fix: the plot's two side margins are balanced, and the dump outlives its widgets

With the axis titles gone the left gutter was 200 px of an 870 px viewport and the right
side had no margin at all, so the newest tick's label was drawn half outside the plot and
the newest sample's ink landed on the frame.

Two causes on the left. The reservation covered `format_si()`'s `%.3g` fallback
(`-1.23e-45`), which no signal on an `Si` axis produces -- the widest real label for a
unitless axis is `-1.23m` -- and `note_y_gutter()` added 6 px of slack to a figure that is
already the maximum of the labels and last frame's floor, making the gutter a ratchet that
climbed to its 200 px cap in ~19 frames. It settles at 104 px now, with `axes.w changes: 1`
where it read 17.

The right side did not exist: a plot's `axes` rect reached the viewport's right edge by
construction. `deps/plotter` gains `Plot::set_right_gutter()` and `Figure::set_right_gutter()`
-- a want rather than a measurement, since nothing is drawn there, imposed figure-wide so
the rows end on one column as they already start on one. udpscope asks for half the widest
time label plus the label padding (59 px), x labels being centred on their tick.

Separately: the exit dump asked two destroyed widgets for their size, which is where the
"exactly two Gtk-CRITICALs" baseline came from. The pointer is freed memory by then, so a
run that had destroyed other windows first (UDPSCOPE_PROBE_HELP_MS opens three) segfaulted
in the middle of the dump instead. Both sizes are captured on the tick; a clean run now
carries no critical.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -62,7 +62,11 @@ app's plain `GtkApplicationWindow` is supported and warning-free; it was checked
 
 `deps/plotter` is upstream's own repository and this app's figure support was added
 there rather than worked around here: `Figure::set_min_y_gutter()` (a floor under the
-common left gutter), and in the GTK4 adapter `PlotArea`'s **figure mode** —
+common left gutter), `Figure::set_right_gutter()` / `Plot::set_right_gutter()` (an empty
+band on the *other* side, which the layout had no concept of — `axes` reached the
+viewport's right edge, so the rightmost x tick label was centred on a line it had half of
+itself outside of; the guard is `figure_rows_share_one_right_gutter`), and in the GTK4
+adapter `PlotArea`'s **figure mode** —
 `set_figure()`, one `input::Controller` per row, nearest-row event routing, a
 figure-wide crosshair — plus `PlotArea::row_at()` for naming the row a pointer is over.
 
@@ -110,9 +114,18 @@ Two baselines every run is read against. A clean build emits **five** warnings a
 `-Woverlength-strings` on **both** generated GResource `.c` files — the help pages' and the
 icons', whose blob crossed C99's 4095-byte string-literal limit when the two app icons joined the
 four action ones (a note about a generated file, which GCC itself supports). And an exit-dump run
-emits exactly **two** `Gtk-CRITICAL`s, `gtk_widget_get_height` and `gtk_widget_get_width`, from
+emits **no** `Gtk-CRITICAL` at all. A sixth warning, or any critical, is a finding.
-the dump asking a destroyed widget for its size. A sixth warning, or a third critical, is a
+
-finding.
+That second baseline used to be "exactly two, `gtk_widget_get_height` and `gtk_widget_get_width`,
+from the dump asking a destroyed widget for its size", and tolerating them was a mistake: the dump
+runs from the destroy handler, so the widget pointer is **freed memory**, and a critical is only
+the lucky reading of it. A run that had built and destroyed other windows first —
+`UDPSCOPE_PROBE_HELP_MS`, which opens three — has had that memory reused, and the same two calls
+then **SIGSEGV in the middle of the dump**, which reads as a truncated dump rather than as a
+crash in a debug line. Every size the dump prints is therefore captured on the *tick*, while the
+window is alive (`App::dbg_*`), and **no `gtk_widget_*` call may appear in the dump** — the
+`panel controls:` line was already written that way for the same reason, and that comment is the
+precedent, not an exception.
 
