface does not outlive backgrounding
 /// the way a winit `Window` does -- `surfaceDestroyed`/`surfaceCreated` can
 /// happen any number of times over the life of one `IrisViewPeer`.
+/// How many frames after each `surface_changed` `render()` logs a full
+/// diagnostic line for -- see the log site's own comment.
+const DIAGNOSTIC_FRAMES: u64 = 10;
+
 pub struct AndroidUiState {
     pub root: Option<StrongWidget>,
     pub renderer: Option<AndroidRenderer>,
@@ -62,10 +70,41 @@ pub struct AndroidUiState {
     /// because `dumpsys gfxinfo` cannot see a `SurfaceView`'s own
     /// GPU-drawn frames at all. See `iris_core::FrameReport`'s own doc.
     pub frame_report: FrameReport,
+    /// `DisplayMetrics.density` (`new_peer`'s doc comment): physical pixels
+    /// per dp on this device, read once at view construction and carried
+    /// on `UiRenderState::density` (`render.set_density`, `new_peer`) from
+    /// then on -- every `Len::dp` in the widget tree resolves against it at
+    /// layout time (`Len::dp`'s field doc, IRIS_TODO.md's
+    /// "density-independent length unit" item, 2026-09-06).
+    ///
+    /// **Everything else in this module is physical pixels, matching the
+    /// real wgpu surface/swapchain resolution** -- window size, touch
+    /// coordinates, insets. That is a correction from an earlier version
+    /// of this comment, which had `window_size`/`surface_changed`'s
+    /// `UiRenderState::resize` call divide by `content_scale` into a
+    /// *logical* coordinate space instead, as a global stopgap for
+    /// RUST.md's P0 box's phone report ("text is far too small"). That
+    /// stopgap fixed the size but not the *sharpness*: dividing to logical
+    /// units meant a `16.0`-sized glyph rasterised at 16 physical px and
+    /// then implicitly upscaled ~3x by the NDC mapping onto the real
+    /// physical framebuffer -- the exact "blurry ... glyphs drawn at
+    /// logical size and stretched by the scale" Iris reported next.
+    /// Resolving `dp` at layout time replaces it: a widget author writes
+    /// `dp(16)` for a size that should look the same physical size on any
+    /// density, and everything downstream (layout, hit-testing, the window
+    /// uniform, and the font size handed to the text shaper) works in the
+    /// display's own physical pixels throughout, so nothing is
+    /// rasterised at one resolution and displayed at another.
+    pub content_scale: f32,
+    /// The last insets `render()` saw -- compared each frame so
+    /// `AndroidAppState::on_insets_changed` fires only when they actually
+    /// change (once at startup for the status bar, again if the device
+    /// rotates), not every frame.
+    last_insets: Insets,
 }
 
 impl AndroidUiState {
-    fn new(shared: Rc<RefCell<Shared>>) -> Self {
+    fn new(shared: Rc<RefCell<Shared>>, content_scale: f32) -> Self {
         Self {
             root: None,
             renderer: None,
@@ -78,6 +117,8 @@ impl AndroidUiState {
             access_adapter: Default::default(),
             access: AccessTree::new(),
             frame_report: FrameReport::new(),
+            content_scale,
+            last_insets: Insets::default(),
         }
     }
 
@@ -107,6 +148,61 @@ pub trait AndroidAppState: HasAndroidUiState {
     fn back_pressed(&mut self, rsc: &mut AndroidRsc<Self>, render: &mut UiRenderState) -> bool {
         false
     }
+    /// Called once, right after `new`, with a fresh `JavaVM` handle and a
+    /// global reference to this app's own `View` -- for a caller that
+    /// needs to call into Java itself beyond what a [`RequestRedraw`]
+    /// handle already covers (P0's bench build calling
+    /// `BatteryManager`/`ClipboardManager` through the view's `Context`,
+    /// docs/RUST.md). Not folded into `new` itself: most implementors need
+    /// nothing here, and `new`'s job is building the widget tree, not
+    /// holding a platform handle -- the default does nothing. `vm`/`view`
+    /// are independent handles from the ones `new_peer` keeps for its own
+    /// `RequestRedraw` (a fresh `get_java_vm`/`new_global_ref` each), so
+    /// storing them has no effect on that mechanism.
+    #[allow(unused_variables)]
+    fn platform_ready(&mut self, rsc: &mut AndroidRsc<Self>, vm: JavaVM, view: GlobalRef) {}
+    /// Called from `render()` whenever `AndroidUiState::insets()` differs
+    /// from what it was last frame -- once at startup for the status bar
+    /// (RUST.md's P0 box: "the status-bar inset is not applied" reported
+    /// the two top buttons sitting under it, because nothing read `.top`
+    /// at all), and again on a rotation or the keyboard opening/closing.
+    /// `insets` is in the same physical-pixel units everything else in the
+    /// tree now uses (`AndroidUiState::content_scale`'s field comment), so
+    /// a widget can add it to a layout size directly -- `dp(...) +
+    /// abs(insets.top)` if the widget wants a density-independent size
+    /// plus the system bar's own (already-physical) height. The default
+    /// does nothing -- most screens have no chrome that sits under a
+    /// system bar.
+    #[allow(unused_variables)]
+    fn on_insets_changed(&mut self, rsc: &mut AndroidRsc<Self>, insets: WindowInsets) {}
+}
+
+/// `insets::Insets` as `f32`, for the widget-facing callback above -- a
+/// distinct type from `insets::Insets` so a caller of `on_insets_changed`
+/// is not coupled to that module's own (`i32`, JNI-shaped) representation.
+/// Both are physical pixels; this used to divide by `content_scale` into a
+/// separate *logical* unit (hence the old name, `LogicalInsets`), back when
+/// the rest of layout was logical too -- see `AndroidUiState::content_scale`'s
+/// field comment for why that stopgap is gone.
+#[derive(Clone, Copy, Default, Debug, PartialEq)]
+pub struct WindowInsets {
+    pub left: f32,
+    pub top: f32,
+    pub right: f32,
+    pub bottom: f32,
+    pub ime_bottom: f32,
+}
+
+impl WindowInsets {
+    fn from_physical(insets: Insets) -> Self {
+        Self {
+            left: insets.left as f32,
+            top: insets.top as f32,
+            right: insets.right as f32,
+            bottom: insets.bottom as f32,
+            ime_bottom: insets.ime_bottom as f32,
+        }
+    }
 }
 
 /// The android-view analogue of `default::DefaultRsc` -- identical in
@@ -253,10 +349,23 @@ impl<State: AndroidAppState> IrisViewPeer<State> {
     /// these in until that is root-caused; removing them loses the exact
     /// evidence a `logcat` capture needs to reproduce the state.
     fn render(&mut self, ctx: &mut CallbackCtx) {
-        let ui_state = self.state.android_state();
-        if ui_state.renderer.is_none() {
+        if self.state.android_state().renderer.is_none() {
             return;
         }
+        // See `AndroidAppState::on_insets_changed`'s doc comment: fires
+        // exactly when insets actually differ from last frame, not every
+        // frame -- most frames this is one `Insets` equality check against
+        // a `Copy` struct. Done before `ui_state` is bound below, since
+        // `on_insets_changed` needs `&mut self.state`/`&mut self.rsc` both.
+        let ui_state = self.state.android_state();
+        let current_insets = ui_state.insets();
+        if current_insets != ui_state.last_insets {
+            let physical = WindowInsets::from_physical(current_insets);
+            self.state.android_state_mut().last_insets = current_insets;
+            self.state.on_insets_changed(&mut self.rsc, physical);
+        }
+
+        let ui_state = self.state.android_state();
         log::debug!(
             "render(): root={:?} widgets={} active={} root_px={:?} out_size={:?}",
             ui_state.root.is_some(),
@@ -281,7 +390,27 @@ impl<State: AndroidAppState> IrisViewPeer<State> {
         let Some(renderer) = &mut ui_state.renderer else {
             return;
         };
-        renderer.update(&mut self.rsc.ui, &mut self.render);
+        let frame_diagnostics = renderer.update(&mut self.rsc.ui, &mut self.render);
+        // First `DIAGNOSTIC_FRAMES` frames after each `surface_changed`
+        // only -- RUST.md's P0 box, "the first input frame" investigation:
+        // the glyph-wipe Iris reported happens on the first tap or scroll
+        // after a fresh surface, so a report from that window is what
+        // would show whether an atlas grow, a masks/move_offsets resize, or
+        // a fresh wgpu error coincided with it. `frame_count()` was just
+        // incremented inside `update()`, so `<=` counts frame 1 through
+        // `DIAGNOSTIC_FRAMES` inclusive.
+        if renderer.frame_count() <= DIAGNOSTIC_FRAMES {
+            log::info!(
+                "iris frame diagnostics: frame={} masks_resized={} moves_resized={} \
+                 atlas_pages_grown_prev={} image_bind_group_creates_prev={} wgpu_errors={}",
+                renderer.frame_count(),
+                frame_diagnostics.masks_resized,
+                frame_diagnostics.moves_resized,
+                frame_diagnostics.atlas_pages_grown_prev,
+                frame_diagnostics.image_bind_group_creates_prev,
+                renderer.wgpu_errors.snapshot().len(),
+            );
+        }
         let submit_to_present = renderer.draw();
         self.state
             .android_state_mut()
@@ -324,6 +453,31 @@ fn show_soft_input<'local>(env: &mut JNIEnv<'local>, view: &View<'local>) {
     imm.show_soft_input(env, view, 0);
 }
 
+/// Replaces the activity's content with a plain, selectable, scrollable
+/// text view holding `report` -- the on-screen half of `surface_changed`'s
+/// renderer-failure path (UI_RULES.md: "a failure is reported where it
+/// happened, and says what to do next," here "copy this and send it").
+/// Goes through an ordinary instance method on the Java side
+/// (`IrisView.showRendererError`) rather than a new `native` method: this
+/// call is Rust reaching *into* Java, the opposite direction from every
+/// `native fn` android-view/`IrisView` declare, and an ordinary virtual
+/// call resolves against `ctx.view`'s real runtime class (`IrisView`) the
+/// same way any other JNI method call here does. Silently does nothing on
+/// any JNI failure -- there is no more-fallback screen to fall back to,
+/// and the `log::error!` in `surface_changed` already reached logcat
+/// first.
+fn show_renderer_error<'local>(env: &mut JNIEnv<'local>, view: &View<'local>, report: &str) {
+    let Ok(message) = env.new_string(report) else {
+        return;
+    };
+    let _ = env.call_method(
+        &view.0,
+        "showRendererError",
+        "(Ljava/lang/String;)V",
+        &[JValue::Object(message.as_ref())],
+    );
+}
+
 impl<State: AndroidAppState> ViewPeer for IrisViewPeer<State> {
     fn on_key_down<'local>(
         &mut self,
@@ -366,6 +520,8 @@ impl<State: AndroidAppState> ViewPeer for IrisViewPeer<State> {
     ) -> bool {
         self.drain_tasks();
         let action = event.action_masked(&mut ctx.env);
+        // Device (physical) pixels, same space layout now uses throughout
+        // -- see `AndroidUiState::content_scale`'s field comment.
         let x = event.x(&mut ctx.env);
         let y = event.y(&mut ctx.env);
         let ui_state = self.state.android_state_mut();
@@ -418,7 +574,6 @@ impl<State: AndroidAppState> ViewPeer for IrisViewPeer<State> {
         height: i32,
     ) {
         self.drain_tasks();
-        let window = holder.surface(&mut ctx.env).to_native_window(&mut ctx.env);
         // The layout engine's own notion of the canvas size is separate
         // from the wgpu surface's -- winit's backend sets it from
         // `WindowEvent::Resized`, and there is no equivalent automatic
@@ -427,13 +582,101 @@ impl<State: AndroidAppState> ViewPeer for IrisViewPeer<State> {
         // nothing but the clear colour: the widget tree laid out against
         // whatever size `UiRenderState::new` starts at instead of the
         // surface's real one.
-        self.render.resize((width as u32, height as u32));
-        // Drop the old renderer (and the surface it owns) before building
-        // one from the new window -- see `AndroidRenderer`'s doc comment.
-        let ui_state = self.state.android_state_mut();
-        ui_state.renderer = None;
-        ui_state.renderer = Some(AndroidRenderer::new(window, width as u32, height as u32));
-        self.render(ctx);
+        //
+        // **Physical pixels, matching `AndroidRenderer`'s own
+        // `size()`/`resize()`/`new()`** -- `AndroidUiState::content_scale`'s
+        // field comment. This call sets `UiRenderState::output_size`, which
+        // every `rel`/`rest` length resolves against and every `abs`
+        // pixel-region compares to directly; a `dp(56)` height now folds
+        // in the density at `Len::apply_rest` time instead of this call
+        // dividing the whole window into a separate logical space, which
+        // is what used to make every `abs`-unit size (a fixed `.height(56)`
+        // in particular) mean something different from a `rest`-based one.
+        self.render.resize((width as f32, height as f32));
+
+        // **Reuse the existing renderer (device, atlas, buffers, bind
+        // groups) when one is already live -- only reconfigure the
+        // surface.** `surfaceChanged` fires on *every* size or format
+        // change, not only on a genuinely new `Surface`/window: showing
+        // the IME under `adjustResize` resizes the same `SurfaceView` and
+        // is reported through this exact callback. Rebuilding the whole
+        // `AndroidRenderer` here used to mean a fresh `UiRenderNode::new`
+        // -- a brand-new, empty glyph atlas and fresh GPU buffers -- while
+        // `iris_core`'s CPU-side glyph cache (`primitive/text.rs`) kept the
+        // atlas coordinates it had already handed out against the *old*
+        // atlas. Every glyph then drew from a UV rectangle that pointed
+        // into a texture that had just been recreated empty, so text
+        // vanished on the first keyboard open while rects (which never go
+        // through the atlas) kept drawing -- exactly the "rectangles stay,
+        // glyphs disappear" Iris reported. Confirmed by reading this path
+        // end to end (no fresh-atlas rebuild anywhere in `resize()` below,
+        // only in `AndroidRenderer::new`) before changing anything, per
+        // AGENTS.md's "verify before finishing".
+        //
+        // `AndroidRenderer::resize` only reconfigures the wgpu surface and
+        // rewrites the window uniform -- device, atlas, buffers and bind
+        // groups are untouched, so the glyph cache's coordinates stay
+        // valid. A genuinely new surface (after `surface_destroyed`, e.g.
+        // backgrounding) still goes through `AndroidRenderer::new` below,
+        // since `renderer` is `None` in that case.
+        let already_live = self.state.android_state().renderer.is_some();
+        if already_live {
+            let ui_state = self.state.android_state_mut();
+            ui_state
+                .renderer
+                .as_mut()
+                .expect("checked Some above")
+                .resize(width as u32, height as u32);
+            self.render(ctx);
+            return;
+        }
+
+        let window = holder.surface(&mut ctx.env).to_native_window(&mut ctx.env);
+        // `AndroidRenderer::new` used to panic here through wgpu's own
+        // default uncaptured-error handler on a bind-group-layout
+        // validation failure -- exactly what aborted the P0 bench APK on
+        // Iris's phone with the message truncated to "wgpu error:
+        // Validation Error" and nothing else recoverable from the crash
+        // report (RUST.md's P0 box, "iris bench crash on the phone,
+        // 2026-09-06"). It now returns the full diagnostic instead; this is
+        // the one place in the app that can turn it into something a
+        // person can read, since `ctx.view`/`ctx.env` (needed to reach the
+        // Java side) are only in scope inside a `ViewPeer` callback.
+        //
+        // `content_scale` reaches `AndroidRenderer` only for the
+        // Diagnostics page's report text now -- window size and the
+        // shader's window uniform are physical pixels throughout (see the
+        // `resize` call above), not divided by it.
+        let content_scale = self.state.android_state().content_scale;
+        match AndroidRenderer::new(window, width as u32, height as u32, content_scale) {
+            Ok(renderer) => {
+                self.state.android_state_mut().renderer = Some(renderer);
+                self.render(ctx);
+            }
+            Err(report) => {
+                // One line for logcat (UI_RULES.md: "the full text for
+                // whoever can read the log" lives here), the multi-line
+                // original on screen -- `show_renderer_error` below.
+                log::error!("iris renderer init failed: {}", report.replace('\n', " | "));
+                // Deferred, not called directly: `Activity::setContentView`
+                // tears the old view hierarchy down synchronously, which
+                // fires `IrisView`'s own `onFocusChanged` before
+                // `setContentView` returns -- straight back into this same
+                // `IrisViewPeer` through `on_focus_changed` while
+                // `with_peer` (android-view's dispatch, `view.rs` upstream)
+                // still holds this peer's `RefCell` borrow for the
+                // `surface_changed` call in progress. Found by inducing a
+                // validation error and hitting `RefCell already borrowed`
+                // at exactly that reentrant call (RUST.md's P0 box).
+                // `push_dynamic_deferred_callback` runs after `with_peer`
+                // drops the borrow, which is what every other callback in
+                // this file that reaches into Java already relies on
+                // (`raise_if_enabled`, above).
+                ctx.push_dynamic_deferred_callback(move |env, view| {
+                    show_renderer_error(env, view, &report);
+                });
+            }
+        }
     }
 
     fn surface_destroyed<'local>(
@@ -544,10 +787,19 @@ impl<State: AndroidAppState> AccessibilityNodeProvider for IrisViewPeer<State> {
 /// `register_view_class`, which wants a plain function pointer) -- see
 /// `iris/android-app/src/lib.rs`.
 pub fn new_peer<'local, State: AndroidAppState>(
-    env: JNIEnv<'local>,
+    mut env: JNIEnv<'local>,
     view: View<'local>,
-    _context: Context<'local>,
+    context: Context<'local>,
 ) -> android_view::jni::sys::jlong {
+    // `DisplayMetrics.density` -- physical pixels per dp on this device.
+    // Read once here, at the one point in this file already handed a
+    // `Context`, and carried on `AndroidUiState` from then on (see
+    // `content_scale`'s field comment for what depends on it).
+    let content_scale = context
+        .resources(&mut env)
+        .display_metrics(&mut env)
+        .density(&mut env);
+    log::info!("iris: new_peer content_scale={content_scale}");
     let vm = env.get_java_vm().unwrap();
     let global_view = env.new_global_ref(&view.0).unwrap();
     let redraw: Arc<dyn RequestRedraw> = Arc::new(AndroidRedrawHandle::new(vm, global_view));
@@ -559,12 +811,22 @@ pub fn new_peer<'local, State: AndroidAppState>(
         state: Default::default(),
         _state: PhantomData,
     };
+    // See `TextData::density`'s field doc for why this is set alongside
+    // `render.set_density` below rather than read from there.
+    rsc.ui.text.density = content_scale;
     let shared = Rc::new(RefCell::new(Shared::default()));
-    let ui_state = AndroidUiState::new(shared.clone());
-    let state = State::new(ui_state, &mut rsc);
+    let ui_state = AndroidUiState::new(shared.clone(), content_scale);
+    let mut state = State::new(ui_state, &mut rsc);
+    let platform_vm = env.get_java_vm().unwrap();
+    let platform_view = env.new_global_ref(&view.0).unwrap();
+    state.platform_ready(&mut rsc, platform_vm, platform_view);
+    let mut render = UiRenderState::new();
+    // Every `Len::dp` in the tree resolves against this from now on -- see
+    // `UiRenderState::density`'s field doc and `Len::dp`'s.
+    render.set_density(content_scale);
     let peer = IrisViewPeer {
         rsc,
-        render: UiRenderState::new(),
+        render,
         state,
         task_recv,
     };

iris/src/default/input.rs

@@ -11,10 +11,15 @@ pub struct Input {
 }
 
 impl Input {
-    pub fn event(&mut self, event: &WindowEvent) -> bool {
+    /// `scale_factor` converts winit's physical-pixel event coordinates
+    /// into the same logical units `UiRenderNode`'s window uniform now uses
+    /// (`default::render::UiRenderer::new`'s doc comment) -- without it,
+    /// a cursor position and the widget tree it's tested against would be
+    /// in two different units on any monitor whose scale factor isn't 1.0.
+    pub fn event(&mut self, event: &WindowEvent, scale_factor: f32) -> bool {
         match event {
             WindowEvent::CursorMoved { position, .. } => {
-                self.cursor.pos = Vec2::new(position.x as f32, position.y as f32);
+                self.cursor.pos = Vec2::new(position.x as f32, position.y as f32) / scale_factor;
                 self.cursor.exists = true;
             }
             WindowEvent::MouseInput { state, button, .. } => {
@@ -30,7 +35,9 @@ impl Input {
             WindowEvent::MouseWheel { delta, .. } => {
                 let mut delta = match *delta {
                     MouseScrollDelta::LineDelta(x, y) => Vec2::new(x, y),
-                    MouseScrollDelta::PixelDelta(pos) => Vec2::new(pos.x as f32, pos.y as f32),
+                    MouseScrollDelta::PixelDelta(pos) => {
+                        Vec2::new(pos.x as f32, pos.y as f32) / scale_factor
+                    }
                 };
                 if delta.x == 0.0 && self.modifiers.shift {
                     delta.x = delta.y;
@@ -68,8 +75,13 @@ impl Input {
 
 impl DefaultUiState {
     pub fn window_size(&self) -> Vec2 {
-        let size = self.renderer.window().inner_size();
-        (size.width, size.height).into()
+        let window = self.renderer.window();
+        let size = window.inner_size();
+        let scale_factor = window.scale_factor() as f32;
+        Vec2::new(
+            size.width as f32 / scale_factor,
+            size.height as f32 / scale_factor,
+        )
     }
 
     pub fn cursor_state(&self) -> &CursorState {

iris/src/default/mod.rs

@@ -246,7 +246,8 @@ impl<State: DefaultAppState> AppState for DefaultApp<State> {
         ui_state
             .access_adapter
             .process_event(&ui_state.window, &event);
-        let input_changed = ui_state.input.event(&event);
+        let scale_factor = ui_state.renderer.window().scale_factor() as f32;
+        let input_changed = ui_state.input.event(&event, scale_factor);
         let cursor_state = ui_state.cursor_state().clone();
         let old = ui_state.focus;
         if cursor_state.buttons.left.is_start() {

iris/src/default/render.rs

@@ -1,5 +1,5 @@
 use crate::task::RequestRedraw;
-use iris_core::{UiData, UiRenderNode, UiRenderState};
+use iris_core::{UiData, UiRenderNode, UiRenderState, util::Vec2};
 use pollster::FutureExt;
 use std::sync::Arc;
 use wgpu::*;
@@ -66,7 +66,13 @@ impl UiRenderer {
         self.config.width = size.width;
         self.config.height = size.height;
         self.surface.configure(&self.device, &self.config);
-        self.ui.resize((size.width, size.height), &self.queue);
+        // Logical, matching `new`'s own seed -- see the comment there.
+        let scale_factor = self.window.scale_factor() as f32;
+        let logical = Vec2::new(
+            size.width as f32 / scale_factor,
+            size.height as f32 / scale_factor,
+        );
+        self.ui.resize(logical, &self.queue);
     }
 
     fn create_encoder(device: &Device) -> CommandEncoder {
@@ -141,7 +147,28 @@ impl UiRenderer {
 
         let encoder = Self::create_encoder(&device);
 
-        let ui = UiRenderNode::new(&device, &queue, &config);
+        // Unlike the Android backend, the desktop backend has no on-screen
+        // fallback to show a diagnostic through, so a renderer-creation
+        // failure still panics here -- but now with wgpu's full "Caused
+        // by:" chain as the message, since `UiRenderNode::new` returns it
+        // rather than letting wgpu's own default handler panic first (see
+        // that function's doc comment).
+        // Logical size (physical / `scale_factor`), matching what the
+        // Android backend now reports too (`android::render::
+        // AndroidRenderer::new`, `content_scale`) -- the swapchain still
+        // configures at the real physical resolution above; only the
+        // window uniform layout/hit-testing agree on is scaled. Without
+        // this a window on any monitor whose scale factor isn't 1.0 would
+        // have the identical "everything too small" bug RUST.md's P0 box
+        // found on Iris's phone, just never noticed here because this
+        // crate's own dev monitors happen to run at 1.0.
+        let scale_factor = window.scale_factor() as f32;
+        let logical_size = Vec2::new(
+            size.width as f32 / scale_factor,
+            size.height as f32 / scale_factor,
+        );
+        let ui = UiRenderNode::new(&device, &queue, &config, logical_size)
+            .expect("Could not create iris render node!");
 
