RUST.md, DECISIONS.md: P0, the phone benchmark gate Iris asked for before P1

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
RUST.md, DECISIONS.md, IRIS_TODO.md: the port plan, P1-P7, after iris-over-Masonry
2026-09-05 20:31:20 -04:00 · 2026-09-05 20:30:02 -04:00 · 2026-09-05 20:25:43 -04:00 · 2026-09-05 20:07:20 -04:00 · 2026-09-05 18:47:01 -04:00 · 2026-09-05 15:21:45 -04:00
35 changed files with 2906 additions and 272 deletions
@@ -5,11 +5,14 @@ replacing the Claude app for daily use. Rust/Axum backend on the desktop,
 Kotlin/Compose Android app, WireGuard + pinned self-signed TLS + bearer token
 between them.

-**`PLAN.md` is the design source of truth** — every decision with its date,
-its rationale, and what was rejected. Read it before changing anything
+**`docs/PLAN.md` is the design source of truth** — every decision with its
+date, its rationale, and what was rejected. Read it before changing anything
 structural, and update it in place when a decision changes rather than
 letting this file and the plan become two versions of the truth. This file is
 the working notes layer: layout, commands, rigs, and things that have bitten.
+The design and working documents live under `docs/` — everything except this
+file and `CLAUDE.md`, which stay at the root because that is where Claude
+Code and other agent harnesses look for them.

 The central design point, worth not undoing by accident: **a session is a
 child process, translated into one common event model.** A new session type
@@ -22,7 +25,7 @@ Mirrors `../dev-updater` deliberately: same stack (axum 0.8 +
 axum-server/rustls, tokio, clap; Kotlin 2.4.x + Compose Multiplatform, single
 `:androidApp` module), same cert scheme, same registry pattern. Read
 dev-updater's `README.md` and `AGENTS.md` before diverging from them.
-Module-by-module intent is in PLAN.md's "Backend layout".
+Module-by-module intent is in `docs/PLAN.md`'s "Backend layout".

 - `server/` — the Rust backend (`ai-server`). `routes.rs`'s module doc
  comment is the HTTP table and the surface's source of truth.
@@ -40,16 +43,23 @@ Module-by-module intent is in PLAN.md's "Backend layout".
  projects version-locked to the commit this repo pins. What deliberately did
  **not** move is the API surface and the config *schema*: routes, drivers,
  sessions and setups are what makes this project itself.
- `EXPLORER.md` — the file explorer's design (`server/src/files.rs` and
-  `FilesScreen.kt` / `FileViewer.kt` / `FileEditor.kt`).
- `TRANSCRIPT_CACHE.md` — the phone's copy of what it has been sent. Read it
-  before touching `TranscriptCache.kt`, `TranscriptSource.kt`, or the opening
-  and stream effects in `SessionScreen.kt`.
- `TODO.md` — the working list.
- `RUST.md` — the plan for moving the app to Rust (on the `rustify`
-  branch of the `ai-app-2` clone): what has to be reproduced, the
-  framework decision, and the ordered experiments with their pass
-  conditions. Read it before touching anything under that branch.
+- `docs/` — every design and working document except this file and
+  `CLAUDE.md`:
+  - `docs/EXPLORER.md` — the file explorer's design (`server/src/files.rs`
+    and `FilesScreen.kt` / `FileViewer.kt` / `FileEditor.kt`).
+  - `docs/TRANSCRIPT_CACHE.md` — the phone's copy of what it has been sent.
+    Read it before touching `TranscriptCache.kt`, `TranscriptSource.kt`, or
+    the opening and stream effects in `SessionScreen.kt`.
+  - `docs/TODO.md` — the working list.
+  - `docs/RUST.md` — the plan for moving the app to Rust (on the `rustify`
+    branch of the `ai-app-2` clone): what has to be reproduced, the
+    framework decision, and the ordered experiments with their pass
+    conditions. Read it before touching anything under that branch.
+  - `docs/IRIS.md`, `docs/IRIS_TODO.md`, `docs/DECISIONS.md`,
+    `docs/LAYOUT.md`, `docs/TEXTURES.md`, `docs/CLIENT_CORE.md` — iris's
+    own public API log, working list, decisions log, layout/render design,
+    and texture-atlas design, and the client-core crate's design,
+    respectively.
 - `.dev-updater.ron` — what Dev Updater builds here: the server (run as
  `service: Managed(…)`, supervised by Dev Updater's own implementation
  rather than a script kept here) and the APK, in parallel. It points at
@@ -312,7 +322,7 @@ means here:
 ## Sessions outlive the backend

 Since 2026-08-29 a session's process is deliberately left running when
-`ai-server` stops, and adopted again when it starts. PLAN.md has the design;
+`ai-server` stops, and adopted again when it starts. docs/PLAN.md has the design;
 day to day:

 - **Stopping the server no longer stops the sessions.** After `pkill
@@ -345,7 +355,7 @@ count tells you what continuing a session will cost. Shown, not warned about;
 importing a large session is a choice somebody is entitled to make.

 **Never import a Claude Code session that is open in a terminal.** The app
-refuses it — see PLAN.md for the incident that made that a refusal rather
+refuses it — see docs/PLAN.md for the incident that made that a refusal rather
 than a warning.

 **One Claude Code session id can name two files, and the listing offers it
@@ -521,4 +531,4 @@ belongs in `~/.claude/TOOLCHAIN.md` or `~/.claude/MACHINE.md` instead.
  `BasicTextField`, which costs two seconds a frame at 128 kB and stops the
  app at 1 MiB, so `EDIT_LIMIT` caps it at 32 kB with the reason said on
  screen. If you make the editor faster, that number is what to move.
-  EXPLORER.md's "What the measurements said" has the rest.
+  docs/EXPLORER.md's "What the measurements said" has the rest.
@@ -1,30 +0,0 @@
-# Decisions taken for Iris to review
-
-Short list of design choices made by the design agent without asking, so
-they can be judged and reversed later. Detail lives in RUST.md (and IRIS.md
-for iris API changes); this file is only the summary. Newest first. Items
-marked **DEFERRED** are ones the agent chose not to decide alone.
-
-## 2026-09-05
-
- **Touch drag on a transcript row follows Android's own rule**: a vertical
-  drag pans the list immediately; a stationary press held 500 ms starts a
-  text selection which further dragging extends; a horizontal drag while
-  something is already selected extends that selection without the wait.
-  One `DragArbiter` per list decides it (`iris/src/sense.rs`). Chosen over a
-  "text layer always wins" or "list always wins" rule because either loses
-  one of the two gestures a reader expects.
- **E4's desktop shape is a new `iris/desktop-app` crate**: a winit window
-  holding `transcript-ui`'s screen beside a session list, talking to a real
-  `ai-server` through `client-core`. It enrols by pasting the same
-  `aiapp://enroll?…` link a phone scans (`client-core::config::EnrolledServer`)
-  and keeps it owner-only under `$XDG_CONFIG_HOME/ai-app-desktop/`. The
-  pinned CA is a path given on the command line, not baked in. Chosen so
-  the phone and desktop share one enrolment format and no second one is
-  invented.
- **Order of remaining work**: finish the two in-flight pieces above, then
-  the transcript screen's Android integration and the `transcript-bench.sh`
-  comparison against Compose — the numbers the recommendation still lacks.
- **DEFERRED — whether to commit to iris over Masonry for `ai-app`.** Waits
-  on the bench numbers above; RUST.md's recommendation says what the
-  measurements must show.
@@ -0,0 +1,34 @@
+#!/bin/sh
+# RUST.md's I5 "Where iris's frame time goes" pass (2026-09-05). The same
+# 24-swipe/6-cycle loop as transcript-bench.sh's, extracted for iris's own
+# demo app -- transcript-bench.sh itself is Compose-specific (opens by
+# session title through the Compose app's own UI) and cannot be called
+# directly against dev.iris.android.demo.
+#
+# MUST be run from inside this checkout (not /tmp): ui-trace/adb pick which
+# emulator to target from the current directory's basename (the
+# per-checkout-AVD rule), and a previous pass lost two attempts to a `cd`
+# into /tmp that made this resolve to a nonexistent "tmp" checkout.
+set -eu
+cd "$(dirname "$0")"
+. ./android-env.sh >/dev/null 2>&1
+
+cycles=${1:-6}
+
+ui-trace record -d 3000 --do "tap 'Reset frame report'" -o /tmp/iris-bench-reset.txt >/dev/null
+adb logcat -c
+
+DO=""
+i=0
+while [ "$i" -lt "$cycles" ]; do
+    DO="$DO --do 'swipe 540 700 540 1600 200' --do 'wait 500'"
+    DO="$DO --do 'swipe 540 700 540 1600 200' --do 'wait 500'"
+    DO="$DO --do 'swipe 540 1600 540 700 200' --do 'wait 500'"
+    DO="$DO --do 'swipe 540 1600 540 700 200' --do 'wait 500'"
+    i=$((i + 1))
+done
+eval ui-trace record -d $((cycles * 16000 + 20000)) $DO -o /tmp/iris-bench-scroll.txt >/dev/null
+
+ui-trace record -d 3000 --do "tap 'Frame report'" -o /tmp/iris-bench-report.txt >/dev/null
+sleep 1
+adb logcat -d -s iris-android-app:I | grep "iris frame report:"
@@ -7,7 +7,7 @@ edition = "2024"
 # with `server/` via `event-model`), the REST + SSE clients for its HTTP
 # surface (see `server/src/routes.rs`'s module doc for the table), the
 # transcript fold and cache, the markdown block model, the syntax
-# highlighter and the ANSI parser. See CLIENT_CORE.md at the repo root for
+# highlighter and the ANSI parser. See `docs/CLIENT_CORE.md` for
 # what this holds today, what it does not yet, and how it corresponds to
 # the Kotlin it replaces.
 #
@@ -78,14 +78,14 @@ fn percent_decode(s: &str) -> String {
    let mut out = Vec::with_capacity(bytes.len());
    let mut i = 0;
    while i < bytes.len() {
-        if bytes[i] == b'%' && i + 2 < bytes.len() {
-            if let Ok(byte) =
+        if bytes[i] == b'%'
+            && i + 2 < bytes.len()
+            && let Ok(byte) =
                u8::from_str_radix(std::str::from_utf8(&bytes[i + 1..i + 3]).unwrap_or(""), 16)
-            {
-                out.push(byte);
-                i += 3;
-                continue;
-            }
+        {
+            out.push(byte);
+            i += 3;
+            continue;
        }
        out.push(bytes[i]);
        i += 1;
@@ -1,5 +1,5 @@
 //! The app's pure logic, shared between the server and any Rust client --
-//! see `CLIENT_CORE.md` at the repo root for what lives here and what does
+//! see `docs/CLIENT_CORE.md` for what lives here and what does
 //! not yet.

 pub mod ansi;
@@ -1,7 +1,7 @@
 //! This phone's copy of the transcripts it has already been sent, so
 //! reopening a session does not download it again. Ported from
-//! `app/.../TranscriptCache.kt`; see `TRANSCRIPT_CACHE.md` at the repo root
-//! for the design and `CLIENT_CORE.md` for how this file corresponds to it.
+//! `app/.../TranscriptCache.kt`; see `docs/TRANSCRIPT_CACHE.md`
+//! for the design and `docs/CLIENT_CORE.md` for how this file corresponds to it.
 //!
 //! What is stored is the server's own JSON for one event per line, in
 //! transcript order. Reading the cache means running the same [`seq_of`]
@@ -606,6 +606,37 @@ pub fn group_tool_runs(items: &[TranscriptItem]) -> Vec<TranscriptRow> {
    rows
 }