 - `UDPSCOPE_EXIT_AFTER_MS` — run the trigger-on → go-live probe, close the window,
   then dump the whole pipeline state to stdout (frame/sample counts, per-plot painted
@@ -251,10 +264,18 @@ Two lines of the self-check output are assertions in disguise:
   monotone (`plot_host.cpp`), its one-shot widest-label reservation can land a frame or
   two after the first measured frame, and the figure serves its floor out of the label
   strip (`y_width = max(measured, floor - y_title_w)`, `plot.cpp`) so the reservation
-  converges over two layouts rather than one. A `y-gutter 44..74` dragging
+  converges over two layouts rather than one. A `y-gutter 88..104` dragging
-  `axes.x 67..80`/`axes.w 546..559` with it is that settle, not a twitch — confirm it
+  `axes.x 88..104`/`axes.w 707..782` with it is that settle, not a twitch — confirm it
   with the `changes` line below. A range that keeps moving is the "twitching axis" bug:
-  the plot being re-measured every frame. **`x-desync` must read 0**: it counts frames
+  the plot being re-measured every frame. **A range that keeps *climbing* to 200 is the
+  other one**: `note_y_gutter()` is handed the gutter the row was laid out with, which
+  already includes the floor imposed last frame, so slack added to it is added again every
+  frame and the gutter ratchets to its own 200 px cap — `axes.x 88..200 / y-gutter 88..200
+  / axes.w changes: 17` on an 870 px viewport is what that reads as, and 17 changes looks
+  like a settle. The reservation's own padding is the only slack there may be.
+  `axes.w` also no longer reaches the viewport's right edge: `apply_gutters()` reserves an
+  empty band there (~59 px of 870), so `viewport.w - axes.x - axes.w` is a *constant*, not
+  a zero. **`x-desync` must read 0**: it counts frames
   in which any row's x range differed from row 0's by more than a pixel of data, i.e.
   frames the x link group did not reach. `x-ticks` is content, not layout, and
   legitimately varies by one as a live
@@ -1175,8 +1196,18 @@ far the largest file.
   Its pan clamping is likewise gated on the data being wider than the view, or the empty
   left-hand side drags the live edge off the right-hand edge.
 - **Layout must not depend on content.** The y gutter is reserved at the widest label
-  `TickFormat::Si` can produce and only ever grows; the status label is ellipsized so
+  `TickFormat::Si` can produce *for an axis with no unit* — a sign, three significant
+  figures and a one-glyph prefix, measured and not counted in characters — and only ever
+  grows; the status label is ellipsized so
   its text cannot drive the paned divider. Both exist to stop per-frame relayout.
+  The reservation deliberately does **not** cover `format_si()`'s `%.3g` fallback
+  (`-1.23e-45`), which it used to: that form needs a value past 1e24, so it bought a third
+  of the gutter for a label no stream produces, and the floor being a monotone maximum over
+  the *measured* need means one that did appear widens the gutter for good anyway. Erring
+  wide is not free here — it is a third of the plot's width.
+  And **nothing may add slack to the gutter it is told**: `note_y_gutter()`'s argument is
+  `layout().y_axis_width`, which is `max(measured, floor)` — partly our own answer coming
+  back — so a constant added to it compounds. See the ratchet reading under Verification.
   The same rule is why the activity badge is one glyph in three colours rather than
   three glyphs, why the `rate` field collapses to one figure or a range instead of a
   per-channel list, and why `format_elapsed()` steps to a coarser unit instead of
@@ -1186,6 +1217,16 @@ far the largest file.
   plotter for this), not on the rows: `Figure::layout()` clears every row's
   `set_min_y_gutter()` to measure what its own labels need, so a floor written onto the
   rows survives exactly until the next layout.
+- **The right-hand band is a want, and the left gutter is a measurement.** The two sides of
+  the plot are not symmetric in kind: the left holds the y labels, so it is measured and
+  floored; the right holds nothing, so there is nothing to measure and `RowSet` simply asks
+  for half the widest time label plus the label padding (`right_gutter_px_`, reserved in the
+  same one-shot block). Half a label is the figure that matters: an x tick label is
+  *centred* on its tick and a live axis is `[-window, 0]`, so there is always a tick exactly
+  on the axes' right edge, and with `axes` flush to the viewport half of that label was
+  drawn outside the plot. Both go on the **figure** and for the same reason — the rows have
+  to end on one column as well as start on one — which is why `apply_gutters()` applies the
+  pair and `rebuild_all()` calls it: a new `Figure` carries neither.
 - **Signals start disabled** — enabling is what starts acquisition. A trigger on a
   signal nobody acquires can never fire, so selecting/arming enables it.
 - **The trigger's event window is separate from the display window**, and