         Self {
             surface,

iris/src/sense.rs

@@ -1,5 +1,6 @@
 use crate::prelude::*;
 use std::{
+    collections::VecDeque,
     ops::{BitOr, Deref, DerefMut},
     rc::Rc,
     time::{Duration, Instant},
@@ -491,7 +492,25 @@ impl DragArbiter {
                 } else if dy.abs() > DRAG_SLOP && dy.abs() >= dx.abs() {
                     self.state = ArbiterState::Panning;
                     self.last = pos;
-                    DragOutcome::Pan(dy)
+                    // `dy` here is the *whole* drag since `press_start`,
+                    // not since the last frame -- nothing panned while
+                    // `Undecided` was withholding the slop, so applying it
+                    // in full on this one frame is a visible jump the
+                    // instant `DRAG_SLOP` is crossed (IRIS_TODO.md's
+                    // "scrolling down sometimes jitters the text," root-
+                    // caused by tracing `List`'s per-frame offset against
+                    // a synthetic monotonic drag: the offset held flat for
+                    // every `Undecided` frame, then stepped by several
+                    // frames' worth of motion at once on the frame slop
+                    // was crossed, before resuming ordinary per-frame
+                    // deltas). Only the excess past the slop threshold is
+                    // real, undecided motion the reader hasn't seen
+                    // reflected yet -- so only that excess is applied now,
+                    // the same way Android's own touch handling consumes
+                    // `ViewConfiguration.getScaledTouchSlop()` once from
+                    // the first scroll past it rather than replaying the
+                    // whole pre-threshold drag in one step.
+                    DragOutcome::Pan(dy - DRAG_SLOP.copysign(dy))
                 } else if now.duration_since(self.origin_at) >= LONG_PRESS
                     && dx.abs() <= DRAG_SLOP
                     && dy.abs() <= DRAG_SLOP
@@ -510,6 +529,390 @@ impl DragArbiter {
     pub fn release(&mut self) {
         self.state = ArbiterState::Idle;
     }
+
+    /// Whether the arbiter's current gesture (if any) has committed to
+    /// panning -- what a caller checks at release time to decide whether
+    /// to hand the tracked velocity to [`crate::widget::List::fling`], per
+    /// IRIS_TODO.md's "swiping has no momentum": a fling must only follow
+    /// a pan, never a text selection that happened to end with the finger
+    /// still moving.
+    pub fn is_panning(&self) -> bool {
+        matches!(self.state, ArbiterState::Panning)
+    }
+}
+
+/// How far back a [`VelocityTracker`] looks when estimating a fling's
+/// initial speed -- Android's own `VelocityTracker` defaults to a similar
+/// short window so a gesture's last flick dominates over its slower start.
+const VELOCITY_WINDOW: Duration = Duration::from_millis(100);
+
+/// Tracks a drag's speed along one axis from its last ~100ms of motion, so
+/// a release can be handed a realistic initial velocity for
+/// [`AndroidFlingSpline`]/[`FlingCalculator`] rather than a single frame's
+/// noisy last delta. Fed one timestamped pan delta per frame
+/// (`add_sample`, the same `dy`/`-dy` quantity `DragArbiter::update`'s
+/// `Pan` outcome already carries) and answers `velocity()` in units per
+/// second, matching whatever unit the deltas were in.
+#[derive(Default)]
+pub struct VelocityTracker {
+    /// `(when, delta)` pairs, oldest first, trimmed to `VELOCITY_WINDOW`
+    /// on every `add_sample` -- so this never grows past however many
+    /// frames land in that window.
+    samples: VecDeque<(Instant, f32)>,
+}
+
+impl VelocityTracker {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Forget everything -- called on a fresh press, so a new gesture's
+    /// velocity is never contaminated by the tail of the previous one.
+    pub fn reset(&mut self) {
+        self.samples.clear();
+    }
+
+    /// Record one frame's motion. `delta` is this frame's movement since
+    /// the last sample, not a cumulative position.
+    pub fn add_sample(&mut self, delta: f32, at: Instant) {
+        self.samples.push_back((at, delta));
+        while let Some(&(when, _)) = self.samples.front() {
+            if at.duration_since(when) > VELOCITY_WINDOW {
+                self.samples.pop_front();
+            } else {
+                break;
+            }
+        }
+    }
+
+    /// The estimated speed, in units-per-second, over whatever samples
+    /// currently fall inside the tracking window: total motion divided by
+    /// the elapsed time between the oldest and newest sample still held.
+    /// `0.0` with fewer than two samples (no time span to divide by).
+    pub fn velocity(&self) -> f32 {
+        if self.samples.len() < 2 {
+            return 0.0;
+        }
+        let total: f32 = self.samples.iter().map(|&(_, d)| d).sum();
+        let span = self
+            .samples
+            .back()
+            .unwrap()
+            .0
+            .duration_since(self.samples.front().unwrap().0)
+            .as_secs_f32();
+        if span <= 0.0 { 0.0 } else { total / span }
+    }
+}
+
+/// Android's fling deceleration curve, ported from AOSP's
+/// `android.widget.OverScroller.SplineOverScroller` (the same curve
+/// Compose's `androidx.compose.ui.gestures.AndroidFlingSpline` and
+/// `androidx.compose.foundation.gestures.FlingCalculator` reuse) so a
+/// fling here travels the same distance a Compose `LazyColumn`'s own
+/// `ScrollableDefaults.flingBehavior()` would for the same initial
+/// velocity -- RUST.md's "Benchmark v2" box asked the two apps' fling
+/// phase to be comparable, and IRIS_TODO.md's "swiping has no momentum"
+/// asked for the same physics a reader's muscle memory already expects
+/// from every other Android scroll view.
+///
+/// The curve is a cubic-Bezier-derived spline sampled into two lookup
+/// tables at start-up (`SPLINE`, built once via [`std::sync::OnceLock`]):
+/// `SPLINE_POSITION[i]`/`SPLINE_TIME[i]` give the fraction of total
+/// distance/time elapsed at the `i`th of 100 even steps along the curve's
+/// own parameter. A lookup at an arbitrary time fraction interpolates
+/// between the two bracketing samples.
+mod android_fling_spline {
+    use std::sync::OnceLock;
+
+    const NB_SAMPLES: usize = 100;
+    /// Where the two cubic tension lines cross (AOSP's own constant name
+    /// and value, `SplineOverScroller.INFLEXION`).
+    pub(super) const INFLEXION: f32 = 0.35;
+    const START_TENSION: f32 = 0.5;
+    const END_TENSION: f32 = 1.0;
+    const P1: f32 = START_TENSION * INFLEXION;
+    const P2: f32 = 1.0 - END_TENSION * (1.0 - INFLEXION);
+
+    pub(super) struct Spline {
+        position: [f32; NB_SAMPLES + 1],
+        time: [f32; NB_SAMPLES + 1],
+    }
+
+    fn build() -> Spline {
+        let mut position = [0.0f32; NB_SAMPLES + 1];
+        let mut time = [0.0f32; NB_SAMPLES + 1];
+        let (mut x_min, mut y_min) = (0.0f32, 0.0f32);
+        for i in 0..NB_SAMPLES {
+            let alpha = i as f32 / NB_SAMPLES as f32;
+
+            let mut x_max = 1.0f32;
+            let (mut x, mut coef);
+            loop {
+                x = x_min + (x_max - x_min) / 2.0;
+                coef = 3.0 * x * (1.0 - x);
+                let tx = coef * ((1.0 - x) * START_TENSION + x * END_TENSION) + x * x * x;
+                if (tx - alpha).abs() < 1e-5 {
+                    break;
+                }
+                if tx > alpha {
+                    x_max = x;
+                } else {
+                    x_min = x;
+                }
+            }
+            position[i] = coef * ((1.0 - x) * P1 + x * P2) + x * x * x;
+
+            let mut y_max = 1.0f32;
+            let (mut y, mut coef_y);
+            loop {
+                y = y_min + (y_max - y_min) / 2.0;
+                coef_y = 3.0 * y * (1.0 - y);
+                let dy = coef_y * ((1.0 - y) * START_TENSION + y * END_TENSION) + y * y * y;
+                if (dy - alpha).abs() < 1e-5 {
+                    break;
+                }
+                if dy > alpha {
+                    y_max = y;
+                } else {
+                    y_min = y;
+                }
+            }
+            time[i] = coef_y * ((1.0 - y) * P1 + y * P2) + y * y * y;
+        }
+        position[NB_SAMPLES] = 1.0;
+        time[NB_SAMPLES] = 1.0;
+        Spline { position, time }
+    }
+
+    static SPLINE: OnceLock<Spline> = OnceLock::new();
+
+    /// The fraction of total distance covered at `time_fraction` (0..=1
+    /// of the fling's total duration). Finds the bracketing samples in
+    /// `SPLINE_TIME` and interpolates linearly between their matching
+    /// `SPLINE_POSITION` entries, exactly as AOSP's `SplineOverScroller
+    /// .flingPosition` does.
+    pub(super) fn distance_fraction(time_fraction: f32) -> f32 {
+        let spline = SPLINE.get_or_init(build);
+        let t = time_fraction.clamp(0.0, 1.0);
+        let index = ((t * NB_SAMPLES as f32) as usize).min(NB_SAMPLES - 1);
+        let t_inf = spline.time[index];
+        let t_sup = spline.time[index + 1];
+        let d_inf = spline.position[index];
+        let d_sup = spline.position[index + 1];
+        let span = t_sup - t_inf;
+        if span <= 0.0 {
+            d_inf
+        } else {
+            d_inf + (d_sup - d_inf) * (t - t_inf) / span
+        }
+    }
+}
+
+/// AOSP `SplineOverScroller`'s two other physical constants: the default
+/// `ViewConfiguration.getScrollFriction()` and the deceleration rate a
+/// friction of `0.84` per frame at 60Hz corresponds to
+/// (`ln(0.78)/ln(0.9)`, `SplineOverScroller.DECELERATION_RATE`).
+const FLING_FRICTION: f32 = 0.015;
+fn deceleration_rate() -> f32 {
+    (0.78f32.ln()) / (0.9f32.ln())
+}
+const GRAVITY_EARTH: f32 = 9.80665;
+
+/// Turns an initial fling velocity into a total travel distance and
+/// duration, following AOSP `SplineOverScroller`'s own closed-form
+/// formulas (`getSplineFlingDistance`/the duration half of `fling()`) --
+/// ported the same way Compose's `FlingCalculator` is, including its
+/// `density`-dependent physical coefficient (`computeDeceleration`,
+/// `GravityEarth * 39.37 * density * 160 * friction`). Density and
+/// velocity/distance units cancel algebraically as long as velocity and
+/// the returned distance share one pixel space (physical or logical) --
+/// [`crate::widget::List::fling`] relies on exactly that cancellation to
+/// avoid needing a display density of its own, since iris's `List`
+/// already works in logical (density-independent) pixels throughout.
+pub struct FlingCalculator {
+    physical_coefficient: f32,
+}
+
+impl FlingCalculator {
+    pub fn new(density: f32) -> Self {
+        Self {
+            physical_coefficient: GRAVITY_EARTH * 39.37 * density * 160.0 * FLING_FRICTION,
+        }
+    }
+
+    fn deceleration_for(&self, velocity: f32) -> f32 {
+        (android_fling_spline::INFLEXION * velocity.abs()
+            / (FLING_FRICTION * self.physical_coefficient))
+            .ln()
+    }
+
+    /// Total signed distance the fling travels before settling, in the
+    /// same pixel units `velocity` was given in.
+    pub fn distance(&self, velocity: f32) -> f32 {
+        if velocity == 0.0 {
+            return 0.0;
+        }
+        let l = self.deceleration_for(velocity);
+        let rate = deceleration_rate();
+        let magnitude =
+            FLING_FRICTION * self.physical_coefficient * (rate / (rate - 1.0) * l).exp();
+        magnitude.copysign(velocity)
+    }
+
+    /// How long the fling takes to settle.
+    pub fn duration(&self, velocity: f32) -> Duration {
+        if velocity == 0.0 {
+            return Duration::ZERO;
+        }
+        let l = self.deceleration_for(velocity);
+        let rate = deceleration_rate();
+        Duration::from_secs_f32((l / (rate - 1.0)).exp())
+    }
+
+    /// The signed distance covered by `elapsed` into a fling of this
+    /// `velocity` that started at `t0` -- what a per-frame ticker
+    /// (`List::tick_fling`) calls to find how far to have scrolled by now.
+    /// Clamped to the full `distance()` once `elapsed` reaches
+    /// `duration()`, so a caller need not special-case "past the end."
+    pub fn position_at(&self, velocity: f32, elapsed: Duration) -> f32 {
+        let duration = self.duration(velocity);
+        if duration.is_zero() {
+            return 0.0;
+        }
+        let fraction = (elapsed.as_secs_f32() / duration.as_secs_f32()).min(1.0);
+        self.distance(velocity) * android_fling_spline::distance_fraction(fraction)
+    }
+}
+
+#[cfg(test)]
+mod velocity_tracker_tests {
+    use super::*;
+    use std::sync::LazyLock;
+
+    // A single fixed base rather than a fresh `Instant::now()` per call --
+    // computing it once per test keeps every sample's spacing exact
+    // instead of at the mercy of however long the test itself takes to
+    // run between calls, the same reasoning `drag_arbiter_tests::t` uses.
+    static BASE: LazyLock<Instant> = LazyLock::new(Instant::now);
+
+    fn t(ms: u64) -> Instant {
+        *BASE + Duration::from_millis(ms)
+    }
+
+    #[test]
+    fn fewer_than_two_samples_reports_zero() {
+        let mut v = VelocityTracker::new();
+        assert_eq!(v.velocity(), 0.0);
+        v.add_sample(10.0, t(0));
+        assert_eq!(v.velocity(), 0.0);
+    }
+
+    #[test]
+    fn a_steady_drag_reports_its_own_speed() {
+        // 5px every 10ms, 11 samples spanning 100ms, sums to 55px over
+        // 0.1s -- 550px/s by this tracker's own "sum of deltas over the
+        // span between the oldest and newest held sample" definition.
+        let mut v = VelocityTracker::new();
+        for i in 0..=10 {
+            v.add_sample(5.0, t(i * 10));
+        }
+        assert!((v.velocity() - 550.0).abs() < 1.0, "got {}", v.velocity());
+    }
+
+    #[test]
+    fn only_the_last_100ms_of_samples_count() {
+        // An old, fast burst well outside the window followed by a slow,
+        // steady drag should report the recent speed, not the average of
+        // both -- otherwise a flick that trails off would still fling at
+        // its earlier, faster speed. The burst sits 110ms before the last
+        // sample, just past the 100ms window, so it is evicted.
+        let mut v = VelocityTracker::new();
+        v.add_sample(1000.0, t(0)); // will be 110ms old by the last sample
+        for i in 1..=11 {
+            v.add_sample(1.0, t(i * 10)); // 1px/10ms = 100px/s
+        }
+        assert!(
+            (v.velocity() - 110.0).abs() < 5.0,
+            "old burst leaked into the window: got {}",
+            v.velocity()
+        );
+    }
+
+    #[test]
+    fn reset_forgets_prior_samples() {
+        let mut v = VelocityTracker::new();
+        v.add_sample(500.0, t(0));
+        v.add_sample(500.0, t(10));
+        assert!(v.velocity() != 0.0);
+        v.reset();
+        assert_eq!(v.velocity(), 0.0);
+    }
+}
+
+#[cfg(test)]
+mod fling_calculator_tests {
+    use super::*;
+
+    #[test]
+    fn zero_velocity_flings_nowhere() {
+        let calc = FlingCalculator::new(1.0);
+        assert_eq!(calc.distance(0.0), 0.0);
+        assert_eq!(calc.duration(0.0), Duration::ZERO);
+    }
+
+    #[test]
+    fn distance_grows_with_velocity_and_keeps_its_sign() {
+        let calc = FlingCalculator::new(2.75); // a typical phone's density
+        let d_slow = calc.distance(2000.0);
+        let d_fast = calc.distance(12000.0);
+        assert!(d_slow > 0.0);
+        assert!(d_fast > d_slow);
+        assert_eq!(calc.distance(-12000.0), -d_fast);
+    }
+
+    /// Summing the spline's own per-frame position deltas across the
+    /// whole fling has to land within 1% of the closed-form `distance()`
+    /// -- this is the guarantee that `List::tick_fling`'s per-frame reads
+    /// of `position_at` actually add up to the total the fling promised,
+    /// not merely that the two formulas look plausible independently.
+    #[test]
+    fn integrating_position_at_matches_the_closed_form_distance() {
+        let calc = FlingCalculator::new(1.0);
+        for velocity in [1500.0f32, 5000.0, 12000.0, -12000.0] {
+            let total = calc.distance(velocity);
+            let duration = calc.duration(velocity);
+            let final_position = calc.position_at(velocity, duration);
+            let err = (final_position - total).abs() / total.abs();
+            assert!(
+                err < 0.01,
+                "velocity {velocity}: position_at(duration)={final_position} vs distance()={total}, err={err}"
+            );
+        }
+    }
+
+    #[test]
+    fn position_at_is_monotonic_and_clamped_past_the_end() {
+        let calc = FlingCalculator::new(1.0);
+        let velocity = 12000.0f32;
+        let duration = calc.duration(velocity);
+        let total = calc.distance(velocity);
+        let mut last = 0.0;
+        let mut t = Duration::ZERO;
+        while t < duration {
+            let p = calc.position_at(velocity, t);
+            assert!(p >= last - 0.01, "position went backwards at {t:?}");
+            last = p;
+            t += Duration::from_millis(16);
+        }
+        // Well past the end, it stays pinned at the total -- a caller
+        // must be able to ask "where would this fling be" without first
+        // checking whether it has already settled.
+        assert_eq!(
+            calc.position_at(velocity, duration + Duration::from_secs(5)),
+            total
+        );
+    }
 }
 
 #[cfg(test)]
@@ -534,9 +937,13 @@ mod drag_arbiter_tests {
     fn a_vertical_drag_pans_immediately() {
         let mut a = DragArbiter::new();
         a.press_start(Vec2::new(0.0, 0.0), t(0), false);
+        // The transition frame applies only the motion past `DRAG_SLOP`
+        // (20 - 8 = 12), not the full 20px since `press_start` -- see the
+        // `Pan` arm's own comment for why replaying the whole withheld
+        // drag in one step is the scroll-jitter bug this guards against.
         assert_eq!(
             a.update(Vec2::new(0.0, 20.0), t(10)),
-            DragOutcome::Pan(20.0)
+            DragOutcome::Pan(12.0)
         );
         // Subsequent frames keep panning, by the delta since last frame.
         assert_eq!(
@@ -545,6 +952,22 @@ mod drag_arbiter_tests {
         );
     }
 
+    /// Direct regression test for the fix: a slow drag that crosses
+    /// `DRAG_SLOP` by only a fraction of a pixel must not still produce a
+    /// visible jump -- the amount applied on the crossing frame should
+    /// itself shrink toward zero as the crossing gets closer to exactly
+    /// `DRAG_SLOP`, rather than always dumping the whole pre-threshold
+    /// distance at once.
+    #[test]
+    fn crossing_the_slop_by_a_little_pans_by_a_little() {
+        let mut a = DragArbiter::new();
+        a.press_start(Vec2::new(0.0, 0.0), t(0), false);
+        assert_eq!(
+            a.update(Vec2::new(0.0, DRAG_SLOP + 0.5), t(10)),
+            DragOutcome::Pan(0.5)
+        );
+    }
+
     #[test]
     fn a_horizontal_drag_with_nothing_selected_does_not_select() {
         let mut a = DragArbiter::new();
@@ -603,7 +1026,7 @@ mod drag_arbiter_tests {
         a.press_start(Vec2::new(0.0, 0.0), t(0), true);
         assert_eq!(
             a.update(Vec2::new(0.0, 20.0), t(10)),
-            DragOutcome::Pan(20.0)
+            DragOutcome::Pan(12.0)
         );
     }
 
@@ -646,7 +1069,7 @@ mod drag_arbiter_tests {
         a.press_start(Vec2::new(0.0, 700.0), t(0), false);
         assert_eq!(
             a.update(Vec2::new(0.0, 720.0), t(10)),
-            DragOutcome::Pan(20.0)
+            DragOutcome::Pan(12.0)
         );
         assert!(!a.is_idle());
     }

iris/src/widget/list.rs

@@ -102,7 +102,7 @@
 
 use crate::prelude::*;
 use iris_core::util::HashMap;
-use std::collections::VecDeque;
+use std::{collections::VecDeque, sync::Arc, time::Instant};
 
 /// A stable identifier for a loaded row, reused across pages so that a row
 /// already measured and drawn is not treated as new when data is inserted
@@ -213,6 +213,39 @@ pub struct List {
     /// row is evicted (`pop_front`/`pop_back`) so this cannot grow past
     /// however many rows are currently loaded.
     heights: HashMap<RowKey, f32>,
+    /// A fling in progress, or `None` if the list is at rest -- see
+    /// `fling`/`tick_fling`/`is_scrolling`, IRIS_TODO.md's "swiping has no
+    /// momentum."
+    fling: Option<Fling>,
+    /// What `tick_fling` re-arms every frame a fling is still running, so
+    /// the list keeps animating without needing a caller to poll it --
+    /// set once via `set_redraw_handle` by whoever owns the surface this
+    /// list draws into (the same handle `iris::task::Tasks::redraw_handle`
+    /// hands out elsewhere). `None` for a list that never flings
+    /// (headless tests, a caller driving `tick_fling` by hand as
+    /// `bench_client.rs`'s scripted phases do).
+    redraw: Option<Arc<dyn RequestRedraw>>,
+    /// Whether the last `draw` found no more content above the topmost
+    /// visible row (its top edge at or past the viewport's own top, with
+    /// no `prev_slot`) -- what `tick_fling` clamps a fling moving toward
+    /// the start against. Stale (from whatever the last draw found) on a
+    /// list that hasn't drawn yet; `false` by default, matching "assume
+    /// there is more content until a draw proves otherwise."
+    at_start: bool,
+    /// The mirror of `at_start` for the newest end.
+    at_end: bool,
+}
+
+/// One in-flight fling: the physics answer (`FlingCalculator`) plus how
+/// much of its total distance has already been applied to the anchor, so
+/// `tick_fling` only ever moves the list by this frame's *incremental*
+/// delta -- matching every other place in this widget that scrolls by
+/// writing `anchor.offset`.
+struct Fling {
+    calc: FlingCalculator,
+    velocity: f32,
+    started_at: Instant,
+    applied: f32,
 }
 
 impl List {
@@ -226,6 +259,10 @@ impl List {
             snap_end: true,
             viewport_len: 0.0,
             last_viewport_len: 0.0,
+            fling: None,
+            redraw: None,
+            at_start: false,
+            at_end: false,
             pending_tap: None,
             extents: HashMap::default(),
             heights: HashMap::default(),
@@ -317,6 +354,40 @@ impl List {
         self.extents.clear();
     }
 
+    /// Swap the last row's widget for a new one **without moving it**: the
+    /// slot index is unchanged, so an anchor already pointing at this slot
+    /// (in particular `snap_end`'s pinned-to-newest case) stays pinned, and
+    /// an anchor pointing anywhere else -- this row scrolled out of view --
+    /// is untouched, so nothing currently on screen moves. This is what a
+    /// streamed reply needs: the row whose *content* keeps changing after
+    /// it first appears is still the same row by position, even if its
+    /// `RowKey` happens to change too (rare -- only `heights`/`extents` care
+    /// about the key, and both are invalidated here the same way
+    /// `pop_back` already invalidates them for the row it removes).
+    /// `None` if the list is empty. O(1), same as `push_back`/`pop_back`.
+    pub fn replace_back(&mut self, row: ListRow) -> Option<ListRow> {
+        let idx = self.items.len().checked_sub(1)?;
+        let old = std::mem::replace(&mut self.items[idx], row);
+        self.heights.remove(&old.key);
+        self.extents.clear();
+        Some(old)
+    }
+
+    /// Drop every loaded row and reset to the same state `List::new` would
+    /// give -- the fallback path for a change `apply`-style incremental
+    /// callers can't express as a replace-or-append (RUST.md: `group_tool_runs`
+    /// regrouping an earlier row). `more_before`/`more_after` are left
+    /// alone: a full paging reset is a different operation from "the
+    /// content changed," and a caller that wants both calls
+    /// `set_more_before(None)`/`set_more_after(None)` itself.
+    pub fn clear(&mut self) {
+        self.items.clear();
+        self.anchor = None;
+        self.snap_end = true;
+        self.heights.clear();
+        self.extents.clear();
+    }
+
     /// Move the anchor's edge by `amt` pixels. Positive moves later
     /// content into view (mirrors `Scroll::scroll`'s sign convention).
     /// Deliberately unclamped -- see the module doc's "what is not
@@ -327,6 +398,97 @@ impl List {
         }
     }
 
+    /// Give this list a way to ask for another frame on its own, so a
+    /// fling keeps animating without a caller polling it every tick --
+    /// see the `redraw` field's doc. Pass the same handle
+    /// `iris::task::Tasks::redraw_handle` hands a `spawn`ed task; a list
+    /// that never calls this can still `fling`, but has to be driven by a
+    /// caller-owned loop instead (`bench_client.rs`'s scripted phases do
+    /// exactly that, since they need to await settling rather than let it
+    /// run in the background).
+    pub fn set_redraw_handle(&mut self, handle: Arc<dyn RequestRedraw>) {
+        self.redraw = Some(handle);
+    }
+
+    /// Start a fling at `velocity_px_per_s` (this widget's own pixel
+    /// space, same sign convention as `scroll`'s `amt`: positive continues
+    /// moving later content into view). Cancels any fling already in
+    /// progress. A caller with a live touch/press must cancel this on the
+    /// next touch-down (`cancel_fling`) -- `AndroidFlingSpline`'s curve
+    /// has no idea a finger came back down, and Android's own `Scroller`
+    /// relies on the view calling `abortAnimation` for the same reason.
+    ///
+    /// Density cancels out of the underlying spline as long as velocity
+    /// and the distance it produces share one pixel space (see
+    /// `FlingCalculator`'s own doc) -- `List` works entirely in logical
+    /// pixels, so `1.0` here is not a placeholder for "unknown density,"
+    /// it is the correct density for a self-consistent unit system.
+    pub fn fling(&mut self, velocity_px_per_s: f32) {
+        if velocity_px_per_s == 0.0 || self.anchor.is_none() {
+            self.fling = None;
+            return;
+        }
+        self.fling = Some(Fling {
+            calc: FlingCalculator::new(1.0),
+            velocity: velocity_px_per_s,
+            started_at: Instant::now(),
+            applied: 0.0,
+        });
+    }
+
+    /// Whether a fling is currently animating. What a caller's own
+    /// per-frame loop polls to know when to stop driving `tick_fling`
+    /// (`bench_client.rs`'s fling phase) or to decide whether the list is
+    /// "moving on its own" for any other purpose.
+    pub fn is_scrolling(&self) -> bool {
+        self.fling.is_some()
+    }
+
+    /// Cancel any fling in progress with no further movement -- the next
+    /// touch-down's job, per `fling`'s own doc.
+    pub fn cancel_fling(&mut self) {
+        self.fling = None;
+    }
+
+    /// Advance an in-flight fling to `now`, applying this call's share of
+    /// its total travel via `scroll` and re-arming this list's own redraw
+    /// handle (if it has one) for another frame. Returns whether the
+    /// fling is still going after this call -- `false` either because it
+    /// settled on its own spline-decided schedule or because it reached
+    /// `at_start`/`at_end` (the module doc's clamp: a fling must not carry
+    /// the list past content that does not exist, unlike an ordinary
+    /// touch-pan, which this widget already leaves unclamped by design).
+    ///
+    /// Safe to call even with no fling active (a no-op returning `false`),
+    /// so a caller does not need to check `is_scrolling` first.
+    pub fn tick_fling(&mut self, now: Instant) -> bool {
+        let Some(f) = &mut self.fling else {
+            return false;
+        };
+        let elapsed = now.saturating_duration_since(f.started_at);
+        let target = f.calc.position_at(f.velocity, elapsed);
+        let delta = target - f.applied;
+        f.applied = target;
+        let settled_on_schedule = elapsed >= f.calc.duration(f.velocity);
+        let velocity = f.velocity;
+        self.scroll(delta);
+
+        // Clamp: a fling moving toward the start that has already reached
+        // it (or one moving toward the end that has already reached that)
+        // stops rather than continuing to spend its remaining distance on
+        // a part of the list that will never scroll further.
+        let hit_bound = (velocity < 0.0 && self.at_start) || (velocity > 0.0 && self.at_end);
+
+        if settled_on_schedule || hit_bound {
+            self.fling = None;
+            return false;
+        }
+        if let Some(redraw) = &self.redraw {
+            redraw.request_redraw();
+        }
+        true
+    }
+
     /// Snap to the newest content (last item, or the `more_after`
     /// sentinel if set), bottom-aligned to the viewport. O(1).
     pub fn jump_to_end(&mut self) {
@@ -572,9 +734,10 @@ impl List {
         let axis = self.axis;
         let output_len = painter.output_size().axis(axis);
         let container_len = painter.region().axis(axis).len();
+        let density = painter.density();
         let resolve = move |used: Size| -> f32 {
             used.axis(axis)
-                .apply_rest()
+                .apply_rest(density)
                 .within_len(container_len)
                 .to_abs(output_len)
         };
@@ -690,26 +853,33 @@ impl Widget for List {
         };
         let (mut top, mut bottom) = self.place(painter, anchor.slot, placement);
 
-        let mut idx = anchor.slot;
+        let mut idx_top = anchor.slot;
         while top > 0.0 {
-            let Some(prev) = self.prev_slot(idx) else {
+            let Some(prev) = self.prev_slot(idx_top) else {
                 break;
             };
             let (t, _) = self.place(painter, prev, Placement::Bottom(top));
             top = t;
-            idx = prev;
+            idx_top = prev;
         }
 
-        idx = anchor.slot;
+        let mut idx_bottom = anchor.slot;
         while bottom < self.viewport_len {
-            let Some(next) = self.next_slot(idx) else {
+            let Some(next) = self.next_slot(idx_bottom) else {
                 break;
             };
             let (_, b) = self.place(painter, next, Placement::Top(bottom));
             bottom = b;
-            idx = next;
+            idx_bottom = next;
         }
 
