ui: tighten the badge/dock/tour probes after review and fix the tour's stale hole

The session old-file probe and save_scheduled now discriminate, Esc is read through the real key path, the dock-section probe proves the Measure section starts out of view, and the tour's spotlight is measured independently of the helper it is drawn from. A target scrolled out of its scroller no longer leaves the previous hole standing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/claude/verification.md

@@ -414,8 +414,8 @@ precedent, not an exception.
   `UDPSCOPE_ENABLE_ALL_MS` ahead of it and `UDPSCOPE_PROBE_MEASURE_MS` to add measurements first.
 - `UDPSCOPE_PROBE_SIDE_TAB_MS=3000` with `UDPSCOPE_EXIT_AFTER_MS=11000` — the measurements in the
   dock's Measure section, a forced pass, then the dock scrolled back to the signal list (the Measure
-  section out of view) and read again two seconds later. The probe pads the dock to 3000 px so a scroll is
-  observable on a short window. **`advanced=4`
+  section out of view) and read again two seconds later. The probe pads the dock page and the signal list to
+  3000 px each so the Measure section really starts below the viewport (`outside_at_top=1`) on any real window. **`advanced=4`
   is the assertion** (every accumulator gained passes while its section was out of view); `advanced=0` is the
   defect where the accumulation is gated on the visible section, which would leave a gap in min/max/avg for
   exactly as long as the trigger was on screen. It enables *and plots* its own signal, so it needs no other
@@ -476,13 +476,13 @@ precedent, not an exception.
   - **a rejected code:** mock `--code 1234`, app `code=7`: one error line, the retries stop.
 - `UDPSCOPE_PROBE_E1608_GEN=1500` with `UDPSCOPE_EXIT_AFTER_MS=5500`, run as `--source e1608 --source-opt
   address=127.0.0.1 --source-opt port=54711 --source-opt ao0_init=0 --source-opt gen_rate=100` against
-  `tools/mock_e1608.py --port 54711 --log /tmp/e1608-gen100.log` -- the generator's update rate: it starts a Sine on
-  DAC 0 through the Analog out panel (and opens the `source-ao` slide-over page, since the panel refreshes on its
-  frame clock, which does not tick for a page that is off screen; the page is closed again at the end), waits 2.5 s, reads the achieved rate and the
-  panel's "Update rate" row, stops the generator and reads both again 400 ms later. Two lines, in
-  `probe-readings.md`. Then count the mock log's `AOUT` lines: about 250 with `gen_rate=100` (the generator ran
-  for about 2.5 s) and about 125 for a run without the option (default 50 Hz). Short and serial, the mock killed
-  afterwards. It enables nothing else, so it can run alone.
+  `tools/mock_e1608.py --port 54711 --log /tmp/e1608-gen100.log` -- the generator's update rate: it starts a Sine
+  on DAC 0 through the Analog out panel (and opens the `source-ao` slide-over page, since the panel refreshes on
+  its frame clock, which does not tick for a page that is off screen; the page is closed again at the end),
+  waits 2.5 s, reads the achieved rate and the panel's "Update rate" row, stops the generator and reads both
+  again 400 ms later. Two lines, in `probe-readings.md`. Then count the mock log's `AOUT` lines: about 250 with
+  `gen_rate=100` (the generator ran for about 2.5 s) and about 125 for a run without the option (default
+  50 Hz). Short and serial, the mock killed afterwards. It enables nothing else, so it can run alone.
 - `UDPSCOPE_PROBE_E1608_RECONNECT=8000` -- reads the source after the mock dropped the link and 500 ms
   later checks the frame count moved on. The reading's own entry is in `probe-readings.md`.
 - `UDPSCOPE_PROBE_E1608_SCAN=1000` with `UDPSCOPE_EXIT_AFTER_MS=6500`, run as `--source e1608 --source-opt