README.md

@@ -41,6 +41,15 @@ both states, the frame and per-channel sample counts, each plot's painted-frame
 count, which channel each trace slot holds, and the allocated size and reveal
 state of both side panels.
 
+Every size it prints is read from a value the frame tick captured while the window was alive, not
+from the widget: the dump runs from the destroy handler, where the widget pointer is already freed
+memory. It used to ask two of them directly, which is where the long-standing "an exit-dump run
+emits exactly two `Gtk-CRITICAL`s" baseline came from — and a critical was only the lucky reading.
+`UDPSCOPE_PROBE_HELP_MS` builds and destroys three windows of its own before the dump, so by then
+the memory had been reused and the same two calls **crashed in the middle of the dump**, which
+looks like a truncated log rather than like a segfault in a debug line. The dump now makes no
+`gtk_widget_*` call at all and a clean run carries no critical.
+
 ## Layout
 
 ```
@@ -1083,13 +1092,40 @@ which is how the second one was found:
    what its labels need, so a floor written onto the rows would survive exactly
    until the next layout. The figure seeds its common gutter — the maximum over
    the rows, which is also what aligns their axes — with that reservation.
+   The reservation is the widest label `format_si()` writes for an axis with no
+   unit (a sign, three significant figures and a one-glyph prefix), not the
+   wider `%.3g` fallback it used to cover: that form needs a value past 1e24, so
+   it cost a third of the gutter for a label no real signal produces — and since
+   the floor is a monotone maximum over the *measured* need, one that did appear
+   would widen the gutter for good anyway.
 2. *The status line drove the pane width.* A `GtkLabel`'s minimum width is its
    text, and the status line is rewritten every frame; as its counters and
    messages changed width they moved the paned divider, which resized the plot,
    which re-laid out the axes and their ticks. The label is now ellipsized, so its
    minimum is “…”; the plot keeps the width it was given.
+3. *The gutter was a ratchet.* `note_y_gutter()` is handed the gutter the row was
+   **laid out with** — already the maximum of its labels and the floor imposed on
+   the frame before — and it added six pixels of slack to it. Those six pixels came
+   back next frame and were added again, so the left margin climbed a decade of
+   pixels a second until it hit the 200 px cap and stopped: 200 px of an 870 px
+   viewport, with `axes.w changes: 17` beside it, which reads as a settle and is a
+   runaway that ran out of room. The reservation's own padding is the slack, once;
+   nothing is added to a measurement that is partly our own answer.
 
-The self-check reports both. `viewport.w` must collapse to a single value, and
+**The two sides are balanced.** The axes rect used to reach the viewport's right
+edge, because that is all the library's layout had ever reserved — so the
+rightmost x tick label, *centred* on its tick, had half of itself outside the plot
+(a live axis is `[-window, 0]`, so there is always a tick exactly on that edge) and
+the newest sample's ink landed on the frame. `Plot::set_right_gutter()` and
+`Figure::set_right_gutter()` were added upstream for this: an empty band, served
+from the same half-viewport allowance as the label and title strips, set once on
+every row because the rows' axes have to end on a common column as well as start on
+one. `RowSet` asks for half the widest time label plus the label padding, which is
+exactly what the last label needs to be drawn whole. With the two fixes above the
+figure now sits in a 104 px left gutter holding the y labels and a 59 px empty band
+on the right, where it was 200 px and nothing.
+
+The self-check reports all of it. `viewport.w` must collapse to a single value, and
 `axes.x`, `axes.w` and `y-gutter` must settle: the one-shot label reservation
 lands a few frames after the first measured frame, and because the figure serves
 its floor out of the label strip the reservation converges over two layouts, so
@@ -1100,9 +1136,9 @@ bug. `x-ticks` is content, and varies by one as a live window slides over a roun
 number:
 
