ai-app/docs/RUST.md

Moving the app to Rust

Plan for a native Rust phone app with full feature parity and a shared desktop UI. It uses iris; platform-specific entry points are acceptable, but shared screens, widgets, and styling are not duplicated. The result must stay lightweight and preserve native behavior and performance.

Keep this file current as you work

Keep open work, current design, measured constraints, and dead ends that would otherwise be repeated. Delete completed plans and migration narratives. Name the command and measured value when evidence matters.

Current status

• The framework is decided and built on. iris draws the transcript screen on the desktop, on this checkout's emulator and on Iris's phone.
• P0 (the phone benchmark gate) passed -- both apps ran on her own phone and the reports are under docs/bench/.
• P1 (session screen parity) is the current work, and is where the next session should start. Its box below has the state.
• The port is one crate under app-rust/; iris/ is only the UI framework.
• Open across the rest of the docs: docs/IRIS_TODO.md is iris's own list; docs/TODO.md is the Compose app's.

Desktop and phone share the code

Iris plans to develop a desktop app as well, and asked that most code be sharable between desktop and phone. The tree already has that shape -- iris and app-rust's client and ui modules are platform-free, and src/android/src/desktop are the entry points -- so the rule is about keeping it: a platform module holds only what the platform forces. Today that is JNI, the IME and insets bridge, the surface lifecycle and the bench JNI on Android; winit, argv and the config file on the desktop. What differs is the screen layout, since a phone screen with a finger and a desktop screen with a mouse want different arrangements -- a session list beside the transcript rather than a screen behind it, hover states, keyboard shortcuts. What does not differ is everything a layout is built from: the widgets (a tap button, a text field, a list, a card, a tool-call row), gestures, folding, paging, selection, and the styling -- colours, spacing, type, the surface ladder -- which is the exact same code on both, never a desktop palette beside a phone one. Those are written once in a shared module, with a platform trait underneath when a behaviour genuinely differs (FocusHost, OpenUrl, and the insets/ime_visible feed are the existing examples). Two checks before finishing a change under iris/: does ai-app-desktop still build and run with it, and is any UI logic newly in src/android that a desktop would also need? The bench client (app-rust/src/android/bench_client.rs, ~1000 lines) is the first thing to look at moving, since a desktop bench on the same fixture is layer 2 of the test rig below.

Three test layers, cheapest first (decided 2026-09-07)

Iris's suggestion, adopted and layered: test at the cheapest layer that can answer the question, and go up only when it cannot. The emulator costs minutes a cycle; the desktop window seconds; the headless harness runs inside cargo test.

1. Headless, in-process, no compositor and no GPU -- the default. iris::harness (iris/src/harness.rs), plus the fixture crate it opens. Harness::new(size, density) builds an Rsc, a UiRenderState and a state whose FocusHost/OpenUrl record what the platform was asked for; frame(t_ms)/frames_until(..) run frames on a clock the test owns, and replay(&TouchScript) feeds a recorded gesture one sample at a time exactly as IrisViewPeer::on_touch_event replays Android's historical samples. The recordings are plain t_ms action x y files under app-rust/touch/, and flick-120hz.touch is the phone's own shape: DOWN, four samples 4ms apart, UP, 20ms in total.

   cd app-rust && cargo test
   

   runs in about a second and asserts (a) the flick releases with a real velocity (List::fling_velocity, which only Released(Some(v)) fills), (b) the list travels and settles inside the AOSP spline's own FlingCalculator::duration, (c) a tap moves nothing and opens no link, (d) a long-press-then-drag leaves selected text and does not pan, and (e) the composer clears a simulated 1000px IME inset (Composer::set_bottom_inset). Each was confirmed to fail without its subject rather than assumed: dropping animate(id) from SelectionController::drag -- the phone's own "fling does nothing" defect -- and starting the fling curve at the wall clock each fail only the flick test; flinging on Tapped fails only the tap test; a 5s LONG_PRESS fails only the selection test; a set_bottom_inset that ignores its argument fails only the composer test.

   What still cannot be answered below layer 3: nothing renders here, so anything about pixels -- glyph rasterisation, the atlas, stale or duplicated primitives, colour, the surface lifecycle, the renderer rebuild -- is invisible to layer 1 and only looked at in layer 2. Frame times are not measurable at either: layer 1 does no GPU work at all and layer 2 runs a debug build on this VM's virtio GPU, so a number from either is not the phone's. Anything JNI (the IME, real insets, the clipboard, battery) is layer 3 by construction: layer 1 records that the platform was asked and layer 2 has no Android platform to ask.

   The one exception, added 2026-09-08: iris/tests/mask_sdf.rs needs a GPU but no compositor and no window -- it asks wgpu for an adapter, runs two functions lifted out of shader.wgsl itself in a compute pass, and compares the answers with the CPU transliteration in iris_core::render::sdf. It sits inside cargo test because what it checks is arithmetic rather than pixels: the fragment stage and the hit test have to agree about where a rounded edge is, and neither layer 1 (which cannot run the shader) nor layer 2 (where a half-pixel disagreement is invisible) can say whether they do. Reach for this shape only when the question is "do these two implementations of one function agree" -- anything about what is drawn is still layer 2.

2. A phone-shaped desktop window under headless sway -- for looking.

   cd iris && ./run-headless.sh phone --phone --dir ../app-rust --shot /tmp/p.png
   

   About 15 seconds warm. --phone sets the private sway output to 1080x2424@120Hz and exports IRIS_SCALE=2.55, which reaches iris the way DisplayMetrics.density does on Android (iris::default::content_scale) -- the desktop backend now lays out in physical pixels with a density instead of dividing into a separate logical space, so both platforms run one path. app-rust's phone example opens the same screen from the same bytes as layer 1 and the Android bench.