+        // What `tick_fling` clamps a fling against -- see `at_start`'s
+        // field doc. `top`/`bottom` are the extreme edges actually placed
+        // this frame, and `prev_slot`/`next_slot` returning `None` is what
+        // "no more content" means everywhere else in this widget.
+        self.at_start = self.prev_slot(idx_top).is_none() && top >= 0.0;
+        self.at_end = self.next_slot(idx_bottom).is_none() && bottom <= self.viewport_len;
+
         self.update_snap_end();
         Size::REST
     }
@@ -1032,4 +1202,258 @@ mod tests {
             assert!(moves <= 12, "n={n}: expected O(visible) moves, got {moves}");
         }
     }
+
+    /// The streamed-reply case (RUST.md's "streaming still costs a full
+    /// rebuild" fix, `transcript-ui::TranscriptScreen::apply`): a delta
+    /// swaps the last row's widget for a taller one, same key, same slot.
+    /// A list flush with its own end (the default, `snap_end`) must stay
+    /// flush -- the row grows *upward* from the pinned bottom edge, not
+    /// the other way around, exactly like an ordinary resize of that same
+    /// row would (`expanding_a_row_holds_the_bottom_edge_when_tap_is_lower`).
+    #[test]
+    fn replacing_the_last_row_stays_pinned_to_the_bottom() {
+        let mut rsc = TestRsc {
+            ui: UiData::default(),
+        };
+        let mut list = List::new(Axis::Y);
+        push_rows(&mut rsc, &mut list, &[0, 1, 2, 3, 4], 20.0);
+        let (list_weak, root) = add_list(&mut rsc, list);
+
+        let mut render = UiRenderState::new();
+        render.resize((100.0, 60.0));
+        render.update(&root, &mut rsc);
+
+        // Row 4 is flush with the viewport's bottom edge before the replace.
+        {
+            let list_ref = rsc.ui.widgets.get(&list_weak).unwrap();
+            assert!((list_ref.extents[&4].bottom - 60.0).abs() < 0.01);
+        }
+
+        let (_weak, new_row) = fixed_row(&mut rsc, 40.0);
+        let old = rsc
+            .ui
+            .widgets
+            .get_mut(&list_weak)
+            .unwrap()
+            .replace_back(ListRow::new(4, new_row));
+        assert!(
+            old.is_some(),
+            "replace_back should hand back the row it evicted"
+        );
+
+        render.update(&root, &mut rsc);
+
+        let list_ref = rsc.ui.widgets.get(&list_weak).unwrap();
+        let row4 = list_ref.extents[&4];
+        assert!(
+            (row4.bottom - 60.0).abs() < 0.01,
+            "still pinned to the newest end after the replace: {row4:?}"
+        );
+        assert!(
+            (row4.top - 20.0).abs() < 0.01,
+            "grew upward, from the pinned bottom edge: {row4:?}"
+        );
+    }
+
+    /// The other half of the same fix's contract: replacing a row that is
+    /// *not* on screen must not move anything that is. `replace_back` only
+    /// touches the last slot's own widget and this file's own `heights`/
+    /// `extents` caches for that one key -- nothing about `Anchor` changes
+    /// -- so the already-placed rows above it should come out at the exact
+    /// same boxes on the next frame.
+    #[test]
+    fn replacing_the_last_row_out_of_view_does_not_move_visible_rows() {
+        let mut rsc = TestRsc {
+            ui: UiData::default(),
+        };
+        let mut list = List::new(Axis::Y);
+        push_rows(&mut rsc, &mut list, &[0, 1, 2, 3, 4], 20.0);
+        let (list_weak, root) = add_list(&mut rsc, list);
+
+        let mut render = UiRenderState::new();
+        render.resize((100.0, 60.0));
+        // Settle at the default (bottom) anchor first -- `jump_to_start`
+        // does not touch `snap_end`, and `repair_anchor` only leaves a
+        // freshly-set anchor's offset alone once `viewport_len` has
+        // already matched `last_viewport_len` once, the same reason
+        // `moves_stay_o1_across_list_size` settles before the tick it
+        // actually measures.
+        render.update(&root, &mut rsc);
+        // Scrolled to the oldest content: rows 0,1,2 visible, row 4 is far
+        // below the viewport.
+        rsc.ui.widgets.get_mut(&list_weak).unwrap().jump_to_start();
+        render.update(&root, &mut rsc);
+
+        let (before0, before1, before2) = {
+            let list_ref = rsc.ui.widgets.get(&list_weak).unwrap();
+            assert!(!list_ref.extents.contains_key(&4));
+            (
+                list_ref.extents[&0],
+                list_ref.extents[&1],
+                list_ref.extents[&2],
+            )
+        };
+
+        let (_weak, new_row) = fixed_row(&mut rsc, 999.0);
+        rsc.ui
+            .widgets
+            .get_mut(&list_weak)
+            .unwrap()
+            .replace_back(ListRow::new(4, new_row));
+
+        render.update(&root, &mut rsc);
+
+        let list_ref = rsc.ui.widgets.get(&list_weak).unwrap();
+        for (key, before) in [(0u64, before0), (1, before1), (2, before2)] {
+            let after = list_ref.extents[&key];
+            assert_eq!(
+                (after.top, after.bottom),
+                (before.top, before.bottom),
+                "row {key} moved after an off-screen replace"
+            );
+        }
+    }
+
+    /// Enough rows, tall enough, that a fling toward the start has real
+    /// room to travel before `at_start` clamps it -- shared by the fling
+    /// tests below.
+    fn build_flingable_list(rsc: &mut TestRsc) -> (WeakWidget<List>, StrongWidget, UiRenderState) {
+        let mut list = List::new(Axis::Y);
+        push_rows(rsc, &mut list, &(0..200).collect::<Vec<_>>(), 20.0);
+        let (list_weak, root) = add_list(rsc, list);
+        let mut render = UiRenderState::new();
+        render.resize((100.0, 600.0));
+        render.update(&root, rsc);
+        (list_weak, root, render)
+    }
+
+    #[test]
+    fn fling_moves_the_list_and_then_settles() {
+        let mut rsc = TestRsc {
+            ui: UiData::default(),
+        };
+        let (list_weak, root, mut render) = build_flingable_list(&mut rsc);
+
+        // A fling toward the start: negative velocity, matching `scroll`'s
+        // sign convention (`Selection::drag` calls `scroll(-dy)` for a
+        // downward finger motion revealing older content).
+        rsc.ui.widgets.get_mut(&list_weak).unwrap().fling(-8000.0);
+        assert!(rsc.ui.widgets.get(&list_weak).unwrap().is_scrolling());
+
+        let start = Instant::now();
+        let mut last_still_scrolling = true;
+        for step in 0..600 {
+            let now = start + std::time::Duration::from_millis(step * 16);
+            last_still_scrolling = rsc.ui.widgets.get_mut(&list_weak).unwrap().tick_fling(now);
+            render.update(&root, &mut rsc);
+            if !last_still_scrolling {
+                break;
+            }
+        }
+        assert!(
+            !last_still_scrolling,
+            "fling never settled within 600 steps"
+        );
+        assert!(!rsc.ui.widgets.get(&list_weak).unwrap().is_scrolling());
+    }
+
+    #[test]
+    fn fling_distance_is_positive_toward_the_end() {
+        let mut rsc = TestRsc {
+            ui: UiData::default(),
+        };
+        let (list_weak, root, mut render) = build_flingable_list(&mut rsc);
+        // Start scrolled away from the newest end so there is room for an
+        // end-ward fling to actually move.
+        rsc.ui.widgets.get_mut(&list_weak).unwrap().jump_to_start();
+        render.update(&root, &mut rsc);
+        let before = rsc.ui.widgets.get(&list_weak).unwrap().extents[&0];
+
+        rsc.ui.widgets.get_mut(&list_weak).unwrap().fling(8000.0);
+        let start = Instant::now();
+        for step in 0..600 {
+            let now = start + std::time::Duration::from_millis(step * 16);
+            let still = rsc.ui.widgets.get_mut(&list_weak).unwrap().tick_fling(now);
+            render.update(&root, &mut rsc);
+            if !still {
+                break;
+            }
+        }
+        let list_ref = rsc.ui.widgets.get(&list_weak).unwrap();
+        // Row 0 either scrolled out of the loaded extents (flung well past
+        // it) or moved upward (smaller top) -- either way, real motion
+        // happened toward the end rather than staying put.
+        if let Some(after) = list_ref.extents.get(&0) {
+            assert!(
+                after.top < before.top,
+                "fling toward the end did not move content up"
+            );
+        }
+    }
+
+    #[test]
+    fn cancel_fling_stops_it_with_no_further_movement() {
+        let mut rsc = TestRsc {
+            ui: UiData::default(),
+        };
+        let (list_weak, root, mut render) = build_flingable_list(&mut rsc);
+        rsc.ui.widgets.get_mut(&list_weak).unwrap().fling(-8000.0);
+        let start = Instant::now();
+        rsc.ui
+            .widgets
+            .get_mut(&list_weak)
+            .unwrap()
+            .tick_fling(start + std::time::Duration::from_millis(16));
+        render.update(&root, &mut rsc);
+        assert!(rsc.ui.widgets.get(&list_weak).unwrap().is_scrolling());
+
+        rsc.ui.widgets.get_mut(&list_weak).unwrap().cancel_fling();
+        assert!(!rsc.ui.widgets.get(&list_weak).unwrap().is_scrolling());
+
+        let before = rsc.ui.widgets.get(&list_weak).unwrap().extents[&199];
+        // A tick after cancelling must be a no-op -- this is what a fresh
+        // touch-down relies on to stop a fling in its tracks.
+        let still = rsc
+            .ui
+            .widgets
+            .get_mut(&list_weak)
+            .unwrap()
+            .tick_fling(start + std::time::Duration::from_millis(200));
+        render.update(&root, &mut rsc);
+        assert!(!still);
+        let after = rsc.ui.widgets.get(&list_weak).unwrap().extents[&199];
+        assert_eq!((before.top, before.bottom), (after.top, after.bottom));
+    }
+
+    #[test]
+    fn fling_toward_the_start_stops_at_the_first_row() {
+        let mut rsc = TestRsc {
+            ui: UiData::default(),
+        };
+        let (list_weak, root, mut render) = build_flingable_list(&mut rsc);
+        // An enormous velocity that would travel far past all 200 rows if
+        // unclamped -- this is exactly what IRIS_TODO.md's "way faster...
+        // better for stress testing" fling asks for.
+        rsc.ui.widgets.get_mut(&list_weak).unwrap().fling(-50_000.0);
+        let start = Instant::now();
+        for step in 0..2000 {
+            let now = start + std::time::Duration::from_millis(step * 16);
+            let still = rsc.ui.widgets.get_mut(&list_weak).unwrap().tick_fling(now);
+            render.update(&root, &mut rsc);
+            if !still {
+                break;
+            }
+        }
+        let list_ref = rsc.ui.widgets.get(&list_weak).unwrap();
+        assert!(
+            list_ref.at_start,
+            "fling should have clamped at the first row"
+        );
+        let first = list_ref.extents[&0];
+        assert!(
+            first.top >= -0.5,
+            "clamped fling overshot the first row's top: {}",
+            first.top
+        );
+    }
 }

iris/src/widget/position/align.rs

@@ -17,14 +17,15 @@ impl Widget for Aligned {
         // already-resolved region double-applies that composition and is
         // wrong for any widget nested below the root.
         let used = painter.widget(&self.inner);
+        let density = painter.density();
         let region = match self.align.tuple() {
-            (Some(x), Some(y)) => used.to_uivec2().align(RegionAlign { x, y }),
+            (Some(x), Some(y)) => used.to_uivec2(density).align(RegionAlign { x, y }),
             (Some(x), None) => {
-                let x = used.x.apply_rest().align(x);
+                let x = used.x.apply_rest(density).align(x);
                 UiRegion::new(x, UiSpan::FULL)
             }
             (None, Some(y)) => {
-                let y = used.y.apply_rest().align(y);
+                let y = used.y.apply_rest(density).align(y);
                 UiRegion::new(UiSpan::FULL, y)
             }
             (None, None) => UiRegion::FULL,

iris/src/widget/position/max_size.rs

@@ -9,12 +9,12 @@ pub struct MaxSize {
 impl MaxSize {
     /// Caps a reported length at `max`, comparing in pixels since `Len`'s
     /// rel/abs/rest components are not otherwise comparable.
-    fn clamp(len: Len, max: Option<Len>, output: f32) -> Len {
+    fn clamp(len: Len, max: Option<Len>, output: f32, density: f32) -> Len {
         let Some(max) = max else {
             return len;
         };
-        let len_px = len.apply_rest().to_abs(output);
-        let max_px = max.apply_rest().to_abs(output);
+        let len_px = len.apply_rest(density).to_abs(output);
+        let max_px = max.apply_rest(density).to_abs(output);
         if len_px > max_px { max } else { len }
     }
 
@@ -24,11 +24,11 @@ impl MaxSize {
     /// start, if it does not. Needed so the child is never painted bigger
     /// than the size this widget reports for it -- see the identical
     /// requirement noted on `Sized::draw`.
-    fn clamp_region(offered_px: f32, max: Option<Len>, output: f32) -> UiSpan {
+    fn clamp_region(offered_px: f32, max: Option<Len>, output: f32, density: f32) -> UiSpan {
         let Some(max) = max else {
             return UiSpan::FULL;
         };
-        let max_scalar = max.apply_rest();
+        let max_scalar = max.apply_rest(density);
         let max_px = max_scalar.to_abs(output);
         if offered_px > max_px {
             max_scalar.align(AxisAlign::Neg)
@@ -41,15 +41,16 @@ impl MaxSize {
 impl Widget for MaxSize {
     fn draw(&mut self, painter: &mut Painter) -> Size {
         let output = painter.output_size();
+        let density = painter.density();
         let offered = painter.px_size();
         let region = UiRegion {
-            x: Self::clamp_region(offered.x, self.x, output.x),
-            y: Self::clamp_region(offered.y, self.y, output.y),
+            x: Self::clamp_region(offered.x, self.x, output.x, density),
+            y: Self::clamp_region(offered.y, self.y, output.y, density),
         };
         let used = painter.widget_within(&self.inner, region);
         Size {
-            x: Self::clamp(used.x, self.x, output.x),
-            y: Self::clamp(used.y, self.y, output.y),
+            x: Self::clamp(used.x, self.x, output.x, density),
+            y: Self::clamp(used.y, self.y, output.y, density),
         }
     }
 }

iris/src/widget/position/pad.rs

@@ -7,9 +7,12 @@ pub struct Pad {
 
 impl Widget for Pad {
     fn draw(&mut self, painter: &mut Painter) -> Size {
-        let used = painter.widget_within(&self.inner, self.padding.region());
-        let width = self.padding.left + self.padding.right;
-        let height = self.padding.top + self.padding.bottom;
+        let density = painter.density();
+        let used = painter.widget_within(&self.inner, self.padding.region(density));
+        let width =
+            self.padding.left.apply_rest(density).abs + self.padding.right.apply_rest(density).abs;
+        let height =
+            self.padding.top.apply_rest(density).abs + self.padding.bottom.apply_rest(density).abs;
         Size {
             x: used.x + Len::abs(width),
             y: used.y + Len::abs(height),
@@ -17,23 +20,29 @@ impl Widget for Pad {
     }
 }
 
+/// Each side is a `Len`, not a bare `f32`, so `.pad(dp(10))` resolves
+/// against the display's density the same way any other size does -- see
+/// `Len::dp`'s field doc. `.pad(10)` (a bare number) still works via
+/// `From<T: UiNum>` below, unchanged: it becomes an `abs` (physical-pixel)
+/// `Len`, exactly as a bare number always has meant elsewhere in this
+/// crate.
 pub struct Padding {
-    pub left: f32,
-    pub right: f32,
-    pub top: f32,
-    pub bottom: f32,
+    pub left: Len,
+    pub right: Len,
+    pub top: Len,
+    pub bottom: Len,
 }
 
 impl Padding {
     pub const ZERO: Self = Self {
-        left: 0.0,
-        right: 0.0,
-        top: 0.0,
-        bottom: 0.0,
+        left: Len::ZERO,
+        right: Len::ZERO,
+        top: Len::ZERO,
+        bottom: Len::ZERO,
     };
 
-    pub fn uniform(amt: impl UiNum) -> Self {
-        let amt = amt.to_f32();
+    pub fn uniform(amt: impl Into<Len>) -> Self {
+        let amt = amt.into();
         Self {
             left: amt,
             right: amt,
@@ -41,80 +50,84 @@ impl Padding {
             bottom: amt,
         }
     }
-    pub fn region(&self) -> UiRegion {
+    pub fn region(&self, density: f32) -> UiRegion {
         let mut region = UiRegion::FULL;
-        region.x.start.abs += self.left;
-        region.y.start.abs += self.top;
-        region.x.end.abs -= self.right;
-        region.y.end.abs -= self.bottom;
+        region.x.start.abs += self.left.apply_rest(density).abs;
+        region.y.start.abs += self.top.apply_rest(density).abs;
+        region.x.end.abs -= self.right.apply_rest(density).abs;
+        region.y.end.abs -= self.bottom.apply_rest(density).abs;
         region
     }
-    pub fn x(amt: impl UiNum) -> Self {
-        let amt = amt.to_f32();
+    pub fn x(amt: impl Into<Len>) -> Self {
+        let amt = amt.into();
         Self {
             left: amt,
             right: amt,
-            top: 0.0,
-            bottom: 0.0,
+            top: Len::ZERO,
+            bottom: Len::ZERO,
         }
     }
-    pub fn y(amt: impl UiNum) -> Self {
-        let amt = amt.to_f32();
+    pub fn y(amt: impl Into<Len>) -> Self {
+        let amt = amt.into();
         Self {
-            left: 0.0,
-            right: 0.0,
+            left: Len::ZERO,
+            right: Len::ZERO,
             top: amt,
             bottom: amt,
         }
     }
 
-    pub fn top(amt: impl UiNum) -> Self {
+    pub fn top(amt: impl Into<Len>) -> Self {
         let mut s = Self::ZERO;
-        s.top = amt.to_f32();
+        s.top = amt.into();
         s
     }
 
-    pub fn bottom(amt: impl UiNum) -> Self {
+    pub fn bottom(amt: impl Into<Len>) -> Self {
         let mut s = Self::ZERO;
-        s.bottom = amt.to_f32();
+        s.bottom = amt.into();
         s
     }
 
-    pub fn left(amt: impl UiNum) -> Self {
+    pub fn left(amt: impl Into<Len>) -> Self {
         let mut s = Self::ZERO;
-        s.left = amt.to_f32();
+        s.left = amt.into();
         s
     }
 
-    pub fn right(amt: impl UiNum) -> Self {
+    pub fn right(amt: impl Into<Len>) -> Self {
         let mut s = Self::ZERO;
-        s.right = amt.to_f32();
+        s.right = amt.into();
         s
     }
 
-    pub fn with_top(mut self, amt: impl UiNum) -> Self {
-        self.top = amt.to_f32();
+    pub fn with_top(mut self, amt: impl Into<Len>) -> Self {
+        self.top = amt.into();
         self
     }
 
-    pub fn with_bottom(mut self, amt: impl UiNum) -> Self {
-        self.bottom = amt.to_f32();
+    pub fn with_bottom(mut self, amt: impl Into<Len>) -> Self {
+        self.bottom = amt.into();
         self
     }
 
-    pub fn with_left(mut self, amt: impl UiNum) -> Self {
-        self.left = amt.to_f32();
+    pub fn with_left(mut self, amt: impl Into<Len>) -> Self {
+        self.left = amt.into();
         self
     }
 
-    pub fn with_right(mut self, amt: impl UiNum) -> Self {
-        self.right = amt.to_f32();
+    pub fn with_right(mut self, amt: impl Into<Len>) -> Self {
+        self.right = amt.into();
         self
     }
 }
 
-impl<T: UiNum> From<T> for Padding {
+/// Covers both a bare number (`.pad(8)`, via `Len`'s own `From<N: UiNum>`
+/// blanket -- an `abs`/physical-pixel `Len`) and a `Len` directly
+/// (`.pad(dp(10))`) with the one impl, since `Len: Into<Len>` is the
+/// reflexive case of the same bound.
+impl<T: Into<Len>> From<T> for Padding {
     fn from(amt: T) -> Self {
-        Self::uniform(amt.to_f32())
+        Self::uniform(amt.into())
     }
 }

iris/src/widget/position/scroll.rs

@@ -43,7 +43,7 @@ impl Widget for Scroll {
 
         self.content_len = used
             .axis(axis)
-            .apply_rest()
+            .apply_rest(painter.density())
             .within_len(container_len)
             .to_abs(output_len);
 

iris/src/widget/position/sized.rs

@@ -17,12 +17,13 @@ impl Widget for Sized {
         // learn its size, then moves it into place with a pure
         // translation; that translation is only valid if what got painted
         // is already the reported size, anchored the same way both times.
+        let density = painter.density();
         let mut region = UiRegion::FULL;
         if let Some(x) = self.x {
-            region.x = x.apply_rest().align(AxisAlign::Neg);
+            region.x = x.apply_rest(density).align(AxisAlign::Neg);
         }
         if let Some(y) = self.y {
-            region.y = y.apply_rest().align(AxisAlign::Neg);
+            region.y = y.apply_rest(density).align(AxisAlign::Neg);
         }
         let used = painter.widget_within(&self.inner, region);
         Size {

iris/src/widget/position/span.rs

@@ -4,12 +4,18 @@ use std::marker::PhantomData;
 pub struct Span {
     pub children: Vec<StrongWidget>,
     pub dir: Dir,
-    pub gap: f32,
+    /// A `Len` (not a bare `f32`) so `dp(4)` resolves against the display's
+    /// density the same way any other size in the tree does -- see
+    /// `Len::dp`'s field doc. Only the `abs` component (folded from `dp` at
+    /// draw time, `Widget::draw` below) is meaningful here; `rel`/`rest`
+    /// were never supported for a gap and still are not.
+    pub gap: Len,
 }
 
 impl Widget for Span {
     fn draw(&mut self, painter: &mut Painter) -> Size {
         let axis = self.dir.axis;
+        let gap = self.gap.apply_rest(painter.density()).abs;
 
         // Phase 1: draw each child once, at the ambient (unmodified, full)
         // region a size-only query used to see before this migration, to
@@ -25,7 +31,7 @@ impl Widget for Span {
             .map(|child| painter.widget(child).axis(axis))
             .collect();
 
-        let gap_total = self.gap * self.children.len().saturating_sub(1) as f32;
+        let gap_total = gap * self.children.len().saturating_sub(1) as f32;
         let total = lens.iter().fold(Len::abs(gap_total), |s, &l| s + l);
 
         // Phase 2: place each child for real, using the lengths just
@@ -54,7 +60,7 @@ impl Widget for Span {
                 child_region.flip(axis);
             }
             let used = painter.widget_within(child, child_region);
-            start.abs += self.gap;
+            start.abs += gap;
 
             let ortho = used.axis(!axis);
             if ortho.rel > 0.0 || ortho.rest > 0.0 {
@@ -82,12 +88,12 @@ impl Span {
         Self {
             children: Vec::new(),
             dir,
-            gap: 0.0,
+            gap: Len::ZERO,
         }
     }
 
-    pub fn gap(mut self, gap: impl UiNum) -> Self {
-        self.gap = gap.to_f32();
+    pub fn gap(mut self, gap: impl Into<Len>) -> Self {
+        self.gap = gap.into();
         self
     }
 
@@ -103,7 +109,7 @@ impl Span {
 pub struct SpanBuilder<State, const LEN: usize, Wa: WidgetArrLike<State, LEN, Tag>, Tag> {
     pub children: Wa,
     pub dir: Dir,
-    pub gap: f32,
+    pub gap: Len,
     _pd: PhantomData<(State, Tag)>,
 }
 
@@ -129,13 +135,13 @@ impl<State, const LEN: usize, Wa: WidgetArrLike<State, LEN, Tag>, Tag>
         Self {
             children,
             dir,
-            gap: 0.0,
+            gap: Len::ZERO,
             _pd: PhantomData,
         }
     }
 
-    pub fn gap(mut self, gap: impl UiNum) -> Self {
-        self.gap = gap.to_f32();
+    pub fn gap(mut self, gap: impl Into<Len>) -> Self {
+        self.gap = gap.into();
         self
     }
 }

iris/src/widget/text/edit.rs

@@ -141,7 +141,8 @@ impl<'a> TextEditCtx<'a> {
     fn layout(&mut self) -> &Layout<UiColor> {
         let attrs = self.text.view.attrs.clone();
         let width = self.text.view.wrap_width();
-        self.text.view.buf.shape(self.data, &attrs, width);
+        let density = self.data.density;
+        self.text.view.buf.shape(self.data, &attrs, width, density);
         self.text.view.buf.layout()
     }
 
@@ -167,6 +168,20 @@ impl<'a> TextEditCtx<'a> {
         self.text.selection = None;
     }
 
+    /// [`set`](Self::set) plus a fresh set of [`SpanStyle`]s in one call --
+    /// what a streamed transcript row needs, since its markdown re-renders
+    /// to a new string *and* a new span list on every delta and the two
+    /// have to land together (a stale span list drawn against new text can
+    /// point past its end). Used by `transcript-ui`'s incremental apply
+    /// (RUST.md's "streaming still costs a full rebuild" fix) rather than
+    /// tearing the row's widget down and rebuilding it from scratch.
+    pub fn set_with_spans(&mut self, text: &str, spans: Vec<SpanStyle>) {
+        let text = self.string(text);
+        self.text.view.buf.set_text(text);
+        self.text.view.buf.set_spans(spans);
+        self.text.selection = None;
+    }
+
     pub fn motion(&mut self, motion: Motion, select: bool) {
         let Some(sel) = self.text.selection else {
             return;

iris/transcript-ui/src/composer.rs

@@ -39,7 +39,7 @@ where
         .label("Message")
         .add(rsc);
 
-    let bar: WeakWidget = (field.pad(12).width(rest(1)),)
+    let bar: WeakWidget = (field.pad(dp(12)).width(rest(1)),)
         .span(Dir::RIGHT)
         .background(rect(UiColor::new(40, 40, 46, 255)))
         .add(rsc);

iris/transcript-ui/src/lib.rs

@@ -60,6 +60,12 @@ pub struct TranscriptScreen {
     pub list: WeakWidget<List>,
     pub composer: composer::Composer,
     selection: Rc<RefCell<Selection>>,
+    /// How many times [`Self::apply`] has fallen back to a full rebuild --
+    /// `Cell` rather than requiring `&mut self`, matching every other
+    /// method here (the real state lives behind `list`/`selection`'s own
+    /// interior mutability, per `push_row`'s existing `&self`). Drained by
+    /// [`Self::take_rebuilds`].
+    rebuilds: std::cell::Cell<usize>,
 }
 
 impl TranscriptScreen {
@@ -75,6 +81,93 @@ impl TranscriptScreen {
         (self.list)(rsc).push_back(ListRow::new(key, widget));
     }
 
