fix: close Θ-W7-T1 review — scaling guard, opacity claims, two vacuous test fixes

Guards the stroke blend against LICE_EXT_GET_SCALING, tightens the analytic-stroker's boxes and NaN handling, corrects the opaque-core threshold and inner-dial rationale in the docs, and re-derives two review-flagged tautological tests so they actually fail against the bugs they claim to catch.

src/core/ui/CLAUDE.md

@@ -101,7 +101,7 @@ L7 sub-pass, 2026-07-27):
 - `tooltip` — pure tooltip placement + prefix-strip: strips the `ReaSampler:` display prefix from the registered action phrase; width clamped to the client rect.
 - `card_drag` — pure drag-gesture precedence + slot hit-test: leave-client → OS drag-out; other-bank → move/copy; same-bank → reorder / Alt-over-occupied → replace.
 - `card_meta` — pure card-metadata formatters: bars.beats.subdivisions and seconds.milliseconds; blank when the sample is unstamped.
-- `stroke_aa` — analytic antialiased thick-stroke COVERAGE (the shell blends it): `StrokeCanvas`, a reusable mask holding distance-to-polyline coverage MAX-accumulated across segments, plus `strokePolyline` / `strokeBounds` / `appendArc`. An arc is just a flattened polyline, so ONE path serves the knob arcs, the inner dial, the envelope polyline and both spline traces. Coverage is `clamp(halfWidth + 0.5 - distance, 0, 1)`, which makes perpendicular weight exactly `2·halfWidth` at every angle and gives an opaque core for any width above 1 px. Long segments are subdivided before rasterizing — EXACT, not an approximation (min-distance to a partition of a segment is min-distance to the whole), purely to keep each piece's bounding box tight, since one long diagonal's box has area O(len²).
+- `stroke_aa` — analytic antialiased thick-stroke COVERAGE (the shell blends it): `StrokeCanvas`, a reusable mask holding distance-to-polyline coverage MAX-accumulated across segments, plus `strokePolyline` / `strokeBounds` / `appendArc`. An arc is just a flattened polyline, so ONE path serves the knob arcs, the inner dial, the envelope polyline and both spline traces. Coverage is `clamp(halfWidth + 0.5 - distance, 0, 1)`, which makes perpendicular weight exactly `2·halfWidth` at every angle. **The guaranteed-opaque-core threshold is width ≥ 2 px, not any width above 1 px**: opacity needs `distance <= halfWidth - 0.5`, and the worst-case distance from a pixel centre to the centreline is 0.5, so a 1 px stroke (`halfWidth = 0.5`) has zero slack — its peak alpha modulates with the stroke's exact alignment to the pixel grid instead of pinning to 255 (the knob track arc and the mini curve-thumbnail trace are both 1 px and both live with this). Long segments are subdivided before rasterizing — EXACT, not an approximation (min-distance to a partition of a segment is min-distance to the whole), purely to keep each piece's bounding box tight, since one long diagonal's box has area O(len²).
 
 ## Gotchas
 

src/core/ui/stroke_aa.cpp

@@ -56,16 +56,26 @@ void StrokeCanvas::extendRow(int y, int x0, int x1) {
 }
 
 void StrokeCanvas::addPiece(float ax, float ay, float bx, float by, float halfWidth) {
+    // Every current caller feeds bounded geometry, but this is a pure module: a NaN/Inf
+    // coordinate would otherwise reach static_cast<int> below, which is UB rather than a
+    // clipped no-op.
+    if (!(std::isfinite(ax) && std::isfinite(ay) && std::isfinite(bx) && std::isfinite(by) &&
+          std::isfinite(halfWidth))) {
+        return;
+    }
     const float reach = halfWidth + 0.5f;  // beyond this the coverage is 0
     const float dx = bx - ax;
     const float dy = by - ay;
     const float len2 = dx * dx + dy * dy;
     const float invLen2 = len2 > 0.0f ? 1.0f / len2 : 0.0f;
 