+/// Folds a page of raw transcript lines (`ApiClient::fetch_transcript_page`'s
+/// `Vec<Value>`) into the flat item list this module works over. A line
+/// this build can't parse fails the whole page rather than being skipped --
+/// CODE_RULES's "an enumeration must be able to say 'it broke'" -- since
+/// silently dropping one event could hide, say, a user message that then
+/// looks like it was never sent. Moved here from `desktop-app`'s `app.rs`
+/// (RUST.md's E4) when the Android transcript client (I5) needed the same
+/// fold: "write the logic once" applies to any caller embedding
+/// `transcript-ui` against a live server, not just the first one.
+pub fn fold_page(values: &[serde_json::Value]) -> Result<Vec<TranscriptItem>, String> {
+    let mut items = Vec::new();
+    for value in values {
+        let event: SeqEvent = serde_json::from_value(value.clone()).map_err(|e| {
+            format!("the server sent a transcript line this build couldn't parse: {e}")
+        })?;
+        items = fold_event(&items, &event);
+    }
+    Ok(items)
+}
+
+/// The wire `seq` a raw transcript line carries -- the live-stream resume
+/// cursor after loading a page must be this, not a folded item's `seq()`.
+/// A folded `AssistantMsg` keeps the seq of the *first* delta it
+/// accumulated (`fold_event`'s own doc), so resuming from that seq would
+/// re-deliver every delta already folded into it, duplicating the tail of
+/// a reply that was mid-stream when the page was fetched -- found via a
+/// real screenshot in E4 (RUST.md), where the assistant's line doubled.
+pub fn raw_seq(value: &serde_json::Value) -> Option<u64> {
+    value.get("seq")?.as_u64()
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -824,4 +855,88 @@ mod tests {
            other => panic!("expected a QuestionCard, got {other:?}"),
        }
    }
+
+    fn line(seq: u64, json: serde_json::Value) -> serde_json::Value {
+        let mut obj = json;
+        obj["seq"] = serde_json::json!(seq);
+        obj["ts"] = serde_json::json!(1.0);
+        obj
+    }
+
+    /// The regression for a bug a real `run-headless.sh` screenshot found
+    /// in `desktop-app` (E4, RUST.md): resuming the live stream from the
+    /// last *item's* seq re-delivers the deltas already folded into a
+    /// still-open assistant message, doubling its tail. `raw_seq` of the
+    /// last wire line must be the true high-water mark instead, which for a
+    /// run of deltas is higher than every item's own `seq()`.
+    #[test]
+    fn the_resume_cursor_is_the_last_wire_seq_not_the_last_items_seq() {
+        let values = vec![
+            line(1, serde_json::json!({"type": "userMessage", "text": "hi"})),
+            line(
+                2,
+                serde_json::json!({"type": "assistantText", "delta": "a"}),
+            ),
+            line(
+                3,
+                serde_json::json!({"type": "assistantText", "delta": "b"}),
+            ),
+            line(
+                4,
+                serde_json::json!({"type": "assistantText", "delta": "c"}),
+            ),
+        ];
+        let after = raw_seq(values.last().unwrap()).unwrap();
+        assert_eq!(after, 4);
+
+        let items = fold_page(&values).unwrap();
+        let assistant_seq = items
+            .iter()
+            .find(|i| matches!(i, TranscriptItem::AssistantMsg { .. }))
+            .unwrap()
+            .seq();
+        assert_eq!(assistant_seq, 2);
+        assert_ne!(
+            after, assistant_seq,
+            "the fixed bug: these must differ here"
+        );
+    }
+
+    #[test]
+    fn a_page_folds_into_one_settled_assistant_message() {
+        let values = vec![
+            line(1, serde_json::json!({"type": "userMessage", "text": "hi"})),
+            line(
+                2,
+                serde_json::json!({"type": "assistantText", "delta": "hel"}),
+            ),
+            line(
+                3,
+                serde_json::json!({"type": "assistantText", "delta": "lo"}),
+            ),
+        ];
+        let items = fold_page(&values).unwrap();
+        assert_eq!(
+            items,
+            vec![
+                TranscriptItem::UserMsg {
+                    seq: 1,
+                    text: "hi".to_string(),
+                    attachments: Vec::new(),
+                },
+                TranscriptItem::AssistantMsg {
+                    seq: 2,
+                    text: "hello".to_string(),
+                    settled: false,
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn an_unparseable_line_fails_the_whole_page() {
+        let values = vec![serde_json::json!({"seq": 1, "ts": 1.0, "type": "not-a-real-type"})];
+        let err = fold_page(&values).unwrap_err();
+        assert!(err.contains("couldn't parse"));
+    }
 }
@@ -0,0 +1,183 @@
+# Decisions taken for Iris to review
+
+Short list of design choices made by the design agent without asking, so
+they can be judged and reversed later. Detail lives in RUST.md (and IRIS.md
+for iris API changes); this file is only the summary. Newest first. Items
+marked **DEFERRED** are ones the agent chose not to decide alone.
+
+## 2026-09-05
+
+- **P0, a phone benchmark gate before any porting, asked for by Iris
+  2026-09-05**: "before P1 I'd like to see benchmarks & also maybe stress
+  test on my own phone ... If it doesn't match compose reasonably well then
+  I don't think I'd wanna continue." Design (RUST.md's P0 box has the
+  detail): the same embedded synthetic fixture in both apps with no server
+  needed; the same scripted scroll loop then a streaming phase, run
+  programmatically since the phone has no usable system tracing and no
+  agent can drive it; the same report from both (frames, janky %, p50/p90/
+  p99, process CPU time, peak RSS, battery current where readable) with a
+  copy button; the iris app under its own id and the Compose one as a new
+  `bench` build type with an id suffix, so neither replaces her production
+  install; two arm64 APKs plus instructions delivered under `~/host/bench/`.
+  The gate is hers: iris within a reasonable margin of Compose release on
+  p50, p99 and CPU time, no crashes, no visible stutter. If it fails, the
+  port stops.
+- **The rest of the port is one UI crate, `iris/app-ui`, grown out of
+  `iris/transcript-ui` rather than started beside it.** It holds a
+  `Screen` enum plus a back stack — the Rust equivalent of `AppRoot.kt`'s
+  `when` — and `iris/desktop-app`/`iris/android-app` become thin entry
+  points over it. Chosen over a fresh crate because `transcript-ui`
+  already has the right generic shape (`Rsc: HasEvents` +
+  `Rsc::State: FocusHost`) and the `client-core`/`event-model` path
+  dependencies every later screen needs, so growing it in place is the
+  smaller diff. Platform-only code (notification service, share target,
+  QR scanner, Keystore token, deep-link enrolment) stays in the E3/E5
+  Java shell (`android-shell/` + `app/shellApp`) rather than moving into
+  this crate, since none of it is a screen. The Android APK is built by
+  `cargo xtask apk` (E5), merging the app-ui cdylib into the E3 shell so
+  there is one app rather than a demo shell plus a service shell.
+  `app/androidApp` (the Compose app) stays untouched and is the baseline
+  every step is measured against, until parity is reached (P7 decides
+  the switch, and is itself a load-bearing decision left to Iris). Order
+  is by risk to the daily-use path: session screen first (P1, where
+  every hard behaviour already lives), then the shell merge and a real
+  phone install (P2), then root tabs (P3), the explorer (P4),
+  settings/enrolment (P5), desktop parity (P6), and the cutover itself
+  (P7). Full plan: RUST.md's "The port, in order (decided 2026-09-05)".
+- **iris gets its own measured frame report, rather than waiting on a
+  `dumpsys`/`gfxinfo` answer that cannot see a `SurfaceView`'s GPU-drawn
+  frames.** `iris_core::FrameReport` (`iris/core/src/render/frame_report.rs`)
+  times each frame's wall clock from the same point `render()`'s redraw
+  starts to just after `queue.submit` + `present()` — the span Compose's
+  own render report and `gfxinfo` both count — into a fixed 4096-entry
+  ring (no allocation per frame; `report()` is the only place that
+  allocates, and only on a button tap). The report gives total frames,
+  janky % over the same 16.7ms budget `gfxinfo` uses, P50/P90/P99 and the
+  worst, plus a reset. Exposed the way the Compose app's copy-button
+  report already is: two named controls ("Frame report", "Reset frame
+  report") on the transcript screen, tappable by accessibility name via
+  `ui-trace`, logging under this crate's fixed `android_logger` tag
+  (`iris-android-app`) so a script can grep `"iris frame report"` the way
+  `transcript-bench.sh` greps `"ai-app render report"`. The report's own
+  `Display` line says plainly that it measures up to the `present()` call
+  returning, not GPU/compositor completion — wgpu's `present()` is not
+  fenced against either, so presenting that span as "time to reach the
+  screen" would be a measured-looking number that is actually inferred,
+  which the standing UI rule forbids.
+- **`ui-trace` gains a hold-then-drag gesture, additive, in
+  `emulator-tools`.** Neither of its two existing actions can produce
+  "hold stationary for `LONG_PRESS`, then move without lifting" — `tap`
+  has no hold and `swipe X1 Y1 X2 Y2 MS` interpolates motion across its
+  whole duration from t=0. A new action presses, waits, then moves to a
+  second point and releases as one continuous touch (raw
+  `sendevent`/`MotionEvent` injection, extending whatever mechanism the
+  existing `swipe` already uses), so `DragArbiter`'s pan-vs-select rule
+  (`iris/src/sense.rs`, already covered by 8 unit tests against a
+  synthetic clock) can finally be driven on a real device instead of only
+  in a test harness.
+- **Touch drag on a transcript row follows Android's own rule**: a vertical
+  drag pans the list immediately; a stationary press held 500 ms starts a
+  text selection which further dragging extends; a horizontal drag while
+  something is already selected extends that selection without the wait.
+  One `DragArbiter` per list decides it (`iris/src/sense.rs`). Chosen over a
+  "text layer always wins" or "list always wins" rule because either loses
+  one of the two gestures a reader expects.
+- **E4's desktop shape is a new `iris/desktop-app` crate**: a winit window
+  holding `transcript-ui`'s screen beside a session list, talking to a real
+  `ai-server` through `client-core`. It enrols by pasting the same
+  `aiapp://enroll?…` link a phone scans (`client-core::config::EnrolledServer`)
+  and keeps it owner-only under `$XDG_CONFIG_HOME/ai-app-desktop/`. The
+  pinned CA is a path given on the command line, not baked in. Chosen so
+  the phone and desktop share one enrolment format and no second one is
+  invented.
+- **I5's Android integration extends `iris-android-app` (I2's shell)
+  behind a Cargo feature (`transcript-screen`), rather than a third
+  shell crate.** That project already has the Gradle module, the
+  `IrisView`/`MainActivity` Java, and the JNI registration; the only
+  thing a second screen needs on top is a different `AndroidAppState`,
+  the same axis `tabs_ui::build`/`transcript_ui::build` already vary
+  along on the winit side. `tabs-screen`/`transcript-screen` are
+  mutually exclusive and each pulls in only its own deps, so the plain
+  tabs build (I2/I4) is untouched.
+- **Order of remaining work, updated 2026-09-05**: the two in-flight
+  pieces and I5's Android integration are all done; next is giving iris
+  its own frame-timing report so item 3 below can be decided by a number.
+- **DECIDED by Iris, 2026-09-05: iris is the app's framework; Masonry was
+  the calibration.** Her words: "I think iris definitely makes more sense
+  based on the limitations we've found." The limitations: Masonry has no
+  touch scroll on Android (E2), no per-span rich text and no cross-row
+  selection on the pinned commit (E2), and its keyboard bridge is a TODO
+  (E1); iris carries the same screen under the Compose baseline on the
+  host GPU (p50 15.0 ms against Compose's 20.0 ms, RUST.md's I5 box). What
+  follows: the E-steps are closed as calibration, and the port proceeds
+  on iris — screens, the shell (E3/E5), and `client-core` underneath.
+  The item below is kept as the record of what she decided from.
+- **Was DEFERRED — whether to commit to iris over Masonry for `ai-app`.**
+  Updated 2026-09-05 with the clean comparison the recommendation wanted:
+  same sandbox session content, same emulator, `EMU_GPU=software`, one
+  session. Headline numbers (RUST.md's I5 box, "Clean scroll comparison,
+  2026-09-05," has the full table and every caveat):
+
+  | app | build | frames | janky % | p50 | p90 | p99 | worst |
+  |---|---|---|---|---|---|---|---|
+  | Compose (in-app report) | debug | 1102 | 99.0% late | 33.8ms | 50.6ms | 79.5ms | -- |
+  | Compose (`dumpsys gfxinfo`) | debug | 1499 | 21.15% (95.66% legacy) | 32ms | 48ms | 150ms (p99) | -- |
+  | iris (`FrameReport`) | **release** | 299 | 94.65% | 79.1ms | 98.6ms | 117.8ms | 212.6ms |
+  | iris (`FrameReport`, repeat) | **release** | 233 | 94.42% | 109.3ms | 130.8ms | 147.1ms | 150.5ms |
+
+  **Not a clean apples-to-apples reading, stated plainly rather than
+  smoothed over**: iris had to be built **release** (debug `SIGSEGV`s on
+  this emulator's Vulkan loader, I4's finding) against Compose's mandated
+  **debug** build, so this asymmetry likely *understates* iris's gap
+  rather than the reverse; the three frame-time sources measure different
+  things (Compose's own phase accounting vs. Android's HWUI deadline-miss
+  definition vs. iris's redraw-start-to-present window, the last of which
+  `dumpsys gfxinfo` cannot see at all for iris's `SurfaceView`); and both
+  figures are emulator numbers under software rasterisation, which
+  Compose's *own* in-app report shows already costs 20-34ms/frame in
+  `swap`+`gpu` alone under this GPU mode, so a same-mode iris number well
+  above 16.7ms was expected going in for either app. A second pair under
+  `-gpu host` was not taken this pass. The earlier session's suspected
+  intermittent touch-delivery dropout was **not reproduced** this pass —
+  the zero-frame results this time traced to this pass's own script bug
+  (a `cd` that changed which emulator `ui-trace` targeted), not the
+  emulator; a CPU-load rise during the gesture was observed by a sampler
+  running throughout, but did not correlate with any failure, so the
+  original candidate is neither confirmed nor ruled out.
+  The choice in front of Iris, updated: decide now on the
+  structural-plus-functional case already made (iris works end-to-end
+  where Masonry's scroll gesture doesn't exist at all on Android) plus
+  this table — reading the two build profiles and three jank definitions
+  with the caveats above rather than as a single number — or ask for a
+  same-profile, same-GPU-mode rerun first. RUST.md's I5 box has the full
+  account.
+
+  **Updated 2026-09-05, the `-gpu host` pair taken.** Real GPU rendering
+  (`force-gles` -- the default Vulkan backend has no adapter at all under
+  plain host-GPU boot, confirmed by the exact `wgpu` error) reverses the
+  software-mode shape:
+
+  | app | build | GPU mode | frames | janky % | p50 | p90 | p99 | worst | cpu p50 | gpu-wait p50 |
+  |---|---|---|---|---|---|---|---|---|---|---|
+  | Compose (in-app report) | debug | host (virgl) | 1268 | 96.4% late | 20.0ms | 28.4ms | 37.7ms | -- | -- | -- |
+  | iris (`FrameReport`) | **release**, `force-gles` | host (virgl) | 62 | 41.94% | 15.0ms | 21.8ms | 37.1ms | 37.1ms | 0.2ms | 12.9ms |
+
+  Under real GPU rendering iris's median frame is *faster* than
+  Compose's, not the 2-3x-slower shape the software-mode table shows. A
+  new split inside `FrameReport` (redraw-to-submit vs. submit-to-present,
+  commit `e2a1fad`) says why: iris's own CPU work per frame is a median
+  0.2ms -- almost the entire frame is time spent handing the frame to the
+  driver, not in iris's layout/text/primitive code. This is consistent
+  with the earlier software-mode gap being mostly SwiftShader's CPU
+  rasterisation cost rather than an iris-specific slowness, but is not
+  proof of it: a same-mode software `force-gles` run to isolate the
+  backend crashed for an unrelated reason (SwiftShader's GL path reports
+  itself as OpenGL ES 3.0, which has no compute shaders, and iris's device
+  request assumes them unconditionally) — real scope to fix, not done
+  here — and the two apps' frame populations still differ in kind the same
+  way the software-mode caveats describe. A real intermittent touch-
+  scroll dropout was also reproduced this pass (six consecutive swipes
+  produced zero redraws while taps kept working; an identical retry then
+  succeeded) and is not explained. RUST.md's I5 box, "Where iris's frame
+  time goes, 2026-09-05, the `-gpu host` pass," has the full account. The
+  iris-vs-Masonry choice itself is still Iris's to make.
@@ -8,6 +8,79 @@ capability that moved. Small and trivial changes do not go here.
 An entry gives the date, what changed, why, and a short before/after where
 it helps judge the change without the session that made it. Newest first.