+    /// Apply the effect of one more folded event without rebuilding the
+    /// whole screen -- RUST.md's "streaming still costs a full rebuild"
+    /// fix. `old`/`new` are `client_core::transcript_fold::fold_event`'s
+    /// own before/after item lists (never grouped into rows -- that
+    /// happens here, over both, so the common tail cases can be told
+    /// apart; `group_tool_runs` is pure bookkeeping over already-folded
+    /// items, no widget is built doing it).
+    ///
+    /// Three cases, cheapest first:
+    /// - **nothing changed**: no-op.
+    /// - **pure append** (a still-open reply's row now closed and stable,
+    ///   a new tool call, a new message): every new row is `push_back`ed,
+    ///   same cost as [`Self::push_row`].
+    /// - **only the last row's content changed** (the common case: a delta
+    ///   folded into a still-open assistant message): that one row is
+    ///   rebuilt (`row::build_row`, the same path a fresh row goes
+    ///   through) and swapped in with [`List::replace_back`] -- every
+    ///   other row is untouched, so nothing else redraws or moves. Any
+    ///   further new rows are appended after it, for the (also common)
+    ///   case of a delta that both finishes the open reply and starts the
+    ///   next row in the same event.
+    ///
+    /// Anything else -- a row *before* the tail changed, which only
+    /// happens when `group_tool_runs` regroups already-seen items (a tool
+    /// run's calls that used to be separate rows join once the run closes)
+    /// -- falls back to a full rebuild: every row is dropped
+    /// (`List::clear`) and rebuilt from `new`. Counted in
+    /// [`Self::take_rebuilds`] so a caller (a report, a test) can see how
+    /// often the fallback actually fires rather than assuming it never
+    /// does.
+    pub fn apply<Rsc: HasEvents>(
+        &self,
+        rsc: &mut Rsc,
+        old: &[client_core::transcript_fold::TranscriptItem],
+        new: &[client_core::transcript_fold::TranscriptItem],
+    ) where
+        Rsc::State: FocusHost,
+    {
+        use client_core::transcript_fold::group_tool_runs;
+
+        let old_rows = group_tool_runs(old);
+        let new_rows = group_tool_runs(new);
+
+        match diff_rows(&old_rows, &new_rows) {
+            RowDiff::Unchanged => {}
+            RowDiff::Appended { common } => {
+                // Pure append: every already-drawn row is byte-for-byte the
+                // same `FoldedRow` it was last time.
+                for row in &new_rows[common..] {
+                    self.push_row(rsc, row);
+                }
+            }
+            RowDiff::ReplaceLast { common } => {
+                // Only the tail row's content changed -- rebuild that one
+                // row and swap it in place, keeping every row before it
+                // untouched.
+                let old_key = row::row_key(&old_rows[common].key());
+                let (new_key, widget) =
+                    row::build_row(rsc, self.list, self.selection.clone(), &new_rows[common]);
+                if new_key != old_key {
+                    self.selection.borrow_mut().unregister(old_key);
+                }
+                let evicted = (self.list)(rsc).replace_back(ListRow::new(new_key, widget));
+                drop(evicted); // frees the old row's widget, same as a pop would
+                for row in &new_rows[common + 1..] {
+                    self.push_row(rsc, row);
+                }
+            }
+            RowDiff::Rebuild => {
+                // A row before the tail changed (a regroup) -- nothing
+                // short of a full rebuild expresses that.
+                self.rebuilds.set(self.rebuilds.get() + 1);
+                (self.list)(rsc).clear();
+                for row in &new_rows {
+                    self.push_row(rsc, row);
+                }
+            }
+        }
+    }
+
+    /// How many times [`Self::apply`] has fallen back to a full rebuild
+    /// since the last call, reset to 0 by reading it -- the same
+    /// take-and-reset shape `AccessTree::take_rebuilds` already uses (I4).
+    pub fn take_rebuilds(&self) -> usize {
+        self.rebuilds.replace(0)
+    }
+
     /// The concatenated text of whatever is currently selected across one
     /// or more rows, `None` if nothing is -- what a copy command reads.
     pub fn selected_text(&self, rsc: &mut impl UiRsc) -> Option<String> {
@@ -139,7 +232,148 @@ where
             list,
             composer,
             selection,
+            rebuilds: std::cell::Cell::new(0),
         },
         tree,
     )
 }
+
+/// What changed at the tail between two folded row lists -- the decision
+/// [`TranscriptScreen::apply`] acts on. Kept as its own pure function, no
+/// widget and no `Rsc`, so the three cases can be tested directly against
+/// synthetic `Vec<FoldedRow>`s (below) rather than needing a full widget
+/// harness to exercise logic that never touches one.
+#[derive(Debug, PartialEq, Eq)]
+enum RowDiff {
+    /// `old` and `new` are the same length and every row is identical.
+    Unchanged,
+    /// Rows `[common..]` of `new` are new; everything before `common` is
+    /// byte-for-byte the same `FoldedRow` `old` already had.
+    Appended { common: usize },
+    /// Row `common` is the only one whose content differs; anything past
+    /// it in `new` is a pure append after the replacement.
+    ReplaceLast { common: usize },
+    /// A row *before* the tail differs -- only `group_tool_runs` regrouping
+    /// an earlier run does this, and nothing short of a full rebuild
+    /// expresses it.
+    Rebuild,
+}
+
+fn diff_rows(old: &[FoldedRow], new: &[FoldedRow]) -> RowDiff {
+    let common = old
+        .iter()
+        .zip(new.iter())
+        .take_while(|(a, b)| a == b)
+        .count();
+
+    if common == old.len() && common == new.len() {
+        RowDiff::Unchanged
+    } else if common == old.len() {
+        RowDiff::Appended { common }
+    } else if !old.is_empty() && common == old.len() - 1 && common < new.len() {
+        // The `common < new.len()` guard is what tells "the tail row's
+        // content changed" apart from "the tail row was removed and
+        // nothing replaced it" (a shrinking list) -- the latter has
+        // nothing at `new[common]` to rebuild into place.
+        RowDiff::ReplaceLast { common }
+    } else {
+        RowDiff::Rebuild
+    }
+}
+
+#[cfg(test)]
+mod diff_tests {
+    use super::*;
+    use client_core::transcript_fold::TranscriptItem;
+
+    fn user(seq: u64, text: &str) -> FoldedRow {
+        FoldedRow::Single(TranscriptItem::UserMsg {
+            seq,
+            text: text.to_string(),
+            attachments: Vec::new(),
+        })
+    }
+
+    fn assistant(seq: u64, text: &str, settled: bool) -> FoldedRow {
+        FoldedRow::Single(TranscriptItem::AssistantMsg {
+            seq,
+            text: text.to_string(),
+            settled,
+        })
+    }
+
+    fn tool(seq: u64, run_id: &str) -> TranscriptItem {
+        TranscriptItem::ToolRun {
+            seq,
+            id: format!("id{seq}"),
+            run_id: run_id.to_string(),
+            tool: "grep".to_string(),
+            input: "x".to_string(),
+            output: String::new(),
+            done: false,
+            asks: Vec::new(),
+            images: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn identical_lists_are_unchanged() {
+        let rows = vec![user(1, "hi"), assistant(2, "hello", true)];
+        assert_eq!(diff_rows(&rows, &rows.clone()), RowDiff::Unchanged);
+    }
+
+    #[test]
+    fn an_empty_list_growing_by_one_is_an_append_from_zero() {
+        let old: Vec<FoldedRow> = Vec::new();
+        let new = vec![user(1, "hi")];
+        assert_eq!(diff_rows(&old, &new), RowDiff::Appended { common: 0 });
+    }
+
+    #[test]
+    fn a_new_message_after_a_settled_reply_is_a_pure_append() {
+        // The row that used to be the tail (a now-closed assistant
+        // message) is unchanged; a new user message is appended after it
+        // -- the transition every reply's *last* delta makes once the
+        // next turn starts.
+        let old = vec![user(1, "hi"), assistant(2, "hello", true)];
+        let new = vec![user(1, "hi"), assistant(2, "hello", true), user(3, "and?")];
+        assert_eq!(diff_rows(&old, &new), RowDiff::Appended { common: 2 });
+    }
+
+    #[test]
+    fn a_delta_into_the_open_reply_is_a_last_row_replace() {
+        // The common streaming case: the assistant message's key (its
+        // first delta's seq) never changes, only its text grows.
+        let old = vec![user(1, "hi"), assistant(2, "hel", false)];
+        let new = vec![user(1, "hi"), assistant(2, "hello", false)];
+        assert_eq!(diff_rows(&old, &new), RowDiff::ReplaceLast { common: 1 });
+    }
+
+    #[test]
+    fn a_delta_that_both_settles_the_reply_and_starts_the_next_row_is_still_a_replace() {
+        // `ReplaceLast` only claims the row it names; `apply` appends
+        // whatever comes after it separately -- this just confirms the
+        // diff still recognises the replace even with a trailing append.
+        let old = vec![user(1, "hi"), assistant(2, "hel", false)];
+        let new = vec![user(1, "hi"), assistant(2, "hello", true), user(3, "and?")];
+        assert_eq!(diff_rows(&old, &new), RowDiff::ReplaceLast { common: 1 });
+    }
+
+    #[test]
+    fn a_tool_run_closing_and_joining_an_earlier_call_is_a_regroup_fallback() {
+        // Two separate `Single` rows for the same run id become one
+        // `Tools` row once `group_tool_runs` sees them adjacent -- that
+        // changes row 0, not just the tail, so nothing short of a full
+        // rebuild expresses it.
+        let old = vec![FoldedRow::Single(tool(1, "run-a")), user(2, "meanwhile")];
+        let new = vec![FoldedRow::Tools(vec![tool(1, "run-a"), tool(3, "run-a")])];
+        assert_eq!(diff_rows(&old, &new), RowDiff::Rebuild);
+    }
+
+    #[test]
+    fn shrinking_the_list_is_a_rebuild() {
+        let old = vec![user(1, "hi"), assistant(2, "hello", true)];
+        let new = vec![user(1, "hi")];
+        assert_eq!(diff_rows(&old, &new), RowDiff::Rebuild);
+    }
+}

iris/transcript-ui/src/row.rs

@@ -60,6 +60,15 @@ fn item_content(item: &TranscriptItem) -> (Option<&str>, String) {
         TranscriptItem::PeerNote { from, text, .. } => (Some(from.as_str()), text.clone()),
         TranscriptItem::Note { text, .. } => (None, text.clone()),
         TranscriptItem::ClearedNote { .. } => (None, "_Context cleared._".to_string()),
+        // Epoch seconds as-is until the port has a relative-time formatter
+        // (P1); the Compose `LimitRow` draws it as a countdown.
+        TranscriptItem::LimitNote { resets_at, .. } => (
+            None,
+            match resets_at {
+                Some(at) => format!("_Usage limit reached; resets at {at:.0} (epoch seconds)._"),
+                None => "_Usage limit reached._".to_string(),
+            },
+        ),
         TranscriptItem::CompactedNote {
             pre_tokens,
             post_tokens,
@@ -165,8 +174,8 @@ where
 
     (header, field.width(rest(1)))
         .span(Dir::DOWN)
-        .gap(4)
-        .pad(10)
+        .gap(dp(4))
+        .pad(dp(10))
         .add_strong(rsc)
         .any()
 }

iris/transcript-ui/src/selection.rs

@@ -41,6 +41,12 @@ pub struct Selection {
     /// pan wanting the same touch gesture). See `drag` below, and
     /// `iris::sense::DragArbiter`'s own doc for the decision itself.
     arbiter: DragArbiter,
+    /// Tracks the last ~100ms of this gesture's pan deltas (in the same
+    /// signed units `list.scroll` takes), so a release that turns out to
+    /// have been panning can hand `List::fling` a realistic initial
+    /// velocity instead of one frame's noisy last delta --
+    /// IRIS_TODO.md's "swiping has no momentum."
+    velocity: VelocityTracker,
 }
 
 impl Default for Selection {
@@ -55,6 +61,7 @@ impl Selection {
             rows: BTreeMap::new(),
             anchor: None,
             arbiter: DragArbiter::new(),
+            velocity: VelocityTracker::new(),
         }
     }
 
@@ -178,9 +185,21 @@ impl Selection {
             CursorSense::PressStart(_) => {
                 let already_selected = self.has_selection(ui);
                 self.arbiter.press_start(pos_window, now, already_selected);
+                self.velocity.reset();
+                // A fresh touch-down cancels any fling still coasting from
+                // the previous gesture -- `List::fling`'s own doc, and
+                // Android's `Scroller::abortAnimation` for the same reason.
+                list(ui).cancel_fling();
                 self.arbiter.update(pos_window, now)
             }
             CursorSense::PressEnd(_) => {
+                // A fling only ever follows a pan -- never a selection
+                // that happened to end with the finger still moving, and
+                // never a tap/long-press that never left `Undecided`.
+                if self.arbiter.is_panning() {
+                    let v = self.velocity.velocity();
+                    list(ui).fling(v);
+                }
                 self.arbiter.release();
                 return;
             }
@@ -198,13 +217,19 @@ impl Selection {
             _ if self.arbiter.is_idle() => {
                 let already_selected = self.has_selection(ui);
                 self.arbiter.press_start(pos_window, now, already_selected);
+                self.velocity.reset();
+                list(ui).cancel_fling();
                 self.arbiter.update(pos_window, now)
             }
             _ => self.arbiter.update(pos_window, now),
         };
         match outcome {
             DragOutcome::Undecided => {}
-            DragOutcome::Pan(dy) => list(ui).scroll(-dy),
+            DragOutcome::Pan(dy) => {
+                let amt = -dy;
+                self.velocity.add_sample(amt, now);
+                list(ui).scroll(amt);
+            }
             DragOutcome::SelectStart => {
                 // Grep-able on "iris selection" the way the frame report is
                 // on "iris frame report" -- selection has no accessibility

server/Cargo.lock

@@ -36,6 +36,7 @@ dependencies = [
  "sha2",
  "tempfile",
  "thiserror",
+ "time",
  "tokio",
  "tokio-stream",
  "tower",

server/Cargo.toml

@@ -57,6 +57,12 @@ ureq = { version = "3", features = ["json"] }
 # both in the graph rustls refuses to auto-select one.
 rustls = "0.23"
 libc = "0.2.189"
+# One ISO-8601 timestamp: the reset time on the invented rate-limit window
+# an echo session's `/usage` puts up. Already in the tree behind the
+# certificate machinery, so this is a direct name for what is compiled
+# anyway rather than a new crate -- and the alternative was hand-rolling a
+# civil-from-days conversion to print one line.
+time = { version = "0.3", features = ["formatting"] }
 
 [dev-dependencies]
 tempfile = "3"

server/src/auth.rs

@@ -207,6 +207,20 @@ mod tests {
     /// like any other.
     #[tokio::test]
     async fn a_spooled_enrollment_is_adopted_on_first_use() {
+        // Under a subscriber, like every other exercise of this middleware.
+        // `tracing` caches a callsite's interest process-wide the first time it
+        // is reached, so the refusal at the end of this test -- reached with no
+        // subscriber on this thread -- could cache the rejection warning as
+        // never-enabled and make the tripwire above see an empty log. That
+        // failed about one full-suite run in ten, in the test that exists to
+        // notice a credential leak, which is the worst place for a flake.
+        let _guard = tracing::subscriber::set_default(
+            tracing_subscriber::fmt()
+                .with_max_level(tracing::Level::TRACE)
+                .with_writer(std::io::sink)
+                .finish(),
+        );
+
         let dir = tempfile::tempdir().expect("tempdir");
         let manager = manager_with_token(dir.path(), "first");
         let spooled = generate_token();

server/src/config.rs

@@ -30,6 +30,18 @@ pub struct Config {
     pub tokens: Vec<TokenEntry>,
     pub setups: Vec<SetupConfig>,
     pub sessions: Vec<SessionConfig>,
+    /// What a new session's thinking level is when nothing chose one.
+    ///
+    /// Here rather than on a provider because providers are *discovered*: a
+    /// default written onto one would be erased by the next rediscovery, which
+    /// is the kind of setting that looks like it stuck until the day it did
+    /// not. Here rather than on the phone because a second device would then
+    /// spawn sessions the first one's owner did not expect.
+    ///
+    /// `None` is the CLI's own default, and stays reachable: this is a level
+    /// somebody chose, not a level this app picked for them.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub default_effort: Option<String>,
 }
 
 /// A machine, and the things it can run.
@@ -78,6 +90,16 @@ pub struct ProviderConfig {
     pub models: Vec<String>,
 }
 
+impl ProviderConfig {
+    /// The executable to run for this provider: its override, or its kind's
+    /// default.
+    pub fn program(&self) -> &str {
+        self.command
+            .as_deref()
+            .unwrap_or(self.kind.default_program())
+    }
+}
+
 /// How to reach a setup that isn't this machine, with the system `ssh` client
 /// -- so `~/.ssh/config`, agents and jump hosts all keep working, and there is
 /// one place to configure connections. A remote session is the identical
@@ -94,6 +116,19 @@ pub struct SshConfig {
     /// Extra `-o` settings, each written as `Key=value`.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub options: Vec<String>,
+    /// Where this machine keeps the GGUF models it can serve, absent for
+    /// the same default this backend uses (`~/.local/share/ai-app/models`
+    /// -- `$XDG_DATA_HOME` is not read on the far side, since it is this
+    /// machine's environment that would answer). A `~` prefix is the
+    /// remote home.
+    ///
+    /// Here rather than on the provider because it is a fact about the
+    /// machine, and because a machine reached over ssh is where the model
+    /// has to be: a llama.cpp session serves the file from the machine
+    /// that runs `llama-server`, and this backend's own downloads are on
+    /// whichever machine that is only when they are the same one.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub models_dir: Option<PathBuf>,
     /// Where a file attached from the phone is put on this machine so the
     /// session can read it. Absent means the session's own working directory,
     /// or the login home for a session that has none. A `~` prefix is the
@@ -145,6 +180,45 @@ impl DriverKind {
         }
     }
 
+    /// Which paid service meters a session of this kind, and `None` for one
+    /// that costs nothing.
+    ///
+    /// What decides which account -- if any -- a rate-limit bar is about is the
+    /// provider a session runs, not the machine it runs on: an echo session on
+    /// a machine that also has the Claude CLI was drawn with that CLI's
+    /// five-hour window, a quota it cannot spend.
+    ///
+    /// Echo names a meter of its own that exists only when a test has asked for
+    /// one (`/usage` in `session::echo`), which is how the bar's states are
+    /// reached without an account. With none set there is no snapshot, and the
+    /// phone draws nothing.
+    ///
+    /// The string is a [`crate::usage::UsageProvider::name`], and it is what
+    /// pairs a session with one of `GET /usage`'s snapshots -- so
+    /// `usage::providers_for` reads this rather than matching on kinds again.
+    pub fn usage_provider(self) -> Option<&'static str> {
+        match self {
+            Self::ClaudeCli => Some(crate::usage::CLAUDE),
+            Self::Echo => Some(crate::usage::ECHO),
+            Self::LlamaCpp => None,
+        }
+    }
+
+    /// The executable a provider of this kind runs when it names none.
+    ///
+    /// Here rather than at each spawn site because it is not only the spawn
+    /// that runs it: `usage` runs the Claude CLI too, to have it refresh its
+    /// own OAuth token, and a default that disagreed with the driver's would
+    /// ask the wrong binary on a machine with two installs.
+    pub fn default_program(self) -> &'static str {
+        match self {
+            Self::ClaudeCli => "claude",
+            Self::LlamaCpp => "llama-server",
+            // Echo is translated in-process; nothing is spawned for it.
+            Self::Echo => "echo",
+        }
+    }
+
     /// Whether the conversation exists outside this app, so that deleting the
     /// session here does not end it.
     ///
@@ -162,6 +236,24 @@ impl DriverKind {
             Self::Echo | Self::LlamaCpp => false,
         }
     }
+
+    /// Whether a thinking level means anything to this kind, so the phone can
+    /// offer the control only where it does something.
+    ///
+    /// Reported from here rather than decided on the phone, and asked of the
+    /// *kind* rather than branched on: the alternative is the session-type
+    /// `if` this app does not have anywhere else. `--effort` is the Claude
+    /// CLI's; a llama session's sampling is `params`, and echo does not think.
+    ///
+    /// It matters more than a control that would simply do nothing, because
+    /// choosing a level stops the process -- so on a session that cannot use
+    /// one it is a button whose only effect is the cost.
+    pub fn takes_effort(self) -> bool {
+        match self {
+            Self::ClaudeCli => true,
+            Self::Echo | Self::LlamaCpp => false,
+        }
+    }
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -196,6 +288,17 @@ pub struct SessionConfig {
     /// the CLI stays the one authority on which modes exist.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub permission_mode: Option<String>,
+    /// How hard the model thinks, passed straight to `--effort`. A string for
+    /// the same reason `permission_mode` is: the CLI owns which levels exist.
+    ///
+    /// Unlike the model and the mode, there is no control request that changes
+    /// one -- checked against 2.1.258, whose only two are `set_model` and
+    /// `set_permission_mode` -- so this is settled at launch and `None` means
+    /// whatever the CLI's own default is. That is a state the phone has to be
+    /// able to *choose*, not just start in, which is why it is an option
+    /// rather than a level with a default written here.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub effort: Option<String>,
     /// Settings the driver interprets, chosen at spawn.
     ///
     /// Deliberately untyped: what a temperature or a context size means is the
@@ -215,6 +318,30 @@ pub struct SessionConfig {
     /// turned off in one tap where one that never arrived is not diagnosable.
     #[serde(default = "notify_default")]
     pub notify: bool,
+    /// Whether a session stopped by the account's usage limit sends itself a
+    /// message once the limit lifts, instead of waiting for a person.
+    ///
+    /// Off unless somebody asked for it. It spends quota the moment it becomes
+    /// available and it does so while nobody is looking, which is exactly the
+    /// kind of thing that must not happen because a default said so.
+    #[serde(default, skip_serializing_if = "not_set")]
+    pub auto_resume: bool,
+    /// What that message says. `None` is [`DEFAULT_RESUME_MESSAGE`], and stays
+    /// reachable: it is this app's word, not one somebody chose, so clearing
+    /// the field goes back to it rather than sending an empty message.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auto_resume_message: Option<String>,
+    /// The message this session owes itself once the limit lifts, and when to
+    /// try. Written when a limit is hit, moved when the wait turns out to be
+    /// wrong, and cleared when the message goes out or auto-resume is turned
+    /// off -- see [`ScheduledResume`].
+    ///
+    /// Persisted rather than held in memory because the wait outlives the
+    /// process doing it: a five-hour window and a weekly one both routinely
+    /// outlast a backend restart, and a resume forgotten across one is a
+    /// session that silently never comes back.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resume: Option<ScheduledResume>,
     /// Whether this session's process is stopped when the server exits, instead
     /// of being left running for the next start to adopt.
     ///
@@ -231,6 +358,28 @@ pub struct SessionConfig {
     pub created: f64,
 }
 
+/// A message owed to a session whose account ran out, and when to try sending
+/// it.
+///
+/// `since` is the whole reason this is a struct: the wait is rescheduled every
+/// time the meter is asked and still says no, so `at` alone cannot say how long
+/// this has been going on -- and something has to, or a machine that can never
+/// be asked is retried until somebody notices. See `crate::resume`.
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ScheduledResume {
+    /// Epoch seconds: when the limit is next worth checking. Never a promise
+    /// that the message goes out then -- the meter is asked first.
+    pub at: f64,
+    /// Epoch seconds the limit was hit.
+    pub since: f64,
+}
+
+/// What an auto-resume says when nothing else was chosen. One word, because
+/// the session already knows what it was doing and this is only the nudge that
+/// lets it carry on.
+pub const DEFAULT_RESUME_MESSAGE: &str = "continue";
+
 fn notify_default() -> bool {
     true
 }
@@ -385,6 +534,7 @@ mod tests {
                         port: Some(2222),
                         identity_file: None,
                         options: Vec::new(),
+                        models_dir: None,
                         attachments_dir: None,
                     }),
                     providers: vec![ProviderConfig {
@@ -395,6 +545,7 @@ mod tests {
                     }],
                 },
             ],
+            default_effort: Some("low".to_string()),
             sessions: vec![SessionConfig {
                 id: "abc123".to_string(),
                 setup: "vm".to_string(),
@@ -403,8 +554,12 @@ mod tests {
                 model: None,
                 cwd: None,
                 permission_mode: None,
+                effort: None,
                 params: BTreeMap::new(),
                 notify: true,
+                auto_resume: false,
+                auto_resume_message: None,
+                resume: None,
                 throwaway: false,
                 created: 1234.5,
             }],

server/src/main.rs

@@ -16,6 +16,7 @@ mod config;
 mod files;
 mod media;
 mod models;
+mod resume;
 mod routes;
 mod session;
 mod setups;
@@ -264,7 +265,16 @@ async fn main() -> Result<()> {
     // No providers listed here any more: which machines can be asked, and about
     // what, comes from the setups at the moment the screen is opened -- so a
     // machine added from the phone reports its limits without a restart.
-    let monitor = Arc::new(usage::UsageMonitor::new());
+    // The fixture is the manager's, because that is where the `/usage` command
+    // that sets it is typed; the monitor is what serves it.
+    let monitor = Arc::new(usage::UsageMonitor::new(manager.usage_fixture()));
+
+    // The one thing in here that acts without a request behind it: a session
+    // switched to auto-resume waits out its account's usage limit and picks
+    // itself back up. Started whether or not any session has it on, because
+    // the setting is per session and changes from the phone -- see
+    // `resume::run`.
+    tokio::spawn(resume::run(Arc::clone(&manager), Arc::clone(&monitor)));
 
     // The bearer-token middleware wraps the entire router -- routes and fallback
     // alike -- here and only here, so a new route can't forget auth.

server/src/models.rs

@@ -29,6 +29,8 @@ use serde::Serialize;
 
 use wg_app_link::private;
 
+use crate::session::transport::{Launch, Transport};
+
 /// Identifies this client to HuggingFace. They ask for one, and a request
 /// without it is more likely to be rate-limited.
 const USER_AGENT: &str = concat!("ai-server/", env!("CARGO_PKG_VERSION"));
@@ -521,6 +523,83 @@ fn collect(root: &Path, dir: &Path, found: &mut Vec<LocalModel>) {
     }
 }
 