   A gesture on screen uses the same recordings:

   ./run-headless.sh phone --phone --dir ../app-rust \
       --replay ../app-rust/touch/flick-120hz.touch --shot /tmp/p.png
   

   writes /tmp/p-before.png and /tmp/p.png either side of the flick; looked at 2026-09-07, the list moved back about seven turns of the fixture and settled.

   swaymsg seat - cursor cannot drive it, and that cost an hour. This compositor runs the headless backend with no input devices (WLR_LIBINPUT_NO_DEVICES=1, LIBSEAT_BACKEND=noop): the cursor commands all report success and nothing whatever reaches the client, with swaymsg -t get_seats showing capabilities: 0 as the only sign. wlroots 0.19 dropped WLR_HEADLESS_INPUTS, and ydotool's uinput device would be ignored by a compositor that is not reading libinput. iris/rig-input's replay-touch uses the virtual-pointer protocol instead, which is a client protocol and needs neither devices nor root, and it parses iris::harness's own TouchScript. Two traps inside it, both found by printing winit's events: a button sent in the same frame as the motion that first puts the pointer over the window is dropped (the client sees the enter, the moves and the release, never the press), so the pointer is positioned and left to settle 200ms first; and a leftover window from an earlier manual run tiles beside the new one, halving the width and producing a screenshot that looks exactly like a duplicated- primitive rendering bug -- swaymsg -t get_tree and pgrep -af examples/phone are the check.

3. The Android emulator -- platform plumbing and the final pass. JNI, IME, insets, surface lifecycle, the renderer rebuild, and one verification run before a build goes to the phone. Not for iterating on layout.

What has to be reproduced

The app is ~19,000 lines of Kotlin. It splits three ways, and the split is what decides how much of a port is mechanical.

Pure logic with no Compose or Android in it, ~4,500 lines. Api.kt (1,142), Events.kt, EventStream.kt, Sse.kt, TranscriptCache.kt (589, touches java.io.File only), TranscriptSource.kt, MarkdownSyntax.kt, Languages.kt, Highlighter.kt, Ansi.kt, ResetCountdown.kt, Durations.kt, Sizes.kt, ModelName.kt, LoadState.kt, ImportableStream.kt. TranscriptUnits.kt and TranscriptItems.kt (the event fold into rows, ~940 lines) are logic with a handful of Compose annotations. This is also exactly the code that has JVM unit tests today. All of it ports directly, and most of it already has a Rust twin in server/: Events.kt is a hand-kept mirror of session/driver.rs's enum, the highlighter and the syntax scanner exist on the server for the explorer, and the cache compares the server's own JSON lines. Sharing these types between server and app is the single largest "keep things in sync" win available, and it does not depend on which UI framework wins.

Compose UI, ~13,000 lines. Screens, dialogs, the transcript list, the markdown renderer's customisations, tool cards, the file explorer viewer and editor. This is the part a UI framework choice is about.

Android platform code, ~1,500 lines, spread over 20 files. Every one of these is a Java-side object that no Rust framework can replace, because Android only offers them as Java classes:

• NotificationService — a foreground service holding the /notifications SSE stream while the app is closed, with its ongoing notification, specialUse type and the POST_NOTIFICATIONS request.
• MainActivity — edge-to-edge, the ACCESS_LOCAL_NETWORK runtime permission (Android 17), singleTop intent routing for aiapp://enroll, notification taps, and the share sheet (ACTION_SEND, any MIME type).
• ServerConfig — the bearer token sealed under an Android Keystore AES-GCM key, shared with Dev Updater through wg-app-link's :link.
• EnrollmentScanActivity — the in-app QR scanner (zxing, camera).
• Attachments — ContentResolver reads of shared URIs, BitmapFactory decode and downscale, EXIF orientation.
• SessionImage — bitmap decode for produced images.
• ScrollAnchor, Drafts — SharedPreferences; CrashLog — filesDir.
• TranscriptCache — cacheDir.
• DebugStats/FrameStats — Choreographer frame timing and the render report; runtime-tracing names composables in a system trace.

So "pure Rust" on Android means Rust owns every line of logic and drawing, behind a thin shell of Java stubs, and a packaging step that produces a signed APK. How thin, and whether Gradle is inevitable, are answered below.

How much Java is unavoidable, and why

Rust can call any Android API through JNI (jni crate, with ndk-context handing over the JavaVM and the Activity): posting a notification, startForegroundService, the Keystore, ContentResolver reads, permission requests, WindowInsets, the clipboard. None of that needs a line of Kotlin. What JNI cannot do is define a class that the system instantiates by name from the manifest — an Activity, a Service, an Application, a BroadcastReceiver. Those must exist as dex bytecode inside the APK before any Rust runs, because the framework constructs them and only then calls into native code. NativeActivity is the platform's own stub for the Activity case; there is no NativeService, and android-view ships its own View subclass for the same reason.

So the floor is roughly two Java classes of ten lines each: an Activity and a Service whose lifecycle methods are declared native and registered from JNI_OnLoad, plus whatever android-view already provides. Everything they would have done in Kotlin — insets, intent routing, the SSE follow loop, the notification builder — is Rust reached through those stubs. Writing the stubs in Java rather than Kotlin drops kotlinc from the toolchain; javac comes with the JDK Gradle already needs. Generating the dex from Rust is not worth it: there is no mature Rust dex writer, and the stubs never change.