+## 2026-09-05 (later the same day): `iris_core::FrameReport` (RUST.md's I5 box)
+
+New public type, `iris_core::FrameReport` (re-exported from `iris_core`'s
+`render` module alongside `FrameStats` and `JANK_THRESHOLD`). Why: `dumpsys
+gfxinfo` cannot see a `SurfaceView`'s own GPU-drawn frames at all, so a
+`wgpu`-rendered iris screen had no way to ask "was this smooth" the way
+Compose's own in-app render report already can -- item 3 of RUST.md's
+recommendation was stuck on a one-sided number for exactly this reason.
+
+`FrameReport::record(elapsed: Duration)` is called once per frame (wired
+into `android/view.rs`'s `render()`, wrapping the same span from redraw
+start to after `queue.submit`+`present()` that Compose's report and
+`gfxinfo` both count) and writes into a fixed 4096-entry ring -- no
+allocation on the hot path. `FrameReport::report() -> Option<FrameStats>`
+gives total frames, janky % (over `JANK_THRESHOLD`, the same 16.7ms 60Hz
+budget `gfxinfo` uses), P50/P90/P99 and the worst; `None` if nothing has
+been recorded since the last `reset()`, not a zeroed report that would
+read as a real measurement. `FrameStats`'s `Display` line says plainly
+that it measures up to `present()` being called, not GPU/compositor
+completion, since wgpu's `present()` isn't fenced against either.
+
+`AndroidUiState` gained a `pub frame_report: FrameReport` field --
+anything with `HasAndroidUiState` can now read or reset it. Before this,
+there was no way to ask iris's own render path how long a frame took at
+all, on any backend.
+
+Before/after, for a caller that already has `ui_state: &AndroidUiState`:
+
+```rust
+// before: no such question could be asked
+// after:
+match ui_state.frame_report.report() {
+    Some(stats) => log::info!("iris frame report: {stats}"),
+    None => log::info!("iris frame report: no frames recorded yet"),
+}
+ui_state.frame_report.reset(); // via android_state_mut()
+```
+
+`iris-android-app`'s transcript screen exposes this as two named,
+tappable controls ("Frame report", "Reset frame report") rather than
+requiring a caller to wire its own UI -- see `transcript_client.rs`'s
+`frame_report_controls`.
+
+## 2026-09-05: `Tasks::redraw_handle` (RUST.md's I5 Android integration)
+
+New public method on `iris::task::Tasks`, `redraw_handle(&self) ->
+Arc<dyn RequestRedraw>`. Why: a caller running its own long-lived loop
+*inside* one spawned task (a live SSE follow, the Android transcript
+client's `select_session`) has no other way to ask for a frame after each
+`TaskCtx::update` -- `Tasks::spawn`'s own wrapper only requests one, after
+the whole async closure finishes, which fits a single request-then-update
+but not a stream that needs to be seen redrawing after *each* event. This
+is the same gap `iris/desktop-app`'s module doc names for why it uses
+winit's `Proxy<AppEvent>` instead of `Tasks` -- android-view has no
+`Proxy`, so this is what closes it there.
+
+**A real bug this uncovered, not a hypothetical**: calling the returned
+handle's `request_redraw()` from the background thread crashed the process
+(`SIGABRT`, `Result::unwrap() on an Err value: JavaException`) the first
+time an Android transcript fetch called it a second time. `android/render.rs`'s
+`AndroidRedrawHandle` was already attaching the calling thread to the JVM
+correctly, but its `request_redraw` called `View::post_frame_callback`,
+whose Java side calls `Choreographer.getInstance()` -- which throws unless
+the *calling* thread already has a `Looper`, and a tokio worker thread,
+even freshly JNI-attached, has none. Fixed by routing through
+`View::post_delayed(0)` instead (Android's own thread-safe "queue work onto
+this View's UI thread" primitive, needing no caller-side `Looper`), landing
+on a new `IrisViewPeer::delayed_callback` override that drains tasks and
+renders -- same body as `do_frame`, on the UI thread where
+`post_frame_callback` is safe again. Any future caller of `redraw_handle()`
+from a background thread gets this for free; nothing about the fix is
+specific to the transcript screen.
+
 ## 2026-09-05: `transcript_ui::build_tree` (RUST.md's E4)

 `transcript_ui::build` claimed the whole window (`ui_state.set_root(tree)`)
@@ -275,3 +348,26 @@ TEXTURES.md's "Recommended shape" and "Implemented, 2026-09-04".
  `wgpu::BindGroup` and draw call instead of a slot in the shared array —
  invisible from the widget API, visible only in `UiRenderNode`'s internals
  and in `iris`'s device requirements.
+
+## 2026-09-05: `FrameReport` splits each frame at `queue.submit`
+
+`FrameStats` gains two fields, and `FrameReport` gains a second recording
+method, to answer "is a slow frame iris's own CPU work or the driver/GPU"
+with a number instead of a guess (RUST.md's I5 box).
+
+- **`FrameReport::record_split(total, submit_to_present)`** is a second way
+  to record a frame, alongside the existing `record(total)` (unchanged,
+  and still what a caller with no split should use — it now reads as
+  `cpu_p50 == total`, `gpu_wait_p50 == 0`, rather than fabricating a
+  number for a half it never measured).
+- **`FrameStats` gains `cpu_p50` and `gpu_wait_p50`**: medians of
+  redraw-start-to-submit and submit-to-after-`present()` respectively,
+  independent of each other and of the existing `p50`/`p90`/`p99`/`worst`
+  (which are unchanged, and still over the whole frame). The Android
+  renderer's `draw()` now returns the `submit_to_present` `Duration` it
+  measured, which `android::view::render()` passes to `record_split`.
+- **Caveat carried in both doc comments**: `submit_to_present` is not
+  fenced against the GPU actually finishing — it is "how long the CPU was
+  blocked handing the frame to the driver," not a confirmed GPU-completion
+  time. Enough to separate "iris is slow building the frame" from "iris is
+  slow handing it off," not enough to claim an exact GPU budget.
@@ -176,14 +176,62 @@ order and what "done" looks like. Tick and date them in place.
  silently dropped. See RUST.md's I5 box for the full account of what
  *was* built (the screen, `SpanStyle`, cross-row selection, the growing
  composer).**
-  - [ ] **Android integration for this screen does not exist yet.** No
-    cdylib/Gradle shell the way `iris-android-app` wraps `tabs-ui` (I2),
-    so `transcript-bench.sh`'s render-number pass condition against the
-    Compose baseline cannot be run. Needs: real `client-core::ApiClient`/
-    `event_stream::follow_session_events` wiring against
-    `app/ui-sandbox.sh --delay` (this crate deliberately fetches nothing
-    itself, `transcript-ui/src/lib.rs`'s doc), a new cdylib + Gradle
-    module, then the bench script pointed at it.
+  - [x] **Android integration for this screen — done, 2026-09-05.**
+    `iris-android-app`'s `transcript-screen` Cargo feature
+    (`transcript_client.rs`) runs this screen against a real `ai-server`
+    through `client-core`, confirmed on-device: real scrolling, real
+    touch-drag panning, tap-by-name on the composer. Two real bugs found
+    and fixed along the way (a missing `INTERNET` permission; a
+    background-thread redraw request that crashed via a `Looper`
+    requirement, fixed by routing through `View::post_delayed` — see
+    `IRIS.md`'s `Tasks::redraw_handle` entry). See RUST.md's I5 box,
+    "The Android integration, done 2026-09-05" for the full account.
+  - [x] **A render-time number for iris, comparable to Compose's
+    `transcript-bench.sh` report — instrumentation done and a real number
+    obtained, 2026-09-05 (later the same day); the clean comparable loop
+    is not.** `iris_core::FrameReport` (`iris/core/src/render/
+    frame_report.rs`, `IRIS.md`'s new entry) times every frame from
+    `render()`'s redraw start to after `queue.submit`+`present()`, exposed
+    as two named on-screen controls ("Frame report", "Reset frame
+    report"). Driven against a real on-device touch-drag it read
+    `frames=34 janky%=61.76 p50=26.5ms p90=48.0ms p99=98.1ms
+    worst=98.1ms` — real, not inferred, but accumulated across several
+    gestures rather than one clean 24-swipe loop, because of the new
+    finding below. See RUST.md's I5 box, "Update, 2026-09-05, later the
+    same day" for the full account.
+  - [ ] **New, 2026-09-05: intermittent touch delivery to iris's
+    `SurfaceView` under this checkout's `EMU_GPU=software` emulator.**
+    The same swipe coordinates, confirmed (by scanning a screenshot
+    column for the first non-black pixel) to sit over real row text,
+    sometimes produced 30+ real frames and a screenshot diff and
+    sometimes produced zero of either, across otherwise-identical
+    `ui-trace` invocations. Not the already-understood "already at that
+    scroll edge" case (reproduced with content confirmed taller than the
+    viewport, in both directions). Leading candidate, not yet confirmed:
+    this checkout's emulator was independently observed at ~78% of one
+    CPU core, continuously, while idle on-screen — SwiftShader's software
+    rasterisation is CPU-bound by design, and a synthetic touch competing
+    with that load for delivery is plausible but unmeasured *during* a
+    failing gesture (the standing rule against diagnosing from
+    after-the-fact measurements applies here). Needs a sampler (load,
+    `dumpsys input`, a `-i 0` `ui-trace` capture) running while a failing
+    gesture is driven, and ideally a comparison under `-gpu host` (real
+    Vulkan) to see whether it is specific to software rendering. This is
+    what blocks the clean, comparable 24-swipe loop above.
+  - [x] **Long-press-then-drag-to-select — confirmed on-device, 2026-09-05
+    (later the same day).** `ui-trace` gained a `holddrag X1 Y1 X2 Y2
+    HOLD_MS MOVE_MS` action (`emulator-tools`, additive, extends the same
+    `MotionEvent`/`injectInputEvent` mechanism `swipe` already used):
+    press, hold past `LONG_PRESS`, move, release, as one continuous touch.
+    Driven against a real row (`holddrag 300 1850 300 2050 600 300`) it
+    produced `iris selection: begin at row ...` then a sequence of
+    `iris selection: extend to row ...` log lines
+    (`transcript-ui/src/selection.rs`, a new small `log` dependency since
+    selection has no accessibility label of its own yet — see the next
+    item), and a screenshot taken right after shows the expected
+    highlighted selection spanning multiple rows. `DragArbiter`'s own
+    unit tests already covered this sequence against a synthetic clock;
+    this is the first time it has been driven by a real device touch.
  - [x] **Touch-drag panning over a row's own rendered text — done,
    2026-09-05.** `row.rs` used to register `CursorSense::click_or_drag()`
    on each row's `TextEdit` for cross-row selection; `TextEdit::draw`'s
@@ -244,6 +292,42 @@ order and what "done" looks like. Tick and date them in place.
  everything, the same way input is**. Whatever the mechanism, a widget
  that does not animate must pay nothing and import nothing for it.

+## Build (for the port)
+
+Widgets `RUST.md`'s "The port, in order (decided 2026-09-05)" needs and
+iris does not have yet, one entry per gap, named against the P-step that
+first needs it. Move an entry up to "Fix" or tick it in place once built;
+do not duplicate it there.
+
+- [ ] **A history-paging cushion measured in on-screen viewports, not a
+  row count.** (**P1**.) `iris::widget::List` has no equivalent of the
+  Compose app's `HISTORY_SCREENS` — AGENTS.md's "Things that have
+  bitten" is explicit that a fixed row count under-fills a screen on a
+  tool-heavy transcript and over-fills one on a text-heavy one, so
+  whatever loads the next page has to ask the list how many viewports
+  are actually on screen, not assume a constant.
+- [ ] **A scaled thumbnail/image widget for an in-transcript image.**
+  (**P1**.) `SessionImage.kt`'s bitmap decode-and-downscale has no iris
+  counterpart; iris's own image widget (used by `bench_images.rs`) draws
+  a loaded texture but does nothing about sourcing or scaling one from a
+  server-produced attachment.
+- [ ] **A modal/dialog primitive.** (**P1**, reused by **P3** and
+  **P5**.) Needed for the session settings dialog, `UsageDialog`'s
+  equivalent, and the delete-with-`deleteForeign` confirmation with its
+  toggle switch. Build once, wherever it is first needed, rather than
+  once per screen that wants one.
+- [ ] **A horizontal gauge/bar widget.** (**P1**.) For
+  `SessionUsageBar`'s equivalent — a bounded fill reflecting a fraction,
+  nothing fancier.
+- [ ] **A `BusyItem` equivalent: a dimmed row carrying an operation
+  label that does not block its list's own scroll/drag.** (**P3**.) The
+  Compose version tried an overlay first and it swallowed the drag along
+  with the tap (AGENTS.md's "Shared appearance") — worth not repeating
+  that attempt in iris before building the row-level version directly.
+- [ ] **A toggle switch.** (**P3**.) For the delete dialog's
+  `deleteForeign` control; iris has no switch/checkbox widget yet as far
+  as this pass found.
+
 ## Reconsider

 - [ ] **`WidgetView`.** Iris is unsure of it: what she wants is an easy way
@@ -3651,6 +3651,7 @@ dependencies = [
 "client-core",
 "event-model",
 "iris",
+ "log",
 "pulldown-cmark",
 ]

@@ -57,6 +57,16 @@ send_wrapper = "0.6.0"
 # installs it -- this crate never installs a logger itself.
 log = "0.4.28"

+[features]
+# RUST.md's I5 "Where iris's frame time goes" diagnosis: forces the Android
+# `wgpu::Instance` to `Backends::GL` instead of `Backends::PRIMARY`, so the
+# same build can be measured against SwiftShader's software Vulkan ICD (the
+# default) or virgl's GLES path, without a second env-var plumbing path that
+# nothing on this machine can hand to an already-launched Android process
+# (there is no `am start` environment and no system-property reader here to
+# add one). Android-only; `android/render.rs` is the only reader.
+force-gles = []
+
 [dev-dependencies]
 tokio = { workspace = true, features = ["sync", "rt", "rt-multi-thread", "time"] }
 # The tabs example's widget tree. A dev-dependency cycle back to this
@@ -558,6 +558,12 @@ dependencies = [
 "arrayvec",
 ]

+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -734,6 +740,16 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"

+[[package]]
+name = "client-core"
+version = "0.1.0"
+dependencies = [
+ "event-model",
+ "serde",
+ "serde_json",
+ "ureq",
+]
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -779,6 +795,35 @@ dependencies = [
 "crossbeam-utils",
 ]