+/// Where a machine reached over ssh keeps its models, when its setup does
+/// not say.
+///
+/// The same place this backend puts its own downloads, written out rather
+/// than derived: `$XDG_DATA_HOME` here describes *this* machine's
+/// environment, and the far machine's is the far machine's business. A
+/// setup whose models are elsewhere says so (`SshConfig::models_dir`).
+const FAR_MODELS_DIR: &str = "~/.local/share/ai-app/models";
+
+/// Which directory holds the models on the machine `transport` reaches.
+///
+/// One answer, because two things ask: the list a spawn screen offers,
+/// and the path a session hands `llama-server`. A machine that listed one
+/// directory and served from another would offer models that then failed
+/// to load, which reads as the model being broken.
+pub fn dir_on(transport: &Transport, local: &Path) -> String {
+    match transport {
+        Transport::Here => local.to_string_lossy().into_owned(),
+        Transport::Ssh { ssh, .. } => ssh
+            .models_dir
+            .as_ref()
+            .map_or(FAR_MODELS_DIR.to_string(), |dir| {
+                dir.to_string_lossy().into_owned()
+            }),
+    }
+}
+
+/// Every GGUF on the machine a setup names, which is the machine that
+/// would have to serve it.
+///
+/// The local half of this is [`ModelStore::list`], reading the same shape
+/// off this machine's disk; a caller picks by transport, since a setup
+/// with no ssh *is* this machine and asking a shell about it would be a
+/// slower way to the same answer. What must not happen is offering this
+/// backend's downloads for a session on another machine: the file has to
+/// be where `llama-server` runs, and a list that says otherwise is a
+/// claim about the wrong filesystem.
+///
+/// `dir` is that machine's models directory, `~` included -- expanded on
+/// the far side, which is the only place that knows what it is. A
+/// directory that is not there is an empty list rather than a failure: a
+/// machine that has never had a model put on it is an ordinary state, and
+/// the same one as a machine whose directory exists and is empty.
+pub async fn on_machine(transport: &Transport, dir: &str) -> Result<Vec<LocalModel>> {
+    let script = "p=$1; case $p in \"~\") p=$HOME;; \"~/\"*) p=$HOME/${p#\"~/\"};; esac; \
+                  [ -d \"$p\" ] || exit 0; \
+                  find \"$p\" -type f -name '*.gguf' -printf '%s\\t%P\\0'";
+    let launch = Launch::new(
+        "sh",
+        vec![
+            "-c".to_string(),
+            script.to_string(),
+            "sh".to_string(),
+            dir.to_string(),
+        ],
+        None,
+    );
+    let out = transport.capture(&launch).await?;
+    let mut found: Vec<LocalModel> = out
+        .split('\0')
+        .filter(|record| !record.is_empty())
+        // Two fields, and the name last, so a `\t` in a filename survives.
+        .filter_map(|record| record.split_once('\t'))
+        .filter_map(|(bytes, key)| {
+            let (repo, file) = key.rsplit_once('/')?;
+            Some(LocalModel {
+                key: key.to_string(),
+                repo: repo.to_string(),
+                file: file.to_string(),
+                bytes: bytes.trim().parse().unwrap_or(0),
+            })
+        })
+        .collect();
+    found.sort_by(|a, b| a.key.cmp(&b.key));
+    Ok(found)
+}
+
 /// A model repository on HuggingFace, as the browse screen shows it.
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]

server/src/resume.rs

@@ -0,0 +1,382 @@
+//! Auto-resume: picking a session back up when its account's usage limit
+//! lifts.
+//!
+//! Off unless a session was switched to it, because this spends quota the
+//! moment quota exists and does it while nobody is watching. What it does is
+//! narrow on purpose: it sends one message -- "continue" unless something else
+//! was typed -- to a session that stopped because the account ran out, and
+//! then it is done. There is no retry loop around the conversation itself.
+//!
+//! **The schedule is a plan to ask, never a plan to send.** A reset time is
+//! the one thing here that cannot be trusted: the dialect's is a hint written
+//! when the turn failed, the endpoint's moves when the window moves, and both
+//! are wrong across the case this exists for -- a limit that lifts later than
+//! it said. So the wait ends in a *question* to [`crate::usage`], and only an
+//! answer that says the limits no longer apply sends anything. Every other
+//! answer, including one that cannot be got at all, becomes a new wait.
+//!
+//! This is the top layer: it holds the session manager and the usage monitor
+//! and neither holds it. That is what lets the decision below be a pure
+//! function of a snapshot and a clock, which is the whole of what is worth
+//! testing here.
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use crate::session::{LimitHit, OwedResume, SessionManager, now};
+use crate::usage::{UsageMonitor, UsageSnapshot, UsageState};
+
+/// How often to look at the schedule. Coarse deliberately: a wait measured in
+/// hours does not deserve a fine-grained clock, and the meter behind it is
+/// cached for three minutes anyway.
+const TICK: Duration = Duration::from_secs(60);
+
+/// How close to a scheduled check is close enough to ask the meter. Anything
+/// further out is left alone, so a session waiting five hours costs nothing
+/// until the last few minutes of it.
+const NEARLY: f64 = 300.0;
+
+/// How long to wait after an answer that decided nothing -- the machine could
+/// not be asked, or it says the limit is still on with no reset time.
+const BACKOFF: f64 = 300.0;
+
+/// The least time to wait before asking again, whatever a reset time says. A
+/// window that claims to reset in the past would otherwise be asked about on
+/// every tick.
+const AT_LEAST: f64 = 60.0;
+
+/// How long after the limit was hit to stop waiting.
+///
+/// Something has to bound it, or a machine that can never be asked -- an
+/// unplugged laptop, a setup somebody edited away -- is retried for ever with
+/// nothing on screen saying so. A day is past the longest window Claude
+/// reports, so reaching this means the wait was never going to end on its own.
+const GIVE_UP: f64 = 24.0 * 60.0 * 60.0;
+
+/// The percentage at which a window is spent. The API counts up to 100, so
+/// this is an equality in all but name; written as a threshold because a
+/// figure arriving slightly over is a full window, not a corrupt one.
+const SPENT: f64 = 100.0;
+
+/// What to do about one owed resume, having asked the meter.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Step {
+    /// The limits no longer apply: send the message.
+    Send,
+    /// Ask again at this epoch second.
+    WaitUntil(f64),
+    /// This has been waiting longer than anything real would take.
+    GiveUp,
+}
+
+/// Runs the schedule until the server stops.
+///
+/// Two things wake it: the tick, and a session reporting that it has just run
+/// out. The second is not an optimisation -- a limit hit is what *creates* a
+/// schedule, and a tick that happened a moment before it would otherwise leave
+/// the session unrecorded until the next one.
+pub async fn run(manager: Arc<SessionManager>, monitor: Arc<UsageMonitor>) {
+    let mut limits = manager.subscribe_limits();
+    loop {
+        tokio::select! {
+            _ = tokio::time::sleep(TICK) => {}
+            hit = limits.recv() => match hit {
+                Ok(LimitHit { session_id, resets_at }) => note(&manager, &session_id, resets_at),
+                // Lagged: some reports were dropped, and a session that hit a
+                // limit while this was busy has no schedule. Nothing is lost
+                // for good -- the sweep below reads the config, and the
+                // session will report again the next time it is poked -- but
+                // it is worth saying, because until then that session waits
+                // for a person.
+                Err(tokio::sync::broadcast::error::RecvError::Lagged(missed)) => {
+                    tracing::warn!("auto-resume missed {missed} limit reports");
+                }
+                Err(tokio::sync::broadcast::error::RecvError::Closed) => return,
+            },
+        }
+        sweep(&manager, &monitor).await;
+    }
+}
+
+/// Records a limit against the session that hit it, if it is one that resumes.
+pub(crate) fn note(manager: &SessionManager, session_id: &str, resets_at: Option<f64>) {
+    match manager.note_limit(session_id, resets_at) {
+        Ok(true) => tracing::info!("session {session_id} hit its usage limit; auto-resume is on"),
+        Ok(false) => {}
+        Err(err) => tracing::error!("couldn't schedule a resume for {session_id}: {err:#}"),
+    }
+}
+
+/// One pass over everything owed a message.
+async fn sweep(manager: &SessionManager, monitor: &Arc<UsageMonitor>) {
+    let at = now();
+    for owed in manager.owed_resumes() {
+        if owed.scheduled.at - at > NEARLY {
+            continue;
+        }
+        // Asked per session rather than once for the whole sweep: the answer
+        // is cached per machine and per meter, so several sessions on one
+        // account share one fetch, and a machine nobody is waiting on is not
+        // dialled at all.
+        let snapshot = snapshot_for(Arc::clone(monitor), manager, &owed).await;
+        match decide(snapshot.as_ref(), &owed, now()) {
+            Step::Send => match manager.resume_now(&owed.session_id) {
+                Ok(message) => tracing::info!(
+                    "the limit on {} has lifted; sent \"{message}\" to {}",
+                    owed.setup,
+                    owed.session_id
+                ),
+                Err(err) => {
+                    tracing::error!("couldn't resume {}: {err:#}", owed.session_id)
+                }
+            },
+            Step::WaitUntil(next) => {
+                if let Err(err) = manager.reschedule_resume(&owed.session_id, next) {
+                    tracing::error!(
+                        "couldn't move {}'s resume to {next}: {err:#}",
+                        owed.session_id
+                    );
+                }
+            }
+            Step::GiveUp => {
+                // About the machine rather than in the state's own words: the
+                // detail is in the log, and what lands in the transcript has
+                // to read on a phone.
+                let why = match snapshot.as_ref().map(|snapshot| &snapshot.state) {
+                    Some(UsageState::Ok) => "the limit has not lifted in a day".to_string(),
+                    _ => format!("{} could not be asked for a day", owed.setup),
+                };
+                if let Err(err) = manager.abandon_resume(&owed.session_id, &why) {
+                    tracing::error!("couldn't clear {}'s resume: {err:#}", owed.session_id);
+                }
+            }
+        }
+    }
+}
+
+/// The numbers for the machine and the meter this session is billed against,
+/// and `None` when nothing reports on it.
+///
+/// Blocking work, so it goes to a blocking thread: the fetch behind it reads a
+/// credential file over ssh and then makes an HTTP call.
+async fn snapshot_for(
+    monitor: Arc<UsageMonitor>,
+    manager: &SessionManager,
+    owed: &OwedResume,
+) -> Option<UsageSnapshot> {
+    let setups: Vec<_> = manager
+        .setups()
+        .into_iter()
+        .filter(|setup| setup.id == owed.setup)
+        .collect();
+    if setups.is_empty() {
+        return None;
+    }
+    let provider = owed.provider;
+    tokio::task::spawn_blocking(move || {
+        monitor
+            .snapshots(&setups)
+            .into_iter()
+            .find(|snapshot| snapshot.provider == provider)
+    })
+    .await
+    .unwrap_or_default()
+}
+
+/// What one owed resume should do, given what the meter said and the time.
+///
+/// A pure function of the two, which is what makes the rule inspectable: every
+/// answer that is not "the limits no longer apply" is a longer wait, and the
+/// only thing that ends the waiting other than success is the clock.
+///
+/// The reset time comes from the *snapshot* rather than from the schedule, so
+/// a window that turns out to reset later than the dialect said pushes the
+/// check back, and one that resets sooner pulls it forward. That is the case
+/// the whole design is about: the first answer was a guess, this one is a
+/// measurement.
+pub fn decide(snapshot: Option<&UsageSnapshot>, owed: &OwedResume, at: f64) -> Step {
+    let step = match snapshot {
+        // The meter answered with numbers, which is the only answer that can
+        // send anything.
+        Some(snapshot) if snapshot.state == UsageState::Ok => {
+            let spent: Vec<&crate::usage::UsageWindow> = snapshot
+                .windows
+                .iter()
+                .filter(|window| window.percent >= SPENT)
+                .collect();
+            if spent.is_empty() {
+                Step::Send
+            } else {
+                // The earliest of the spent windows: it is the first moment
+                // the situation can have changed, and if the others are still
+                // full this comes straight back here.
+                match spent
+                    .iter()
+                    .filter_map(|window| epoch_of(window.resets_at.as_deref()))
+                    .min_by(f64::total_cmp)
+                {
+                    Some(resets) => Step::WaitUntil(resets),
+                    // Spent with no reset time anybody could read. Not a
+                    // reason to send: what is known is that the limit is on.
+                    None => Step::WaitUntil(at + BACKOFF),
+                }
+            }
+        }
+        // Logged out, unreachable, or the endpoint refused us -- and nothing
+        // at all, which is a session whose machine or provider has gone. None
+        // of them says the limit has lifted, and sending on any of them is
+        // exactly the "inferred value presented as a measured one" this is
+        // built to avoid.
+        _ => Step::WaitUntil(at + BACKOFF),
+    };
+    match step {
+        // Waiting past the point where a real window would have reset means
+        // whatever is wrong is not going to fix itself.
+        Step::WaitUntil(_) if at - owed.scheduled.since > GIVE_UP => Step::GiveUp,
+        Step::WaitUntil(next) => Step::WaitUntil(next.max(at + AT_LEAST)),
+        other => other,
+    }
+}
+
+/// An RFC-3339 timestamp as epoch seconds, and `None` for one that is absent
+/// or unreadable -- the same two answers the phone's countdown makes, kept
+/// apart from each other nowhere here because both mean "this cannot decide
+/// when to ask".
+fn epoch_of(resets_at: Option<&str>) -> Option<f64> {
+    let text = resets_at?;
+    time::OffsetDateTime::parse(text, &time::format_description::well_known::Rfc3339)
+        .ok()
+        .map(|at| at.unix_timestamp() as f64)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::ScheduledResume;
+    use crate::usage::UsageWindow;
+
+    fn owed(since: f64) -> OwedResume {
+        OwedResume {
+            session_id: "s1".to_string(),
+            setup: "local".to_string(),
+            provider: crate::usage::CLAUDE,
+            scheduled: ScheduledResume { at: since, since },
+        }
+    }
+
+    fn snapshot(state: UsageState, windows: Vec<UsageWindow>) -> UsageSnapshot {
+        UsageSnapshot {
+            provider: crate::usage::CLAUDE.to_string(),
+            setup: "local".to_string(),
+            setup_name: "this machine".to_string(),
+            state,
+            windows,
+            fetched_at: 0.0,
+        }
+    }
+
+    fn window(percent: f64, resets_at: Option<&str>) -> UsageWindow {
+        UsageWindow {
+            kind: "session".to_string(),
+            label: "5-hour window".to_string(),
+            percent,
+            resets_at: resets_at.map(str::to_string),
+            active: true,
+        }
+    }
+
+    #[test]
+    fn a_meter_with_room_in_it_is_the_only_thing_that_sends() {
+        let clear = snapshot(UsageState::Ok, vec![window(41.0, None)]);
+        assert_eq!(decide(Some(&clear), &owed(0.0), 100.0), Step::Send);
+    }
+
+    #[test]
+    fn a_window_still_spent_moves_the_check_to_its_own_reset_time() {
+        // The case the feature exists for: the wait was scheduled for one
+        // time, the limit is still on, and the endpoint now names another.
+        let at = 1_788_546_972.0;
+        let later = "2026-09-05T12:00:00+00:00";
+        let spent = snapshot(UsageState::Ok, vec![window(100.0, Some(later))]);
+        assert_eq!(
+            decide(Some(&spent), &owed(at - 60.0), at),
+            Step::WaitUntil(epoch_of(Some(later)).expect("parses"))
+        );
+    }
+
+    #[test]
+    fn a_reset_time_already_past_still_waits_a_little() {
+        let at = 1_788_546_972.0;
+        let spent = snapshot(
+            UsageState::Ok,
+            vec![window(100.0, Some("2020-01-01T00:00:00+00:00"))],
+        );
+        assert_eq!(
+            decide(Some(&spent), &owed(at - 60.0), at),
+            Step::WaitUntil(at + AT_LEAST)
+        );
+    }
+
+    #[test]
+    fn the_earliest_spent_window_is_the_one_worth_waiting_on() {
+        let at = 1_788_546_972.0;
+        let soon = "2026-09-05T12:00:00+00:00";
+        let far = "2026-09-09T12:00:00+00:00";
+        let mut weekly = window(100.0, Some(far));
+        weekly.kind = "weekly_all".to_string();
+        let spent = snapshot(UsageState::Ok, vec![window(100.0, Some(soon)), weekly]);
+        assert_eq!(
+            decide(Some(&spent), &owed(at - 60.0), at),
+            Step::WaitUntil(epoch_of(Some(soon)).expect("parses"))
+        );
+    }
+
+    #[test]
+    fn a_meter_that_could_not_be_asked_never_sends() {
+        let at = 1_788_546_972.0;
+        for state in [
+            UsageState::NotLoggedIn,
+            UsageState::Unreachable {
+                detail: "no route".to_string(),
+            },
+            UsageState::Failed {
+                detail: "429".to_string(),
+            },
+        ] {
+            let broken = snapshot(state.clone(), Vec::new());
+            assert_eq!(
+                decide(Some(&broken), &owed(at - 60.0), at),
+                Step::WaitUntil(at + BACKOFF),
+                "{state:?}"
+            );
+        }
+        // And no snapshot at all -- a machine or provider edited away under a
+        // session that was waiting on it.
+        assert_eq!(
+            decide(None, &owed(at - 60.0), at),
+            Step::WaitUntil(at + BACKOFF)
+        );
+    }
+
+    #[test]
+    fn waiting_longer_than_any_real_window_gives_up_rather_than_retrying_for_ever() {
+        let at = 1_788_546_972.0;
+        let broken = snapshot(
+            UsageState::Unreachable {
+                detail: "no route".to_string(),
+            },
+            Vec::new(),
+        );
+        assert_eq!(
+            decide(Some(&broken), &owed(at - GIVE_UP - 1.0), at),
+            Step::GiveUp
+        );
+        // A meter that answers is still allowed to send on the same tick: the
+        // ceiling bounds waiting, not resuming.
+        let clear = snapshot(UsageState::Ok, vec![window(3.0, None)]);
+        assert_eq!(
+            decide(Some(&clear), &owed(at - GIVE_UP - 1.0), at),
+            Step::Send
+        );
+    }
+}

server/src/routes.rs

@@ -7,6 +7,7 @@
 //! POST   /setups                       add {name, ssh?} -- providers are discovered
 //! POST   /setups/probe                 dry run {ssh?}: what would be found there
 //! GET    /setups/{id}                  one machine, for refetching after a change
+//! GET    /setups/{id}/models           GGUFs on that machine, for a llama session
 //! GET    /setups/{id}/dir?path=P       entries of directory P, and P resolved
 //! GET    /setups/{id}/file?path=P      content of file P, or why not
 //! PUT    /setups/{id}/file             {path, content, ifSha256} -> new size/mtime/sha256
@@ -28,6 +29,12 @@
 //! GET    /sessions/{id}/transcript    a page of history: ?before=N (newest when absent),
 //!                                     ?limit=N, ?coalesce=true to count rows not deltas,
 //!                                     ?after=N to floor it at what the caller already holds
+//! GET    /sessions/{id}/subagents     [{id, title, status, created, lastActivity}], oldest
+//!                                     first -- see SUBAGENTS.md
+//! GET    /sessions/{id}/subagents/{sub}/transcript  exactly the transcript route above,
+//!                                     against that subagent's own transcript
+//! GET    /sessions/{id}/subagents/{sub}/events?after=N  exactly the events route above,
+//!                                     against that subagent's own stream
 //! POST   /sessions/{id}/message        {text, attachmentIds?}
 //!                                     (starts the process first if it has exited)
 //! POST   /sessions/{id}/unqueue        {messageId} -- take back one not read yet
@@ -41,6 +48,8 @@
 //!                                     which starts again in the new one
 //! POST   /sessions/{id}/model          {model}
 //! POST   /sessions/{id}/permission-mode  {permissionMode}
+//! POST   /sessions/{id}/effort         {effort} -- null for the CLI's default;
+//!                                     settled at launch, so this stops the process
 //! POST   /sessions/{id}/command        {text}  -- /compact, /clear, /rename x, or the dialect's own
 //!                                     (starts the process first if it has exited)
 //! POST   /sessions/{id}/compact
@@ -49,8 +58,12 @@
 //! DELETE /sessions/{id}                kill process, delete transcript + files
 //!                                     (?deleteForeign=true removes the machine's own copy too)
 //! POST   /sessions/{id}/notify         {notify}  -- announce this one or not
+//! POST   /sessions/{id}/auto-resume    {autoResume, message?} -- carry on by itself
+//!                                     once the account's usage limit lifts
 //! GET    /notifications                SSE: every session's attention-wanting
 //!                                      moments, live only (see `notifications`)
+//! GET    /defaults                    {effort} -- what a new session starts at
+//! POST   /defaults                    {effort} -- null for the CLI's own default
 //! GET    /usage                        cached usage windows per provider
 //! GET    /models                       downloaded GGUFs, and what is being fetched
 //! GET    /models/search?q=Q            HuggingFace repositories matching Q
@@ -92,6 +105,7 @@ use tokio_stream::wrappers::{BroadcastStream, ReceiverStream};
 
 use crate::session::driver::{SessionCommand, Unqueued};
 use crate::session::pending::Operation;
+use crate::session::subagent::{Subagent, SubagentInfo};
 use crate::session::transcript::{CATCH_UP_LIMIT, CatchUp, SeqEvent, catch_up};
 use crate::session::{LiveSession, SessionInfo, SessionManager, SpawnSpec};
 
@@ -109,6 +123,8 @@ pub fn router(manager: Arc<SessionManager>) -> Router {
             "/setups/{id}",
             get(read_setup).put(update_setup).delete(delete_setup),
         )
+        // The models on the machine a setup names, for a llama session there.
+        .route("/setups/{id}/models", get(setup_models))
         // The filesystem of the machine a setup names. Under the setup
         // rather than under a session because a filesystem is a property of
         // a machine; a session only says where to start looking.
@@ -121,6 +137,15 @@ pub fn router(manager: Arc<SessionManager>) -> Router {
         .route("/sessions/{id}", get(read_session).delete(delete_session))
         .route("/sessions/{id}/events", get(events))
         .route("/sessions/{id}/transcript", get(transcript))
+        .route("/sessions/{id}/subagents", get(list_subagents))
+        .route(
+            "/sessions/{id}/subagents/{sub}/transcript",
+            get(subagent_transcript),
+        )
+        .route(
+            "/sessions/{id}/subagents/{sub}/events",
+            get(subagent_events),
+        )
         .route("/sessions/{id}/message", post(message))
         .route("/sessions/{id}/unqueue", post(unqueue))
         .route("/sessions/{id}/answer", post(answer))
@@ -131,7 +156,10 @@ pub fn router(manager: Arc<SessionManager>) -> Router {
         .route("/sessions/{id}/cwd", post(set_cwd))
         .route("/sessions/{id}/model", post(set_model))
         .route("/sessions/{id}/permission-mode", post(set_permission_mode))
+        .route("/sessions/{id}/effort", post(set_effort))
+        .route("/defaults", get(defaults).post(set_defaults))
         .route("/sessions/{id}/notify", post(set_notify))
+        .route("/sessions/{id}/auto-resume", post(set_auto_resume))
         .route("/notifications", get(notifications))
         .route("/sessions/{id}/compact", post(compact))
         .route("/sessions/{id}/command", post(command))
@@ -197,6 +225,18 @@ fn lookup(manager: &SessionManager, id: &str) -> Result<Arc<LiveSession>, ApiErr
         .ok_or_else(|| ApiError::NotFound(format!("no session {id}")))
 }
 
+/// A session's subagent by id -- the second half of the lookup every
+/// `/sessions/{id}/subagents/{sub}/...` route needs. `Arc` because reopening
+/// one from disk (a subagent this process has not touched yet) inserts it
+/// into the registry, and a route holding a borrow across that would be
+/// holding the registry's lock the whole request.
+fn lookup_subagent(session: &LiveSession, sub: &str) -> Result<Arc<Subagent>, ApiError> {
+    session
+        .subagents()
+        .get(sub)
+        .ok_or_else(|| ApiError::NotFound(format!("no subagent {sub}")))
+}
+
 async fn list_sessions(State(manager): State<Arc<SessionManager>>) -> axum::Json<Vec<SessionInfo>> {
     axum::Json(manager.sessions())
 }
@@ -291,6 +331,9 @@ struct SshRequest {
     /// Where attached files land on that machine; see `SshConfig`.
     #[serde(default)]
     attachments_dir: Option<String>,
+    /// Where that machine keeps its GGUF models; see `SshConfig`.
+    #[serde(default)]
+    models_dir: Option<String>,
 }
 
 impl SshRequest {
@@ -320,6 +363,14 @@ impl SshRequest {
                 .map(str::trim)
                 .filter(|dir| !dir.is_empty())
                 .map(std::path::PathBuf::from),
+            // The same rule, and for the same reason: this directory is
+            // on the other machine, so a `~` in it is that machine's home.
+            models_dir: self
+                .models_dir
+                .as_deref()
+                .map(str::trim)
+                .filter(|dir| !dir.is_empty())
+                .map(std::path::PathBuf::from),
         })
     }
 }
@@ -495,6 +546,27 @@ struct PathQuery {
     path: String,
 }
 
+/// The models **that machine** has, which is the list a llama.cpp session
+/// on it can choose from.
+///
+/// Not `GET /models`, which is this backend's own downloads: those are on
+/// the machine a session runs on only when they are the same machine. A
+/// spawn screen offering this backend's list for a remote setup would be
+/// naming files that are not there, and the session would fail at the
+/// point of loading rather than at the point of choosing.
+async fn setup_models(
+    State(manager): State<Arc<SessionManager>>,
+    UrlPath(id): UrlPath<String>,
+) -> Result<axum::Json<Vec<crate::models::LocalModel>>, ApiError> {
+    let setup = setup_by_id(&manager, &id)?;
+    let transport = crate::session::transport::Transport::for_setup(&setup);
+    let dir = crate::models::dir_on(&transport, manager.models_dir());
+    crate::models::on_machine(&transport, &dir)
+        .await
+        .map(axum::Json)
+        .map_err(from_machine)
+}
+
 /// What is in a directory, and what that directory resolved to.
 async fn list_dir(
     State(manager): State<Arc<SessionManager>>,
@@ -609,6 +681,8 @@ struct SpawnRequest {
     cwd: Option<PathBuf>,
     #[serde(default)]
     permission_mode: Option<String>,
+    #[serde(default)]
+    effort: Option<String>,
     /// Whatever the chosen driver understands -- llama.cpp's context size and
     /// sampling. Opaque here on purpose: see `SessionConfig::params`.
     #[serde(default)]
@@ -796,6 +870,7 @@ async fn start_import(
             model: body.model.clone(),
             cwd: None,
             permission_mode: body.permission_mode.clone(),
+            effort: body.effort.clone(),
             params: std::collections::BTreeMap::new(),
             import: Some(session.clone()),
         };
@@ -828,6 +903,8 @@ struct ImportRequest {
     model: Option<String>,
     #[serde(default)]
     permission_mode: Option<String>,
+    #[serde(default)]
+    effort: Option<String>,
 }
 
 /// Runs `work` on the server, marked as in flight for as long as it takes.
@@ -978,6 +1055,7 @@ async fn spawn(manager: &Arc<SessionManager>, body: SpawnRequest) -> Result<Sess
                 .filter(|cwd| cwd.as_os_str() != "")
         }),
         permission_mode: body.permission_mode,
+        effort: body.effort,
         params: body.params,
     };
 
@@ -1311,6 +1389,60 @@ struct PermissionModeRequest {
     mode: String,
 }
 
+/// What new sessions start at. One field today; a struct rather than a bare
+/// value because "the defaults" is the thing a phone asks for, and the next
+/// one to move here -- the permission mode, which the spawn screen still
+/// hardcodes -- must not need a second route.
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[serde(deny_unknown_fields)]
+struct Defaults {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    effort: Option<String>,
+}
+
+async fn defaults(State(manager): State<Arc<SessionManager>>) -> axum::Json<Defaults> {
+    axum::Json(Defaults {
+        effort: manager.default_effort(),
+    })
+}
+
+/// Sets what a new session's thinking level is. Applied when a session is
+/// spawned, so nothing already running changes underneath anybody.
+async fn set_defaults(
+    State(manager): State<Arc<SessionManager>>,
+    axum::Json(body): axum::Json<Defaults>,
+) -> Result<StatusCode, ApiError> {
+    manager
+        .set_default_effort(body.effort.as_deref())
+        .map_err(bad_request)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[serde(deny_unknown_fields)]
+struct EffortRequest {
+    /// Absent or null is the CLI's own default, which is a choice somebody can
+    /// make rather than only a state to start in.
+    #[serde(default)]
+    effort: Option<String>,
+}
+
+/// Records how hard this session thinks, and stops the process so the next one
+/// is launched with it -- `--effort` has no control request behind it. See
+/// [`SessionManager::set_session_effort`].
+async fn set_effort(
+    State(manager): State<Arc<SessionManager>>,
+    UrlPath(id): UrlPath<String>,
+    axum::Json(body): axum::Json<EffortRequest>,
+) -> Result<StatusCode, ApiError> {
+    manager
+        .set_session_effort(&id, body.effort.as_deref())
+        .map_err(bad_request)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
 async fn set_permission_mode(
     State(manager): State<Arc<SessionManager>>,
     UrlPath(id): UrlPath<String>,
@@ -1339,6 +1471,33 @@ async fn set_notify(
     Ok(StatusCode::NO_CONTENT)
 }
 
