fix: a crossing is counted with hysteresis, so noise is not counted as cycles

period, frequency and pulse duration counted every sign change about a single
level, which is unusable on any real signal: the mid level is exactly where a
waveform moves fastest, so an interferer faster than the fundamental recrosses
it several times per true crossing. A 5 Hz sine with a 500 Hz tone at a tenth of
the amplitude read 79 crossings for 9, period=0.025622 against 0.2.

MeasureLevel gains a hysteresis band sized once in measure_set_level(): a tenth
of the window's peak-to-peak, clamped to half the room to the nearer extreme so
a threshold set near one stays usable. The band moves the edge decision only --
the sum/count split stays at the bare level, since that split is top/bottom and
has a documented exact reading. The bucket fast path tests the band and the
level separately rather than folding them, or it would refuse exactly the
buckets a crossing passes through: clean cost is unchanged at raw=0.1% and
1.41 ms a recompute.

tools/mock_udpstreamer.py gains --noise, defaulting to 0 so the exact probe
assertions still hold.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -170,9 +170,12 @@ precedent, not an exception.
   waveform over a window of millions -- 0.1% is what the pyramid-backed walks give (see the
   measurement-cost invariant below). A `raw` near `covered` means the walks went back to reading
   the window, which at 1 MS/s is 19.7 ms per recompute and a third of the run's frames. It is
-  *legitimately* near `covered` for a window shorter than a bucket (64 samples) or a signal noisy
-  enough to straddle a level everywhere, so read it on the fast mock
+  *legitimately* higher for a window shorter than a bucket (64 samples) or a signal noisy
+  enough to cross a threshold everywhere, so read it on the fast mock
   (`tools/mock_udpstreamer.py --rate 1300000 --batch 2000`), where a window is ~2 M samples.
+  `--noise 0.1` there reads **2.0%** at 1.96 ms a recompute against the clean 0.1% at 1.41 ms, and
+  that is the interferer's own cost rather than a regression -- the figure to compare a change
+  against is the **clean** one.
   Note the **final** `measurements:` line and `[measure-trace]`'s last lines may read `--`:
   `UDPSCOPE_EXIT_AFTER_MS` arms the trigger before it dumps, so the dump can land in `Waiting`
   with nothing bound and the axis at its default. The race-free reading is an earlier
@@ -438,7 +441,14 @@ Two lines of the self-check output are assertions in disguise:
   plottable signal and lets the tick compute them, so what it prints is what a user reads.
   On the test stream's 1 Hz ±1 sine the values must be: average ≈ 0, `top` ≈ 0.64 and
   `bottom` ≈ -0.64 (the mean of each half of a sine), max/min ≈ ±1, `pulse duration` ≈ 0.5 s
-  with `duty` ≈ 0.5, `period` ≈ 1 s and `frequency` ≈ 1 Hz. `marks=` lists each mark with its kind, and the **mix is the point**:
+  with `duty` ≈ 0.5, `period` ≈ 1 s and `frequency` ≈ 1 Hz. It needs **`UDPSCOPE_ENABLE_ALL_MS`
+  ahead of it** or it prints `no acquired signal to measure` and the dump reads `n=0`.
+  **Run it against `--noise 0.1 --freq 1` as well, and the three crossing types must still read
+  those figures** (measured: `period=1.000100 frequency=0.999900 pulse duration=0.504100`): the
+  hysteresis band is the only thing holding them there, a single level reads a 500 Hz interferer as
+  the signal, and the default `--noise 0` mock cannot see it. The band costs `raw`, not accuracy --
+  the clean fast mock reads `raw=0.1%` at 1.41 ms a recompute and the noisy one `raw=2.0%` at 1.96
+  ms, so read `measure cost:` on **both**. `marks=` lists each mark with its kind, and the **mix is the point**:
   `level:V` alone for average/top/bottom, `level:V,time:T` for min/max (a ruler at the value
   *and* a marker at the first sample that reached it — two level marks at both extremes was
   the bug), `time:A,time:B` for pulse/period/frequency. `text=` is the pane's own string with
@@ -764,7 +774,7 @@ Two lines of the self-check output are assertions in disguise:
   so the panes the tick rewrites are measured directly. The `[width-probe]` lines are the
   per-change detail behind the `axes.w changes` count, and a step over 100 px dumps the widget
   tree's wide subtrees — that is what the documented, intermittent ~320 px step wants read.