+[[package]]
+name = "cookie"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "cookie_store"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b2c103cf610ec6cae3da84a766285b42fd16aad564758459e6ecf128c75206"
+dependencies = [
+ "cookie",
+ "document-features",
+ "idna",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "url",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -886,6 +931,12 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"

+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
 [[package]]
 name = "dispatch"
 version = "0.2.0"
@@ -1048,6 +1099,14 @@ dependencies = [
 "pin-project-lite",
 ]

+[[package]]
+name = "event-model"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "exr"
 version = "1.74.2"
@@ -1179,6 +1238,15 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"

+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
 [[package]]
 name = "futures-core"
 version = "0.3.34"
@@ -1253,6 +1321,26 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "getopts"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.3.4"
@@ -1423,6 +1511,22 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfa686283ad6dd069f105e5ab091b04c62850d3e4cf5d67debad1933f55023df"

+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
 [[package]]
 name = "icu_collections"
 version = "2.3.0"
@@ -1551,6 +1655,27 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad"

+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
 [[package]]
 name = "image"
 version = "0.25.10"
@@ -1640,9 +1765,13 @@ version = "0.1.0"
 dependencies = [
 "android-view",
 "android_logger",
+ "client-core",
+ "event-model",
 "iris",
 "log",
+ "serde_json",
 "tabs-ui",
+ "transcript-ui",
 ]

 [[package]]
@@ -1676,6 +1805,12 @@ dependencies = [
 "either",
 ]

+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
 [[package]]
 name = "jni"
 version = "0.21.1"
@@ -2096,6 +2231,12 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
 [[package]]
 name = "num-derive"
 version = "0.4.2"
@@ -2744,6 +2885,12 @@ dependencies = [
 "zerovec",
 ]

+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -2796,6 +2943,25 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "pulldown-cmark"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
+dependencies = [
+ "bitflags 2.13.1",
+ "getopts",
+ "memchr",
+ "pulldown-cmark-escape",
+ "unicase",
+]
+
+[[package]]
+name = "pulldown-cmark-escape"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "007d8adb5ddab6f8e3f491ac63566a7d5002cc7ed73901f72057943fa71ae1ae"
+
 [[package]]
 name = "pulp"
 version = "0.22.3"
@@ -3075,6 +3241,20 @@ version = "0.8.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47b34b781b31e5d73e9fbc8689c70551fd1ade9a19e3e28cfec8580a79290cc4"

+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "roxmltree"
 version = "0.21.1"
@@ -3125,6 +3305,41 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "rustls"
+version = "0.23.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -3207,6 +3422,19 @@ dependencies = [
 "syn 3.0.5",
 ]

+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
 [[package]]
 name = "serde_repr"
 version = "0.1.21"
@@ -3363,6 +3591,12 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6637bab7722d379c8b41ba849228d680cc12d0a45ba1fa2b48f2a30577a06731"

+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "swash"
 version = "0.2.10"
@@ -3490,6 +3724,36 @@ dependencies = [
 "zune-jpeg",
 ]

+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tiny-skia"
 version = "0.11.4"
@@ -3596,6 +3860,17 @@ dependencies = [
 "once_cell",
 ]

+[[package]]
+name = "transcript-ui"
+version = "0.1.0"
+dependencies = [
+ "client-core",
+ "event-model",
+ "iris",
+ "log",
+ "pulldown-cmark",
+]
+
 [[package]]
 name = "tree_magic_mini"
 version = "3.2.2"
@@ -3634,6 +3909,12 @@ dependencies = [
 "keyboard-types",
 ]

+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -3652,6 +3933,62 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"

+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "972d7902c8735f2695410b8aed7df6ed12a47394aa1c8d7af49f0497b731a94d"
+dependencies = [
+ "base64",
+ "cookie_store",
+ "flate2",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da5f78b09e6941e1a0f2e30e695e4b120377b54d5e0aec11b594bb57b3971613"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -3696,6 +4033,12 @@ dependencies = [
 "winapi-util",
 ]

+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
 [[package]]
 name = "wasip2"
 version = "1.0.4+wasi-0.2.12"
@@ -3889,6 +4232,15 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -4748,6 +5100,12 @@ dependencies = [
 "synstructure",
 ]

+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
 [[package]]
 name = "zerotrie"
 version = "0.2.5"
@@ -4789,6 +5147,12 @@ version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"

+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
 [[package]]
 name = "zune-core"
 version = "0.5.3"
@@ -17,10 +17,30 @@ crate-type = ["cdylib"]

 [dependencies]
 iris = { path = "../" }
-tabs-ui = { path = "../tabs-ui" }
 android-view = { git = "https://github.com/rust-mobile/android-view.git", rev = "bec6c62a96cef8239b0fd7fedeef9b184d02e3a1" }
 android_logger = "0.15.0"
 log = "0.4.28"
+# `tabs-screen` (default, I2/I4's demo) and `transcript-screen` (I5's
+# Android integration) are mutually exclusive -- one `ActiveClient` type is
+# compiled in, never both (`lib.rs`'s doc comment) -- so both sets of deps
+# are optional and each screen's feature pulls in only its own. Without
+# this, building `--features transcript-screen` alone (default features
+# still on) left `tabs-ui` linked but never referenced under that cfg,
+# which Cargo's `unused_dependencies` lint (on by default) correctly flags.
+tabs-ui = { path = "../tabs-ui", optional = true }
+transcript-ui = { path = "../transcript-ui", optional = true }
+client-core = { path = "../../client-core", optional = true }
+event-model = { path = "../../event-model", optional = true }
+serde_json = { version = "1", features = ["float_roundtrip"], optional = true }
+
+[features]
+default = ["tabs-screen"]
+tabs-screen = ["dep:tabs-ui"]
+transcript-screen = ["dep:transcript-ui", "dep:client-core", "dep:event-model", "dep:serde_json"]
+# RUST.md's I5 "Where iris's frame time goes": forces the GLES backend
+# instead of SwiftShader's software Vulkan. See `iris/Cargo.toml`'s own doc
+# on the feature this forwards to.
+force-gles = ["iris/force-gles"]

 [profile.release]
 panic = "abort"
@@ -1,6 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">

+    <!-- Only needed by the transcript-screen feature (RUST.md's I5),
+         which talks to a real ai-server; the plain tabs demo (I2/I4) makes
+         no network call and never noticed this was missing. Absent,
+         UreqTransport::new's connect failed with EPERM (Operation not
+         permitted), not the ECONNREFUSED/ENETUNREACH a firewall or a dead
+         server would give: a seccomp-level socket denial reads nothing
+         like a network problem, which is what made it worth a comment. -->
+    <uses-permission android:name="android.permission.INTERNET" />
+
    <application
        android:allowBackup="true"
        android:label="iris android-view demo"
@@ -0,0 +1,92 @@
+// Only does anything under the `transcript-screen` feature (RUST.md's I5
+// Android integration) -- the plain tabs build (I2/I4) needs none of this
+// and stays untouched, same reasoning as the feature gate in Cargo.toml.
+//
+// Bakes the sandbox server's host, port, token and pinned CA in at build
+// time, the same way `app/androidApp/build.gradle.kts`'s
+// `GeneratePinnedCert` task bakes the CA for the Compose app -- see that
+// file's comment for why reading the machine's own certificate at build
+// time is the right trust boundary. This build additionally bakes the
+// host/port/token, which the Compose app does not: that app enrolls at
+// runtime from a scanned QR/deep link, and a from-scratch enrollment UI
+// (Keystore-sealed token storage, a QR/link scanner) is real, separate
+// scope this integration does not need to build to answer RUST.md's
+// question -- there is nothing here yet resembling `ServerConfig.kt`. So
+// this is a **deliberate simplification for this rig only**: an APK built
+// this way is good for exactly the emulator/server pair that built it, and
+// must never be treated as a template for a real enrollment flow. Recorded
+// in RUST.md's I5 box rather than left to be rediscovered.
+use std::path::PathBuf;
+
+fn main() {
+    if std::env::var_os("CARGO_FEATURE_TRANSCRIPT_SCREEN").is_none() {
+        return;
+    }
+    println!("cargo:rerun-if-env-changed=AI_APP_TRANSCRIPT_HOST");
+    println!("cargo:rerun-if-env-changed=AI_APP_TRANSCRIPT_PORT");
+    println!("cargo:rerun-if-env-changed=AI_APP_TRANSCRIPT_TOKEN");
+    println!("cargo:rerun-if-env-changed=AI_APP_CA");
+    println!("cargo:rerun-if-env-changed=XDG_CONFIG_HOME");
+
+    let host = require_env(
+        "AI_APP_TRANSCRIPT_HOST",
+        "the sandbox server's host as the emulator reaches it, e.g. 10.0.2.2",
+    );
+    let port = require_env(
+        "AI_APP_TRANSCRIPT_PORT",
+        "the sandbox server's port -- app/ui-sandbox.sh's start banner prints it",
+    );
+    let token = require_env(
+        "AI_APP_TRANSCRIPT_TOKEN",
+        "the bearer token -- ~/.config/ai-app/sandbox-token, or the start banner's enrollment link",
+    );
+
+    let ca_path = std::env::var_os("AI_APP_CA")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| {
+            let base = std::env::var_os("XDG_CONFIG_HOME")
+                .map(PathBuf::from)
+                .unwrap_or_else(|| {
+                    let home = std::env::var_os("HOME").expect("HOME must be set");
+                    PathBuf::from(home).join(".config")
+                });
+            base.join("ai-app").join("certs").join("ca.pem")
+        });
+    let ca_pem = std::fs::read_to_string(&ca_path).unwrap_or_else(|e| {
+        panic!(
+            "no CA certificate at {} ({e}).\n\
+             Start ai-server (or app/ui-sandbox.sh) once on this machine first -- it \
+             generates the CA this build pins. Set AI_APP_CA=/path/to/ca.pem to build \
+             against a different one.",
+            ca_path.display()
+        )
+    });
+    let ca_pem = ca_pem.trim();
+    if !ca_pem.starts_with("-----BEGIN CERTIFICATE-----") {
+        panic!("{} is not a PEM certificate.", ca_path.display());
+    }
+
+    let out_dir = PathBuf::from(std::env::var_os("OUT_DIR").unwrap());
+    let generated = format!(
+        "// Generated by build.rs from {host}:{port} and {ca}. Do not edit.\n\
+         pub const HOST: &str = {host_lit:?};\n\
+         pub const PORT: u16 = {port};\n\
+         pub const TOKEN: &str = {token_lit:?};\n\
+         pub const CA_PEM: &str = {ca_lit:?};\n",
+        host = host,
+        port = port
+            .parse::<u16>()
+            .unwrap_or_else(|e| panic!("AI_APP_TRANSCRIPT_PORT={port:?} is not a u16: {e}")),
+        ca = ca_path.display(),
+        host_lit = host,
+        token_lit = token,
+        ca_lit = ca_pem,
+    );
+    std::fs::write(out_dir.join("pinned_config.rs"), generated).unwrap();
+}
+
+fn require_env(name: &str, what: &str) -> String {
+    std::env::var(name).unwrap_or_else(|_| {
+        panic!("{name} must be set to build the transcript-screen feature -- {what}")
+    })
+}
@@ -1,5 +1,5 @@
-//! The android-view demo app: iris's `tabs` widget tree (`tabs_ui::build`,
-//! shared with the winit example) running through
+//! The android-view demo app: by default, iris's `tabs` widget tree
+//! (`tabs_ui::build`, shared with the winit example) running through
 //! `iris::android`'s `ViewPeer`. This is RUST.md's I2 pass condition made
 //! concrete -- there is no UI here beyond what `tabs-ui` already draws.
 //!
@@ -9,6 +9,20 @@
 //! wrapping `iris::android::new_peer`'s generic function in a concrete
 //! `extern "system" fn`, since `register_view_class` wants a plain
 //! function pointer.
+//!
+//! **`transcript-screen` feature (RUST.md's I5 Android integration):** with
+//! `--features transcript-screen`, `new_view_peer` instantiates
+//! `transcript_client::TranscriptClient` instead of the tabs `Client`
+//! below, against a real `ai-server` (see that module's doc). Chosen over a
+//! third shell crate: this one already has the Gradle project, the
+//! `IrisView`/`MainActivity` Java, and the JNI registration I2 built and
+//! measured against, and the only thing a transcript screen needs on top
+//! is a different `AndroidAppState` -- the same axis `tabs_ui::build` vs.
+//! `transcript_ui::build` already varies along on the winit side (compare
+//! `iris/examples/tabs.rs` and `iris/transcript-ui/examples/transcript.rs`).
+//! A build picks one screen or the other, never both, so `Client` and
+//! `TranscriptClient` are cfg-gated apart rather than switched at runtime --
+//! there is no in-app navigation to switch *to* on either side yet.

 use android_view::{
    Context, View,
@@ -18,19 +32,26 @@ use android_view::{
    },
    register_view_class,
 };
+#[cfg(not(feature = "transcript-screen"))]
 use iris::android::{AndroidAppState, AndroidRsc, AndroidUiState, HasAndroidUiState};
+#[cfg(not(feature = "transcript-screen"))]
 use iris::prelude::*;
 use log::LevelFilter;
 use std::ffi::c_void;

+#[cfg(feature = "transcript-screen")]
+mod transcript_client;
+
 /// The app's `View` subclass, matching the Java side's package --
 /// `app/src/main/java/dev/iris/android/demo/IrisView.java`.
 const VIEW_CLASS: &str = "dev/iris/android/demo/IrisView";

+#[cfg(not(feature = "transcript-screen"))]
 pub struct Client {
    ui_state: AndroidUiState,
 }

+#[cfg(not(feature = "transcript-screen"))]
 impl HasAndroidUiState for Client {
    fn android_state(&self) -> &AndroidUiState {
        &self.ui_state
@@ -40,6 +61,7 @@ impl HasAndroidUiState for Client {
    }
 }

+#[cfg(not(feature = "transcript-screen"))]
 impl AndroidAppState for Client {
    fn new(mut ui_state: AndroidUiState, rsc: &mut AndroidRsc<Self>) -> Self {
        // `widgets.info` is the winit example's frame-debug readout, kept
@@ -61,12 +83,17 @@ impl AndroidAppState for Client {
    }
 }