Can the APK be built without Gradle?

Yes. An APK is a zip containing a binary-XML AndroidManifest.xml, resources.arsc, classes.dex, lib/<abi>/*.so and assets, aligned and signed with the v2 scheme. The tools are aapt2 (manifest and resources), d8 (Java bytecode to dex), zipalign and apksigner, all in the SDK's build-tools, none of them Gradle. Three ways to drive them:

• A cargo xtask (or build.rs-adjacent script) that runs cargo ndk for each ABI, javac + d8 for the stubs, aapt2 link, zipalign, apksigner. About 150 lines, every step visible, no AGP, no Gradle daemon holding 2.8 GB between builds. The pinned-CA constant becomes a build.rs reading the same certs/ca.pem path.
• cargo-apk2: the maintained successor to cargo-apk, and unlike it compiles java_sources / kotlin_sources into the dex and declares multiple activities and services with intent filters from [package.metadata.android], with per-profile keystores and optional aapt2. Exactly the shape needed; the question is whether a third-party tool with one maintainer beats 150 lines we own.
• cargo-apk / xbuild: unmaintained and NativeActivity-only. No.

What Gradle would take with it: Android Lint (which found two real bugs here, but in Kotlin that would no longer exist — with forty lines of Java stubs there is little left for it to find), manifest merging, R8, and the generated-source plumbing. What it gives back: one toolchain, cargo end to end, and Dev Updater keeps calling build-apk.sh exactly as now. Recommendation: the xtask, with cargo-apk2 read for the details it already got right (v2 signing, uses-feature, ABI splits).

The behaviours that are hard to get back

Reading the Compose code for what a replacement must be able to express, rather than what it happens to look like:

1. The transcript is one selectable body of text. A SelectionController is registered directly on the lazy list, with no selection widget in the layout tree, so a selection runs from a reply into the tool output beneath it. Each parent supplies either draw order or one visual axis for its immediate children; ordering is resolved only when selection queries it. Iris owns the selection handles because its text is drawn into one surface, while the platform supplies the clipboard and related system services.
2. Rich inline text: markdown with links (one tap detector per text, not a node per link), inline code chips drawn behind the text, tables with wrapping cells and a sideways scroll, syntax-highlighted fences, ANSI colour in tool output, Nerd Font icon glyphs. Needs a text layout engine with spans, not just styled labels.
3. A bottom-anchored virtualised list of variable-height rows, paged in both directions (800-event pages, HISTORY_SCREENS measured in viewports), with a saved scroll anchor per session, "hold the edge nearest the tap" when a row expands (holdTopEdge, done in the layout pass so the wrong frame is never drawn), and rows keyed so that a run of tool calls stays one row while it grows.
4. The soft keyboard: the composer resizes with the IME, the guard against a stuck inset animation, drafts per session, autocorrect and suggestions from the phone's own keyboard. This is where most Rust frameworks fail on Android today; see below.
5. Platform integration through the app model: foreground service, notifications, share sheet, deep link, Keystore, camera, back gesture, edge-to-edge insets, local-network permission.
6. Accessibility names on icon buttons, which the bench scripts depend on (ui-trace taps by label). A framework with no accessibility tree also breaks the measuring rig.
7. Measurable frames: the debug render report, and a way to attribute a frame's cost to a widget on the real phone.

Measurements and constraints

The Android release profile and APK size

Iris asked why the iris bench APK was double the Compose one (20.6 MB vs 10.1 MB). It was almost all libmain.so, built with panic = "abort" and nothing else. Measured cumulatively, arm64 release:

profile.release	APK bytes	.so bytes	delta
panic="abort" only (baseline)	20,678,956	18,546,488	--
+ strip = true	16,435,156	14,302,688	-4,243,800
+ lto = "fat"	15,751,212	13,618,744	-683,944
+ codegen-units = 1	15,185,204	13,052,736	-566,008
+ opt-level = "s"	13,326,076	11,193,608	-1,859,128
+ opt-level = "z" (not adopted)	12,507,276	10,374,808	-818,800
+ platform fonts, no bundled Noto	9,577,940	7,445,472	-3,748,136

opt-level = "z" was not taken: 0.8 MB is not worth the loop vectorisation on a renderer. Everything else is app-rust/Cargo.toml's [profile.android-release] -- a profile of its own rather than release, so the desktop build is not also optimised for size.

The fling stutter and what a frame report cannot say

Iris, from her phone: "I'm noticing some stuttering when flinging in particular. Harder to notice with my finger directly moving the scroll." Her report had the fling phase at 3396 frames over 33.0s -- 103fps on a 120Hz screen -- with p50 6.3ms and 13.4% "late".

The report was not measuring what its own labels claimed. Three things came out of chasing it, and the first two are corrections to the instrument rather than to the renderer:

1. The swapchain acquire was counted as iris's CPU work. AndroidRenderer::draw timed queue.submit + present() and called everything before it redraw_to_submit, but get_current_texture -- which blocks until the compositor frees an image -- sits in that span. An app comfortably ahead of the display spends most of every frame there, so a healthy fling read as several milliseconds of iris being slow. A frame is now three measured parts (FrameParts: build, acquire, submit), per phase as well as per run, because they do not divide the same way in every phase.

2. Nothing could say a frame was never produced. late counts frames that cost more than a budget, which is not the thing a reader sees: a frame that is late but drawn shows up on the next vsync, while a frame that never happens leaves the previous one on screen for two refreshes. PhaseStats::missed counts vsyncs nothing was drawn for, from the gap between consecutive frame times.

