Put the log and the crash records in one file, and show it before writing it

NFR-OPS-1 asks for a diagnostics bundle — the log, the schema version, the
GPU and driver, the app version — "with an explicit preview-and-consent
step before anything leaves the device". The log and the crash records
have existed since August; what did not exist was any way to hand them
over that was not `adb pull` and a knowledge of where the state directory
is, which on the tablet the requirement was written for is nobody.

Nothing here sends anything, and that is the design rather than a gap:
crash.rs already says why a transport built ahead of the consent is the
shape of thing that gets switched on by default. The bundle writes one
text file to a place the user can find, so that they can attach it. That
is the moment it leaves, and it is theirs. So the consent guards the
write, not a send. Preparing gathers everything into memory and shows
what would be written — each section, its size, what was taken out, and
where the file would go — and only the second press puts bytes on disk.
A user who reads the preview and presses the other button has changed
nothing anywhere. The gathered bundle is held between the presses so what
is saved is exactly what was shown, not a second gathering that differs
by whatever was logged while they were reading.

One text file rather than an archive, because a `.txt` opens wherever
the user is sitting and pastes into an issue, and because the preview
can then be the file rather than a summary of it. Every line goes
through the blunter of the two redactions on the way in, whatever the
sink already did to it: the log's own rule keeps paths, since a path
read over `adb` is context, but a file meant to be attached to a public
report by someone who may not read it first is held to the crash
record's rule instead.

The About page's graphics line gains the driver, which the requirement
names and the adapter has always reported. And docs/outstanding.md is
corrected on both OPS requirements: it said crash reporting was a
log::error! hook and NFR-OPS-1 had nothing behind it, and neither had
been true since 2026-08-30.

docs/gestures.md

@@ -25,7 +25,7 @@ Sampling a neutral is the first move of the tonal pass — every colour judgemen
 
 Anchored on the fingers' midpoint, and on the pointer, so the gesture reads as magnifying the picture rather than sliding it about. Double-tap is the way to an exact 1:1; this is the way to everything in between.
 
-<sub>`ui/dr-ui/ui/app.slint:1950`</sub>
+<sub>`ui/dr-ui/ui/app.slint:1965`</sub>
 
 ### Move a magnified photograph about
 
@@ -34,7 +34,7 @@ Anchored on the fingers' midpoint, and on the pointer, so the gesture reads as m
 
 Only once there is something outside the viewport to reach, which is why the cursor becomes a hand exactly then. The view is clamped to the frame: panning past the edge would show undefined area beside the photograph, and that reads as a rendering fault rather than as the end of the picture.
 
-<sub>`ui/dr-ui/ui/app.slint:2041`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2056`</sub>
 
 ### Paint a mask by hand
 
@@ -43,7 +43,7 @@ Only once there is something outside the viewport to reach, which is why the cur
 
 A model's mask stops inside a shoulder and leaks into the hair, and no single edge control fixes two errors that go opposite ways. The whole stroke is one step in the history, so taking a mark back costs one press however long it took to make.
 
-<sub>`ui/dr-ui/ui/app.slint:2128`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2143`</sub>
 
 ### Take back the last change
 
@@ -53,7 +53,7 @@ A model's mask stops inside a shoulder and leaks into the hair, and no single ed
 
 A whole drag is one step, so undo takes back a decision rather than a frame of a gesture. The list is there because arriving six steps back costs what arriving from one does.
 
-<sub>`ui/dr-ui/ui/app.slint:2349`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2364`</sub>
 
 ### Do it again after taking it back
 
@@ -61,7 +61,7 @@ A whole drag is one step, so undo takes back a decision rather than a frame of a
 - **Pointer** — Click it, or press Redo in the History header
 - **Keyboard** — Ctrl+Shift+Z
 
-<sub>`ui/dr-ui/ui/app.slint:2362`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2377`</sub>
 
 ### Copy the settings from this photograph
 
@@ -71,7 +71,7 @@ A whole drag is one step, so undo takes back a decision rather than a frame of a
 
 The panel is the copy that has to work: a tablet has no modifier key to hold and no menu bar to hang the action from. The shortcut is an accelerator for a control that is on screen either way.
 
-<sub>`ui/dr-ui/ui/app.slint:2395`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2410`</sub>
 
 ### Paste the settings onto this photograph
 
@@ -81,7 +81,7 @@ The panel is the copy that has to work: a tablet has no modifier key to hold and
 
 The button names what would be pasted — "3 adjustments", and whether the crop is coming with it — which the shortcut cannot say. Both paste the same scope.
 