+#[cfg(not(feature = "transcript-screen"))]
+type ActiveClient = Client;
+#[cfg(feature = "transcript-screen")]
+type ActiveClient = transcript_client::TranscriptClient;
+
 extern "system" fn new_view_peer<'local>(
    env: JNIEnv<'local>,
    view: View<'local>,
    context: Context<'local>,
 ) -> jlong {
-    iris::android::new_peer::<Client>(env, view, context)
+    iris::android::new_peer::<ActiveClient>(env, view, context)
 }

 /// # Safety
@@ -0,0 +1,375 @@
+//! RUST.md's I5 Android integration: `transcript-ui`'s screen filling the
+//! whole window on android-view, against a real `ai-server` through
+//! `client-core` -- the missing half `iris-android-app` (I2) only had for
+//! `tabs-ui` until now. Behind the `transcript-screen` Cargo feature so the
+//! plain build (`cargo ndk build`, no `--features`) stays exactly the tabs
+//! demo I2/I4 already measured against.
+//!
+//! **Deliberate simplification, recorded rather than left to be
+//! rediscovered (RUST.md's I5 box has the full account)**: there is no
+//! session list and no enrollment UI here. The server, port, token and
+//! pinned CA are baked in at build time (`build.rs`'s
+//! `AI_APP_TRANSCRIPT_HOST`/`_PORT`/`_TOKEN`/`AI_APP_CA`), and the first
+//! session `ApiClient::fetch_sessions` returns is opened automatically --
+//! there is nothing to tap to get there, which is what `transcript-bench.sh`
+//! and `ui-trace` need to land straight on the screen under test. A real
+//! app needs `desktop-app`'s `EnrolledServer`/QR-link flow or E3's
+//! Keystore-sealed `ServerConfig.kt`; building a second one of those was
+//! not this pass's job.
+//!
+//! **Reuses `iris/desktop-app`'s `app.rs` shape almost exactly** --
+//! `fold_event`/`group_tool_runs`/`fold_page`/`raw_seq` from
+//! `client_core::transcript_fold`, a `generation` counter guarding against
+//! a stale background response, and a full rebuild of the widget tree on
+//! every event (same tradeoff, same reason: `push_row` cannot update a row
+//! already on screen, and this rig's conversations are small). What
+//! differs is only the redraw mechanism: android-view has no
+//! `winit::EventLoopProxy`, so this uses `iris::task::Tasks::redraw_handle`
+//! (new, added alongside this box) to request a frame after each
+//! `TaskCtx::update` instead of relying on `Tasks::spawn`'s single
+//! end-of-future redraw -- see that method's own doc for why.
+
+use client_core::api::{ApiClient, UreqTransport};
+use client_core::event_stream::{StreamItem, follow_session_events};
+use client_core::transcript_fold::{TranscriptItem, fold_event, fold_page, group_tool_runs};
+use event_model::SeqEvent;
+use iris::android::{AndroidAppState, AndroidRsc, AndroidUiState, HasAndroidUiState};
+use iris::prelude::*;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+mod pinned {
+    include!(concat!(env!("OUT_DIR"), "/pinned_config.rs"));
+}
+
+pub struct TranscriptClient {
+    ui_state: AndroidUiState,
+    /// The screen's own content -- everything under the fixed
+    /// [`frame_report_controls`] bar, which is built once (`new`, below)
+    /// and never touched by `show_message`/`rebuild_transcript`'s own
+    /// `set` calls the way `desktop-app`'s `transcript_ptr` isn't touched
+    /// by rebuilding the session list beside it.
+    content: WeakWidget<WidgetPtr>,
+    screen: Option<transcript_ui::TranscriptScreen>,
+    /// The folded transcript as of the last rebuild -- kept here (not
+    /// re-derived) for the same reason `desktop-app`'s `Client::items`
+    /// exists: a live `StreamEvent` only carries one new wire event, and
+    /// `fold_event` needs everything folded so far to fold it in.
+    items: Vec<TranscriptItem>,
+    /// The session currently open -- `None` only before the first fetch
+    /// resolves. Read back by `apply_event`'s rebuild, which has no session
+    /// id of its own (a live `SeqEvent` doesn't carry one).
+    session_id: Option<String>,
+    /// Bumped every time a new session load starts; a background response
+    /// checks it before touching state, so a slow reply for a session this
+    /// screen has moved on from can't overwrite what replaced it. There is
+    /// only ever one session here (no list to switch away to), but the
+    /// guard still matters for the *first* fetch racing a `stop`/`start`.
+    generation: Arc<AtomicU64>,
+}
+
+impl HasAndroidUiState for TranscriptClient {
+    fn android_state(&self) -> &AndroidUiState {
+        &self.ui_state
+    }
+    fn android_state_mut(&mut self) -> &mut AndroidUiState {
+        &mut self.ui_state
+    }
+}
+
+/// Builds one `UreqTransport` from the config `build.rs` baked in. Called
+/// twice per session load, same as `desktop-app`'s `build_transport`
+/// closure -- `ApiClient` and the live-stream follow each need their own,
+/// since `UreqTransport` holds its own `ureq::Agent`.
+fn build_transport() -> Result<UreqTransport, String> {
+    let base_url = format!("https://{}:{}", pinned::HOST, pinned::PORT);
+    UreqTransport::new(
+        base_url,
+        pinned::TOKEN.to_string(),
+        pinned::CA_PEM.as_bytes(),
+    )
+    .map_err(|e| e.to_string())
+}
+
+fn placeholder<Rsc: HasEvents>(rsc: &mut Rsc, message: &str) -> StrongWidget {
+    wtext(message.to_string())
+        .color(Color::WHITE)
+        .wrap(true)
+        .pad(16)
+        .add_strong(rsc)
+        .any()
+}
+
+/// The two named controls RUST.md's I5 box ("Measurements taken" (b))
+/// drives by name over `ui-trace`, e.g. `ui-trace record --do "tap 'Frame
+/// report'"`. `dumpsys gfxinfo` cannot see this screen's own GPU-drawn
+/// frames at all -- this is the screen's own equivalent of the Compose
+/// app's "Copy render timings" control, logged rather than clipboarded
+/// (no clipboard wiring exists here) under this crate's own fixed
+/// `android_logger` tag (`iris-android-app`, `lib.rs`'s `JNI_OnLoad`),
+/// grep-able on the fixed string `"iris frame report"` the way
+/// `transcript-bench.sh` greps `"ai-app render report"`.
+fn frame_report_controls(rsc: &mut AndroidRsc<TranscriptClient>) -> WeakWidget {
+    type Rsc = AndroidRsc<TranscriptClient>;
+    let report_rect = rect(Color::rgb(50, 50, 60))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, _rsc: &mut Rsc| match ctx
+                .state
+                .android_state()
+                .frame_report
+                .report()
+            {
+                Some(stats) => log::info!("iris frame report: {stats}"),
+                None => log::info!(
+                    "iris frame report: no frames recorded -- scroll first, then press this"
+                ),
+            },
+        )
+        .label("Frame report");
+    let report = (
+        report_rect,
+        wtext("Frame report").size(18).text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(8)
+        .add(rsc);
+
+    let reset_rect = rect(Color::rgb(70, 40, 40))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, _rsc: &mut Rsc| {
+                ctx.state.android_state_mut().frame_report.reset();
+                log::info!("iris frame report: reset");
+            },
+        )
+        .label("Reset frame report");
+    let reset = (
+        reset_rect,
+        wtext("Reset").size(18).text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(8)
+        .add(rsc);
+
+    (report, reset).span(Dir::RIGHT).height(56).add(rsc)
+}
+
+impl AndroidAppState for TranscriptClient {
+    fn new(mut ui_state: AndroidUiState, rsc: &mut AndroidRsc<Self>) -> Self {
+        let content = WidgetPtr::new().add(rsc);
+        let loading = placeholder(rsc, "Loading sessions...");
+        content(rsc).set(loading);
+
+        let tree = (frame_report_controls(rsc), content.height(rest(1)))
+            .span(Dir::DOWN)
+            .add_strong(rsc)
+            .any();
+        ui_state.set_root(tree);
+
+        let mut client = Self {
+            ui_state,
+            content,
+            screen: None,
+            items: Vec::new(),
+            session_id: None,
+            generation: Arc::new(AtomicU64::new(0)),
+        };
+        client.spawn_fetch_sessions(rsc);
+        client
+    }
+
+    fn back_pressed(&mut self, _rsc: &mut AndroidRsc<Self>, _render: &mut UiRenderState) -> bool {
+        // No screen stack of its own -- same "let the activity finish"
+        // answer `iris-android-app`'s tabs `Client` already gives.
+        false
+    }
+}
+
+impl TranscriptClient {
+    fn show_message(&mut self, rsc: &mut AndroidRsc<Self>, message: &str) {
+        let widget = placeholder(rsc, message);
+        (self.content)(rsc).set(widget);
+        self.screen = None;
+    }
+
+    fn spawn_fetch_sessions(&mut self, rsc: &mut AndroidRsc<Self>) {
+        let redraw = rsc.tasks.redraw_handle();
+        let my_generation = self.generation.load(Ordering::SeqCst);
+        let generation = self.generation.clone();
+        rsc.spawn_task(async move |mut ctx| {
+            let outcome = match build_transport() {
+                Ok(transport) => ApiClient::new(transport)
+                    .fetch_sessions()
+                    .map_err(|e| e.to_string()),
+                Err(e) => Err(format!("couldn't set up TLS: {e}")),
+            };
+            ctx.update(move |state: &mut TranscriptClient, rsc| {
+                if generation.load(Ordering::SeqCst) != my_generation {
+                    return;
+                }
+                match outcome {
+                    Ok(sessions) => match sessions.into_iter().next() {
+                        Some(session) => state.select_session(rsc, session.id),
+                        None => state.show_message(rsc, "No sessions on the sandbox server."),
+                    },
+                    Err(message) => {
+                        state.show_message(rsc, &format!("Couldn't list sessions: {message}"))
+                    }
+                }
+            });
+            redraw.request_redraw();
+        });
+    }
+
+    /// Loads the opening page, then follows the live SSE stream for the
+    /// rest of this session's life -- `desktop-app`'s `select_session`
+    /// almost verbatim, with `Proxy::send_event` replaced by `ctx.update` +
+    /// `redraw.request_redraw()` (see this module's doc).
+    fn select_session(&mut self, rsc: &mut AndroidRsc<Self>, session_id: String) {
+        let my_generation = self.generation.fetch_add(1, Ordering::SeqCst) + 1;
+        self.items.clear();
+        self.session_id = Some(session_id.clone());
+        self.show_message(rsc, "Loading transcript...");
+
+        let redraw = rsc.tasks.redraw_handle();
+        let live_generation = self.generation.clone();
+        rsc.spawn_task(async move |mut ctx| {
+            let transports =
+                build_transport().and_then(|rest| build_transport().map(|stream| (rest, stream)));
+            let (rest, stream_transport) = match transports {
+                Ok(pair) => pair,
+                Err(e) => {
+                    let message = format!("couldn't set up TLS: {e}");
+                    ctx.update(move |state: &mut TranscriptClient, rsc| {
+                        if live_generation.load(Ordering::SeqCst) == my_generation {
+                            state.show_message(rsc, &message);
+                        }
+                    });
+                    redraw.request_redraw();
+                    return;
+                }
+            };
+            let api = ApiClient::new(rest);
+
+            // The most recent 200 events, coalesced -- the same page size
+            // `desktop-app` uses; RUST.md's I3/history-paging work is what
+            // a real scrollback would reuse (out of scope here, same as
+            // E4).
+            let page: Result<Vec<serde_json::Value>, String> = api
+                .fetch_transcript_page(&session_id, None, 200, true)
+                .map_err(|e| e.to_string());
+            // The wire `seq` of the last line, not a folded item's `seq()`
+            // -- see `client_core::transcript_fold::raw_seq`'s doc for why
+            // resuming from the latter re-delivers deltas already folded
+            // into an in-progress reply.
+            let after = page
+                .as_ref()
+                .ok()
+                .and_then(|values| values.last())
+                .and_then(client_core::transcript_fold::raw_seq)
+                .unwrap_or(0);
+            let result = page.and_then(|values| fold_page(&values));
+
+            {
+                let live_generation = live_generation.clone();
+                ctx.update(move |state: &mut TranscriptClient, rsc| {
+                    if live_generation.load(Ordering::SeqCst) != my_generation {
+                        return;
+                    }
+                    match result {
+                        Ok(items) => {
+                            state.items = items;
+                            state.rebuild_transcript(rsc);
+                        }
+                        Err(message) => {
+                            state.show_message(rsc, &format!("Couldn't load transcript: {message}"))
+                        }
+                    }
+                });
+            }
+            redraw.request_redraw();
+
+            if live_generation.load(Ordering::SeqCst) != my_generation {
+                return;
+            }
+            // The outer closure here is an `FnMut` -- `follow_session_events`
+            // calls it once per line -- so it captures `live_generation` by
+            // move and re-clones it for each inner `ctx.update` closure
+            // rather than moving a shared `stop`-style helper into itself:
+            // a value moved out of an `FnMut`'s captures on one call leaves
+            // nothing there for the next.
+            let _ =
+                follow_session_events(
+                    &stream_transport,
+                    &session_id,
+                    after,
+                    move |item| match item {
+                        StreamItem::Open | StreamItem::Reset => {
+                            live_generation.load(Ordering::SeqCst) == my_generation
+                        }
+                        StreamItem::Event { event, .. } => {
+                            if live_generation.load(Ordering::SeqCst) != my_generation {
+                                return false;
+                            }
+                            let live_generation = live_generation.clone();
+                            ctx.update(move |state: &mut TranscriptClient, rsc| {
+                                if live_generation.load(Ordering::SeqCst) != my_generation {
+                                    return;
+                                }
+                                state.apply_event(rsc, &event);
+                            });
+                            redraw.request_redraw();