3. The frame loop asked for its next frame after doing the work. Choreographer.postFrameCallback schedules for the next vsync after the call, so any frame whose work ran past the vsync boundary registered too late for the next one and got the one after -- one frame over budget silently cost a second frame as well. It is asked for immediately after tick_animations, before the layout and the draw.

And one that is about the animation rather than the report: the fling was advanced on Instant::now(), not on the vsync the callback carried. do_frame's frame_time_nanos was discarded. Frames are presented on an even cadence whatever clock they are computed on, so sampling the spline at "whenever the callback got to run" moves the content by an uneven distance every frame -- a shimmer with no frame late enough to appear in any report, and it is exactly the asymmetry Iris described, since a drag's positions come from the finger's own timestamped samples and never had it. sense::PointerClock is now sense::DeviceClock and the view keeps one, anchored by whichever of a touch or a frame arrives first, so a fling is advanced on the clock its velocity was measured on.

What the CPU side is not: scripts/rigs/ui-profile's frame_profile.rs (AGENTS.md's rig list) puts iris's own per-frame work during a warm fling at p99 0.26ms, with only one frame in six laying anything out at all. The multi-millisecond spikes are first-pass only.

The result, from Iris's phone the same day: "now THAT is smooth. I couldn't actually see any lag myself." With three corrections to what the report meant, found by reading that run against the bench's own timings:

• The frame rate never was the problem, and the first reading of it was wrong. "103fps on a 120Hz screen" divided the fling phase's frames by its whole duration, which includes sixteen deliberate 300ms rests. Both runs sustained ~120.3fps through the motion itself. So the callback ordering was not costing frames -- what changed is the clock, which moves no frame count and is the whole point: an uneven sample of an even cadence cannot show up in any frame-time percentile.
• missed vsyncs counted idleness. Every gap was treated as cadence, so the bench's own pauses read as stutter: 276 for sixteen 300ms rests, 2410 for twelve hundred 50ms keystroke gaps, 821 for four hundred 50ms stream gaps -- each within a few percent of the arithmetic. A gap now measures anything only if the frame before it had asked for another.
• late counted the vsync wait as cost. A well-paced loop spends each frame blocked in the acquire, so its total sits at exactly one refresh period and every frame lands on the budget boundary. It is judged on FrameParts::work -- the total minus the acquire -- now.
• The refresh rate is the larger of what the platform claims and what the run sustained, because each can only be wrong one way. Display.getRefreshRate() answered 60 for a run that drew 3405 frames in 33.1s, since a phone that varies its rate answers with whatever mode it is in when asked. And FrameReport::sustained_frame_hz is a floor: an app that cannot keep up says nothing about the panel. The first version of it took the fastest tenth of the gaps rather than the sustained rate and reported 88Hz for this repo's 60Hz emulator, whose app manages 51 -- a budget no frame there could meet, invented out of the app's best moments, and caught only by running the corrected report on the emulator before shipping it. The two are printed together whenever they disagree.

The signature of the fixed loop, from that run: build p50 0.4ms, acquire p50 5.7ms, submit p50 1.7ms -- four tenths of a millisecond of work and the rest of the refresh period spent waiting its turn.

Streaming frame time

Measured after the fling was fixed, and it is not where it looks. frame_profile.rs's stream run: folding an arriving event is 0.35ms and applying the diff to the widget tree is 0.41ms, while the frame that follows is 3.86ms on this desktop and 9.5ms of build on Iris's phone -- over a 120Hz budget on its own. 401 streamed events move the item count from 652 to 654, so nearly every one is a delta into the same row: the cost is re-laying out and re-shaping one growing markdown message on every delta.

fold_event's items.to_vec() per event was the hypothesis -- it is the exact shape of the Compose lesson in AGENTS.md's "Things that have bitten" -- and measuring it is what ruled it out.

Incremental text shaping

Iris asked to investigate incremental text rendering and hoped parley supported it. It does not, by design. The crate's own docs: a Layout "supports re-linebreaking and re-aligning many times... but if the text content or the styles applied to that content change then a new Layout must be created". Its LruCache caches harfrust's per-font shaper data, instance and plan -- not shaped runs -- and its own PlainEditor::update_layout rebuilds the whole layout from the whole buffer on every keystroke. So there is nothing to adopt, and adding it would be upstream work in parley.

And the app already does the thing incremental layout would buy. RowBlocks::apply_delta keeps one Text per top-level markdown block and re-shapes only the block a delta landed in; re-splitting the markdown to find that block is 18µs at 18,000 characters and comparing the blocks is 470ns. Neither is the cost.

The 9.5ms is a bench-fixture artifact. Measured with frame_profile.rs:

• Re-shaping a block is linear in its length -- ~0.23ms per 1,000 characters on this desktop, so a message grown to 17,600 characters costs 4.1ms on its last delta and 842ms of shaping over the whole reply.
• The fixture's streamed message is 14,888 characters in one block -- a synthetic run-on paragraph with no blank line in it, so every delta reshapes all of it. That is the whole of the frame: 3.5ms of the measured 3.86ms.
• Real replies are not like that. Over 7,706 top-level blocks from 3,675 real assistant messages on this machine (block lengths only; no content left the machine): p50 147 characters, p90 449, p99 836, largest 1,580, and nothing above 4,000. Code fences are smaller still -- 170 of them, p50 126, largest 589.
• At those sizes a live reshape is 48µs (p50), 208µs (p99) and 372µs (the largest block ever seen), or roughly 0.12-0.93ms on the phone. Comfortably inside a 120Hz budget, with no incremental anything.