 ```
-layout over 952 frames: axes.x 67..80, axes.w 546..559, viewport.w 627..627,
+layout over 583 frames: axes.x 88..104, axes.w 707..782, viewport.w 870..870,
-                        y-gutter 44..74, x-ticks 20..21, x-desync 0
+                        y-gutter 88..104, x-ticks 20..41, x-desync 0
-axes.w changes: 2 (last at frame 35, side panel up=1)
+axes.w changes: 1 (last at frame 1, side panel up=1)
 ```
 
 Set `UDPSCOPE_PROBE_PAUSE_MS=<ms>` to pause the acquisition part-way through a
@@ -1430,7 +1466,7 @@ them all with nothing to propagate by hand. The live follow is the *group's*
 (`set_x_link_follow`), not each row's — `Figure::link_x()` refuses a member whose
 own axis still follows, because a following axis would reinterpret the pushed
 range as its own span and offset behind its own edge, which is per-row drift by
-construction. The figure also owns the left gutter and the crosshair, so a
+construction. The figure also owns both gutters and the crosshair, so a
 vertical feature lands in the same pixel column in every row.
 
 The self-check's layout line carries `x-desync N`, the number of frames in which

src/help/04-layout.txt

@@ -1,7 +1,10 @@
 <b>Rows, layout and drag &amp; drop</b>
 
 The figure is a stack of rows, 1 to 8 of them, each holding up to 4 traces. Rows share one
-time axis and one left gutter, so their y labels line up and their windows cannot drift apart.
+time axis and one pair of side margins, so their y labels line up, their data areas start and
+end on the same two columns, and their windows cannot drift apart. The left margin holds the y
+labels; the right one is empty, and is there so the newest tick's label and the newest sample's
+ink have somewhere to land instead of sitting on the frame.
 
 <b>How to reach it</b>
 

src/plot_host.cpp

@@ -125,9 +125,9 @@ bool RowSet::remove_row(int at) {
 void RowSet::install(Row& r, int /*row_index*/, plot::Plot& p) {
   r.plot = &p;
   r.axis_x = r.plot->add_x_axis(
-      {"time", {-1.0, 1.0}, true, plot::AxisPlace::Bottom, false, plot::TickFormat::Time});
+      {"", {-1.0, 1.0}, true, plot::AxisPlace::Bottom, false, plot::TickFormat::Time});
   r.axis_y = r.plot->add_y_axis(
-      {"value", {-1.0, 1.0}, true, plot::AxisPlace::Left, false, plot::TickFormat::Si});
+      {"", {-1.0, 1.0}, true, plot::AxisPlace::Left, false, plot::TickFormat::Si});
   for (int s = 0; s < kSlotsPerRow; ++s) {
     const std::size_t i = static_cast<std::size_t>(s);
     r.plot->add_trace(
@@ -199,7 +199,7 @@ void RowSet::rebuild_all() {
     }
     figure_->link_x(static_cast<plot::u32>(i), x_group_);
   }
-  if (y_gutter_px_ > 0.0) apply_y_gutter();
+  apply_gutters();
   // A new figure starts with no window at all, so the one the rows were showing has to
   // be restated -- as the pin it was, if an event is on screen: assigning a trace or
   // changing the row count while a capture is displayed must not throw the view back
@@ -844,10 +844,16 @@ void RowSet::fit_all() {
 }
 
 void RowSet::note_y_gutter(double need_px) {
-  double want = std::min(need_px + 6.0, 200.0);
+  // No slack added here, and that is load-bearing: `need_px` is the gutter the row was
+  // *laid out with*, which is already the maximum of its labels and the floor imposed last
+  // frame -- so a few pixels added to it are added again next frame. The `+ 6.0` this used
+  // to carry made the gutter a ratchet that climbed 6 px a frame until it hit the cap
+  // below, which is the whole reason the left margin was `200` of an 870 px viewport (and
+  // the `axes.w changes: 17` beside it). The label padding the reservation below adds is
+  // the slack, once.
+  double want = std::min(need_px, 200.0);
   // Reserve room for the widest label the formatter can produce, once, with the