+                            true
+                        }
+                    },
+                );
+        });
+    }
+
+    /// Rebuilds the whole widget tree from `self.items` -- same tradeoff as
+    /// `desktop-app`'s `rebuild_transcript` (this module's doc comment).
+    /// Reads `self.session_id` rather than taking one, since every caller
+    /// (the opening page, and every live event) already has it set there.
+    fn rebuild_transcript(&mut self, rsc: &mut AndroidRsc<Self>) {
+        let in_progress = self
+            .screen
+            .as_ref()
+            .map(|screen| screen.composer.field.edit(rsc).text.text().to_string())
+            .filter(|t| !t.is_empty());
+
+        let rows = group_tool_runs(&self.items);
+        let (screen, tree) = transcript_ui::build_tree(rsc, rows);
+
+        if let Some(text) = in_progress {
+            screen.composer.field.edit(rsc).set(&text);
+        }
+        if let Some(session_id) = self.session_id.clone() {
+            let field = screen.composer.field;
+            rsc.register_event(field, Submit, move |ctx, rsc| {
+                let text = field.edit(rsc).take();
+                let text = text.trim().to_string();
+                if !text.is_empty() {
+                    ctx.state.send_message(session_id.clone(), text);
+                }
+            });
+        }
+
+        (self.content)(rsc).set(tree);
+        self.screen = Some(screen);
+    }
+
+    fn apply_event(&mut self, rsc: &mut AndroidRsc<Self>, event: &SeqEvent) {
+        self.items = fold_event(&self.items, event);
+        self.rebuild_transcript(rsc);
+    }
+
+    fn send_message(&mut self, session_id: String, text: String) {
+        std::thread::spawn(move || {
+            if let Ok(transport) = build_transport() {
+                let api = ApiClient::new(transport);
+                let _ = api.send_message(&session_id, &text, &[]);
+            }
+        });
+    }
+}
@@ -0,0 +1,299 @@
+use std::time::Duration;
+
+/// The frame budget `dumpsys gfxinfo` also uses to call a frame "janky": the
+/// 60Hz vsync period. Kept as the same threshold so a percentage from this
+/// report and a percentage from `gfxinfo` mean the same thing.
+pub const JANK_THRESHOLD: Duration = Duration::from_nanos(16_666_667);
+
+/// Enough frames for several minutes of scrolling before the oldest ones
+/// start being overwritten -- the same "diagnostic, not a log" sizing
+/// `FrameStats.kt`'s `CAP` uses on the Compose side, chosen independently
+/// here since a `Duration` is smaller than the six `Long` arrays it keeps.
+const RING_CAPACITY: usize = 4096;
+
+/// A per-frame wall-time report iris keeps of itself, because `dumpsys
+/// gfxinfo` cannot see a `SurfaceView`'s own GPU-drawn frames at all
+/// (RUST.md's I5 box, "Measurements taken" (b)): it instruments Android's
+/// ordinary Skia/HWUI View-drawing pipeline, which a `wgpu`-rendered
+/// `SurfaceView` bypasses entirely. `record` is meant to be called once per
+/// frame, wrapping the same span Compose's own render report and `gfxinfo`
+/// count -- from the frame's redraw/update start to after the frame is
+/// handed to the platform to present.
+///
+/// **What this does not measure**: wgpu's `present()` call queues the frame
+/// with the compositor and returns; it is not fenced against the GPU
+/// actually finishing the frame or the compositor actually showing it, the
+/// way `gfxinfo`'s own `GPU_DURATION`/vsync accounting is. So a sample here
+/// is "how long the CPU took to build and submit this frame", not
+/// "how long the frame took to reach the screen" -- named in
+/// [`FrameStats`]'s own `Display` line rather than presented as the latter,
+/// per the standing rule against showing an inferred number as a measured
+/// one where the two differ.
+///
+/// Fixed-size ring, no allocation on the hot path -- `report()` is the only
+/// place that allocates (a sort over the current ring), and it is only
+/// ever called from a button tap, not once per frame.
+pub struct FrameReport {
+    ring: Box<[Duration; RING_CAPACITY]>,
+    /// The `submit_to_present` half of each sample in `ring`, same index,
+    /// same lifetime -- kept as a second ring rather than a ring of pairs so
+    /// the existing `ring`/percentile code above is untouched (RUST.md's I5
+    /// "Where iris's frame time goes" CPU/GPU split, added 2026-09-05).
+    /// `ring[i] - submit_ring[i]` is that frame's `redraw_to_submit` half.
+    submit_ring: Box<[Duration; RING_CAPACITY]>,
+    /// How many of `ring`'s slots hold a real sample -- saturates at
+    /// `RING_CAPACITY`, unlike `total_frames` below which keeps counting.
+    len: usize,
+    pos: usize,
+    /// All frames recorded since the last `reset`, even past `RING_CAPACITY`
+    /// -- what `janky_percent` divides by, so a long run's percentage stays
+    /// correct even once the ring itself only holds the most recent frames.
+    total_frames: u64,
+    janky_frames: u64,
+}
+
+/// One resolved reading. `Display` is the log line both the "Frame report"
+/// button and `transcript-bench.sh`-style scripts read, grep-able on
+/// `"iris frame report"`.
+pub struct FrameStats {
+    pub total_frames: u64,
+    pub janky_percent: f64,
+    pub p50: Duration,
+    pub p90: Duration,
+    pub p99: Duration,
+    pub worst: Duration,
+    /// Median of `redraw_to_submit` -- iris's own CPU work (layout, text,
+    /// primitive building) up to and including building the `queue.submit`
+    /// call, per frame. RUST.md's I5 "Where iris's frame time goes" split,
+    /// added 2026-09-05 to answer "CPU or GPU?" with a number rather than a
+    /// guess.
+    pub cpu_p50: Duration,
+    /// Median of `submit_to_present` -- the `queue.submit` call itself plus
+    /// `present()`, i.e. wherever the driver/GPU/compositor wait actually
+    /// happens. Same caveat as the type's own doc: `present()` is not
+    /// fenced against the GPU actually finishing, so this is "how long the
+    /// CPU was blocked handing the frame off", not the frame's true GPU
+    /// time -- still enough to separate "iris is slow building the frame"
+    /// from "iris is slow handing it to the driver".
+    pub gpu_wait_p50: Duration,
+}
+
+impl std::fmt::Display for FrameStats {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "frames={} janky%={:.2} p50={:.1}ms p90={:.1}ms p99={:.1}ms worst={:.1}ms \
+             (measures redraw-start to after present() is called, not GPU/compositor \
+             completion)",
+            self.total_frames,
+            self.janky_percent,
+            self.p50.as_secs_f64() * 1000.0,
+            self.p90.as_secs_f64() * 1000.0,
+            self.p99.as_secs_f64() * 1000.0,
+            self.worst.as_secs_f64() * 1000.0,
+        )?;
+        write!(
+            f,
+            " cpu_p50={:.1}ms gpu_wait_p50={:.1}ms (redraw-start-to-submit vs. \
+             submit-to-after-present)",
+            self.cpu_p50.as_secs_f64() * 1000.0,
+            self.gpu_wait_p50.as_secs_f64() * 1000.0,
+        )
+    }
+}
+
+impl FrameReport {
+    pub fn new() -> Self {
+        Self {
+            ring: Box::new([Duration::ZERO; RING_CAPACITY]),
+            submit_ring: Box::new([Duration::ZERO; RING_CAPACITY]),
+            len: 0,
+            pos: 0,
+            total_frames: 0,
+            janky_frames: 0,
+        }
+    }
+
+    /// Record one frame's elapsed wall time, with no CPU/GPU split (the
+    /// `submit_to_present` half is recorded as zero, so `cpu_p50` reads as
+    /// the whole frame and `gpu_wait_p50` as nothing -- honest for a caller
+    /// that never measured the split, rather than fabricating one). O(1),
+    /// no allocation.
+    pub fn record(&mut self, elapsed: Duration) {
+        self.record_split(elapsed, Duration::ZERO);
+    }
+
+    /// Record one frame's elapsed wall time, split at `queue.submit`:
+    /// `submit_to_present` is the `queue.submit()` call plus `present()`;
+    /// `total - submit_to_present` is everything before it (layout, text,
+    /// primitive building). RUST.md's I5 "Where iris's frame time goes"
+    /// CPU/GPU split, added 2026-09-05. O(1), no allocation.
+    pub fn record_split(&mut self, total: Duration, submit_to_present: Duration) {
+        self.ring[self.pos] = total;
+        self.submit_ring[self.pos] = submit_to_present;
+        self.pos = (self.pos + 1) % RING_CAPACITY;
+        self.len = (self.len + 1).min(RING_CAPACITY);
+        self.total_frames += 1;
+        if total > JANK_THRESHOLD {
+            self.janky_frames += 1;
+        }
+    }
+
+    /// Clears every counter and every sample -- what the "Reset frame
+    /// report" control calls, so a report covers only what was scrolled
+    /// after the button was pressed (the same reason `FrameStats.kt`'s
+    /// `reset()` exists on the Compose side).
+    pub fn reset(&mut self) {
+        self.len = 0;
+        self.pos = 0;
+        self.total_frames = 0;
+        self.janky_frames = 0;
+    }
+
+    /// `None` if nothing has been recorded since the last reset -- the
+    /// "no frames recorded, scroll first" case, not a zeroed report that
+    /// would read as a real (perfect) measurement.
+    pub fn report(&self) -> Option<FrameStats> {
+        if self.len == 0 {
+            return None;
+        }
+        let mut samples: Vec<Duration> = self.ring[..self.len].to_vec();
+        samples.sort_unstable();
+        let pct = |p: usize| samples[(samples.len() * p / 100).min(samples.len() - 1)];
+
+        // Separate arrays rather than subtracting the two medians above:
+        // medians do not distribute over subtraction, and each needs its
+        // own sort.
+        let submit_samples: Vec<Duration> = self.submit_ring[..self.len].to_vec();
+        let cpu_samples: Vec<Duration> = self.ring[..self.len]
+            .iter()
+            .zip(self.submit_ring[..self.len].iter())
+            .map(|(&total, &submit_to_present)| total.saturating_sub(submit_to_present))
+            .collect();
+        let median = |mut v: Vec<Duration>| {
+            v.sort_unstable();
+            v[v.len() / 2]
+        };
+
+        Some(FrameStats {
+            total_frames: self.total_frames,
+            janky_percent: 100.0 * self.janky_frames as f64 / self.total_frames as f64,
+            p50: pct(50),
+            p90: pct(90),
+            p99: pct(99),
+            worst: *samples.last().expect("len > 0 checked above"),
+            cpu_p50: median(cpu_samples),
+            gpu_wait_p50: median(submit_samples),
+        })
+    }
+}
+
+impl Default for FrameReport {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn no_frames_reports_none() {
+        assert!(FrameReport::new().report().is_none());
+    }
+
+    #[test]
+    fn one_frame_is_every_percentile_and_the_worst() {
+        let mut r = FrameReport::new();
+        r.record(Duration::from_millis(10));
+        let stats = r.report().unwrap();
+        assert_eq!(stats.total_frames, 1);
+        assert_eq!(stats.p50, Duration::from_millis(10));
+        assert_eq!(stats.p99, Duration::from_millis(10));
+        assert_eq!(stats.worst, Duration::from_millis(10));
+        assert_eq!(stats.janky_percent, 0.0);
+    }
+
+    #[test]
+    fn percentiles_and_worst_over_a_known_set() {
+        let mut r = FrameReport::new();
+        // 100 samples, 1ms..=100ms, fed out of order so the ring's own
+        // order is not what gives the right answer -- the sort has to.
+        for ms in (1..=100).rev() {
+            r.record(Duration::from_millis(ms));
+        }
+        let stats = r.report().unwrap();
+        assert_eq!(stats.total_frames, 100);
+        assert_eq!(stats.p50, Duration::from_millis(51));
+        assert_eq!(stats.p90, Duration::from_millis(91));
+        assert_eq!(stats.p99, Duration::from_millis(100));
+        assert_eq!(stats.worst, Duration::from_millis(100));
+    }
+
+    #[test]
+    fn jank_threshold_matches_gfxinfos_60hz_budget() {
+        let mut r = FrameReport::new();
+        r.record(Duration::from_nanos(16_666_667)); // exactly on budget: not janky
+        r.record(Duration::from_nanos(16_666_668)); // one ns over: janky
+        let stats = r.report().unwrap();
+        assert_eq!(stats.janky_percent, 50.0);
+    }
+
+    #[test]
+    fn janky_percent_is_over_all_time_frames_not_just_the_ring() {
+        // Fewer than RING_CAPACITY frames, all janky, then a fresh reset --
+        // the percentage must reset to 0, not divide by a stale count.
+        let mut r = FrameReport::new();
+        for _ in 0..10 {
+            r.record(Duration::from_millis(50));
+        }
+        assert_eq!(r.report().unwrap().janky_percent, 100.0);
+        r.reset();
+        assert!(r.report().is_none());
+        r.record(Duration::from_millis(1));
+        assert_eq!(r.report().unwrap().janky_percent, 0.0);
+    }
+
+    #[test]
+    fn record_without_a_split_reports_the_whole_frame_as_cpu() {
+        // A caller that never measured the split (plain `record`) should
+        // not fabricate a GPU-wait number -- it reads as zero, and the CPU
+        // half reads as the whole frame.
+        let mut r = FrameReport::new();
+        r.record(Duration::from_millis(20));
+        let stats = r.report().unwrap();
+        assert_eq!(stats.cpu_p50, Duration::from_millis(20));
+        assert_eq!(stats.gpu_wait_p50, Duration::ZERO);
+    }
+
+    #[test]
+    fn record_split_reports_each_halfs_own_median() {
+        let mut r = FrameReport::new();
+        // Three frames: total is always 30ms, but the CPU/GPU-wait split
+        // moves, so the two medians must be independent of each other and
+        // of `total`'s own median.
+        r.record_split(Duration::from_millis(30), Duration::from_millis(5));
+        r.record_split(Duration::from_millis(30), Duration::from_millis(10));
+        r.record_split(Duration::from_millis(30), Duration::from_millis(20));
+        let stats = r.report().unwrap();
+        assert_eq!(stats.p50, Duration::from_millis(30));
+        assert_eq!(stats.gpu_wait_p50, Duration::from_millis(10));
+        assert_eq!(stats.cpu_p50, Duration::from_millis(20));
+    }
+
+    #[test]
+    fn ring_wraps_without_growing_past_capacity() {
+        let mut r = FrameReport::new();
+        for i in 0..(RING_CAPACITY * 2) {
+            r.record(Duration::from_millis(1 + (i % 5) as u64));
+        }
+        let stats = r.report().unwrap();
+        // total_frames keeps the full count even once the ring has wrapped.
+        assert_eq!(stats.total_frames, (RING_CAPACITY * 2) as u64);
+        // but every sample the ring can report on is still one of the five
+        // values fed in, since a wrap can only overwrite with more of the
+        // same pattern here.
+        assert!(stats.worst <= Duration::from_millis(5));
+    }
+}
@@ -11,12 +11,14 @@ use wgpu::{

