trigger: a phosphor display keeps the last N acquisitions; and a Force button

Two changes in the trigger pane, landed together.

**Persistence.** Trigger mode keeps the last N published acquisitions and draws them fading toward
the background, N being a panel control (1..8, default 1) with N=1 meaning today's behaviour
exactly, so the knob is the switch. The layers are the accumulate path's own -- one layer per
(signal, age) in the row's free trace slots, named with the accumulate vocabulary so
`layer_base_name()` strips the suffix and `signal_color()` resolves the base signal -- so a layer is
not a signal: the signal list, the colours and the measurements see one row per signal.
`ScopeModel` retains the outgoing snapshot in seven atomic `shared_ptr` slots (no lock, no copy; the
snapshot already exists) and a layer's channel is resolved **by name inside the snapshot**, because
the channel list is renumbered by any structural change since that acquisition was cut.
`RowSet::sync_layers()` re-plans from the rows and the depth alone, so a latch costs no rebuild, and
`event_data_window()` skips layer slots so an older acquisition can never re-pin the axis. The
schedule is 0.5^age -- the acquisition on screen at full brightness and each older one half the
previous, independent of N, so raising the depth adds dimmer acquisitions rather than rescaling the
ones already on screen. Memory is bounded by the ring's own `--buffer-mb` rather than by the depth,
which is the bound that cannot be driven into an OOM, and the panel says when either bound bites.
This also wired up `set_trace_alpha()`, which the accumulate path was setting and nothing was
reading -- so the documented 0.35 translucency of an accumulation was opaque in fact.

**Force.** In the trigger pane beside Arm/Disarm, shown only while trigger mode is on: one
acquisition now, with the configured window. It is a synthetic edge rather than a second publisher
-- the engine opens one capture at the present moment and everything else is the ordinary latch, so
a forced acquisition is cut, pinned, framed, recorded and cached exactly like a latched one, and
the button owns no window and no publish. The pre-trigger gate is deliberately skipped (capture now
is a request for the history that exists, and the snapshot reports its own shorter pre_s), a
capture already filling is refused rather than restarted, and the state afterwards is the mode's:
Normal stays armed, Single disarms. The request is one atomic flag written under the model mutex
with `armed` -- the producer reads `armed` at the top of a packet and the request at the bottom, so
a request written between the two would be dropped -- and consumed at the end of a packet, after
the channel loop and before the pending publish.

**A defect fixed in passing, in the function Force was modelled on:** `on_arm_clicked()` passed
`TriggerConfig::channel` (an index into `channels()`) to `set_signal_enabled()` (an index into
`signals()`). With one signal acquired, arming switched on the stream's clock signal and left the
watched signal untouched -- and since a signal the panel was not showing is a change, it rebuilt
the buffer under the click, dropping the very pre-trigger window the arming, and now the Force, was
about to capture. Measured before: `0.0100 s of history behind it`; after: `2.5299 s`.
`trigger_signal_index()` is now the one resolution, used by both buttons.

src/model.cpp

@@ -891,9 +891,11 @@ void ScopeModel::publish_event(double pre_s, double post_s, double edge) {
   }
 
   snap->values.resize(channels_.size());
+  snap->channel_names.resize(channels_.size());
   snap->y.resize(channels_.size(), plot::Range{0.0, 0.0});
   snap->pyramids.resize(channels_.size());
   for (std::size_t c = 0; c < channels_.size(); ++c) {
+    snap->channel_names[c] = channels_[c].name;
     auto& vals = snap->values[c];
     vals.resize(static_cast<std::size_t>(n));
     if (n > 0) src.values(c).copy_from(first, n, vals.data());
@@ -918,6 +920,24 @@ void ScopeModel::publish_event(double pre_s, double post_s, double edge) {
   // capture at the first sample past `post_s` rather than exactly on it.
   snap->pre_s = snap->stamps.empty() ? 0.0 : -static_cast<double>(snap->stamps.front());
   snap->post_s = snap->stamps.empty() ? 0.0 : static_cast<double>(snap->stamps.back());
+  // The persistence retention: what was on screen until now becomes the *newest of the older*
+  // acquisitions, and the set is cut back to the depth the panel asks for and to the retention
+  // budget. Nothing is retained at depth 1, so the default costs no memory and no copy at all.
+  if (const int depth = persist_depth_locked(); depth > 1) {
+    std::shared_ptr<const EventSnapshot> prev = event_.load(std::memory_order_relaxed);
+    if (prev != nullptr) {
+      // Only the slots the depth wants are shifted: the ones past it are the prune's business, and
+      // moving an acquisition into a slot nothing can ever read is work for a snapshot about to be
+      // dropped.
+      const std::size_t top = std::min(static_cast<std::size_t>(depth - 1), persist_.size());
+      for (std::size_t i = top; i-- > 1;) {
+        persist_[i].store(persist_[i - 1].load(std::memory_order_relaxed),
+                          std::memory_order_relaxed);
+      }
+      persist_[0].store(std::move(prev), std::memory_order_relaxed);
+    }
+  }
+  prune_persist_locked(static_cast<std::size_t>(persist_depth_locked() - 1));
   event_.store(std::move(snap), std::memory_order_release);
   // Bumped after the snapshot is in place, so a consumer that sees the new sequence
   // number sees the snapshot it counts.
@@ -963,6 +983,48 @@ void ScopeModel::set_trigger_enabled(bool on) {
   trigger_enabled_.store(on, std::memory_order_relaxed);
 }
 
+void ScopeModel::prune_persist_locked(std::size_t keep) {
+  const std::size_t limit = std::min(keep, persist_.size());
+  const std::size_t budget = persist_budget_bytes();
+  std::size_t bytes = 0;
+  std::size_t kept = 0;
+  std::uint64_t dropped = 0;
+  bool full = false;
+  for (std::size_t i = 0; i < persist_.size(); ++i) {
+    const std::shared_ptr<const EventSnapshot> snap = persist_[i].load(std::memory_order_relaxed);
+    if (snap == nullptr) continue;
+    if (i < limit) {
+      // Either bound can cut the set: the depth the panel asks for, and the budget, which a long
+      // window on a fast stream reaches long before the seventh layer.
+      const std::size_t b = snapshot_bytes(*snap);
+      if (!full && bytes + b <= budget) {
+        bytes += b;
+        ++kept;
+        continue;
+      }
+      full = true;  // does not fit, and neither does anything older
+      // Only what the *budget* refused is counted: a slot past the depth is not a drop, it is the
+      // depth -- and counting it would make the reading say the memory was the reason when the
+      // panel's own number was.
+      ++dropped;
+    }
+    persist_[i].store(nullptr, std::memory_order_relaxed);
+  }
+  persist_count_.store(kept, std::memory_order_relaxed);
+  persist_bytes_.store(bytes, std::memory_order_relaxed);
+  persist_dropped_.store(persist_dropped_.load(std::memory_order_relaxed) + dropped,
+                         std::memory_order_relaxed);
+}
+
+void ScopeModel::set_persist_depth(int depth) {
+  const int n = std::clamp(depth, 1, kMaxPersistDepth);
+  std::lock_guard<std::mutex> lock(mutex_);
+  trigger_.persist_depth = n;
+  // Pruned here and not only at the next latch: lowering the depth is the user asking to stop
+  // paying for the layers, and a trigger that has stopped firing never reaches another publish.
+  prune_persist_locked(static_cast<std::size_t>(n - 1));
+}
+
 void ScopeModel::set_epoch_if_unset(f64 e) noexcept {
   if (epoch_ == 0.0) epoch_ = e;
 }