-- `[help] pages=14 parsed=14 shortest='Pause and play' 1434 B; shortcuts: app=12 plot=13; about version=… commit=… built=… settings=… icon=org.udpscope.app; closed ok` (stderr, `UDPSCOPE_PROBE_HELP_MS`) — **`parsed` must equal `pages`** and no page may be empty: a missing resource or markup Pango rejects renders a one-line stand-in instead of failing, so the window *looks* fine and only this count notices. `settings=` must be a real path (the same one the About dialog shows). **`icon=` must read `org.udpscope.app`** — it is read back through `adw_about_dialog_get_application_icon()` while the dialog is open, so the dialog is asserted to *carry* the icon rather than merely to open (a `set_application_icon()` lost in an edit leaves a dialog that opens, looks almost right, and shows a generic placeholder). `closed ok` with **no `Gtk-CRITICAL`** is as much a crash test of three windows built, presented and closed in one run as it is a state check, and a stronger one than it was: the three are now closed by **two different calls**, so a mismatched pair crashes or leaks here. One of the three is a `GtkWindow` (the help window, `gtk_window_close()`); the About dialog and the shortcut overview are `AdwDialog`s and close with `adw_dialog_close()`, cleared on `::closed`. `shortest=` is the page title — a page whose body was never compiled into the binary is absent rather than empty, and a title alone is the stand-in's shape.
+- `[help] pages=14 parsed=14 shortest='Choosing a source' 1563 B; shortcuts: app=12 plot=13; about version=… commit=… built=… settings=… icon=org.udpscope.app; closed ok` (stderr, `UDPSCOPE_PROBE_HELP_MS`) — **`parsed` must equal `pages`** and no page may be empty: a missing resource or markup Pango rejects renders a one-line stand-in instead of failing, so the window *looks* fine and only this count notices. `settings=` must be a real path (the same one the About dialog shows). **`icon=` must read `org.udpscope.app`** — it is read back through `adw_about_dialog_get_application_icon()` while the dialog is open, so the dialog is asserted to *carry* the icon rather than merely to open (a `set_application_icon()` lost in an edit leaves a dialog that opens, looks almost right, and shows a generic placeholder). `closed ok` with **no `Gtk-CRITICAL`** is as much a crash test of three windows built, presented and closed in one run as it is a state check, and a stronger one than it was: the three are now closed by **two different calls**, so a mismatched pair crashes or leaks here. One of the three is a `GtkWindow` (the help window, `gtk_window_close()`); the About dialog and the shortcut overview are `AdwDialog`s and close with `adw_dialog_close()`, cleared on `::closed`. `shortest=` is the page title — a page whose body was never compiled into the binary is absent rather than empty, and a title alone is the stand-in's shape.
 - `[menu] N 'label' accel='key' h=P label_x=X accel_right=R/W order=D ok=O`, one line per row,
   then `[menu] rows=R expected=E order=D rows_bad=B popover_visible=V mapped=M button_mapped=B`
   and `[menu] status pos=top bubble=WxH button_top=T button_right=R fits=F` (stderr,
@@ -1568,13 +1578,19 @@ far the largest file.
   level-0 buckets -- 64 samples each, carrying min, max an **exact** sum and a finite count -- and
   locates each extreme to a *bucket*; one raw `measure_scan()` of that bucket alone then pins it
   to a sample, two buckets at most whatever the window's size. Pass two
-  (`measure_accumulate_bucket()`) folds a bucket whole only when it lies **strictly** on one side
-  of its level (`k.lo > level` or `k.hi < level`): then every sample decides the same side, none
-  is *at* the level, and an entering edge is exactly the bucket's first sample -- which is where
-  the raw walk would have found it, so this is exact and not an approximation. It refuses a
-  bucket that straddles, and a bucket holding a non-finite sample, because the raw walk takes the
-  first *finite* sample of the new side and an aggregate cannot say which that is; the caller
-  then opens that bucket. Four things this rests on, each of which breaks it silently:
+  (`measure_accumulate_bucket()`) folds a bucket's **sums** only when it lies **strictly** on one
+  side of its level (`k.lo > level` or `k.hi < level`): then every sample falls in the same bin and
+  none is *at* the level, so the fold is exact and not an approximation. It asks **separately**
+  whether the bucket enters a side of the hysteresis band (see the invariant below), because a
+  single test against `level ± h` refuses exactly the buckets a crossing passes through. A bucket
+  wholly past a threshold holds that crossing at its first sample, exactly -- which is where the raw
+  walk would have found it. It refuses a bucket that straddles the level, one that enters a side
+  somewhere inside itself, and one holding a non-finite sample (the raw walk takes the first
+  *finite* sample of the new side and an aggregate cannot say which that is); the caller then opens
+  that bucket. **Nothing may be folded before a refusal** -- a refused bucket goes to
+  `measure_accumulate()`, which adds the same samples again, and sums added above the `return false`
+  double-counted every opened bucket, reading `top=0.614304` on a unit sine against the 2/pi it must
+  be. Four things this rests on, each of which breaks it silently:
   * **Exactness is the point, so nothing may stride or decimate.** `peak to peak` must still read
     exactly `2` on a unit sine and `top` exactly `0.636620` (2/pi). A bucket's sum is a sum.