 mod atlas;
 mod data;
+mod frame_report;
 mod primitive;
 mod texture;
 mod util;

 pub use atlas::*;
 pub use data::{Mask, MaskIdx, MoveIdx, MoveOffset};
+pub use frame_report::{FrameReport, FrameStats, JANK_THRESHOLD};
 pub use primitive::*;

 const SHAPE_SHADER: &str = include_str!("./shader.wgsl");
@@ -45,7 +45,9 @@

 use client_core::api::{ApiClient, SessionSummary, UreqTransport};
 use client_core::event_stream::{StreamItem, follow_session_events};
-use client_core::transcript_fold::{TranscriptItem, fold_event, group_tool_runs};
+use client_core::transcript_fold::{
+    TranscriptItem, fold_event, fold_page, group_tool_runs, raw_seq,
+};
 use event_model::SeqEvent;
 use iris::prelude::*;
 use std::sync::Arc;
@@ -421,118 +423,3 @@ fn placeholder(rsc: &mut DefaultRsc<Client>, message: &str) -> StrongWidget {
        .add_strong(rsc)
        .any()
 }
-
-/// Folds a page of raw transcript lines (`ApiClient::fetch_transcript_page`'s
-/// `Vec<Value>`) into the flat item list `client_core::transcript_fold`
-/// works over. A line this build can't parse fails the whole page rather
-/// than being skipped -- CODE_RULES's "an enumeration must be able to say
-/// 'it broke'" -- since silently dropping one event could hide, say, the
-/// user message the composer is about to look like it never sent.
-fn fold_page(values: &[serde_json::Value]) -> Result<Vec<TranscriptItem>, String> {
-    let mut items = Vec::new();
-    for value in values {
-        let event: SeqEvent = serde_json::from_value(value.clone()).map_err(|e| {
-            format!("the server sent a transcript line this build couldn't parse: {e}")
-        })?;
-        items = fold_event(&items, &event);
-    }
-    Ok(items)
-}
-
-/// The wire `seq` a raw transcript line carries -- see `select_session`'s
-/// comment on why the live-stream cursor has to be this, not a folded
-/// item's `seq()`.
-fn raw_seq(value: &serde_json::Value) -> Option<u64> {
-    value.get("seq")?.as_u64()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn line(seq: u64, json: serde_json::Value) -> serde_json::Value {
-        let mut obj = json;
-        obj["seq"] = serde_json::json!(seq);
-        obj["ts"] = serde_json::json!(1.0);
-        obj
-    }
-
-    /// The regression for the bug a real `run-headless.sh` screenshot
-    /// found (see `select_session`'s comment): resuming the live stream
-    /// from the last *item's* seq re-delivers the deltas already folded
-    /// into a still-open assistant message, doubling its tail. `raw_seq`
-    /// of the last wire line must be the true high-water mark instead,
-    /// which for a run of deltas is higher than every item's own `seq()`.
-    #[test]
-    fn the_resume_cursor_is_the_last_wire_seq_not_the_last_items_seq() {
-        let values = vec![
-            line(1, serde_json::json!({"type": "userMessage", "text": "hi"})),
-            line(
-                2,
-                serde_json::json!({"type": "assistantText", "delta": "a"}),
-            ),
-            line(
-                3,
-                serde_json::json!({"type": "assistantText", "delta": "b"}),
-            ),
-            line(
-                4,
-                serde_json::json!({"type": "assistantText", "delta": "c"}),
-            ),
-        ];
-        let after = raw_seq(values.last().unwrap()).unwrap();
-        assert_eq!(after, 4);
-
-        let items = fold_page(&values).unwrap();
-        // The folded item keeps the *first* delta's seq (2), which is
-        // exactly the value that must not be used as the resume cursor.
-        let assistant_seq = items
-            .iter()
-            .find(|i| matches!(i, TranscriptItem::AssistantMsg { .. }))
-            .unwrap()
-            .seq();
-        assert_eq!(assistant_seq, 2);
-        assert_ne!(
-            after, assistant_seq,
-            "the fixed bug: these must differ here"
-        );
-    }
-
-    #[test]
-    fn a_page_folds_into_one_settled_assistant_message() {
-        let values = vec![
-            line(1, serde_json::json!({"type": "userMessage", "text": "hi"})),
-            line(
-                2,
-                serde_json::json!({"type": "assistantText", "delta": "hel"}),
-            ),
-            line(
-                3,
-                serde_json::json!({"type": "assistantText", "delta": "lo"}),
-            ),
-        ];
-        let items = fold_page(&values).unwrap();
-        assert_eq!(
-            items,
-            vec![
-                TranscriptItem::UserMsg {
-                    seq: 1,
-                    text: "hi".to_string(),
-                    attachments: Vec::new(),
-                },
-                TranscriptItem::AssistantMsg {
-                    seq: 2,
-                    text: "hello".to_string(),
-                    settled: false,
-                },
-            ]
-        );
-    }
-
-    #[test]
-    fn an_unparseable_line_fails_the_whole_page() {
-        let values = vec![serde_json::json!({"seq": 1, "ts": 1.0, "type": "not-a-real-type"})];
-        let err = fold_page(&values).unwrap_err();
-        assert!(err.contains("couldn't parse"));
-    }
-}
@@ -6,6 +6,7 @@ use android_view::{
 };
 use iris_core::{UiData, UiRenderNode, UiRenderState};
 use pollster::FutureExt;
+use std::time::{Duration, Instant};
 use wgpu::{
    rwh::{DisplayHandle, HandleError, HasDisplayHandle, HasWindowHandle, WindowHandle},
    *,
@@ -51,8 +52,19 @@ pub struct AndroidRenderer {

 impl AndroidRenderer {
    pub fn new(window: NativeWindow, width: u32, height: u32) -> Self {
+        // `force-gles` (RUST.md's I5 "Where iris's frame time goes") swaps
+        // the software-Vulkan (SwiftShader) path for GLES/virgl on the same
+        // build, to isolate whether the backend itself explains the frame
+        // time gap against Compose. `cfg!` rather than a runtime switch:
+        // there is no way to hand an env var to an already-launched Android
+        // process on this machine (see the feature's doc in Cargo.toml).
+        let backends = if cfg!(feature = "force-gles") {
+            Backends::GL
+        } else {
+            Backends::PRIMARY
+        };
        let instance = Instance::new(&InstanceDescriptor {
-            backends: Backends::PRIMARY,
+            backends,
            ..Default::default()
        });

@@ -128,7 +140,18 @@ impl AndroidRenderer {
        self.ui.update(&self.device, &self.queue, ui, render);
    }

-    pub fn draw(&mut self) {
+    /// Draws and presents one frame, returning the time spent in
+    /// `queue.submit` plus `present()` -- wherever a driver/GPU/compositor
+    /// wait would actually show up. The caller (`android::view::render`)
+    /// already times the whole frame from its own `redraw_to_submit` start;
+    /// subtracting this from that total is `redraw_to_submit` itself
+    /// (layout, text, primitive building, and this method's own render-pass
+    /// recording). RUST.md's I5 "Where iris's frame time goes" diagnosis,
+    /// added 2026-09-05 -- see `iris_core::FrameReport::record_split`'s own
+    /// doc for the caveat this shares: `present()` is not fenced against
+    /// the GPU actually finishing, so this is "how long the CPU was blocked
+    /// handing the frame off", not confirmed GPU time.
+    pub fn draw(&mut self) -> Duration {
        let output = self.surface.get_current_texture().unwrap();
        let view = output
            .texture
@@ -151,8 +174,10 @@ impl AndroidRenderer {
            self.ui.draw(render_pass);
        }

+        let submit_start = Instant::now();
        self.queue.submit(std::iter::once(encoder.finish()));
        output.present();
+        submit_start.elapsed()
    }

    pub fn size(&self) -> iris_core::util::Vec2 {
@@ -169,9 +194,22 @@ impl AndroidRenderer {

 /// `Tasks`' redraw handle on Android: a background task finishes on the
 /// tokio thread `Tasks::init` spawned, which is not attached to the JVM, so
-/// asking for a frame means attaching first. `post_frame_callback` needs a
-/// live `View` reference; the global ref is what survives past the JNI call
-/// that handed it to us.
+/// asking for a frame means attaching first. The global ref is what
+/// survives past the JNI call that handed the `View` to us.
+///
+/// **Goes through `View::post_delayed`, not `post_frame_callback`
+/// directly** -- found the hard way (RUST.md's I5 Android integration):
+/// `post_frame_callback`'s Java side calls `Choreographer.getInstance()`,
+/// which throws `IllegalStateException` unless the *calling* thread already
+/// has a `Looper` (`Choreographer.getInstance()`'s own contract). A tokio
+/// worker thread, even freshly attached to the JVM, has none -- the crash
+/// was a `JavaException` inside `View::post_frame_callback`'s `.unwrap()`,
+/// aborting the process on the second `redraw.request_redraw()` any
+/// android transcript-screen fetch made. `View.postDelayed(Runnable, 0)`
+/// is the ordinary Android answer to "queue work onto a View's own UI
+/// thread from any thread" and needs no Looper of its own; `delayed_callback`
+/// below is what that Runnable resolves to on the UI thread, where a real
+/// `post_frame_callback` is safe again.
 pub struct AndroidRedrawHandle {
    vm: JavaVM,
    view: GlobalRef,
@@ -189,6 +227,6 @@ impl RequestRedraw for AndroidRedrawHandle {
            return;
        };
        let local = env.new_local_ref(&self.view).unwrap();
-        View(local).post_frame_callback(&mut env);
+        View(local).post_delayed(&mut env, 0);
    }
 }
@@ -57,6 +57,11 @@ pub struct AndroidUiState {
    /// The AccessKit tree itself -- see `iris_core::AccessTree`'s doc
    /// comment.
    pub access: AccessTree,
+    /// iris's own frame-time report (RUST.md's I5 box, "Measurements
+    /// taken" (b)) -- `render()` below records into it once per frame,
+    /// because `dumpsys gfxinfo` cannot see a `SurfaceView`'s own
+    /// GPU-drawn frames at all. See `iris_core::FrameReport`'s own doc.
+    pub frame_report: FrameReport,
 }

 impl AndroidUiState {
@@ -72,6 +77,7 @@ impl AndroidUiState {
            shared,
            access_adapter: Default::default(),
            access: AccessTree::new(),
+            frame_report: FrameReport::new(),
        }
    }

@@ -262,6 +268,13 @@ impl<State: AndroidAppState> IrisViewPeer<State> {
                .and_then(|r| self.render.window_region(r, &self.rsc)),
            self.window_size(),
        );
+        // iris's own frame-time report (RUST.md's I5 box, "Measurements
+        // taken" (b)): started here, at the same point a redraw request
+        // fires, and stopped after `renderer.draw()`'s `queue.submit` +
+        // `present()` -- the span Compose's render report and `gfxinfo`
+        // both count. See `iris_core::FrameReport`'s own doc for exactly
+        // what this does and does not measure.
+        let frame_start = Instant::now();
        let ui_state = self.state.android_state_mut();
        self.render.update(&ui_state.root, &mut self.rsc);
        let ui_state = self.state.android_state_mut();
@@ -269,7 +282,11 @@ impl<State: AndroidAppState> IrisViewPeer<State> {
            return;
        };
        renderer.update(&mut self.rsc.ui, &mut self.render);
-        renderer.draw();
+        let submit_to_present = renderer.draw();
+        self.state
+            .android_state_mut()
+            .frame_report
+            .record_split(frame_start.elapsed(), submit_to_present);
        let ui_state = self.state.android_state();
        log::debug!(
            "render(): after update active={} root_px={:?}",
@@ -432,6 +449,20 @@ impl<State: AndroidAppState> ViewPeer for IrisViewPeer<State> {
        self.render(ctx);
    }

+    /// Where `AndroidRedrawHandle::request_redraw` (`android/render.rs`)
+    /// actually lands: `View.postDelayed`'s Runnable resolves to this, on
+    /// the UI thread, which is what makes it safe to call from a background
+    /// task's own thread when `post_frame_callback`'s `Choreographer`
+    /// requirement (a `Looper` on the *calling* thread) is not. Same body
+    /// as `do_frame` -- draining tasks and rendering immediately is a
+    /// perfectly good answer to "a background fetch has new state," and
+    /// avoids a second frame-scheduling path to keep in sync with the real
+    /// one.
+    fn delayed_callback(&mut self, ctx: &mut CallbackCtx) {
+        self.drain_tasks();
+        self.render(ctx);
+    }
+
    fn as_input_connection(&mut self) -> Option<&mut dyn InputConnection> {
        Some(self)
    }
@@ -72,6 +72,18 @@ impl<Rsc: HasState> Tasks<Rsc> {
        )
    }