So: incremental text is not worth building -- and Iris agreed, with the fixture changed instead (2026-09-09: "let's switch to new lines for the test, and also let's keep the single line around for stress + could be something to try to optimize later"). What landed:

• The streamed reply gets a blank line every 4-12 deltas, so it is 53 blocks with a longest of 502 characters instead of one of 14,888. The streaming frame went from p50 3.86ms / p90 8.65ms / worst 10.95ms to p50 2.20ms / p90 5.90ms / worst 8.78ms here.
• The run-on message is kept as the first two backlog events, sized just under text_cap's 16 KiB so it draws in full. The streaming pathology is kept in frame_profile.rs instead of the fixture, because it needs a growing block and iterating on it there costs a second rather than a two-minute phone run.
• Adding it is purely additive: the random state is saved and restored around those two events, so every other backlog event is byte-identical. That is not cosmetic -- phone_screen.rs's a_long_press_and_drag_selects_text replays a real recording at (300, 1000) and failed the first time round, when the insertion shifted what was under it.
• BACKLOG_COUNT is 3202 now, in generate.py, fixture.rs and BenchFixture.kt. The split is by line index, so a stale copy opens a different half of the file.

The cap does not save a streamed reply, and this is worth knowing before optimising anything here. Iris asked whether the newest message caps: it does not, deliberately -- row::build_row's cap is false for the live tail because a row that grew while capped would appear to stop growing, and a reply that grows past the cap never gets caught either, since it grows through apply_delta. So a streamed block's shaping cost has no ceiling: at the measured ~0.23ms per 1,000 characters (about 2.5x that on the phone), a 50,000-character block would be ~29ms per delta and a 100,000-character one ~58ms. Real replies do not do this, which is why it is not urgent; nothing stops one doing it, which is why the stress case is kept.

What the remaining streaming cost is, and is not. With realistic blocks the reshape is no longer the cost: layer 1's frame went to p50 2.20ms, spread over frames that added a block (p50 3.56ms, 56 of 401) and frames that did not (p50 1.94ms). Folding is 0.12ms and applying the diff 0.35ms.

But the emulator's stream: build p50 did not move -- 10.4ms before the fixture change, 10.5ms after -- while layer 1's CPU frame nearly halved. So most of a streaming frame on a real GPU path is something layer 1 builds and never uploads, and therefore cannot time. The candidate, and the arithmetic behind it:

• The screen holds 11,568 primitives by the end of the stream phase.
• UiRenderNode::update re-uploads the entire instance and primitive arenas whenever primitives.updated is set, which a text change sets every delta -- about 370 KB per delta at 32 bytes an instance, before the primitive data itself. ArrBuf::update also recreates the buffer whenever its length changes, which adding glyphs does on nearly every delta, and a recreated buffer means a fresh bind group too.
• The fling phase is the control that makes this convincing: it moves the same 11,568 primitives every frame through move_offsets -- a small buffer, no arena rewrite -- and its build p50 is 0.4ms against streaming's 10.5ms, on the same screen and the same content.

So the next thing to look at for streaming is uploading only what changed rather than the whole arena, not anything about text. Splitting the reply into blocks was still right -- it is what makes the fixture representative, and it halved the CPU half -- but it was never going to move this, and it slightly increases the primitive count.

Arena delta uploads

Done, and measured by scripts/rigs/ui-profile's arena_churn -- see AGENTS.md's entry for the rig and the numbers. The arithmetic above was right about the symptom and wrong about the cause being the upload strategy alone. Three things, in the order they had to be fixed:

1. ArrBuf reallocated on every length change, and a fresh buffer's contents are undefined, so a partial upload could not have been correct in the first place. It has a capacity now: geometric growth, never shrinking, and update says whether the Buffer identity moved so a caller can rebuild its bind group and force the whole range dirty. This alone took the glyph array from 95% re-uploaded to 3%.
2. A redraw freed its primitives and pushed new ones. Freed slots are not reusable until the end of the frame (a layer's draw order still names them), and nested provisional layout meant the arena's high-water was the transient push count: 17 million pushes across 401 deltas, and 127,443 slots for 11,569 live primitives, growing linearly with the transcript. A redraw now gets its old handles back as a recycle pool (Painter::take_recycled, Primitives::recycle) and writes into the slots it already holds. The arena is exactly the live count now, and the CPU frame fell from p50 2.20ms to 1.39ms as a side effect, since the freeing and draw-order renumbering went away.
3. Nothing tracked which entries changed. util::Dirty is a bitset per uploaded array, coalesced into ranges at a 1 KiB gap. Marking is O(1), and the read-back is one word per 64 entries. A min..max span was rejected on measurement (a frame's changes land in 5-20 scattered runs, so a span is nearly the whole buffer) and so was a Vec of indices (thousands of marks per frame would mean an allocation and a sort).

The trap that only the rig could have caught: writing an entry is not the same as changing it. Recycling rewrote every glyph of every moved row with identical bytes, marking 73% of the glyph array against 0.6% genuinely changed. PrimitiveVec::set and Primitives::set_instance compare before marking. Layout can also write a provisional instance and restore it within one frame; Primitives remembers the pre-frame bytes and cancels that dirty bit when the GPU-visible result is unchanged. arena_churn prints both numbers so either gap cannot reopen unnoticed.