   * **The bucket index space must be the window's.** `ChannelBuffer::acquire()` calls
@@ -1593,6 +1609,39 @@ far the largest file.
   `measure cost:`'s `covered`/`buckets`/`raw` is the guard, and it needs the fast mock to say
   anything.
 
+- **A crossing is counted with hysteresis, and the band moves the *edge decision* only.**
+  `MeasureLevel::hysteresis` is a Schmitt trigger about `level`: an edge is counted once the signal
+  has passed `level + h` going up or `level - h` going down, and a sample inside the band decides
+  nothing. Without it `period`, `frequency` and `pulse duration` are unusable on anything real --
+  the mid level is exactly where a waveform moves *fastest*, so an interferer faster than the
+  fundamental recrosses a single level several times per true crossing. Measured on a 5 Hz sine with
+  a 500 Hz tone at a tenth of the amplitude (`tools/mock_udpstreamer.py --noise 0.1`): 9 true
+  crossings counted as **79**, `period=0.025622 freq=39.029` for a true 0.2 s / 5 Hz, against
+  `period=0.200188` with the band. Four rules, each of which was wrong first:
+  * **`measure_set_level()` is the only place the band is sized**, and `src/ui.cpp` calls it rather
+    than assigning `.level` itself: two expressions for the width is how the raw walk and the bucket
+    path end up disagreeing about where a crossing was. `h = min(0.10 * (hi - lo), 0.5 * min(hi -
+    level, level - lo))`. The 0.10 is measured -- 5 % reads a 0.1 interferer and fails at 0.2
+    (`period=0.075`), 10 % holds to 0.3 and to white noise at sigma=0.05.
+  * **The clamp is load-bearing.** `PulseDuration` lets the user put the split near an extreme, and
+    a fixed tenth of the span there puts the upper threshold *above every sample*: the walk never
+    decides that side and the measurement reads nothing at all, which is worse than reading
+    something noisy. On a ringing 3.3 V logic signal at a 90 % split: `enters=0` with a fixed band,
+    `enters=4 period=0.200000` with the clamp.
+  * **The `sum`/`count` split stays at the bare `level`.** That split *is* `Top`/`Bottom` -- the mean
+    above and below the threshold -- so a band there changes a documented exact reading. `top` on a
+    unit sine must still be `0.636620`.
+  * **`h = 0` must reduce exactly to the single-level walk**, including the `v == level` skip, so the
+    band is a parameter of the engine rather than a mode of it.
+  The cost is the noise's, not the band's: the clean fast mock reads `raw=119412 (0.1%)` of 215 M at
+  1.41 ms a recompute and with the 0.1 interferer `raw=2.0%` at 1.96 ms. A
+  `/tmp/check_measure.cpp`-style check is how the walk itself was verified (`g++ -std=c++20 -O2 -I
+  src ... src/measure.cpp`): over a clean sine, sines with 0.1 and 0.3 interferers, 10 %/50 % duty
+  squares and a 90 % threshold, the **bucket walk must equal the raw walk exactly** -- same
+  `enters`, same `count[]`, identical `first_enter`/`last_enter` to 0.0 -- which is the assertion
+  that the fast path is a fast path and not an approximation. The app's reading is
+  `[measures-probe]` against `--noise 0.1`.
+
 - **The math channels' cost is the *producer's*, and the instrument must not be part of it.**
   `push_math_sample()` runs once per stored slot -- up to the wire rate -- so what a regression
   here looks like is `gaps`, never a frame time. Three things were taken off that path and must