+    /// The same redraw handle `spawn`'s wrapper calls once, after a whole
+    /// task's future completes -- exposed so a caller running its own
+    /// longer-lived loop *inside* a spawned task (a live SSE follow, here)
+    /// can ask for a frame after each `TaskCtx::update`, not just at the
+    /// end. Without this a caller has no way to get a redraw mid-stream,
+    /// which is exactly the gap `iris/desktop-app`'s `app.rs` module doc
+    /// names for why it uses winit's `Proxy` instead of `Tasks` -- Android
+    /// has no `Proxy`, so this is what closes the same gap there.
+    pub fn redraw_handle(&self) -> Arc<dyn RequestRedraw> {
+        self.redraw.clone()
+    }
+
    pub fn spawn<F: AsyncFnOnce(TaskCtx<Rsc>) + 'static + std::marker::Send>(&mut self, task: F)
    where
        F::CallOnceFuture: Send,
@@ -18,3 +18,9 @@ iris = { path = ".." }
 client-core = { path = "../../client-core" }
 event-model = { path = "../../event-model" }
 pulldown-cmark = { workspace = true }
+# Selection has no accessibility label of its own yet (IRIS_TODO.md's
+# "Row-level accessibility names"), so a logcat line at
+# begin/extend is the smallest way to confirm a real long-press-then-drag
+# reached `Selection` on-device (RUST.md's I5 box, "Measurements taken"
+# (c)) -- version pinned to match `iris-android-app`'s own dependency.
+log = "0.4.28"
@@ -189,8 +189,19 @@ impl Selection {
        match outcome {
            DragOutcome::Undecided => {}
            DragOutcome::Pan(dy) => list(ui).scroll(-dy),
-            DragOutcome::SelectStart => self.begin(ui, key, pos_row, size),
-            DragOutcome::SelectExtend => self.extend(ui, key, pos_row, size),
+            DragOutcome::SelectStart => {
+                // Grep-able on "iris selection" the way the frame report is
+                // on "iris frame report" -- selection has no accessibility
+                // label of its own yet, so this is the smallest way to
+                // confirm a real on-device long-press-then-drag actually
+                // reached here (RUST.md's I5 box, "Measurements taken" (c)).
+                log::info!("iris selection: begin at row {key:?}");
+                self.begin(ui, key, pos_row, size);
+            }
+            DragOutcome::SelectExtend => {
+                log::info!("iris selection: extend to row {key:?}");
+                self.extend(ui, key, pos_row, size);
+            }
        }
    }
Author	SHA1	Message	Date
irisandClaude Fable 5.1	bfe93c4188	RUST.md, DECISIONS.md: P0, the phone benchmark gate Iris asked for before P1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 20:31:20 -04:00
irisandClaude Fable 5.1	5b7dc0e4e2	RUST.md, DECISIONS.md, IRIS_TODO.md: the port plan, P1-P7, after iris-over-Masonry Adds "The port, in order (decided 2026-09-05)" to RUST.md: seven ordered steps building the app on iris now that the framework is decided, each naming the Kotlin files it replaces, the client-core pieces it needs (and which are not yet covered and must be ported first), the missing iris widgets it needs (recorded in IRIS_TODO.md's new "Build (for the port)" section), and a pass condition a later agent can run. Ordered by risk to the daily-use path: session screen parity, then the shell merge and a real phone install, then root tabs, the file explorer, settings/enrolment, desktop parity, and the cutover itself. Crate-shape decision recorded in DECISIONS.md: one UI crate, app-ui, grown out of transcript-ui rather than started beside it, with desktop-app/android-app as thin entry points over it and platform-only code staying in the E3/E5 Java shell. Updates RUST.md's "Where things stand" and "For the next agent" to point at P1 rather than the now-closed framework decision. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 20:30:02 -04:00
irisandClaude Fable 5.1	621f08d725	DECISIONS.md, RUST.md: Iris decided iris over Masonry, 2026-09-05 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 20:25:43 -04:00
irisandClaude Fable 5.1	e49d0e606f	RUST.md, DECISIONS.md, IRIS.md: iris's host-GPU frame time, 2026-09-05 Takes the -gpu host pair the earlier software-mode comparison flagged as missing. Under real GPU rendering (--features force-gles: the default Vulkan backend has no adapter at all under plain host-GPU boot, confirmed by the exact wgpu error), iris's median frame (15.0ms) is faster than Compose's (20.0ms) on the same session content -- the opposite shape from the software-mode table. The new redraw-to-submit/submit-to-present split shows iris's own CPU work is a median 0.2ms per frame; almost the whole frame is time handing off to the driver, consistent with (but not proof of) the software-mode gap being mostly SwiftShader's CPU rasterisation cost rather than iris-specific slowness. A same-mode software force-gles run, meant to isolate the backend, hit a third distinct crash instead (SwiftShader's GL path reports itself as OpenGL ES 3.0, which has no compute shaders, and iris's device request assumes them unconditionally) -- real scope to fix, not done here, so the software-mode question stays open. A real intermittent touch-scroll dropout was also reproduced (six consecutive swipes produced zero redraws while taps kept working; an identical retry then succeeded) and is not explained. The idle-redraw and virtualised-culling findings from the software-mode pass were confirmed to hold under real GPU rendering too. DECISIONS.md's DEFERRED item carries the updated table; the iris-vs- Masonry choice itself is still Iris's to make. IRIS.md records the FrameReport::record_split/FrameStats::cpu_p50/gpu_wait_p50 API from the prior commit (`e2a1fad`), which this pass's measurement used. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 20:07:20 -04:00
irisandClaude Fable 5.1	e2a1fadbec	iris: FrameReport CPU/GPU split, force-gles backend switch, iris-scroll.sh rig Splits each frame sample at queue.submit into redraw-to-submit (iris's own CPU work) and submit-to-after-present (driver/GPU wait), so RUST.md's I5 "where does iris's frame time go" question can be answered with a number per half instead of a single total. Adds a force-gles Cargo feature that switches the Android wgpu::Instance from Backends::PRIMARY to Backends::GL at compile time (no runtime env-var path exists into an already-launched Android process on this machine), for isolating SwiftShader-Vulkan vs. GLES/virgl as the software-mode gap's cause. app/iris-scroll.sh extracts transcript-bench.sh's exact 24-swipe/6-cycle gesture loop for iris's own demo app, which transcript-bench.sh cannot drive directly since it opens a session through the Compose app's own UI. Verification (this pass, on a disk-pressure-limited host running low on space): cargo fmt --all clean, no diff. cargo clippy --workspace --all-targets: no warnings from this diff (pre-existing future-incompat notices from wgpu/winit/naga only). cargo test --workspace and cargo ndk for iris-android-app --features transcript-screen were verified clean by the previous pass on this identical diff (fmt/clippy/test/ndk all clean, per that pass's own report); not re-run here because the host's disk was 93% full and a concurrent ai-server rebuild (stable toolchain moved to 1.98.1, rebuilding aws-lc-sys from scratch) had driven I/O pressure to ~60%, so a repeat cargo test --workspace sat 50+ minutes doing no useful work and was stopped rather than left to make the disk situation worse. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 18:47:01 -04:00
irisandClaude Fable 5.1	0e4629361b	docs: I5's clean scroll comparison between Compose and iris, one session Same sandbox session content, same emulator, EMU_GPU=software: Compose (debug, in-app report) 1102 frames/99.0% late/p50 33.8ms/p99 79.5ms vs iris (release -- debug SIGSEGVs on this emulator) FrameReport 299 frames/94.65% janky/p50 79.1ms/p99 117.8ms (repeat: 233/94.42%/p50 109.3ms). Ticks I5 [x]; states plainly what's not comparable (build profile forced asymmetric, three different jank definitions, both are software-rasterised emulator numbers). The two "zero frames" attempts that preceded the clean runs traced to this session's own script bug (a cd into /tmp changed which emulator ui-trace targeted), not a reproduction of the previously-suspected touch-delivery dropout; a sampler ran the whole session and saw load rise during the gesture without correlating to any failure. DECISIONS.md's DEFERRED item gets the same table so Iris can decide iris-vs-Masonry from it -- that choice is left to her. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 15:21:45 -04:00
irisandClaude Fable 5.1	1e7b1cddb7	RUST.md, IRIS.md, IRIS_TODO.md, DECISIONS.md: record I5's frame report and holddrag results FrameReport gave a real, measured on-device number (frames=34, janky%=61.76, p50=26.5ms p90=48.0ms p99=98.1ms worst=98.1ms) and long-press-then-drag-to-select is now confirmed on-device (logcat plus a screenshot of the highlighted selection). Neither closes I5's box to [x] yet: the frame number is real but not the clean single 24-swipe loop comparable to Compose's, because gestures against this checkout's EMU_GPU=software emulator intermittently delivered zero touch input this session -- a new, separately named finding (candidate cause: the emulator's own software rasterisation measured at ~78% of a CPU core continuously), not yet root-caused. DECISIONS.md's DEFERRED item is updated with these numbers rather than a decision made here. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 15:00:29 -04:00
irisandClaude Fable 5.1	470f8e5019	transcript-ui: log selection begin/extend, for on-device verification Selection has no accessibility label of its own yet, so a logcat line at begin/extend is the smallest way to confirm a real long-press-then-drag reached DragArbiter/Selection on-device. Driven with the new ui-trace holddrag action against iris-android-app's transcript screen: produced "iris selection: begin at row ..." then a sequence of "... extend to row ..." lines, and a screenshot right after shows the expected highlighted selection spanning multiple rows. New `log = "0.4.28"` dependency (matching iris-android-app's own pin) -- transcript-ui had no logging facility before this. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 15:00:18 -04:00
irisandClaude Fable 5.1	7ae53ad797	iris: FrameReport, a per-frame wall-time report of iris's own render path dumpsys gfxinfo cannot see a SurfaceView's own GPU-drawn frames at all (RUST.md's I5 box), so iris needs its own equivalent of Compose's render-report button before item 3 of the recommendation can be decided by a number. FrameReport (iris/core/src/render/frame_report.rs) records each frame's wall time -- from render()'s redraw start to after queue.submit + present() -- into a fixed 4096-entry ring, and reports total frames, janky % (>16.7ms, gfxinfo's own budget), P50/P90/P99 and the worst. Wired into AndroidUiState and android/view.rs's render(), and exposed as two named controls ("Frame report", "Reset frame report") on iris-android-app's transcript screen, logged under the crate's fixed tag so a script can grep "iris frame report" the way transcript-bench.sh greps "ai-app render report". 6 new unit tests for the ring/percentile math. cargo fmt/clippy/test --workspace clean; cargo ndk (iris, transcript-ui, and iris-android-app --features transcript-screen) all clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 14:23:51 -04:00
irisandClaude Fable 5.1	d17040b601	RUST.md, IRIS.md, IRIS_TODO.md, DECISIONS.md: record I5's Android integration and measurements I5's transcript screen now runs on-device against a real ai-server on iris-android-app's new transcript-screen feature (extends I2's shell rather than a third one), with real scrolling, real touch-drag panning and tap-by-name accessibility all confirmed by screenshot/log evidence. I4's own emulator-side check (tap-by-name on the tabs demo) closed the same session, so its box ticks [x] now. Still [~], not [x]: the render-time number RUST.md's recommendation wants for iris couldn't be produced this pass, for a precise and recorded reason rather than a vague one -- dumpsys gfxinfo cannot see a SurfaceView's own GPU-drawn frames at all (0 frames reported across a gesture loop that visibly scrolled), and a SurfaceFlinger --latency fallback gave no per-frame history either on this Android version. The Compose side of the same loop did produce a real number under identical conditions (8.96% janky, 99th percentile 150ms), so this is now a one-sided number rather than a missing one on both sides. Also found and recorded: the AVD's saved snapshot carries a GPU config across restarts, so switching between the documented Vulkan boot recipes needs a cold boot (clearing snapshots/) that the emu wrapper does not force -- cost three different-looking crashes before the pattern was the snapshot, not the code. DECISIONS.md's DEFERRED item is updated with the numbers Iris needs to weigh the iris-vs-Masonry call; the call itself stays hers. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 14:09:04 -04:00
irisandClaude Fable 5.1	bf5087a598	iris/android: fix background-thread redraw crash, add missing INTERNET permission Two real bugs found bringing up I5's Android transcript client, neither specific to that screen -- any future caller of Tasks::redraw_handle() from a background thread would hit the first one. AndroidRedrawHandle::request_redraw called View::post_frame_callback from a tokio worker thread; its Java side calls Choreographer.getInstance(), which throws IllegalStateException unless the calling thread already has a Looper, and a JNI-attached background thread has none. That crashed the whole process (SIGABRT, unwrap() on a JavaException) the first time a background fetch asked for a second frame. Fixed by routing through View::post_delayed(0) instead, Android's own thread-safe way to queue work onto a View's UI thread, landing on a new IrisViewPeer::delayed_callback override that drains tasks and renders -- same body as do_frame, now running safely on the UI thread. iris-android-app's manifest never needed INTERNET before (the tabs demo makes no network call); its absence read as EPERM ("Operation not permitted") from UreqTransport::new's connect, not the ECONNREFUSED/ENETUNREACH a dead server would give. Full account in RUST.md's I5 box and IRIS.md's Tasks::redraw_handle entry. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 14:08:40 -04:00
irisandClaude Fable 5.1	aa3d11471f	iris-android-app: transcript-screen feature -- I5's Android integration Extends the existing tabs demo shell (I2/E5's Gradle project, JNI registration) with a second, mutually-exclusive AndroidAppState rather than building a third shell -- it already has the working IrisView/MainActivity Java and the register_view_class wiring, and the only thing a transcript screen needs on top is a different Client type (the same axis tabs_ui::build vs. transcript_ui::build already varies along on winit). `--no-default-features --features transcript-screen` builds transcript_client::TranscriptClient instead of the plain tabs Client: fetches the sandbox's session list, opens the first one, and follows it live, reusing desktop-app's app.rs shape (fold_event/group_tool_runs/ fold_page/raw_seq, a generation counter) almost verbatim. The one real difference is the redraw path -- android-view has no winit::EventLoopProxy, so Tasks gained redraw_handle() (iris/src/task.rs) to let a caller request a frame after each TaskCtx::update from inside a still-running task, not just once when the whole future completes. Deliberate simplification, not a template: there is no session list or enrollment UI here. build.rs bakes the sandbox's host/port/token plus the pinned CA in at build time from AI_APP_TRANSCRIPT_HOST/_PORT/_TOKEN and AI_APP_CA, the same trust-boundary reasoning as the Compose app's GeneratePinnedCert Gradle task, extended to also bake the enrollment since building a real one (Keystore-sealed storage, a QR/link scanner) is E3's scope, not this box's. Recorded in RUST.md's I5 box. tabs-ui and the transcript-screen deps are now both optional, gated by mutually exclusive tabs-screen (default) / transcript-screen features -- building one screen with the other's default deps still active tripped Cargo's unused_dependencies lint. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 13:26:10 -04:00
irisandClaude Fable 5.1	78aff64844	client-core: hoist transcript_fold::{fold_page,raw_seq} out of desktop-app Both desktop-app's app.rs and the new Android transcript client (RUST.md's I5) need the same page-fold and live-stream resume-cursor logic; per CODE_RULES's "write the logic once" it now lives in client-core alongside fold_event/group_tool_runs instead of being duplicated. desktop-app calls the shared functions; its own copies and their tests moved with them. Also fixes a clippy::collapsible_if in config.rs's percent_decode, found while re-running clippy after this change (let-chains are stable now). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 13:25:46 -04:00
irisandClaude Fable 5.1	9a33cb5384	docs/: move the design and working documents out of the repo root (CLAUDE.md and AGENTS.md stay, harnesses read them there) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-05 13:03:42 -04:00
iris	45ced405f3	Merge branch 'worktree-agent-afe80868604fef704' into tmp-merge	2026-09-05 12:59:54 -04:00