Layout has no measurement mode. A widget is drawn provisionally only when its size cannot be known yet, and that retained drawing is moved into place. Widget::size_hint(axis) lets context-free wrappers such as Sized report an exact Len; a debug assertion compares every hint with the real draw result. If final allocation changes a child's size, Painter::place redraws it in that box. Otherwise placement is one move-offset write.

Measured over the fixture's 401 streamed events, streamed-frame CPU p50 is 0.12ms, from 1.18ms before this layout change. Arena size and upload floors are unchanged.

Pinned growth now uses the same subtree translation as scrolling. A container can retain a child-coordinate move slot through Painter::set_child_offset; LazySpan keeps retained rows in stable local boxes and changes that one slot when its anchor moves. It still walks the visible run to virtualise it, but unchanged rows no longer acquire new absolute primitive regions. Over the fixture's 401 streamed events, instance upload is 1.1% against a 1.1% floor, from 71.9% against 71.8%; median instance bytes per frame are 1,488, from 176,496. This is framework layout/rendering behaviour and the transcript screen contains no special case for it.

The Android release profile uses opt-level = 3

The table above was measured in bytes only. "s" costs the loop vectorisation and inlining a renderer runs on: over the same warm fling eight times, iris's own per-frame work is p90 0.15ms / p99 0.42ms at "s" against p90 0.09ms / p99 0.26ms at 3. The arm64 release APK goes from 9,745,704 to 11,542,646 bytes (+1.8 MB) -- the same trade the table refused for "z", one level further up. Iris raised it herself ("I'd make sure it's in release mode"); the build always was, and this was the part of "release" that was not about speed.

Platform fonts

Iris: "remove the font for now; just match what compose does." The Compose app takes body text from FontFamily.Default and code from FontFamily.Monospace and ships no text font, only its Nerd Fonts icon subset. So TextData::register_bundled_fonts, the six include_bytes! Noto constants and iris/core/assets/fonts/'s .ttfs are gone.

The reason this works at all: FontContext::new() was already finding the platform's fonts underneath the bundled ones -- fontique's CollectionOptions::system_fonts defaults to true, with a real backend on both platforms iris ships on (fontconfig on Linux, /system/fonts + /system/etc/fonts.xml on Android). The icon font is the opposite case and is still bundled: a small, closed set of codepoints no system font is guaranteed to have (AGENTS.md's "Icons").

Still unverified, and it is the half that can fail (review R6, 2026-09-07): the bundled fonts originally existed because "bold spans on a real phone rendered as blank gaps of the correct advance width", and the replacement was checked with CJK and emoji on the desktop. The fault was Android's font enumeration resolving a weight/style, so the desktop cannot answer it. Before the next phone build, look at a bold run and at CLOSED_MARK/OPEN_MARK/UP_MARK (U+25B8/BE/B4) on Iris's own device; the emulator's font set is not evidence for hers.

The port, in order

Every screen is a module under app-rust/src/ui, which holds a Screen enum and a back stack -- the direct equivalent of AppRoot.kt's when and MainScreen.kt's tab enum -- with each Compose screen becoming one iris::widget subtree. src/desktop and src/android are thin entry points that call into it, the way AppRoot/MainActivity today call into Compose screens they do not otherwise own. Platform-only code (the notification foreground service, the share target, the QR scanner, the Keystore-sealed token, deep-link enrolment) stays in src/shell + app/shellApp, since none of it is a screen ui could draw.

Order is by risk to the daily-use path, not by screen count: the session screen is what the app is for and where every hard behaviour (paging, cache, keyboard insets, selection) already lives, so it goes first and on the phone as reachable code as soon as possible, before the lower-risk screens.

Every step below assumes the app/ui-sandbox.sh fixtures (AGENTS.md's "The rigs") and the this-machine-android skill's facts (per-checkout AVD, ui-trace by accessibility name, GrapheneOS phone quirks, the adb shell quoting traps) apply unchanged -- read that skill before running any pass condition below that touches an emulator or a real device.

Bench-only cleanup still open: the diagnostics report pane draws over transcript rows. REPORT_MAX_HEIGHT_DP constrains its claimed height, but the pane is neither masked nor scrollable despite its construction comment saying it is both. This is an app-rust defect, not an iris framework item.

• P1 — session screen parity. Continue in this order: - [ ] P1c — history paging and jump-to-latest. Wire client::transcript_source into src/ui: the opening page, paging back on scroll with the cushion measured in on-screen viewports (HISTORY_SCREENS, IRIS_TODO "Build (for the port)"), the NothingLoaded/empty/error states drawn distinctly (UI_RULES: design the unknown state first), join_pages at each seam, and a jump-to-latest control that pins to the newest end. Pass condition: the P1 pass condition below, against ui-sandbox.sh with AI_SANDBOX_BIG_MB and --delay. - [ ] P1d — images, the session settings dialog, attachments, usage bar. SessionImage thumbnails (the scaled image widget), the modal primitive and SessionSettingsDialog/ UsageDialog, PendingAttachments over the attachments route (api.rs gap), SessionUsageBar (the gauge widget). - [ ] P1e — keyboard and insets behaviours from AGENTS.md's "Things that have bitten", re-verified on the phone build: composer never left floating after the keyboard closes mid-stream, adjustResize + edge-to-edge together, one recomposition-equivalent per keyboard toggle (the iris insets: log line count).

  The remaining screen work is history paging and jump-to-latest, the
  session settings and usage dialogs, images and composer attachments,
  and the keyboard/insets behaviours AGENTS.md's "Things that have
  bitten" names (the floating-composer bug, `adjustResize`, the
  `imePadding`-vs-raw-inset rule). This is the highest-risk step: it is
  the screen the app is used for, every hour of the day.
  