-  // font the labels are actually drawn in (the embedded font is monospaced, so a
+  // font the labels are actually drawn in.
-  // character count is an exact width).
   if (!y_gutter_reserved_) {
     for (int i = 0; i < rows_; ++i) {
       Row& r = row(i);
@@ -855,10 +861,19 @@ void RowSet::note_y_gutter(double need_px) {
       const plot::render::TextBackend* text = r.plot->text_backend();
       if (text == nullptr) continue;
       const plot::render::Style& style = r.plot->style();
-      const double advance = double(text->measure("0123456789")) / 10.0;
       const double pad = double(style.device(style.grid_label_pad));
-      // "-1.23e-45" is the longest label `format_si()`'s fallback can print.
+      // A sign, three significant figures and a one-glyph SI prefix: the widest label
-      want = std::max(want, 9.0 * advance + 2.0 * pad + 2.0);
+      // `format_si()` writes for an axis with no unit, measured rather than counted in
+      // characters. Its `%.3g` fallback is wider (`-1.23e-45`) and was what this reserved,
+      // which cost a *third* of the gutter for a label no signal on a `Si` axis produces --
+      // it needs a value past 1e24, and `note_y_gutter()` is a monotone maximum over the
+      // measured need, so one that did appear widens the gutter for good anyway.
+      want = std::max(want, double(text->measure("-1.23m")) + 2.0 * pad + 2.0);
+      // The other side, from the same metrics. An x tick label is *centred* on its tick and
+      // the newest tick sits on the axes' right edge (a live axis is [-window, 0]), so half
+      // the widest time label is what the rightmost one needs to be drawn at all -- and that
+      // is also the band which keeps the newest sample's ink off the frame.
+      right_gutter_px_ = 0.5 * double(text->measure("-1.23ms")) + pad;
       y_gutter_reserved_ = true;
       break;
     }
@@ -866,9 +881,10 @@ void RowSet::note_y_gutter(double need_px) {
   if (want > y_gutter_px_) y_gutter_px_ = want;
 }
 
-void RowSet::apply_y_gutter() {
+void RowSet::apply_gutters() {
-  if (!figure_ || !(y_gutter_px_ > 0.0)) return;
+  if (!figure_) return;
-  figure_->set_min_y_gutter(static_cast<f32>(y_gutter_px_));
+  if (y_gutter_px_ > 0.0) figure_->set_min_y_gutter(static_cast<f32>(y_gutter_px_));
+  figure_->set_right_gutter(static_cast<f32>(right_gutter_px_));
 }
 
 void RowSet::set_trigger_marker(double x, bool visible) {

src/plot_host.hpp

@@ -373,18 +373,22 @@ class RowSet {
   /// left and right by a few pixels every frame. Since `set_min_y_gutter()` is a
   /// floor and the library still takes the larger of the two, a floor smaller than
   /// the labels cannot stop that; the reservation therefore covers the widest label
-  /// `format_si()` can produce (three significant digits, a sign and a prefix, or the
+  /// `format_si()` writes for an axis with no unit -- a sign, three significant figures
-  /// `%.3g` fallback) plus the label padding, measured once with the plot's own font.
+  /// and a one-glyph prefix -- plus the label padding, measured once with the plot's own
-  /// Both reservations only ever grow, so the gutter is constant in practice.
+  /// font. Both reservations only ever grow, so the gutter is constant in practice.
+  ///
+  /// The same metrics fix the **right** gutter, which is a want and not a measurement:
+  /// see `apply_gutters()`.
   void note_y_gutter(double need_px);
 
-  /// Applies the stable gutter as the figure's floor. Call once per frame, before the
+  /// Applies the stable left gutter as the figure's floor, and the right gutter beside
-  /// frame is drawn.
+  /// it. Call once per frame, before the frame is drawn.
   ///
-  /// It has to be the *figure's* floor and not each row's: `Figure::layout()` clears
+  /// Both have to be the *figure's* and not each row's: `Figure::layout()` clears every