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct AutoResumeRequest {
+    auto_resume: bool,
+    /// What to send when the limit lifts. Absent -- and empty, which is what a
+    /// cleared field sends -- means this app's own default word, which is a
+    /// choice a caller has to be able to make rather than only start in.
+    #[serde(default)]
+    message: Option<String>,
+}
+
+/// Turns auto-resume on or off, and sets what it would say.
+///
+/// One request for both, because they are one decision: switching it on
+/// without saying what to send is the ordinary case, and changing the words
+/// while it is off is how somebody sets it up before it is needed.
+async fn set_auto_resume(
+    State(manager): State<Arc<SessionManager>>,
+    UrlPath(id): UrlPath<String>,
+    axum::Json(body): axum::Json<AutoResumeRequest>,
+) -> Result<StatusCode, ApiError> {
+    manager
+        .set_session_auto_resume(&id, body.auto_resume, body.message.as_deref())
+        .map_err(bad_request)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
 struct CommandRequest {
@@ -1616,8 +1775,36 @@ async fn transcript(
     Query(query): Query<TranscriptQuery>,
 ) -> Result<axum::Json<Vec<crate::session::transcript::SeqEvent>>, ApiError> {
     let session = lookup(&manager, &id)?;
+    transcript_page(session.transcript_path(), &id, query)
+}
+
+/// Exactly [`transcript`]'s route and answer, against one subagent's own
+/// transcript instead of its session's -- see `SUBAGENTS.md`'s wire shape.
+async fn subagent_transcript(
+    State(manager): State<Arc<SessionManager>>,
+    UrlPath((id, sub)): UrlPath<(String, String)>,
+    Query(query): Query<TranscriptQuery>,
+) -> Result<axum::Json<Vec<crate::session::transcript::SeqEvent>>, ApiError> {
+    let session = lookup(&manager, &id)?;
+    let subagent = lookup_subagent(&session, &sub)?;
+    transcript_page(
+        &subagent.transcript_path(),
+        &format!("{id}/subagents/{sub}"),
+        query,
+    )
+}
+
+/// A page of history at `path`, newest first to open with -- the one
+/// implementation [`transcript`] and [`subagent_transcript`] share, since a
+/// subagent's transcript is read exactly the way a session's is. `label` is
+/// only for the debug line below.
+fn transcript_page(
+    path: &Path,
+    label: &str,
+    query: TranscriptQuery,
+) -> Result<axum::Json<Vec<crate::session::transcript::SeqEvent>>, ApiError> {
     let events = crate::session::transcript::read_window(
-        session.transcript_path(),
+        path,
         query.before,
         query.after,
         query.limit,
@@ -1629,7 +1816,7 @@ async fn transcript(
     // for events and draws rows, and the ratio between them is a property of
     // the conversation. `RUST_LOG=ai_server=debug`.
     tracing::debug!(
-        session = %id,
+        session = %label,
         before = ?query.before,
         after = ?query.after,
         limit = query.limit,
@@ -1647,23 +1834,74 @@ async fn events(
     headers: HeaderMap,
 ) -> Result<Sse<impl tokio_stream::Stream<Item = Result<SseEvent, Infallible>>>, ApiError> {
     let session = lookup(&manager, &id)?;
-    let cursor = headers
-        .get("last-event-id")
-        .and_then(|value| value.to_str().ok())
-        .and_then(|value| value.parse().ok())
-        .unwrap_or(query.after);
-
+    let cursor = cursor_of(&headers, query.after);
     // Subscribe before reading the file so nothing can land in the gap
     // between replay and live; overlap is deduplicated by seq.
     let live = session.subscribe();
-    let (tx, stream) = mpsc::channel(64);
-    tokio::spawn(stream_session(
+    Ok(sse_stream(
         session.transcript_path().to_path_buf(),
         cursor,
         live,
-        tx,
-    ));
-    Ok(Sse::new(ReceiverStream::new(stream).map(Ok)).keep_alive(KeepAlive::default()))
+    ))
+}
+
+/// Exactly [`events`]'s route and answer, against one subagent's own stream
+/// instead of its session's -- see `SUBAGENTS.md`'s wire shape.
+async fn subagent_events(
+    State(manager): State<Arc<SessionManager>>,
+    UrlPath((id, sub)): UrlPath<(String, String)>,
+    Query(query): Query<EventsQuery>,
+    headers: HeaderMap,
+) -> Result<Sse<impl tokio_stream::Stream<Item = Result<SseEvent, Infallible>>>, ApiError> {
+    let session = lookup(&manager, &id)?;
+    let subagent = lookup_subagent(&session, &sub)?;
+    let cursor = cursor_of(&headers, query.after);
+    let live = subagent.subscribe();
+    Ok(sse_stream(subagent.transcript_path(), cursor, live))
+}
+
+/// The cursor an SSE reconnect resumes from: the native `Last-Event-ID`
+/// takes precedence over the query parameter, same cursor either way.
+fn cursor_of(headers: &HeaderMap, query_after: u64) -> u64 {
+    headers
+        .get("last-event-id")
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(query_after)
+}
+
+/// Spawns the backlog-then-live task and wraps it as the response, the one
+/// piece [`events`] and [`subagent_events`] share.
+fn sse_stream(
+    transcript: PathBuf,
+    cursor: u64,
+    live: broadcast::Receiver<SeqEvent>,
+) -> Sse<impl tokio_stream::Stream<Item = Result<SseEvent, Infallible>>> {
+    let (tx, stream) = mpsc::channel(64);
+    tokio::spawn(stream_session(transcript, cursor, live, tx));
+    Sse::new(ReceiverStream::new(stream).map(Ok)).keep_alive(KeepAlive::default())
+}
+
+/// `GET /sessions/{id}/subagents`: every subagent this session has started,
+/// oldest first, with a status read from its own transcript -- see
+/// `SUBAGENTS.md`'s wire shape. A subagent whose last status is `Running` is
+/// reported `Unknown` instead when the session itself is not running: its
+/// process was the session's, and a session with none has nothing left to
+/// ask.
+async fn list_subagents(
+    State(manager): State<Arc<SessionManager>>,
+    UrlPath(id): UrlPath<String>,
+) -> Result<axum::Json<Vec<SubagentInfo>>, ApiError> {
+    let session = lookup(&manager, &id)?;
+    // Anything but `Exited` or `Unknown` has a process behind it, which is
+    // what decides whether a subagent still reading `Running` from its own
+    // transcript can be believed -- see `SUBAGENTS.md`'s wire shape.
+    let running = !matches!(
+        session.status(),
+        crate::session::driver::SessionStatus::Exited
+            | crate::session::driver::SessionStatus::Unknown
+    );
+    Ok(axum::Json(session.subagents().list(running)))
 }
 
 /// Every session's attention-wanting moments, on one stream.

server/src/session/claude.rs

@@ -59,6 +59,7 @@ use tokio::sync::mpsc;
 
 use super::driver::{AttachmentRef, Driver, Event, EventSink, SessionStatus, Unqueued};
 use super::process;
+use super::subagent::Subagents;
 use super::transport::{Launch, Streams, Transport};
 use crate::config::{ProviderConfig, SessionConfig};
 use translate::{AnswerOutcome, Setting, Translator, starts_a_model_call};
@@ -213,8 +214,12 @@ impl ClaudeDriver {
         transport: &Transport,
         session_dir: &Path,
         sink: EventSink,
+        subagents: Arc<Subagents>,
     ) -> Result<Self> {
-        let state = Arc::new(Mutex::new(Translator::new(session_dir.to_path_buf())));
+        let state = Arc::new(Mutex::new(Translator::new(
+            session_dir.to_path_buf(),
+            subagents,
+        )));
         let queue = Arc::new(Mutex::new(Queue::default()));
         let reading = Arc::new(AtomicBool::new(true));
 
@@ -351,6 +356,12 @@ impl ClaudeDriver {
         if let Some(mode) = &meta.permission_mode {
             push("--permission-mode", mode);
         }
+        // Launch-only: see `SessionConfig::effort`. Omitted entirely when
+        // unset, so the CLI's own default is what an unchosen session gets
+        // rather than a level this app decided to call the default.
+        if let Some(effort) = &meta.effort {
+            push("--effort", effort);
+        }
         // Named at birth, so this session is the same session in the CLI's own
         // picker and in what other agents see.
         //
@@ -386,7 +397,7 @@ impl ClaudeDriver {
         let stdout = create_log(&session_dir.join(STDOUT_LOG))?;
         let stderr = create_log(&session_dir.join(STDERR_LOG))?;
 
-        let program = provider.command.as_deref().unwrap_or("claude");
+        let program = provider.program();
         let launch = Launch::new(program, args, meta.cwd.as_deref());
         let child = transport.spawn(
             &launch,
@@ -1163,7 +1174,10 @@ mod tests {
     /// this" and "the transcript records that".
     fn events_from_lines(lines: &[&str]) -> Vec<Event> {
         let dir = tempfile::tempdir().expect("temp dir");
-        let state = Arc::new(Mutex::new(Translator::new(dir.path().to_path_buf())));
+        let state = Arc::new(Mutex::new(Translator::new(
+            dir.path().to_path_buf(),
+            Arc::new(Subagents::new(dir.path().to_path_buf())),
+        )));
         let queue = Arc::new(Mutex::new(Queue::default()));
         let (sink, mut out) = mpsc::unbounded_channel::<Event>();
         for line in lines {
@@ -1187,7 +1201,10 @@ mod tests {
         interject: impl FnOnce(&Arc<Mutex<Queue>>),
     ) -> Vec<Event> {
         let dir = tempfile::tempdir().expect("temp dir");
-        let state = Arc::new(Mutex::new(Translator::new(dir.path().to_path_buf())));
+        let state = Arc::new(Mutex::new(Translator::new(
+            dir.path().to_path_buf(),
+            Arc::new(Subagents::new(dir.path().to_path_buf())),
+        )));
         let queue = Arc::new(Mutex::new(Queue::default()));
         let (sink, mut out) = mpsc::unbounded_channel::<Event>();
         let mut interject = Some(interject);
@@ -1481,7 +1498,10 @@ mod tests {
         // doing.
         let dir = tempfile::tempdir().expect("tempdir");
         let (sink, mut received) = mpsc::unbounded_channel();
-        let state = Arc::new(Mutex::new(Translator::new(dir.path().to_path_buf())));
+        let state = Arc::new(Mutex::new(Translator::new(
+            dir.path().to_path_buf(),
+            Arc::new(Subagents::new(dir.path().to_path_buf())),
+        )));
         let queue = Arc::new(Mutex::new(Queue::default()));
 
         let text = r#"{"type":"stream_event","event":{"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"working"}},"parent_tool_use_id":null}"#;
@@ -1526,7 +1546,10 @@ mod tests {
         // session back to work.
         let dir = tempfile::tempdir().expect("tempdir");
         let (sink, mut received) = mpsc::unbounded_channel();
-        let state = Arc::new(Mutex::new(Translator::new(dir.path().to_path_buf())));
+        let state = Arc::new(Mutex::new(Translator::new(
+            dir.path().to_path_buf(),
+            Arc::new(Subagents::new(dir.path().to_path_buf())),
+        )));
         let queue = Arc::new(Mutex::new(Queue::default()));
         queue.lock().unwrap().close(&sink, "the session ended");
 

server/src/session/claude/translate.rs

@@ -11,10 +11,12 @@
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
 
 use serde_json::{Value, json};
 
 use super::super::driver::{Event, QuestionOption, SessionStatus, context_tokens};
+use super::super::subagent::Subagents;
 
 /// Whether this line is the CLI opening a fresh model call.
 ///
@@ -92,10 +94,20 @@ pub(super) struct Translator {
     /// reports none rather than repeating the previous turn's.
     context: Option<u64>,
     session_dir: PathBuf,
+    /// This session's subagents, shared with every child translator below --
+    /// see `SUBAGENTS.md`. One registry per session, so a subagent started
+    /// through this translator or any of its children lands in the same
+    /// place a route reads it back from.
+    subagents: Arc<Subagents>,
+    /// One translator per subagent id, holding *its* streaming and
+    /// tool-tracking state -- separate from the parent's because tool ids
+    /// are unique but a `stream_event`'s content-block index is not, and
+    /// parallel subagents interleave their deltas on one stdout.
+    children: HashMap<String, Arc<Mutex<Translator>>>,
 }
 
 impl Translator {
-    pub(super) fn new(session_dir: PathBuf) -> Self {
+    pub(super) fn new(session_dir: PathBuf, subagents: Arc<Subagents>) -> Self {
         Self {
             session_id: None,
             pending: HashMap::new(),
@@ -103,6 +115,8 @@ impl Translator {
             interrupting: false,
             context: None,
             session_dir,
+            subagents,
+            children: HashMap::new(),
         }
     }
 
@@ -122,13 +136,77 @@ impl Translator {
     pub(super) fn translate(&mut self, message: &Value) -> Vec<Event> {
         // Events from subagents (Task tool internals) carry a
         // parent_tool_use_id; the transcript shows the Task tool's own
-        // start/end instead of every nested step.
-        if message
-            .get("parent_tool_use_id")
-            .is_some_and(|id| !id.is_null())
-        {
-            return Vec::new();
+        // start/end instead of every nested step. Routed into that
+        // subagent's own transcript rather than dropped -- see
+        // `SUBAGENTS.md`.
+        if let Some(parent_id) = message.get("parent_tool_use_id").and_then(Value::as_str) {
+            return self.translate_child(parent_id, message);
         }
+        self.dispatch(message)
+    }
+
+    /// A line belonging to a subagent rather than to this translator's own
+    /// session. Always returns nothing to the *caller*: everything it
+    /// produces goes into the subagent's own transcript instead.
+    fn translate_child(&mut self, id: &str, message: &Value) -> Vec<Event> {
+        match self.subagents.get(id) {
+            Some(subagent) if !subagent.is_open() => {
+                // Not stale: the Task tool runs in the background by
+                // default, so a finished subagent can still be sent another
+                // message later (SendMessage) and start working again. A
+                // line arriving after `finish` means exactly that, not a
+                // conversation that is over -- see `SUBAGENTS.md`.
+                self.subagents.reopen(id);
+            }
+            Some(_) => {}
+            None => {
+                // Nobody has heard of this id yet: the Task call itself
+                // either has not been seen or never will be. Started here
+                // with the best title available -- the tool name of this
+                // first line -- since SUBAGENTS.md's real title only
+                // arrives with the Task call.
+                self.subagents.start(id, &fallback_title(message), None);
+            }
+        }
+        let child = self
+            .children
+            .entry(id.to_string())
+            .or_insert_with(|| {
+                Arc::new(Mutex::new(Translator::new(
+                    self.session_dir.clone(),
+                    Arc::clone(&self.subagents),
+                )))
+            })
+            .clone();
+        let events = child.lock().unwrap().dispatch(message);
+        for event in events {
+            // The subagent's own vocabulary is Running/Exited/Unknown, never
+            // Idle -- a background Task is either working or it has ended,
+            // never merely "between turns" the way a session is. Dropped
+            // here rather than never produced, so a `result` line's own
+            // `Idle` (dispatch's ordinary end-of-turn event, for a subagent
+            // dialect that ever sends one) is caught the same way a
+            // `message_delta` would be.
+            if !matches!(
+                event,
+                Event::Status {
+                    state: SessionStatus::Idle
+                }
+            ) {
+                self.subagents.record(id, event);
+            }
+        }
+        // What actually ends a subagent's turn: not the parent's
+        // `tool_result`, which for a background Task arrives at launch
+        // ("Async agent launched...") long before the work is done -- see
+        // `SUBAGENTS.md`.
+        if ends_a_turn(message) {
+            self.subagents.finish(id);
+        }
+        Vec::new()
+    }
+
+    fn dispatch(&mut self, message: &Value) -> Vec<Event> {
         match message.get("type").and_then(Value::as_str) {
             Some("system") => self.translate_system(message),
             // The CLI's own announcement that `/clear` took effect, sent just
@@ -224,12 +302,12 @@ impl Translator {
                         .and_then(Value::as_bool)
                         .unwrap_or(false)
                 {
-                    events.push(Event::Error {
-                        message: message
-                            .get("result")
-                            .and_then(Value::as_str)
-                            .unwrap_or("the turn ended with an error")
-                            .to_string(),
+                    let said = message.get("result").and_then(Value::as_str);
+                    events.push(match said.and_then(usage_limit) {
+                        Some(resets_at) => Event::LimitReached { resets_at },
+                        None => Event::Error {
+                            message: said.unwrap_or("the turn ended with an error").to_string(),
+                        },
                     });
                 }
                 let context = self.context.take();
@@ -379,22 +457,47 @@ impl Translator {
         content
             .iter()
             .filter(|block| block.get("type").and_then(Value::as_str) == Some("tool_use"))
-            .map(|block| Event::ToolStart {
-                id: block
+            .map(|block| {
+                let id = block
                     .get("id")
                     .and_then(Value::as_str)
                     .unwrap_or_default()
-                    .to_string(),
-                tool: block
+                    .to_string();
+                let tool = block
                     .get("name")
                     .and_then(Value::as_str)
                     .unwrap_or_default()
-                    .to_string(),
-                input: block.get("input").cloned().unwrap_or(Value::Null),
+                    .to_string();
+                let input = block.get("input").cloned().unwrap_or(Value::Null);
+                // A subagent this call is about to start -- see
+                // `SUBAGENTS.md`'s lifecycle #1. The parent's own transcript
+                // still shows only the Task call itself, below.
+                if tool == "Task" || tool == "Agent" {
+                    self.start_subagent_from_task(&id, &input);
+                }
+                Event::ToolStart { id, tool, input }
             })
             .collect()
     }
 
+    /// Starts the subagent a Task call names, with the title and prompt
+    /// SUBAGENTS.md describes: the call's `description`, then
+    /// `(<subagent_type>)` when one is given, falling back to the tool's own
+    /// name when there is no description to build one from.
+    fn start_subagent_from_task(&self, id: &str, input: &Value) {
+        let description = text_field(input, "description");
+        let subagent_type = text_field(input, "subagent_type");
+        let prompt = input.get("prompt").and_then(Value::as_str);
+        let title = match (description, subagent_type) {
+            (Some(description), Some(subagent_type)) => {
+                format!("{description} ({subagent_type})")
+            }
+            (Some(description), None) => description,
+            (None, _) => "Task".to_string(),
+        };
+        self.subagents.start(id, &title, prompt);
+    }
+
     fn translate_control_request(&mut self, message: &Value) -> Vec<Event> {
         let request = &message["request"];
         if request.get("subtype").and_then(Value::as_str) != Some("can_use_tool") {
@@ -598,11 +701,90 @@ impl Translator {
                 id: about.clone(),
                 output: texts.join("\n"),
             });
+            // Deliberately does *not* finish a subagent `about` might name:
+            // the Task tool runs in the background by default, so this
+            // `tool_result` -- "Async agent launched..." -- arrives at
+            // launch, long before the subagent's own work is done. What
+            // ends it is its own turn ending, handled in `translate_child`.
         }
         events
     }
 }
 
+/// The title to start a subagent under when its own first line arrives
+/// before (or without) its Task call ever being seen: the tool name of that
+/// first line, which is the only thing known about it yet. `"subagent"` for
+/// a line this cannot even find a tool name in, such as one that opens with
+/// something other than a tool call.
+fn fallback_title(message: &Value) -> String {
+    message["message"]["content"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .find(|block| block.get("type").and_then(Value::as_str) == Some("tool_use"))
+        .and_then(|block| block.get("name"))
+        .and_then(Value::as_str)
+        .unwrap_or("subagent")
+        .to_string()
+}
+
+/// Whether this line is a subagent's *own* turn ending -- the only thing
+/// that does, per `SUBAGENTS.md`: not the parent's `tool_result`, which for
+/// a background Task arrives at launch rather than at completion.
+///
+/// Checked on the raw line rather than on what `dispatch` returns, so this
+/// never has to touch the shared `translate_stream_event`/`dispatch` code a
+/// top-level session's own turn-ending also goes through -- a subagent's
+/// idea of "ended" must not change when a real session's does.
+///
+/// `message_delta` is the raw API's own signal, carrying the stop reason:
+/// `end_turn` is genuinely done, `tool_use` means the model is about to call
+/// one and there is more coming. A `result` line is the CLI's own shape for
+/// a top-level turn; a subagent has not been observed to send one, but
+/// SUBAGENTS.md counts it too in case a future CLI version does.
+fn ends_a_turn(message: &Value) -> bool {
+    match message.get("type").and_then(Value::as_str) {
+        Some("stream_event") => {
+            let event = &message["event"];
+            event.get("type").and_then(Value::as_str) == Some("message_delta")
+                && event["delta"].get("stop_reason").and_then(Value::as_str) == Some("end_turn")
+        }
+        Some("result") => true,
+        _ => false,
+    }
+}
+
+/// Whether a failed turn failed because the account is out of quota, and when
+/// the CLI said the limit lifts.
+///
+/// The wording is the CLI's: a turn stopped by the limit ends with `is_error`
+/// and a result of `Claude AI usage limit reached|1788546972`, the reset being
+/// epoch seconds after a pipe. Matched on the sentence rather than on a code
+/// because the CLI sends none, so this is deliberately loose about everything
+/// but the four words.
+///
+/// The two `None`s mean different things and both are real. The outer one is
+/// "some other failure". The inner one is "the limit is reached and the CLI did
+/// not say until when" -- which is not a reason to invent a time: `crate::resume`
+/// asks the usage endpoint before sending anything, and that answer is the one
+/// that decides.
+///
+/// Milliseconds are accepted as well as seconds and told apart by magnitude,
+/// since a wrong guess would schedule a resume tens of thousands of years out
+/// and look exactly like auto-resume being broken.
+fn usage_limit(result: &str) -> Option<Option<f64>> {
+    if !result.to_ascii_lowercase().contains("usage limit reached") {
+        return None;
+    }
+    let stamp = result
+        .rsplit('|')
+        .next()
+        .and_then(|tail| tail.trim().parse::<f64>().ok())
+        .filter(|stamp| *stamp > 0.0)
+        .map(|stamp| if stamp > 1e11 { stamp / 1000.0 } else { stamp });
+    Some(stamp)
+}
+
 /// A string field that is there and not empty, or `None`. The CLI omits these
 /// rather than sending them empty, but a caller that sends `""` means the same
 /// thing and should not produce a description that draws as a blank line.
@@ -665,10 +847,18 @@ mod tests {
             .collect()
     }
 
+    /// A fresh, empty subagent registry over the same temp dir a test's
+    /// translator writes into -- every test here is about the parent's own
+    /// events, so what a registry does with a subagent is `subagent.rs`'s
+    /// tests to make, not these.
+    fn test_subagents(dir: &tempfile::TempDir) -> Arc<Subagents> {
+        Arc::new(Subagents::new(dir.path().to_path_buf()))
+    }
+
     #[test]
     fn captures_the_resume_token_and_the_settings_from_init() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -690,7 +880,7 @@ mod tests {
     #[test]
     fn a_setting_is_reported_when_the_cli_accepts_it_and_not_before() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
 
         // What `set_model` does: remember, send, and say nothing yet.
         translator.expect_setting("req-a".to_string(), Setting::Model("sonnet".to_string()));
@@ -767,7 +957,7 @@ mod tests {
         // The line it sends just after answering `set_permission_mode`, which is
         // also how a mode changed from the terminal arrives.
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -787,7 +977,7 @@ mod tests {
     fn streams_text_deltas_and_skips_the_consolidated_copy() {
         // Real lines (trimmed) from the 2.1.237 probe.
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -807,7 +997,7 @@ mod tests {
     #[test]
     fn tool_use_and_result_become_tool_events() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -834,7 +1024,7 @@ mod tests {
     #[test]
     fn subagent_events_are_not_duplicated_into_the_transcript() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -844,10 +1034,243 @@ mod tests {
         assert!(events.is_empty());
     }
 
