working on todo.md features

docs/claude/invariants-gtk-and-chrome.md

@@ -42,12 +42,12 @@ Part of [CLAUDE.md](../../CLAUDE.md). These are rules that cost a defect to lear
   runs after the window is destroyed and asking GTK about a widget then is four criticals, which is
   how the first version of that line earned them. What stays in the menu is what acts on the *data*
   (Fit, Export) and the two editors that are not panes (Layout, Signal list). The Arm/Disarm button in the trigger panel still has text.
-- **Six of this app's icons are its own, and they are a `GResource` compiled into the
+- **Seven of this app's icons are its own, and they are a `GResource` compiled into the
   binary.** No icon theme has a glyph for an oscilloscope trigger, a pair of cursors or a
   measurement ruler, and the stock names those buttons used to carry said something else
   entirely: a *record dot* for the trigger and three different **magnifiers** for cursors,
-  measurements and math. `src/icons/scalable/actions/udpscope-{trigger,cursors,measure,math}-symbolic.svg`
-  are the four action icons; beside them in `src/icons/scalable/apps/` are the two
+  measurements and math. `src/icons/scalable/actions/udpscope-{trigger,cursors,measure,math,events}-symbolic.svg`
+  are the five action icons; beside them in `src/icons/scalable/apps/` are the two
   **application** icons, `org.udpscope.app.svg` (128px colour artwork) and
   `org.udpscope.app-symbolic.svg` (16px). The `apps` context is where an icon theme keeps an
   application's own icon and is where the **in-process** window icon resolves from; it is also
@@ -156,6 +156,57 @@ Part of [CLAUDE.md](../../CLAUDE.md). These are rules that cost a defect to lear
   They are `GtkPicture`s **with a height request**: one created `can_shrink` asks for *no* height
   at all inside a box, so without the request it is allocated nothing and the page renders its text
   with a silent gap where its screenshots should be — which is what the first version did.
+- **A `GtkPaned` hands its start child at least its minimum unless the position says otherwise.**
+  Putting the events pane in a paned is what makes its width the user's to drag -- but with the
+  position left alone, `shrink-start-child` or not, the pane's minimum is reserved as an empty column
+  while it is *closed*, and the plot pays for a pane nobody opened. The position is the only knob that
+  says "no room": store the width when it is closed (reading `gtk_paned_get_position()` *before*
+  zeroing it) and set 0, restoring it when the pane opens. `gtk_paned_set_shrink_start_child(TRUE)` is
+  still needed, or the minimum would clamp even a zero position.
+- **An unrevealed `GtkRevealer` measures 0x0 and is still given the leftover width.** `reveal_child
+  = FALSE` makes both the revealer's minimum and its natural size zero -- and its box then hands it
+  everything the expanding sibling beside it did not claim, so a *collapsed* pane reserved a
+  310-pixel empty column between the window edge and a plot drawn 630 pixels wide in a 1270-pixel
+  window. Every vertical revealer in the side panel hides this, because there the leftover goes down
+  instead of across. `gtk_widget_set_visible()` is what a layout honours, so anything that must not
+  take room has to be hidden and not merely unrevealed; the revealer keeps the slide while the pane
+  *is* open. The allocated width is how this was found -- the revealer's own measure said 0.
+- **A list box outlives the children of the pane it sits in, and the teardown order is not yours to
+  choose.** Tearing the window down finalizes the events pane's buttons, then the list box, and the
+  list's own `selected-rows-changed` then reaches a handler holding the freed pointers: four
+  `Gtk-CRITICAL`s from `gtk_widget_set_sensitive` and a read of memory nobody owns. `close-request` is
+  *not* the hook -- `UDPSCOPE_EXIT_AFTER_MS` ends the self-check with `gtk_window_destroy()`, which does
+  not emit it. The hook that does work is `App::window`: every teardown path clears it *before* the
+  widgets go (the exit probe says so in a comment: "stop the tick before the widgets go"), so a handler
+  that can fire during teardown checks that first, rather than asking GTK whether a pointer is still a
+  widget.
+- **A `GtkPicture`'s natural size *is* its content, so a size request on it is a floor, not a cap.**
+  A 480x160 texture in a row of a list claims the row's whole width and squeezes the text beside it
+  out of the row -- the box gives a non-expanding child its natural size and grows it further when
+  the expanding child has nothing left to take. Give the picture a **frame** whose size request equals
+  the **scaled texture's** size (natural == minimum, which is what stops the box growing it), and
+  scale the texture once at decode: it is also what keeps a per-row cache at 12 KB per picture rather
+  than 300.
+- **A pointer to a widget inside a list survives the list being rebuilt.** `events_thumb` named a row's
+  picture across `refresh_events_pane()`, which removes every row first: the next reader of that
+  pointer got a `Gtk-CRITICAL` from `gtk_picture_get_paintable` on freed memory (the four criticals
+  read as "the pane is empty"). A rebuild has to null what it is about to destroy, not only rebuild it.
+- **`gtk_picture_set_filename()` can render nothing, silently.** It hands the file to the image
+  loader's sandboxed, asynchronous decoder, which on this machine fails without a message: the
+  picture keeps a *paint-able* and takes an allocation, so a probe that checks
+  `gtk_picture_get_paintable()` reads success while the pane shows an empty rectangle (the event
+  pane's preview did exactly that). `gdk_texture_new_from_filename()` decodes the same file on this
+  thread and `gtk_picture_set_paintable()` hands over the result -- and a NULL texture at least says
+  so. A picture that must be on screen is also a picture with a **height request**: `can_shrink`
+  alone asks for no height at all in a box.
+- **Unparenting a popover inside its own `closed` emission is a use-after-free.** Dismissals go
+  through `gtk_popover_popdown()`, which emits `closed`; a handler that unparents the popover there
+  drops the reference the parent held, the widget dies, and GTK's own popdown path then runs on freed
+  memory — `gtk_popover_get_autohide: assertion 'GTK_IS_POPOVER (popover)' failed`, on every menu
+  entry that dismisses its popover, which is every entry there is. `on_popover_closed()` therefore
+  defers the unparent by one idle and holds a reference across it
+  (`g_idle_add_full(..., g_object_ref(popover), g_object_unref)`), so the popover outlives the
+  emission that dismissed it.
 - **`find_accel()` masks the modifiers before comparing.** Lock, Num-Lock and the pointer buttons
   all arrive in `GdkModifierType`, so an unmasked compare matches no table row at all once
   Caps Lock is on.