-  /// every row's `set_min_y_gutter()` to measure what its own labels need, so a floor
+  /// row's `set_min_y_gutter()` to measure what its own labels need, so a floor written
-  /// written onto the rows survives exactly until the next layout.
+  /// onto the rows survives exactly until the next layout, and the rows have to end on
-  void apply_y_gutter();
+  /// one column as well as start on one.
+  void apply_gutters();
 
   /// The palette entry `index`, wrapped. Keyed by the *signal*, so that the colour a
   /// trace is drawn in is the colour the signal list's chip shows, on every row the
@@ -431,6 +435,9 @@ class RowSet {
   /// gesture to be honoured; one that matches it is just the clamp's own answer arriving back.
   plot::Range pinned_stated_{0.0, 0.0};
   double y_gutter_px_ = 0.0;
+  /// The empty band kept to the right of the data, device pixels. Nothing is drawn in it,
+  /// so it is reserved once from the font's metrics and never measured or grown.
+  double right_gutter_px_ = 0.0;
   bool y_gutter_reserved_ = false;
   std::array<Row, static_cast<std::size_t>(kMaxRows)> storage_{};
   CursorMode cursor_mode_ = CursorMode::Vertical;

src/ui.cpp

@@ -274,6 +274,13 @@ struct App {
   int dbg_win_btn_w = -1;
   int dbg_win_label_w = -1;
   int dbg_bar_w = -1;
+  /// The measurements pane's allocation, for the same reason and more urgently: the dump used
+  /// to ask the widget itself, which is where the two documented `Gtk-CRITICAL`s came from --
+  /// and a critical is the lucky outcome. The pointer is freed memory by then, so a run that
+  /// built and destroyed other windows first (`UDPSCOPE_PROBE_HELP_MS`, three of them) has had
+  /// that memory reused and the read is a **SIGSEGV** in the middle of the dump.
+  int dbg_measures_pane_w = -1;
+  int dbg_measures_pane_h = -1;
   bool measures_revealed = false;
   /// The measurement dialog while one is open (null otherwise). A probe needs a handle on it:
   /// it is a window of its own, so the main window's widget tree does not reach its buttons.
@@ -4878,6 +4885,11 @@ gboolean tick(gpointer user) {
       std::fflush(stderr);
     }
   }
+  // Captured every frame so the dump has the last live value: see `dbg_measures_pane_w`.
+  if (app->measures_list != nullptr) {
+    app->dbg_measures_pane_w = gtk_widget_get_width(app->measures_list);
+    app->dbg_measures_pane_h = gtk_widget_get_height(app->measures_list);
+  }
   if (model.generation() != app->signal_generation) rebuild_signal_panels(*app);
   // A gesture moves the *plot's* cursor; adopting it here is what makes the two
   // vertical markers one time across every row, and what the pane then reads.
@@ -5243,7 +5255,7 @@ gboolean tick(gpointer user) {
     if (r.plot) gutter = std::max(gutter, double(r.plot->layout().y_axis_width));
   }
   app->rows->note_y_gutter(gutter);
-  app->rows->apply_y_gutter();
+  app->rows->apply_gutters();
 
   // The editor's buttons are placed from the rects this frame was laid out with, so they
   // follow a resize and the gutter settling without being told.
@@ -8566,8 +8578,7 @@ int run_ui(int argc, char** argv, const Config& cfg, ScopeModel& model, Acquisit
                   "pane_w=%d pane_h=%d\n",
                   app.measures.size(), app.measures_revealed ? 1 : 0,
                   rows.measure_marks_placed(), app.measure_labels.size(),
-                  app.measures_list != nullptr ? gtk_widget_get_width(app.measures_list) : -1,
+                  app.dbg_measures_pane_w, app.dbg_measures_pane_h);
-                  app.measures_list != nullptr ? gtk_widget_get_height(app.measures_list) : -1);
     }
     std::printf("[udpscope]   header: window_button_w=%d window_label_w=%d (bar_w=%d)\n",
                 app.dbg_win_btn_w, app.dbg_win_label_w, app.dbg_bar_w);