-<sub>`ui/dr-ui/ui/app.slint:2407`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2422`</sub>
 
 ### Change which group of adjustments is on screen
 
@@ -91,7 +91,7 @@ The button names what would be pasted — "3 adjustments", and whether the crop
 
 The groups are whatever the operation set declares itself to be about, so there are as many as the pipeline has and no key can be assigned to one of them by name. Stepping is the binding that survives a node being added.
 
-<sub>`ui/dr-ui/ui/app.slint:2435`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2450`</sub>
 
 ### Look at the photograph at 1:1
 
@@ -101,7 +101,7 @@ The groups are whatever the operation set declares itself to be about, so there
 
 Noise reduction and capture sharpening are judgements about single pixels, and a fitted view averages several of the file's into each one on screen — so the frame looks softer than it is and the correction goes too far. The point and the magnification survive opening the next photograph, which is what makes checking the same eye across forty portraits forty keystrokes rather than forty pans.
 
-<sub>`ui/dr-ui/ui/app.slint:2470`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2485`</sub>
 
 ### Move to the next or previous photograph
 
@@ -111,7 +111,7 @@ Noise reduction and capture sharpening are judgements about single pixels, and a
 
 The edit on screen is saved on the way out, so stepping through a folder is as much a departure as going back to the grid and loses nothing.
 
-<sub>`ui/dr-ui/ui/app.slint:2522`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2537`</sub>
 
 ### See the photograph before you edited it
 
@@ -121,7 +121,7 @@ The edit on screen is saved on the way out, so stepping through a folder is as m
 
 Held rather than toggled, and no split screen: a split halves the working image on the tablet the column was sized for, and the comparison photographers describe making is a flick back and forth. It takes no history step, so checking whether a frame is overcooked costs nothing to undo afterwards.
 
-<sub>`ui/dr-ui/ui/app.slint:2646`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2661`</sub>
 
 ### Put one control back to its default
 

docs/outstanding.md

@@ -244,11 +244,14 @@ requirement singles out are missing: whether `shaderFloat16` and 16-bit storage
 one it flags as jeopardising R1), minimum RAM, minimum desktop Mesa, and a named reference device
 from a second GPU vendor.
 
-**NFR-OPS-2 and NFR-OPS-4.** Crash reporting is a `log::error!` panic hook on Android and nothing at
-all on desktop: no local crash record, no backtrace capture, no upload path and therefore no opt-in
-gate to guard it. Update and first run are undefined; the concrete reason NFR-OPS-4 gives — that D2
-pins rawler at a non-SemVer alpha whose camera-support fixes users will need — is unaddressed, and
-there is no update mechanism of any kind.
+**NFR-OPS-2 is met, and NFR-OPS-4 is not.** Crash reporting is `platform/dr-plat/src/crash.rs`: a
+panic on either platform writes a local record with a redacted message and backtrace, ten are kept,
+and there is deliberately no upload path — the requirement's "upload only on explicit opt-in" is
+satisfied by there being nothing to opt into, and the module says why a transport built ahead of the
+consent is the wrong order. (This paragraph said the opposite until 2026-09-12; the record had landed
+on 2026-08-30 and the paragraph had not been read against it.) Update and first run are undefined;
+the concrete reason NFR-OPS-4 gives — that D2 pins rawler at a non-SemVer alpha whose camera-support
+fixes users will need — is unaddressed, and there is no update mechanism of any kind.
 
 ---
 
@@ -388,11 +391,13 @@ line — and R1 is untagged again, which is the honest reading while it has no a
 tag anything against.
 NFR-OPS-1 was covered by tags that were real rather than fixtures, which is the worse case of the
 two: one on `compute_coverage` and one on the gesture extractor, both on the traceability tool. A
-coverage calculation and a documentation generator are not diagnostics under any reading, and the
-requirement asks for a rotating, size-capped on-disk log in the XDG state directory, credential
-redaction, and a consented diagnostics bundle. None of that exists — logging goes to stderr and
-logcat — so both tags have been removed and NFR-OPS-1 is untagged. It is the case
-[CONTRIBUTING.md](../CONTRIBUTING.md) warns about in its own words: a tag proves a tag exists.
+coverage calculation and a documentation generator are not diagnostics under any reading, so both
+tags were removed. It is the case [CONTRIBUTING.md](../CONTRIBUTING.md) warns about in its own words:
+a tag proves a tag exists. The requirement has since been built where it says: the rotating,
+size-capped log and its redaction in `platform/dr-plat/src/diagnostics.rs` (2026-08-30), and the
+bundle in `diagnostics/bundle.rs` (2026-09-12) — the log, the crash records, the version, the schema
+and the GPU as one text file, shown in full in Settings before a second press writes it, and sent
+nowhere by either press.
 
 **R2 — Efficient display of huge RAW libraries.** Its acceptance criterion contains "*(figure
 TBD)*" — the scroll velocity below which no cell may render as a placeholder — and asks for a stated