+    /// A child line does not just vanish from the parent -- it lands in its
+    /// own subagent's transcript, with that transcript's own sequence
+    /// numbers, starting at 1 like any other.
+    #[test]
+    fn a_child_line_lands_in_its_own_subagents_transcript() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = test_subagents(&dir);
+        let mut translator = Translator::new(dir.path().to_path_buf(), Arc::clone(&subagents));
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_c1","name":"Bash","input":{"command":"echo hi"}}]},"parent_tool_use_id":"toolu_parent"}"#,
+            ],
+        );
+        let subagent = subagents.get("toolu_parent").expect("subagent started");
+        let lines = crate::session::transcript::read_after(&subagent.transcript_path(), 0)
+            .expect("read subagent transcript");
+        assert_eq!(lines[0].seq, 1);
+        assert_eq!(
+            lines[0].event,
+            Event::Status {
+                state: SessionStatus::Running
+            }
+        );
+        assert!(
+            lines.iter().any(
+                |entry| matches!(&entry.event, Event::ToolStart { tool, .. } if tool == "Bash")
+            )
+        );
+    }
+
+    /// The title and prompt shown for a subagent come from the Task call
+    /// that started it, not from anything guessed at its first line.
+    #[test]
+    fn the_subagent_takes_its_title_and_prompt_from_the_task_call() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = test_subagents(&dir);
+        let mut translator = Translator::new(dir.path().to_path_buf(), Arc::clone(&subagents));
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_task","name":"Task","input":{"description":"Investigate the bug","prompt":"Find why X fails","subagent_type":"general-purpose"}}]},"parent_tool_use_id":null}"#,
+            ],
+        );
+        let rows = subagents.list(true);
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].title, "Investigate the bug (general-purpose)");
+        let subagent = subagents.get(&rows[0].id).expect("subagent");
+        let lines = crate::session::transcript::read_after(&subagent.transcript_path(), 0)
+            .expect("read subagent transcript");
+        assert!(lines.iter().any(
+            |entry| matches!(&entry.event, Event::UserMessage { text, .. } if text == "Find why X fails")
+        ));
+    }
+
+    /// The parent's `tool_result` for the Task id is what ends the
+    /// subagent -- SUBAGENTS.md's lifecycle #3 -- and nothing else does.
+    #[test]
+    fn the_parents_tool_result_does_not_finish_the_subagent() {
+        // The Task tool runs in the background by default: this
+        // `tool_result` is "Async agent launched...", arriving the moment
+        // the subagent *starts*, while it goes on working for however long
+        // its own turn takes. Finishing it here was the bug -- a running
+        // background agent read as "finished" with its transcript truncated
+        // at launch.
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = test_subagents(&dir);
+        let mut translator = Translator::new(dir.path().to_path_buf(), Arc::clone(&subagents));
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_task2","name":"Task","input":{"description":"helper"}}]},"parent_tool_use_id":null}"#,
+            ],
+        );
+        let subagent = subagents.get("toolu_task2").expect("subagent started");
+        assert!(subagent.is_open());
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"user","message":{"role":"user","content":[{"type":"tool_result","tool_use_id":"toolu_task2","content":"Async agent launched","is_error":false}]},"parent_tool_use_id":null}"#,
+            ],
+        );
+        assert!(subagent.is_open());
+    }
+
+    /// What actually ends a subagent: the raw API's own `message_delta`
+    /// saying its turn stopped with `end_turn`. Never written into the
+    /// subagent's own transcript as `Idle` -- its vocabulary has no such
+    /// state.
+    #[test]
+    fn the_subagents_own_end_turn_finishes_it() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = test_subagents(&dir);
+        let mut translator = Translator::new(dir.path().to_path_buf(), Arc::clone(&subagents));
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_task3","name":"Task","input":{"description":"helper"}}]},"parent_tool_use_id":null}"#,
+                r#"{"type":"stream_event","event":{"type":"message_delta","delta":{"stop_reason":"end_turn"}},"parent_tool_use_id":"toolu_task3"}"#,
+            ],
+        );
+        let subagent = subagents.get("toolu_task3").expect("subagent started");
+        assert!(!subagent.is_open());
+        let lines = crate::session::transcript::read_after(&subagent.transcript_path(), 0)
+            .expect("read subagent transcript");
+        assert!(
+            !lines
+                .iter()
+                .any(|entry| matches!(&entry.event, Event::Status { state } if *state == SessionStatus::Idle)),
+            "a subagent's transcript must never carry Idle: {lines:?}"
+        );
+        assert_eq!(
+            lines.last().unwrap().event,
+            Event::Status {
+                state: SessionStatus::Exited
+            }
+        );
+    }
+
+    /// `stop_reason: "tool_use"` is the model about to call a tool, with
+    /// more of the turn still coming -- not an end.
+    #[test]
+    fn a_stop_reason_of_tool_use_does_not_finish_the_subagent() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = test_subagents(&dir);
+        let mut translator = Translator::new(dir.path().to_path_buf(), Arc::clone(&subagents));
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_task4","name":"Task","input":{"description":"helper"}}]},"parent_tool_use_id":null}"#,
+                r#"{"type":"stream_event","event":{"type":"message_delta","delta":{"stop_reason":"tool_use"}},"parent_tool_use_id":"toolu_task4"}"#,
+            ],
+        );
+        assert!(
+            subagents
+                .get("toolu_task4")
+                .expect("subagent started")
+                .is_open()
+        );
+    }
+
+    /// A background Task can be sent another message long after its first
+    /// turn ended -- a further child line for it reopens rather than being
+    /// dropped, and the same transcript and child translator carry on.
+    #[test]
+    fn a_line_after_finish_reopens_the_subagent_rather_than_being_dropped() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = test_subagents(&dir);
+        let mut translator = Translator::new(dir.path().to_path_buf(), Arc::clone(&subagents));
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_task5","name":"Task","input":{"description":"helper"}}]},"parent_tool_use_id":null}"#,
+                r#"{"type":"stream_event","event":{"type":"message_delta","delta":{"stop_reason":"end_turn"}},"parent_tool_use_id":"toolu_task5"}"#,
+            ],
+        );
+        let subagent = subagents.get("toolu_task5").expect("subagent started");
+        assert!(!subagent.is_open());
+
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_more","name":"Bash","input":{}}]},"parent_tool_use_id":"toolu_task5"}"#,
+            ],
+        );
+        assert!(subagent.is_open());
+        let lines = crate::session::transcript::read_after(&subagent.transcript_path(), 0)
+            .expect("read subagent transcript");
+        // Running, [prompt], Exited, Running (reopened), then the new line's
+        // own ToolStart -- the same transcript throughout, not a new one.
+        assert!(
+            lines.iter().any(
+                |entry| matches!(&entry.event, Event::ToolStart { tool, .. } if tool == "Bash")
+            )
+        );
+        assert_eq!(
+            lines
+                .iter()
+                .filter(|entry| matches!(
+                    &entry.event,
+                    Event::Status {
+                        state: SessionStatus::Running
+                    }
+                ))
+                .count(),
+            2,
+            "expected one Running at creation and one at the reopen: {lines:?}"
+        );
+    }
+
+    /// Two subagents running at once keep two separate transcripts: tool ids
+    /// are unique but a `stream_event`'s content-block index is not, so
+    /// sharing translation state between them would cross their streams.
+    #[test]
+    fn two_parallel_subagents_keep_separate_transcripts() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = test_subagents(&dir);
+        let mut translator = Translator::new(dir.path().to_path_buf(), Arc::clone(&subagents));
+        translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_a","name":"Bash","input":{}}]},"parent_tool_use_id":"toolu_task_a"}"#,
+                r#"{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_b","name":"Read","input":{}}]},"parent_tool_use_id":"toolu_task_b"}"#,
+            ],
+        );
+        let a = subagents.get("toolu_task_a").expect("subagent a");
+        let b = subagents.get("toolu_task_b").expect("subagent b");
+        let a_events = crate::session::transcript::read_after(&a.transcript_path(), 0)
+            .expect("read a's transcript");
+        let b_events = crate::session::transcript::read_after(&b.transcript_path(), 0)
+            .expect("read b's transcript");
+        assert!(
+            a_events.iter().any(
+                |entry| matches!(&entry.event, Event::ToolStart { tool, .. } if tool == "Bash")
+            )
+        );
+        assert!(
+            b_events.iter().any(
+                |entry| matches!(&entry.event, Event::ToolStart { tool, .. } if tool == "Read")
+            )
+        );
+        assert!(
+            !a_events.iter().any(
+                |entry| matches!(&entry.event, Event::ToolStart { tool, .. } if tool == "Read")
+            )
+        );
+        assert!(
+            !b_events.iter().any(
+                |entry| matches!(&entry.event, Event::ToolStart { tool, .. } if tool == "Bash")
+            )
+        );
+    }
+
     #[test]
     fn a_permission_request_becomes_an_allow_deny_question() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -896,7 +1319,7 @@ mod tests {
     #[test]
     fn denying_a_permission_sends_deny() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         translate_lines(
             &mut translator,
             &[
@@ -914,7 +1337,7 @@ mod tests {
         // The real 2.1.237 shape, verified live: answers go back inside
         // updatedInput, keyed by the question text.
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -966,7 +1389,7 @@ mod tests {
         // in the event: a phone that had to read this dialect's tool input to
         // find them would be the only place that knew how.
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1014,7 +1437,7 @@ mod tests {
     #[test]
     fn images_in_tool_results_are_saved_and_referenced() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         // A 1x1 PNG, the smallest real payload worth round-tripping.
         let png = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==";
         let line = format!(
@@ -1043,7 +1466,7 @@ mod tests {
     #[test]
     fn a_turn_result_reports_usage_and_returns_to_idle() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1078,7 +1501,7 @@ mod tests {
     #[test]
     fn a_turn_started_by_another_agent_records_who_and_what() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1112,7 +1535,7 @@ mod tests {
     #[test]
     fn an_ordinary_turn_carries_no_peer_note() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1137,7 +1560,7 @@ mod tests {
     #[test]
     fn the_context_is_what_the_last_message_held_not_the_turn_added_up() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1177,7 +1600,7 @@ mod tests {
         // Note the snake_case keys -- the CLI's transcript file writes the same
         // records in camelCase.
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1207,7 +1630,7 @@ mod tests {
     #[test]
     fn a_failed_compaction_says_why_and_leaves_the_turn_running() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1234,7 +1657,7 @@ mod tests {
     #[test]
     fn a_boundary_without_counts_says_so_rather_than_inventing_them() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1254,7 +1677,7 @@ mod tests {
     #[test]
     fn an_error_result_surfaces_the_message() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[
@@ -1275,6 +1698,55 @@ mod tests {
         );
     }
 
+    /// Running out of quota is a state, not a failure of the work.
+    ///
+    /// The naive reading -- an error result like any other -- is what shipped
+    /// before this: the transcript said "Claude AI usage limit reached|…" in
+    /// red, which is neither readable nor actionable, and nothing above the
+    /// driver could tell it apart from a broken tool call.
+    #[test]
+    fn a_turn_stopped_by_the_usage_limit_says_so_and_carries_the_reset() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
+        let events = translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Claude AI usage limit reached|1788546972","usage":{}}"#,
+            ],
+        );
+        assert_eq!(
+            events[0],
+            Event::LimitReached {
+                resets_at: Some(1_788_546_972.0)
+            }
+        );
+    }
+
+    #[test]
+    fn a_limit_the_cli_gave_no_reset_for_is_reported_without_one() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
+        let events = translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Claude AI usage limit reached","usage":{}}"#,
+            ],
+        );
+        // Not a time this side invented: the meter is asked before anything is
+        // sent, and a made-up reset would only decide when to ask.
+        assert_eq!(events[0], Event::LimitReached { resets_at: None });
+    }
+
+    #[test]
+    fn a_reset_in_milliseconds_is_not_read_as_the_year_58000() {
+        assert_eq!(
+            usage_limit("Claude AI usage limit reached|1788546972000"),
+            Some(Some(1_788_546_972.0))
+        );
+        // And anything that is not the limit stays an ordinary failure.
+        assert_eq!(usage_limit("something broke"), None);
+    }
+
     /// Pressing Stop is not a failure, and the CLI cannot tell you which it was.
     ///
     /// An interrupted turn arrives as exactly the same shape a broken one does,
@@ -1286,7 +1758,7 @@ mod tests {
     #[test]
     fn a_turn_stopped_on_purpose_is_not_an_error() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let stopped_result = r#"{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Interrupted by user","usage":{}}"#;
 
         translator.expect_interrupt();
@@ -1318,7 +1790,7 @@ mod tests {
     #[test]
     fn replayed_and_synthetic_user_text_is_skipped() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let mut translator = Translator::new(dir.path().to_path_buf());
+        let mut translator = Translator::new(dir.path().to_path_buf(), test_subagents(&dir));
         let events = translate_lines(
             &mut translator,
             &[

server/src/session/echo.rs

@@ -26,6 +26,20 @@
 //! - `/error [text]` -- a failure, which is otherwise awkward to cause.
 //! - `/peer [text]`, `/peer-turn` -- a message from another agent, in the
 //!   in-place and the live shapes.
+//! - `/usage [what]` -- an invented rate-limit answer, or `/usage off` to take
+//!   it away. An echo session meters nothing, so it draws no usage bar until
+//!   this is set; what it exists for is the states that bar can be in, which
+//!   otherwise cost real quota to reach. `/usage 42`, `/usage 95 20`,
+//!   `/usage 42 never`, `/usage notloggedin`, `/usage unreachable`,
+//!   `/usage failed`. The vocabulary is `usage::Fixture`'s, where the states
+//!   live.
+//! - `/limit [minutes]` -- a turn that stops because the account is out of
+//!   quota, saying the limit lifts in `minutes` (default 5, and `never` for a
+//!   limit with no stated reset). What it exists for is auto-resume, which is
+//!   otherwise reachable only by actually exhausting somebody's account: pair
+//!   it with `/usage 100 5` for a meter that agrees, and then `/usage 20` for
+//!   the moment the limit lifts. The wait itself is decided by the meter, so
+//!   those two commands are the whole rig.
 //! - `/compact` -- a compaction, start to finish.
 //! - `/stream N` -- one long answer in N small pieces, 50ms apart: the shape a
 //!   real model's reply arrives in, and the one where the row a reader is
@@ -34,6 +48,10 @@
 //!   and height the app draws, in one session, which is what a scrolling
 //!   problem needs in order to be reproduced twice the same way.
 //! - `/table [columns]` -- a markdown table with cells too long for one line.
+//! - `/subagent [n]` -- n subagents at once (default 1), each named
+//!   "helper k", its prompt recorded as its own first user message: a
+//!   streamed reply, one Bash call, then it finishes about three seconds
+//!   later, the same lifecycle a real Task call has -- see `SUBAGENTS.md`.
 //!
 //! `/slow` earns its place: a queued message, a Stop button and a spinner are
 //! states that only exist mid-turn, and the obvious way to get one -- ask a
@@ -48,6 +66,7 @@ use std::time::Duration;
 use super::driver::{
     AttachmentRef, Driver, Event, EventSink, QuestionOption, SessionStatus, Unqueued,
 };
+use super::subagent::Subagents;
 
 /// Delay between streamed deltas -- long enough that streaming is visibly
 /// streaming, short enough that tests waiting on a full turn stay fast.
@@ -85,11 +104,19 @@ pub struct EchoDriver {
     /// because `/ask` puts up to four on one tool call, and the turn resumes
     /// when the last is answered rather than the first.
     pending_questions: Mutex<Vec<PendingQuestion>>,
+    /// The invented rate-limit answer `/usage` sets, shared with the usage
+    /// monitor that serves it. An echo session meters nothing, so this is unset
+    /// until a test asks for something -- see [`crate::usage::Fixture`].
+    usage: crate::usage::Fixture,
     /// A pretend context, so the status row has something that behaves the way
     /// a real one does: it grows with each turn, drops to what the compaction
     /// says it recovered, and a clear leaves it unmeasured. What is real is
     /// which way the numbers move.
     context: Arc<AtomicU64>,
+    /// This session's subagents -- see `SUBAGENTS.md`. `/subagent` is the
+    /// test rig for the same registry the claude driver routes real Task
+    /// calls into.
+    subagents: Arc<Subagents>,
 }
 
 impl EchoDriver {
@@ -311,6 +338,110 @@ impl EchoDriver {
             return;
         }
 
+        // Answered here rather than in the turn below, because it is not a
+        // turn: nothing is generated, and what is being exercised is the
+        // *other* screens -- the bar under the header, the button beside it and
+        // the dialog it opens, which read the usage route, not this transcript.
+        if let Some(rest) = text.strip_prefix("/usage") {
+            if announce {
+                self.emit(Event::MessageTaken {
+                    id: None,
+                    text: text.clone(),
+                    attachments,
+                });
+            }
+            let said = self.usage.command(rest);
+            self.emit(Event::AssistantText {
+                delta: format!("{said}\n"),
+            });
+            self.emit(Event::Status {
+                state: SessionStatus::Idle,
+            });
+            return;
+        }
+
+        // A turn that ends the way a real one does when the account runs out:
+        // the same event a real driver reports, so what acts on it -- the
+        // transcript row and `crate::resume` -- is exercised rather than
+        // imitated. The meter it should agree with is `/usage`'s fixture,
+        // deliberately separate: the two disagreeing is a state worth being
+        // able to produce, since it is what a stale reset time looks like.
+        if let Some(rest) = text.strip_prefix("/limit") {
+            if announce {
+                self.emit(Event::MessageTaken {
+                    id: None,
+                    text: text.clone(),
+                    attachments,
+                });
+            }
+            let rest = rest.trim();
+            let resets_at = match rest {
+                "never" | "none" => None,
+                "" => Some(super::now() + 5.0 * 60.0),
+                minutes => Some(super::now() + minutes.parse::<f64>().unwrap_or(5.0) * 60.0),
+            };
+            self.emit(Event::Status {
+                state: SessionStatus::Running,
+            });
+            self.emit(Event::AssistantText {
+                delta: "Working on it".to_string(),
+            });
+            self.emit(Event::LimitReached { resets_at });
+            self.emit(Event::Status {
+                state: SessionStatus::Idle,
+            });
+            return;
+        }
+
+        // `n` subagents at once, each with its own transcript in the
+        // registry a real Task call routes into -- see `SUBAGENTS.md`. The
+        // parent's own Task calls end when their subagent does, three
+        // seconds later, which is long enough to see the running state on
+        // the phone before it finishes.
+        if let Some(rest) = text.strip_prefix("/subagent") {
+            let n = rest.trim().parse::<usize>().unwrap_or(1).clamp(1, 8);
+            if announce {
+                self.emit(Event::MessageTaken {
+                    id: None,
+                    text: text.clone(),
+                    attachments,
+                });
+            }
+            self.emit(Event::Status {
+                state: SessionStatus::Running,
+            });
+            let sink = self.sink.clone();
+            let subagents = Arc::clone(&self.subagents);
+            tokio::spawn(async move {
+                let mut helpers = Vec::new();
+                for k in 1..=n {
+                    let id = format!("echo-subagent-{k}-{}", super::random_hex());
+                    let title = format!("helper {k}");
+                    let prompt = format!(
+                        "You are helper {k} of {n}. Say a few words, run a command, then stop."
+                    );
+                    let _ = sink.send(Event::ToolStart {
+                        id: id.clone(),
+                        tool: "Task".to_string(),
+                        input: serde_json::json!({
+                            "description": title,
+                            "prompt": prompt,
+                            "subagent_type": "general-purpose",
+                        }),
+                    });
+                    subagents.start(&id, &title, Some(&prompt));
+                    helpers.push((id, sink.clone(), Arc::clone(&subagents)));
+                }
+                for (id, sink, subagents) in helpers {
+                    tokio::spawn(run_helper(id, sink, subagents));
+                }
+                let _ = sink.send(Event::Status {
+                    state: SessionStatus::Idle,
+                });
+            });
+            return;
+        }
+
         // The same word the real CLI takes, so a phone drives both the same way.
         // `Driver::compact` is what the manager's route calls; this is the typed
         // path onto it.
@@ -606,7 +737,12 @@ impl EchoDriver {
         });
     }
 
-    pub fn new(sink: EventSink, session_dir: PathBuf) -> Self {
+    pub fn new(
+        sink: EventSink,
+        session_dir: PathBuf,
+        usage: crate::usage::Fixture,
+        subagents: Arc<Subagents>,
+    ) -> Self {
         let driver = Self {
             sink,
             pending_questions: Mutex::new(Vec::new()),
@@ -614,6 +750,8 @@ impl EchoDriver {
             busy: Arc::new(AtomicBool::new(false)),
             queued: Arc::new(Mutex::new(Vec::new())),
             session_dir,
+            usage,
+            subagents,
         };
         driver.emit(Event::Status {
             state: SessionStatus::Idle,
@@ -735,6 +873,51 @@ async fn write_beat(sink: &EventSink, session_dir: &Path, beat: usize) {
     tokio::time::sleep(Duration::from_millis(120)).await;
 }
 
+/// One `/subagent` helper: a few streamed words, one Bash call, then
+/// `Status::Exited` about three seconds after it started -- long enough that
+/// its `Running` state can be seen on the phone before it finishes. The
+/// parent's own Task call for it ends at the same moment, the same way a
+/// real Task's `tool_result` ends it.
+async fn run_helper(id: String, sink: EventSink, subagents: Arc<Subagents>) {
+    let start = tokio::time::Instant::now();
+    for word in "Working on it now.".split_inclusive(' ') {
+        subagents.record(
+            &id,
+            Event::AssistantText {
+                delta: word.to_string(),
+            },
+        );
+        tokio::time::sleep(DELTA_DELAY).await;
+    }
+    let tool_id = format!("{id}-bash");
+    subagents.record(
+        &id,
+        Event::ToolStart {
+            id: tool_id.clone(),
+            tool: "Bash".to_string(),
+            input: serde_json::json!({ "command": "echo helper done" }),
+        },
+    );
+    tokio::time::sleep(DELTA_DELAY).await;
+    subagents.record(
+        &id,
+        Event::ToolEnd {
+            id: tool_id,
+            output: "helper done".to_string(),
+        },
+    );
+    let target = Duration::from_secs(3);
+    let elapsed = start.elapsed();
+    if elapsed < target {
+        tokio::time::sleep(target - elapsed).await;
+    }
+    subagents.finish(&id);
+    let _ = sink.send(Event::ToolEnd {
+        id,
+        output: "subagent finished".to_string(),
+    });
+}
+
 /// A message written during a turn and waiting for it to end: the id of the
 /// `MessageQueued` that announced it, what it said, and what was attached. All
 /// three, because all three are what the `MessageTaken` at the other end owes.

server/src/session/llama.rs

@@ -5,9 +5,19 @@
 //!
 //! **It is spawned but not spoken to over stdio.** The process is started
 //! through the same [`Transport`] as any other and then reached over HTTP on a
-//! loopback port. A remote llama-server would need its port forwarded as well
-//! as its command wrapped, which is not built, so a session on an ssh host is
-//! refused rather than silently talking to the wrong machine.
+//! loopback port. That is the second half of what a transport is -- "run this"
+//! plus "reach this port" -- and it is what lets a session run on another
+//! machine: [`Transport::reserve_port`] hands back a port the server binds
+//! *there* and one that reaches it *here*, and the ssh connection carrying the
+//! command carries the tunnel between them. The far `llama-server` binds
+//! loopback only, so a model is never served to that machine's network.
+//!
+//! **The model file is the far machine's, not this one's.** A remote setup
+//! names its own models directory (`SshConfig::models_dir`, defaulting to where
+//! this backend keeps its downloads), and the file is looked for *there* -- so
+//! a session naming a model that machine does not have says so, instead of
+//! starting a server that will never load one. Downloading to another machine
+//! is not built; the model gets there however anything else does.
 //!
 //! **The server is stateless between requests**, so the whole conversation goes
 //! with every one. It is rebuilt from the session's transcript rather than kept
@@ -67,6 +77,7 @@ impl LlamaDriver {
     /// in a different currency: two servers holding the same model is twice the
     /// memory, and the second would bind a different port while the phone kept
     /// talking to the first.
+    #[allow(clippy::too_many_arguments)]
     pub fn launch(
         meta: &SessionConfig,
         provider: &ProviderConfig,
@@ -75,17 +86,15 @@ impl LlamaDriver {
         transcript: &Path,
         session_dir: &Path,
         sink: EventSink,
+        // llama.cpp has no notion of a Task call, so this is accepted only
+        // to keep one shape across every driver's launch -- see
+        // `SUBAGENTS.md`'s "Server layout".
+        _subagents: Arc<super::subagent::Subagents>,
     ) -> Result<Self> {
-        if !matches!(transport, Transport::Here) {
-            bail!(
-                "llama.cpp sessions can only run on this machine for now: the model is served \
-                 over HTTP, and forwarding that port to another host isn't built yet."
-            );
-        }
         let model = meta.model.as_deref().context(
             "a llama.cpp session needs a model -- one of the downloaded ones, by its key",
         )?;
-        let path = model_path(models_dir, model)?;
+        let path = model_on(transport, models_dir, model)?;
 
         // Already loaded and still running: keep talking to it. The health poll
         // below confirms it is really answering, so adopting a pid whose server
@@ -111,14 +120,21 @@ impl LlamaDriver {
             ));
         }
 
-        let port = free_port().context("finding a port for llama-server")?;
+        // Where it listens on its own machine, and where that is reached
+        // from here -- the same number when that machine is this one.
+        let forward = transport
+            .reserve_port()
+            .context("finding a port for llama-server")?;
         let mut args: Vec<String> = vec![
             "-m".into(),
-            path.to_string_lossy().into_owned(),
+            path.clone(),
+            // Loopback there, whichever machine there is: what reaches it
+            // from outside that machine is the ssh tunnel and nothing
+            // else.
             "--host".into(),
             "127.0.0.1".into(),
             "--port".into(),
-            port.to_string(),
+            forward.there.to_string(),
         ];
         // Settings that belong to the server because they decide how the model
         // is loaded; the sampling ones ride on each request instead, so changing
@@ -134,8 +150,8 @@ impl LlamaDriver {
             }
         }
 
-        let program = provider.command.as_deref().unwrap_or("llama-server");
-        let launch = Launch::new(program, args, meta.cwd.as_deref());
+        let program = provider.program();
+        let launch = Launch::new(program, args, meta.cwd.as_deref()).reaching(forward);
         // Its output goes to files, not pipes. Not only so the process can
         // outlive this server: nothing ever read those pipes, so a chatty
         // llama-server filled the 64 KB buffer and blocked mid-load with no sign
@@ -152,8 +168,12 @@ impl LlamaDriver {
             .id()
             .context("llama-server exited before it could be recorded")?;
         tracing::info!(
-            "session {} running {program} for {model} on 127.0.0.1:{port} as pid {pid}",
-            meta.id
+            "session {} running {program} for {model} {} on 127.0.0.1:{} there, \
+             reached at 127.0.0.1:{} here, as pid {pid}",
+            meta.id,
+            transport.describe(),
+            forward.there,
+            forward.here,
         );
         // Reaped so it does not become a zombie while this server is still its
         // parent; the health poll and the record are what say whether the
@@ -163,12 +183,18 @@ impl LlamaDriver {
             let _ = child.wait().await;
         });
 
-        let record = process::Record::of(pid, process::Detail::Http { port })
+        // The *near* port, because that is the one anything reaching this
+        // server has to dial -- including a later run of this backend,
+        // which adopts the record without knowing which machine the server
+        // is on. For a remote session the recorded pid is the ssh
+        // client's, which is the process this machine owns and which holds
+        // the tunnel open for exactly as long as the far server lives.
+        let record = process::Record::of(pid, process::Detail::Http { port: forward.here })
             .context("llama-server was gone before its start time could be read")?;
         process::write(session_dir, &record);
 
         Ok(Self::attached(
-            format!("http://127.0.0.1:{port}"),
+            format!("http://127.0.0.1:{}", forward.here),
             meta,
             model,
             transcript,
@@ -202,7 +228,7 @@ impl LlamaDriver {
             let endpoint = endpoint.clone();
             let model = model.to_string();
             let session_dir = session_dir.to_path_buf();
-            std::thread::spawn(move || match wait_until_ready(&endpoint) {
+            std::thread::spawn(move || match wait_until_ready(&endpoint, &session_dir) {
                 Ok(()) => {
                     tracing::info!("{model} loaded and answering at {endpoint}");
                     let _ = sink.send(Event::Status {
@@ -499,17 +525,70 @@ fn model_path(models_dir: &Path, key: &str) -> Result<PathBuf> {
     Ok(path)
 }
 
-/// An unused loopback port, by asking the OS for one and letting it go. Racy in
-/// principle, but nothing on this machine is hunting for ports, and the
-/// alternative -- parsing the port back out of the server's log -- couples us to
-/// its output format for no real gain.
-fn free_port() -> Result<u16> {
-    let listener = std::net::TcpListener::bind("127.0.0.1:0")?;
-    Ok(listener.local_addr()?.port())
+/// The model file's path **on the machine that will serve it**, confirmed to be
+/// there.
+///
+/// One function rather than a local check and hope for the other case: the same
+/// question has to be asked of two filesystems. The remote answer is measured
+/// for the reason the local one is -- a missing file otherwise becomes a
+/// `llama-server` that starts, fails to load, and reports as a session that
+/// never became ready, which reads as the machine being slow.
+///
+/// One blocking round trip on a remote spawn, which is what the spawn is
+/// already paying to start ssh. The alternative is a path built here from a `~`
+/// this machine cannot expand.
+fn model_on(transport: &Transport, models_dir: &Path, key: &str) -> Result<String> {
+    let Transport::Ssh { name, .. } = transport else {
+        return Ok(model_path(models_dir, key)?.to_string_lossy().into_owned());
+    };
+    // The same directory the spawn screen listed for this machine, and one
+    // function for the same reason: a list from one place and a load from
+    // another is a model that appears and then fails.
+    let dir = crate::models::dir_on(transport, models_dir);
+    // Checked here rather than in the script: `..` in a key would walk out of
+    // the models directory on a machine this server can start processes on,
+    // and the phone is where the key comes from.
+    for part in key.split('/') {
+        if part.is_empty() || part == "." || part == ".." {
+            bail!("\"{key}\" is not a model key this can resolve");
+        }
+    }
+    let path = format!("{}/{key}", dir.trim_end_matches('/'));
+    // `$HOME` on the far side, which is the only machine that knows what it is,
+    // and the resolved path printed back so the launch hands `llama-server`
+    // something absolute. "Not there" is answered rather than failed, because a
+    // machine that could not be asked at all has to say so in its own words --
+    // it would otherwise arrive as this same sentence about a missing model.
+    let script = "p=$1; case $p in \"~\") p=$HOME;; \"~/\"*) p=$HOME/${p#\"~/\"};; esac; \
+                  [ -f \"$p\" ] && printf 'at\\t%s\\n' \"$p\" || printf 'missing\\n'"
+        .to_string();
+    let launch = Launch::new(
+        "sh",
+        vec!["-c".to_string(), script, "sh".to_string(), path.clone()],
+        None,
+    );
+    let answer = transport
+        .capture_blocking(&launch)
+        .with_context(|| format!("couldn't ask {name} where its models are"))?;
+    match answer.trim().split_once('\t') {
+        Some(("at", resolved)) => Ok(resolved.to_string()),
+        _ => bail!(
+            "{name} has no model at {path}. A llama.cpp session serves the file from the \
+             machine it runs on, so the model has to be on {name} -- what this backend has \
+             downloaded is somewhere else."
+        ),
+    }
 }
 