  **Kotlin it replaces**: `SessionScreen.kt`, `TranscriptList.kt`,
  `SessionSettingsDialog.kt`, `ToolInput.kt`, `ToolRows.kt`,
  `AskQuestion.kt`, `Compaction.kt`, `SessionUsageBar.kt`,
  `PendingAttachments.kt`, `Attachment.kt`, `Attachments.kt`,
  `SessionImage.kt`, `MemoryNote.kt`, `PeerMessage.kt`, `RawBlock.kt`,
  `CodeFence.kt`, `MarkdownLinks.kt`, `MarkdownPieces.kt`,
  `Markdown.kt`, `Bubble.kt`, `ScrollAnchor.kt`, `Drafts.kt`,
  `UsageDialog.kt`, `Chevron.kt`, `Dividers.kt`. (`src/ui`
  already covers the row/markdown/selection/composer core these sit
  on top of or beside.)
  
  **`app-rust`'s `client` needed** (`CLIENT_CORE.md`): the paging half
  is ready — `transcript_source`, `join_pages` with seam healing, and
  `markdown_blocks` are all ported. The remaining client gap in P1 is
  the attachments route (`/sessions/{id}/attachments`), needed by P1d's
  `PendingAttachments`/`Attachment`.
  
  **iris widgets missing, → `IRIS_TODO.md`'s "Build (for the port)"
  section**: the distance-to-unloaded-edge query P1c needs for its
  viewport-sized history cushion; per-range text backgrounds for inline
  code; a fitted image widget; one modal/dialog primitive reused by the
  settings and usage dialogs; and a horizontal gauge for
  `SessionUsageBar`. Tappable links already exist. Row accessibility
  names are app content applied through iris's existing `.label()` API,
  not a missing framework widget.
  
  **Pass condition**: `app/ui-sandbox.sh`'s fixtures driven by
  `ui-trace record --do "tap '<label>'"` — a session with the big
  transcript (`AI_SANDBOX_BIG_MB`), a paused/slow-spawning one
  (`AI_SANDBOX_SPAWN_DELAY`), and `--delay` on the server — exercising
  the four states UI_RULES.md says to design first: unknown (a page
  that hasn't loaded), empty (a session with no messages yet), error
  (a failed send/interrupt), and too-long (the big transcript,
  paged). Re-take the I5 `FrameReport` (`iris frame report` in
  logcat, same as I5's box) once this screen has real paging and
  compare it against I5's own numbers, not against Compose's — the
  three measurement sources still are not comparable.
  

• P2 — the shell merge and a real phone install. Merge this screen's cdylib into the E3/E5 shell (src/shell + app/shellApp) behind the same feature-flag pattern I5 used to extend src/android (decided 2026-09-05), so there is one app — notification service, share target and the real screen — rather than a demo shell and a service shell side by side. Package with cargo xtask apk (E5) and get it onto the real GrapheneOS phone, not just the emulator: arm64-v8a is the ABI that matters there (the emulator here is x86_64), and the this-machine-android skill's facts apply for the first time in this port — no System Tracing on that phone (frame numbers have to come from FrameReport itself), the local-network permission is required there even though AOSP's docs say VPN traffic is excluded, and ui-trace/adb target this checkout's own emulator by default so a real-device command needs -s <serial> explicitly.

  **Kotlin it replaces**: nothing further than E3 already did
  (`Notifications.kt` → `notifications.rs`, `Share.kt` → `share.rs`,
  `ServerConfig.kt`'s Keystore half → JNI calls into `wg-app-link`) —
  this step is wiring P1's screen in as the shell's real content
  instead of E3's placeholder, plus getting a signed APK onto a
  physical device for the first time in this port.
  
  **`app-rust`'s `client` needed**: none new; E3 already covers what the
  shell itself needs. Attachments (P1's gap) matter here too if a
  real photo share is exercised.
  
  **iris widgets missing**: none — this step is integration, not new
  widgets.
  
  **Pass condition**: `cargo xtask apk`, install on the real phone
  over adb, enroll via the deep link, background the app and get a
  real notification, share a text snippet into a session, and
  confirm `ui-trace` can still find controls by name on real
  hardware (accessibility names are not guaranteed to survive a real
  device's TalkBack/AccessKit wiring the way they do in the
  emulator — this is the first time that gets checked for real).
  

• P3 — root tabs. Screen/MainTab in src/ui: the sessions list, import, models and setups tabs, plus spawn and the app's one level of back-stack navigation (AppRoot.kt's when).

  **Kotlin it replaces**: `AppRoot.kt`, `MainScreen.kt`,
  `SessionListScreen.kt`, `ImportScreen.kt`, `ModelsScreen.kt`,
  `SetupsScreen.kt`, `SpawnScreen.kt`, `BusyItem.kt`,
  `UniqueItems.kt`, `SessionAlerts.kt`.
  
  **`app-rust`'s `client` needed, not yet covered**: setups/machine/provider
  discovery, the models routes (`/models*`, HuggingFace browsing and
  downloads), and importing (`/setups/{id}/importable*`) — all three
  listed "not covered" in `api.rs`'s table and none started; each is
  real work, not a stub, per `CLIENT_CORE.md`'s own caveat.
  
  **UI still needed**: `BusyItem` is app-specific appearance — a row
  dimmed, drained of colour and labelled with the operation in progress
  without blocking the list's scroll — so it belongs in `src/ui`, not
  iris. `uniqueItems` is app logic there too. Iris itself still needs
  the modal primitive P1 flagged and a toggle switch for the
  delete-with-`deleteForeign` flow.
  
  **Pass condition**: `ui-trace` tap-by-name on all four tabs against
  `ui-sandbox.sh`'s fixtures; the two-copies-of-one-session-id
  fixture (AGENTS.md's "Importing") does not crash the list — this is
  the regression `uniqueItems` exists for and it must be exercised
  here, not assumed; the delete dialog's paragraph reads correctly
  both with and without `deleteForeign` toggled (its own text, not
  appended, per AGENTS.md).
  

• P4 — file explorer. The viewer, the editor with its EDIT_LIMIT, and the 409 conflict.

  **Kotlin it replaces**: `FilesScreen.kt`, `FileViewer.kt`,
  `FileEditor.kt`, `FileLines.kt`.
  
  **`app-rust`'s `client` needed, not yet covered**: `/setups/{id}/dir|file`
  — not in `api.rs`'s covered list, real work, port first.
  
  **iris widgets missing**: nothing beyond what P1 needs (a
  virtualised line-numbered text view is `iris::widget::List` reused,
  per I3's box) — the open question is whether the editor's
  `BasicTextField`-equivalent cost (`docs/EXPLORER.md`'s "what the
  measurements said") reproduces in iris's `TextEdit` at the same
  `EDIT_LIMIT`, which this step has to re-measure rather than assume.
  
  **Pass condition**: `app/ui-sandbox.sh`'s `~/files` fixture tree
  (empty dir, tab/apostrophe names, binary, over `FILE_LIMIT`,
  `chmod 000`, symlinks good and broken, one source file per
  language, `edit-32k.rs`/`edit-128k.rs`/`big-source.rs`) driven by
  name; the 409 reproduced by editing the file on the machine between
  opening it and saving, per AGENTS.md's own recipe.
  

• P5 — settings, enrollment, notifications permission.

  **Kotlin it replaces**: `SettingsScreen.kt`, `ServerConfig.kt`'s
  remaining non-Keystore parts, `DebugStats.kt`, `FrameStats.kt`,
  `CrashLog.kt`. The QR scanner (`EnrollmentScanActivity`, in
  `wg-app-link`) is platform-only and is **not** replaced — it stays
  a Java/Kotlin activity per decision 1 above, called into from
  `src/ui` the way it is called into from Compose today.
  
  **`app-rust`'s `client` needed**: none new — `config.rs`'s
  `EnrolledServer`/`parse_link` already cover the deep-link half; the
  Keystore half stays the JNI call E3 already wired.
  
  **iris widgets missing**: none identified yet — a plain form screen.
  
  **Pass condition**: enroll via the same `aiappshell://enroll?...`
  link `ui-sandbox.sh`'s banner prints; the local-network-not-allowed
  banner (AGENTS.md's standing-condition text) reads by name when the
  permission is off; `POST_NOTIFICATIONS` request flow checked on the
  real phone from P2, not just the emulator.
  

• P6 — desktop parity. Root tabs, explorer and settings on src/desktop, matching P3–P5 there. Not a Kotlin replacement (the desktop app has no Compose original) — this is closing the gap E4 deliberately left (session list + transcript only).

  **`app-rust`'s `client` needed**: the same P3/P4 gaps, once closed there.
  
  **Pass condition**: `run-headless.sh` screenshots of each tab and
  the explorer against `app/ui-sandbox.sh`, the same way E4's did.
  

• P7 — the switch of ai-app's main. Point ai-app's production Android build at src/ui/src/shell instead of app/androidApp; decide then whether app/androidApp stays as a reference or is retired — a load-bearing decision (AGENTS.md's "ask before changing load-bearing decisions") to bring to Iris rather than make here.

  **Pass condition**: the full set of pass conditions above, re-run
  once more against a real `ai-server` (not the sandbox) on a real
  phone, side by side with the Compose build until it holds.
  

One app crate

The Rust client is one ai-app crate in app-rust/: platform-free code is under src/client and src/ui, while src/desktop, src/android, and src/shell contain the platform entry points. The fixture is behind its own feature so its 1.9 MB include_str! does not enter ordinary phone builds.

iris/ now holds core, macro, the iris crate, tabs-ui and rig-input — framework only, with no mention of a session, a transcript, a setup or a server anywhere in it.

src/client must not depend on iris. Features select the crate's face: screens for UI builds, shell for the Compose shell bridge, and bench for the fixture. The Android faces both produce libai_app.so.

event-model remains separate because both the server and client depend on that wire contract. Iris remains a separate UI-framework workspace and must contain no product concepts.

Build constraints

• The rolling nightly setting is per directory. The toolchain files in app-rust, iris, and scripts/rigs/ui-profile must stay synchronized.
• The Android release profile is android-release, not release. The aggressive settings iris/android-app had (panic = "abort", opt-level = "s", fat LTO) would otherwise apply to the desktop build too, which is a testing surface. build-apk.sh passes --profile android-release / --profile android-dev.
• iris/run-headless.sh --dir DIR selects the workspace containing the example; it defaults to iris/.
• Not renamed, deliberately: the Android application id and Java package are still dev.iris.android.demo and the label is still "iris android-view demo", both now misleading. Changing them changes the app's identity on Iris's phone (a side-by-side install rather than an upgrade) and the DevLogProvider authority Dev Updater reads, so changing them requires an explicit migration decision.