 /// Polls until the server says it is ready, or gives up.
-fn wait_until_ready(endpoint: &str) -> Result<()> {
+///
+/// Watches the process as well as the port, because the two failures need
+/// different words and one of them is common: a model that will not load,
+/// a port already taken on the far machine, a `llama-server` too old for
+/// a flag. All of those exit within a second and none of them will ever
+/// answer `/health`, so waiting out the timeout turns a server that said
+/// exactly what was wrong into "gave up after 300s".
+fn wait_until_ready(endpoint: &str, session_dir: &Path) -> Result<()> {
     let deadline = std::time::Instant::now() + READY_TIMEOUT;
     let url = format!("{endpoint}/health");
     loop {
@@ -518,13 +597,48 @@ fn wait_until_ready(endpoint: &str) -> Result<()> {
         {
             return Ok(());
         }
+        // `None` is the session having been stopped or deleted while this
+        // waited, which is nobody's fault and still not worth waiting on.
+        match process::recorded(session_dir) {
+            Some((_, process::Liveness::Alive | process::Liveness::Unknown)) => {}
+            Some((_, process::Liveness::Dead)) | None => {
+                bail!("it exited before it answered.{}", log_tail(session_dir));
+            }
+        }
         if std::time::Instant::now() > deadline {
-            bail!("gave up after {}s", READY_TIMEOUT.as_secs());
+            bail!(
+                "gave up after {}s.{}",
+                READY_TIMEOUT.as_secs(),
+                log_tail(session_dir)
+            );
         }
         std::thread::sleep(std::time::Duration::from_millis(250));
     }
 }
 
+/// The end of `llama-server`'s own log, for a failure message.
+///
+/// Its account of what went wrong is the useful half -- "failed to load
+/// model", "bind: Address already in use" -- and on a remote session it
+/// is the only half, since nobody reading the phone can open a file on
+/// that machine. Bounded, because this ends up in an event a phone draws.
+fn log_tail(session_dir: &Path) -> String {
+    let Ok(text) = std::fs::read_to_string(session_dir.join(SERVER_LOG)) else {
+        return String::new();
+    };
+    let tail: Vec<&str> = text.lines().rev().take(LOG_TAIL_LINES).collect();
+    if tail.is_empty() {
+        return String::new();
+    }
+    format!(
+        " It last said: {}",
+        tail.into_iter().rev().collect::<Vec<_>>().join(" / ")
+    )
+}
+
+/// How much of that log to carry into a message somebody reads on a phone.
+const LOG_TAIL_LINES: usize = 6;
+
 /// One streamed completion: posts the conversation, emits each delta as it
 /// arrives. Emits rather than returns, because the transcript those events land
 /// in is what the next turn reads back.

server/src/session/subagent.rs

@@ -0,0 +1,507 @@
+//! A session's subagents -- see `SUBAGENTS.md`.
+//!
+//! **A subagent is a second transcript owned by a session, in the same event
+//! model, with no process and no controls.** It shares the transcript file
+//! format, the paging routes, and the SSE stream with a session by
+//! addressing, not by copying: `Transcript`, `read_window` and `catch_up`
+//! work on a subagent's file unchanged.
+//!
+//! Storage is `<session dir>/subagents/<id>/{meta.json,transcript.jsonl}`,
+//! where `<id>` is the Task tool_use id that started it -- unique, stable
+//! across a backend restart, and already the key the parent side uses. Only
+//! ids matching [`is_subagent_id`] are ever turned into a path.
+
+use std::collections::HashMap;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+use tokio::sync::broadcast;
+
+use super::driver::{Event, SessionStatus};
+use super::transcript::{SeqEvent, Transcript};
+
+/// Fan-out buffer for one subagent's SSE subscribers. Smaller than a
+/// session's: a subagent's whole conversation is usually a handful of tool
+/// calls, not an hours-long session.
+const EVENT_BUFFER: usize = 64;
+
+/// Whether `id` is safe to become a path segment under a session's
+/// `subagents/` directory. Mirrors `import::is_session_id`'s reasoning: the
+/// id arrives as a value inside JSON the CLI sent, and it becomes a
+/// directory name, so a `/` or `..` in it must never be trusted.
+fn is_subagent_id(id: &str) -> bool {
+    !id.is_empty()
+        && id.len() <= 200
+        && id
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || b == b'_' || b == b'-')
+}
+
+/// What a subagent's directory holds beside its transcript. Small and
+/// separate from `Subagent` itself because this is exactly what survives a
+/// backend restart on disk, and nothing else does.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct Meta {
+    title: String,
+    /// Epoch seconds. Absent from `SubagentInfo`'s sort key deliberately:
+    /// `list` sorts by this rather than by directory order, which a
+    /// filesystem does not promise.
+    created: f64,
+}
+
+/// One row of `GET /sessions/{id}/subagents`.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SubagentInfo {
+    pub id: String,
+    pub title: String,
+    pub status: SessionStatus,
+    pub created: f64,
+    pub last_activity: f64,
+}
+
+/// One subagent: its own transcript and broadcast, same shape as a
+/// session's but with no driver behind it.
+pub struct Subagent {
+    dir: PathBuf,
+    transcript: Mutex<Transcript>,
+    events: broadcast::Sender<SeqEvent>,
+    /// Mirrors the transcript's last `Status` event, kept live rather than
+    /// read back from `Transcript::last_status` -- that answers "as of
+    /// opening" (see its own doc comment) and never moves for an append made
+    /// through *this* object, which is every append a live subagent ever
+    /// makes. Without this, `finish` immediately after `start` in the same
+    /// process read the file's stale opening status and reported itself
+    /// still open.
+    status: Mutex<SessionStatus>,
+}
+
+impl Subagent {
+    pub fn transcript_path(&self) -> PathBuf {
+        self.dir.join("transcript.jsonl")
+    }
+
+    pub fn subscribe(&self) -> broadcast::Receiver<SeqEvent> {
+        self.events.subscribe()
+    }
+
+    /// Whether this subagent's last recorded status is not `Exited` --
+    /// what decides whether a further child line reopens it (see
+    /// `Subagents::reopen`) rather than continuing straight through. See
+    /// `SUBAGENTS.md`'s lifecycle.
+    pub fn is_open(&self) -> bool {
+        *self.status.lock().unwrap() != SessionStatus::Exited
+    }
+
+    fn append(&self, event: Event) {
+        let mut transcript = self.transcript.lock().unwrap();
+        match transcript.append(event, super::now()) {
+            Ok(entry) => {
+                if let Event::Status { state } = &entry.event {
+                    *self.status.lock().unwrap() = *state;
+                }
+                // No subscribers is fine; the transcript already has it,
+                // same as a session's pump.
+                let _ = self.events.send(entry);
+            }
+            Err(err) => tracing::error!("subagent transcript append failed: {err:#}"),
+        }
+    }
+}
+
+/// Every subagent one session has started, keyed by the Task tool_use id
+/// that names it.
+///
+/// Lives beside a session's driver rather than inside it: a claude driver
+/// holds an `Arc` to this and routes child lines into it; echo uses it for
+/// its `/subagent` rig; llama ignores it, since it has no notion of a Task
+/// call. One instance per live session, built at launch and handed to
+/// whichever driver replaces it across a stop/start.
+pub struct Subagents {
+    /// The session's own directory; subagents live under `<dir>/subagents`.
+    dir: PathBuf,
+    live: Mutex<HashMap<String, Arc<Subagent>>>,
+}
+
+impl Subagents {
+    pub fn new(session_dir: PathBuf) -> Self {
+        Self {
+            dir: session_dir,
+            live: Mutex::new(HashMap::new()),
+        }
+    }
+
+    fn subagents_dir(&self) -> PathBuf {
+        self.dir.join("subagents")
+    }
+
+    /// Opens the subagent named `id`, creating it if this is the first
+    /// anyone has heard of it -- on disk as well as in memory, so a
+    /// subagent from before a backend restart is reopened rather than
+    /// recreated. `title`/`prompt` are used only at creation: reopening an
+    /// existing one keeps its original title and never repeats the prompt
+    /// into its transcript a second time.
+    fn open_or_create(&self, id: &str, title: &str, prompt: Option<&str>) -> Result<Arc<Subagent>> {
+        let dir = self.subagents_dir().join(id);
+        let meta_path = dir.join("meta.json");
+        let existed = meta_path.is_file();
+        let meta = if existed {
+            let text = fs::read_to_string(&meta_path)
+                .with_context(|| format!("read {}", meta_path.display()))?;
+            serde_json::from_str::<Meta>(&text).context("parse subagent meta")?
+        } else {
+            wg_app_link::private::create_dir(&dir)?;
+            let meta = Meta {
+                title: title.to_string(),
+                created: super::now(),
+            };
+            wg_app_link::private::write_file(
+                &meta_path,
+                serde_json::to_string(&meta)
+                    .context("serialize subagent meta")?
+                    .as_bytes(),
+            )?;
+            meta
+        };
+        let mut transcript = Transcript::open(&dir.join("transcript.jsonl"))?;
+        if !existed {
+            // First lines, in order: the subagent is running the moment it
+            // exists, and its prompt -- when known -- is genuinely its first
+            // user turn. Written once, here, so a reopen never repeats them.
+            transcript.append(
+                Event::Status {
+                    state: SessionStatus::Running,
+                },
+                meta.created,
+            )?;
+            if let Some(prompt) = prompt {
+                transcript.append(
+                    Event::UserMessage {
+                        id: None,
+                        text: prompt.to_string(),
+                        attachments: Vec::new(),
+                    },
+                    meta.created,
+                )?;
+            }
+        }
+        // A freshly created subagent is running by construction (its only
+        // lines so far are `Status::Running` and maybe its prompt); a
+        // reopened one takes whatever the file last said, since this
+        // `Transcript` has not been appended to yet in this process.
+        let status = if existed {
+            transcript.last_status().unwrap_or(SessionStatus::Running)
+        } else {
+            SessionStatus::Running
+        };
+        let (events, _) = broadcast::channel(EVENT_BUFFER);
+        Ok(Arc::new(Subagent {
+            dir,
+            transcript: Mutex::new(transcript),
+            events,
+            status: Mutex::new(status),
+        }))
+    }
+
+    /// Starts a subagent unless one is already known by this id -- see
+    /// `SUBAGENTS.md`'s lifecycle: created at the Task call or at the first
+    /// child line, whichever comes first, and never twice. A bad id is
+    /// refused rather than turned into a path.
+    pub fn start(&self, id: &str, title: &str, prompt: Option<&str>) {
+        if !is_subagent_id(id) {
+            tracing::debug!("refusing to start a subagent with a bad id {id:?}");
+            return;
+        }
+        let mut live = self.live.lock().unwrap();
+        if live.contains_key(id) {
+            return;
+        }
+        match self.open_or_create(id, title, prompt) {
+            Ok(subagent) => {
+                live.insert(id.to_string(), subagent);
+            }
+            Err(err) => tracing::error!("couldn't start subagent {id}: {err:#}"),
+        }
+    }
+
+    /// The subagent named `id`, reopening it from disk on first use in this
+    /// process if one is there. `None` for an id nothing has ever started --
+    /// deliberately not created here, since a route or a routing decision is
+    /// not the Task call that is supposed to be the only way one begins.
+    pub fn get(&self, id: &str) -> Option<Arc<Subagent>> {
+        if !is_subagent_id(id) {
+            return None;
+        }
+        if let Some(existing) = self.live.lock().unwrap().get(id).cloned() {
+            return Some(existing);
+        }
+        if !self.subagents_dir().join(id).join("meta.json").is_file() {
+            return None;
+        }
+        // Title and prompt are ignored: the directory already exists, so
+        // `open_or_create` reads its own meta rather than using either.
+        match self.open_or_create(id, "", None) {
+            Ok(subagent) => {
+                self.live
+                    .lock()
+                    .unwrap()
+                    .insert(id.to_string(), Arc::clone(&subagent));
+                Some(subagent)
+            }
+            Err(err) => {
+                tracing::error!("couldn't reopen subagent {id}: {err:#}");
+                None
+            }
+        }
+    }
+
+    /// Appends one event to a subagent's own transcript. A no-op, with a
+    /// debug log, for an id nothing was started under -- a child line for a
+    /// subagent this registry never opened is dropped rather than guessed
+    /// at.
+    pub fn record(&self, id: &str, event: Event) {
+        match self.live.lock().unwrap().get(id).cloned() {
+            Some(subagent) => subagent.append(event),
+            None => tracing::debug!("dropping an event for unknown subagent {id}"),
+        }
+    }
+
+    /// The subagent's own turn ended: its `Status::Exited`. Called from
+    /// `translate_child` on the subagent's own `end_turn`, never on the
+    /// parent's `tool_result` -- a background Task's `tool_result` arrives
+    /// at launch, not at completion, so it says nothing about whether this
+    /// is over. A no-op for an id that is not a subagent's or is already
+    /// closed.
+    pub fn finish(&self, id: &str) {
+        if let Some(subagent) = self.live.lock().unwrap().get(id).cloned()
+            && subagent.is_open()
+        {
+            subagent.append(Event::Status {
+                state: SessionStatus::Exited,
+            });
+        }
+    }
+
+    /// A line arrived for a subagent that had already finished: it is
+    /// working again, not stale -- a background Task can be sent another
+    /// message long after its first turn ended. Appends `Status::Running`
+    /// so the list stops reporting it as finished; a no-op if it was not
+    /// actually closed, so a caller need not check first.
+    pub fn reopen(&self, id: &str) {
+        if let Some(subagent) = self.live.lock().unwrap().get(id).cloned()
+            && !subagent.is_open()
+        {
+            subagent.append(Event::Status {
+                state: SessionStatus::Running,
+            });
+        }
+    }
+
+    /// The parent session's process is gone, so nothing still open here has
+    /// a process behind it either -- see `SUBAGENTS.md`'s lifecycle #4.
+    pub fn finish_all(&self) {
+        let subagents: Vec<Arc<Subagent>> = self.live.lock().unwrap().values().cloned().collect();
+        for subagent in subagents {
+            if subagent.is_open() {
+                subagent.append(Event::Status {
+                    state: SessionStatus::Exited,
+                });
+            }
+        }
+    }
+
+    /// Every subagent under this session's directory, oldest first --
+    /// `GET /sessions/{id}/subagents`. Read straight from disk rather than
+    /// from `live`, so a subagent from before this process started (or one
+    /// this run has not yet touched) still shows up; one file read per
+    /// subagent, which is fine at the handful a session usually has.
+    ///
+    /// `session_running` is what turns a subagent whose last status is
+    /// `Running` into `Unknown`: its process was the session's, and the
+    /// session has none.
+    pub fn list(&self, session_running: bool) -> Vec<SubagentInfo> {
+        let mut rows: Vec<SubagentInfo> = match fs::read_dir(self.subagents_dir()) {
+            Ok(entries) => entries
+                .filter_map(Result::ok)
+                .filter_map(|entry| info_of(&entry.path(), session_running))
+                .collect(),
+            // No directory is no subagents, not a fault worth reporting.
+            Err(_) => Vec::new(),
+        };
+        rows.sort_by(|a, b| {
+            a.created
+                .partial_cmp(&b.created)
+                .unwrap_or(std::cmp::Ordering::Equal)
+        });
+        rows
+    }
+}
+
+fn info_of(subagent_dir: &Path, session_running: bool) -> Option<SubagentInfo> {
+    let id = subagent_dir.file_name()?.to_str()?.to_string();
+    let meta_path = subagent_dir.join("meta.json");
+    let text = fs::read_to_string(&meta_path).ok()?;
+    let meta: Meta = serde_json::from_str(&text).ok()?;
+    let transcript = Transcript::open(&subagent_dir.join("transcript.jsonl")).ok()?;
+    // The subagent's first line is always `Status::Running`, written before
+    // this directory is discoverable at all, so `None` here is not a state a
+    // reader can actually observe -- but it is not this function's place to
+    // invent one, so a status this build does not expect to see falls back
+    // to the word the lifecycle promises it started in.
+    let last_status = transcript.last_status().unwrap_or(SessionStatus::Running);
+    let status = if last_status == SessionStatus::Running && !session_running {
+        SessionStatus::Unknown
+    } else {
+        last_status
+    };
+    Some(SubagentInfo {
+        id,
+        title: meta.title,
+        status,
+        created: meta.created,
+        last_activity: transcript.last_activity().unwrap_or(meta.created),
+    })
+}
+
+/// How many subagents a session has, for `SessionInfo::subagents`: a
+/// directory listing, so the session list stays cheap and only the
+/// dedicated route pays for reading a status out of each one.
+pub fn count(session_dir: &Path) -> usize {
+    fs::read_dir(session_dir.join("subagents"))
+        .map(|entries| entries.filter_map(Result::ok).count())
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_bad_id_is_refused_rather_than_turned_into_a_path() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = Subagents::new(dir.path().to_path_buf());
+        subagents.start("../../etc", "escape", None);
+        assert!(subagents.get("../../etc").is_none());
+        assert!(!dir.path().join("subagents").exists());
+    }
+
+    #[test]
+    fn starting_twice_keeps_the_first_title_and_does_not_repeat_the_prompt() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = Subagents::new(dir.path().to_path_buf());
+        subagents.start("toolu_1", "first title", Some("do the thing"));
+        subagents.start("toolu_1", "second title", Some("do the thing"));
+
+        let rows = subagents.list(true);
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].title, "first title");
+
+        let events = crate::session::transcript::read_after(
+            &subagents.get("toolu_1").unwrap().transcript_path(),
+            0,
+        )
+        .expect("read");
+        assert_eq!(
+            events
+                .iter()
+                .filter(|e| matches!(e.event, Event::UserMessage { .. }))
+                .count(),
+            1
+        );
+    }
+
+    #[test]
+    fn a_reopened_subagent_continues_its_own_transcript() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        {
+            let subagents = Subagents::new(dir.path().to_path_buf());
+            subagents.start("toolu_2", "helper", Some("go"));
+            subagents.record(
+                "toolu_2",
+                Event::AssistantText {
+                    delta: "working".to_string(),
+                },
+            );
+        }
+        // A fresh registry, the way a backend restart builds one.
+        let subagents = Subagents::new(dir.path().to_path_buf());
+        let subagent = subagents.get("toolu_2").expect("reopened");
+        assert!(subagent.is_open());
+        subagents.record(
+            "toolu_2",
+            Event::AssistantText {
+                delta: " more".to_string(),
+            },
+        );
+        let events =
+            crate::session::transcript::read_after(&subagent.transcript_path(), 0).expect("read");
+        // Status, UserMessage, two AssistantText deltas, seq continuing.
+        assert_eq!(events.len(), 4);
+        assert_eq!(events.last().unwrap().seq, 4);
+    }
+
+    #[test]
+    fn finishing_appends_exited_and_further_lines_are_droppable() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = Subagents::new(dir.path().to_path_buf());
+        subagents.start("toolu_3", "helper", None);
+        subagents.finish("toolu_3");
+        let subagent = subagents.get("toolu_3").unwrap();
+        assert!(!subagent.is_open());
+        // On disk too, not only in the live cache `is_open` reads.
+        assert_eq!(
+            Transcript::open(&subagent.transcript_path())
+                .expect("reopen")
+                .last_status(),
+            Some(SessionStatus::Exited)
+        );
+
+        // Finishing an id that was never a subagent is a no-op, not a panic.
+        subagents.finish("never-started");
+    }
+
+    #[test]
+    fn finish_all_closes_only_what_is_still_open() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = Subagents::new(dir.path().to_path_buf());
+        subagents.start("toolu_4", "one", None);
+        subagents.start("toolu_5", "two", None);
+        subagents.finish("toolu_4");
+        subagents.finish_all();
+
+        let rows = subagents.list(false);
+        assert_eq!(rows.len(), 2);
+        for row in rows {
+            assert_eq!(row.status, SessionStatus::Exited);
+        }
+    }
+
+    #[test]
+    fn a_subagent_still_running_when_the_session_is_not_reports_unknown() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = Subagents::new(dir.path().to_path_buf());
+        subagents.start("toolu_6", "helper", None);
+
+        assert_eq!(subagents.list(true)[0].status, SessionStatus::Running);
+        assert_eq!(subagents.list(false)[0].status, SessionStatus::Unknown);
+    }
+
+    #[test]
+    fn list_is_oldest_first_and_the_count_matches_the_directory() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let subagents = Subagents::new(dir.path().to_path_buf());
+        assert_eq!(count(dir.path()), 0);
+        subagents.start("toolu_a", "a", None);
+        std::thread::sleep(std::time::Duration::from_millis(2));
+        subagents.start("toolu_b", "b", None);
+        let rows = subagents.list(true);
+        assert_eq!(
+            rows.iter().map(|r| r.id.as_str()).collect::<Vec<_>>(),
+            ["toolu_a", "toolu_b"]
+        );
+        assert_eq!(count(dir.path()), 2);
+    }
+}

server/src/session/transport.rs

@@ -11,9 +11,13 @@
 //! `crate::ssh`'s: this module decides *which* transport, that one knows what a
 //! correct ssh invocation is.
 //!
-//! Known second operation, not built because nothing needs it yet: a managed
-//! `llama-server` is spawned as a process but then spoken to over HTTP, so a
-//! remote one needs a forwarded port (`ssh -L`) as well.
+//! A transport is therefore two operations rather than one: **run this** and
+//! **reach this port**. The second is what a managed `llama-server` needs -- it
+//! is spawned as a process and then spoken to over HTTP -- and it is a no-op
+//! locally, where the port a program binds is already one this machine can
+//! dial. Over ssh it is an `-L` tunnel on the same connection that runs the
+//! command, so the model server binds loopback on the far machine and is never
+//! exposed to its network. See [`Transport::reserve_port`].
 
 use std::path::{Path, PathBuf};
 use std::process::Stdio;
@@ -22,14 +26,26 @@ use anyhow::{Context, Result};
 use tokio::process::Child;
 
 use crate::config::SshConfig;
+pub use crate::ssh::Forward;
 
 /// What a driver needs run in order to exist as a process. Deliberately just
-/// the three things every transport can carry; anything a particular machine
-/// needs is the transport's own configuration, not something a driver states.
+/// what every transport can carry -- the command, where it runs, and a port the
+/// caller needs to reach; anything a particular machine needs is the
+/// transport's own configuration, not something a driver states.
 pub struct Launch {
     pub program: String,
     pub args: Vec<String>,
     pub cwd: Option<PathBuf>,
+    /// A port this program will listen on, and the port that reaches it
+    /// from here -- see [`Transport::reserve_port`], which is the only
+    /// thing that should produce one.
+    ///
+    /// On the launch rather than in [`Transport::spawn`]'s signature
+    /// because it is part of what is being run: a caller that needs to
+    /// reach the process it is starting says so once, where it says
+    /// everything else about it, and every transport reads it the same
+    /// way.
+    pub forward: Option<Forward>,
 }
 
 impl Launch {
@@ -38,8 +54,16 @@ impl Launch {
             program: program.into(),
             args,
             cwd: cwd.map(Path::to_path_buf),
+            forward: None,
         }
     }
+
+    /// Says that this program serves `forward.there`, and that the caller
+    /// will reach it at `forward.here`.
+    pub fn reaching(mut self, forward: Forward) -> Self {
+        self.forward = Some(forward);
+        self
+    }
 }
 
 /// How a launched process's standard streams are connected.
@@ -102,6 +126,7 @@ impl Transport {
             &launch.program,
             &launch.args,
             launch.cwd.as_deref(),
+            launch.forward,
         ));
         match streams {
             Streams::Piped => {
@@ -153,12 +178,15 @@ impl Transport {
             Self::Here => None,
             Self::Ssh { ssh, .. } => Some(ssh),
         };
-        let output =
-            crate::ssh::command(host, &launch.program, &launch.args, launch.cwd.as_deref())
-                .output()
-                .with_context(|| {
-                    format!("couldn't run \"{}\" {}", launch.program, self.describe())
-                })?;
+        let output = crate::ssh::command(
+            host,
+            &launch.program,
+            &launch.args,
+            launch.cwd.as_deref(),
+            launch.forward,
+        )
+        .output()
+        .with_context(|| format!("couldn't run \"{}\" {}", launch.program, self.describe()))?;
         if !output.status.success() {
             let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
             anyhow::bail!(if stderr.is_empty() {
@@ -217,6 +245,34 @@ impl Transport {
         })
     }
 
+    /// Picks a port for a launched program to serve on, and the port that
+    /// reaches it from here.
+    ///
+    /// The "reach this port" half of what a transport is. Locally there is
+    /// one port and the OS chooses it, by binding and letting go -- racy
+    /// in principle, and nothing on this machine is hunting for ports.
+    ///
+    /// Over ssh the near end is chosen the same way and the far end is a
+    /// guess, because there is no portable way to ask a machine for a free
+    /// port that does not race with binding it anyway. It is taken from
+    /// [`FAR_PORTS`], below the range Linux hands out to outgoing
+    /// connections, so a collision means something else deliberately
+    /// listening there. That is not silent: the program fails to bind and
+    /// exits, and `session::llama` reports what its log said rather than
+    /// waiting out its readiness timeout.
+    pub fn reserve_port(&self) -> Result<Forward> {
+        let listener = std::net::TcpListener::bind("127.0.0.1:0")
+            .context("asking this machine for a free port")?;
+        let here = listener.local_addr()?.port();
+        Ok(match self {
+            Self::Here => Forward { there: here, here },
+            Self::Ssh { .. } => Forward {
+                there: rand::random_range(FAR_PORTS),
+                here,
+            },
+        })
+    }
+
     /// How to say where this runs, for a log line a person reads.
     pub fn describe(&self) -> String {
         match self {
@@ -226,6 +282,11 @@ impl Transport {
     }
 }
 
+/// Where a port on another machine is guessed from: high enough to be out
+/// of the way of services, and below the 32768-60999 Linux hands out to
+/// outgoing connections, which is where a guess would most often collide.
+const FAR_PORTS: std::ops::Range<u16> = 20000..30000;
+
 /// What a command is given on its standard input.
 ///
 /// Three cases rather than an `Option<Stdio>` because they are three genuinely

server/src/setups.rs

@@ -25,7 +25,10 @@ use crate::session::transport::{Launch, Transport};
 /// session stores.
 const PROBES: &[(&str, &str, DriverKind)] = &[
     ("claude-cli", "claude", DriverKind::ClaudeCli),
-    ("local-llama", "llama-server", DriverKind::LlamaCpp),
+    // Named for the program rather than for where it runs: it runs
+    // wherever the setup is, and "local" was true only while a llama
+    // session could not be spawned on another machine.
+    ("llama-cpp", "llama-server", DriverKind::LlamaCpp),
 ];
 
 /// Models offered for a discovered Claude CLI. A shortcut list for the spawn