-    int x0 = static_cast<int>(std::floor((std::min)(ax, bx) - reach));
-    int x1 = static_cast<int>(std::ceil((std::max)(ax, bx) + reach)) + 1;
-    int y0 = static_cast<int>(std::floor((std::min)(ay, by) - reach));
-    int y1 = static_cast<int>(std::ceil((std::max)(ay, by) + reach)) + 1;
+    // A pixel can only take ink when its centre (x+0.5) is within `reach` of the piece, i.e.
+    // x + 0.5 < maxX + reach — so the exclusive upper bound is floor(maxX + reach + 0.5), not
+    // ceil(maxX + reach) + 1 (a whole extra pixel of guaranteed-zero coverage on every side).
+    int x0 = static_cast<int>(std::ceil((std::min)(ax, bx) - reach - 0.5f));
+    int x1 = static_cast<int>(std::floor((std::max)(ax, bx) + reach + 0.5f));
+    int y0 = static_cast<int>(std::ceil((std::min)(ay, by) - reach - 0.5f));
+    int y1 = static_cast<int>(std::floor((std::max)(ay, by) + reach + 0.5f));
     x0 = (std::max)(x0, bounds_.x);
     y0 = (std::max)(y0, bounds_.y);
     x1 = (std::min)(x1, bounds_.right());
@@ -123,11 +133,20 @@ Rect strokeBounds(const StrokePoint* pts, std::size_t count, float halfWidth, co
         minY = (std::min)(minY, pts[i].y);
         maxY = (std::max)(maxY, pts[i].y);
     }
+    // Same NaN/Inf guard as addPiece: an unbounded coordinate must clip to nothing, not reach
+    // the static_cast<int> below as UB.
+    if (!(std::isfinite(minX) && std::isfinite(maxX) && std::isfinite(minY) &&
+          std::isfinite(maxY) && std::isfinite(halfWidth))) {
+        return Rect{};
+    }
     const float reach = halfWidth + 0.5f;
-    const int x0 = (std::max)(clip.x, static_cast<int>(std::floor(minX - reach)));
-    const int y0 = (std::max)(clip.y, static_cast<int>(std::floor(minY - reach)));
-    const int x1 = (std::min)(clip.right(), static_cast<int>(std::ceil(maxX + reach)) + 1);
-    const int y1 = (std::min)(clip.bottom(), static_cast<int>(std::ceil(maxY + reach)) + 1);
+    // Same tightened box as addPiece (see its comment): a pixel only takes ink when its centre
+    // is within `reach`, so this is [ceil(min-reach-0.5), floor(max+reach+0.5)) rather than the
+    // old ceil/floor pair that padded a whole extra pixel on every side.
+    const int x0 = (std::max)(clip.x, static_cast<int>(std::ceil(minX - reach - 0.5f)));
+    const int y0 = (std::max)(clip.y, static_cast<int>(std::ceil(minY - reach - 0.5f)));
+    const int x1 = (std::min)(clip.right(), static_cast<int>(std::floor(maxX + reach + 0.5f)));
+    const int y1 = (std::min)(clip.bottom(), static_cast<int>(std::floor(maxY + reach + 0.5f)));
     if (x0 >= x1 || y0 >= y1) return Rect{};
     return Rect::ltrb(x0, y0, x1, y1);
 }

src/core/ui/stroke_aa.h

@@ -84,4 +84,14 @@ void strokePolyline(StrokeCanvas& canvas, const StrokePoint* pts, std::size_t co
 void appendArc(std::vector<StrokePoint>& out, float cx, float cy, float radius, float startRad,
                float endRad, float flatnessPx = kArcFlatnessPx);
 
+// The row-major element offset of row `y` within a `rowSpan`-elements-per-row pixel buffer,
+// accounting for a possibly bottom-up (`flipped`) layout. Pulled out of the shell's LICE blend
+// so its flipped branch — dead for every bitmap type the shell actually constructs, and
+// otherwise unverifiable without a live LICE surface — is pinned by a host-free test. Matches
+// LICE's own row math (`lice.cpp`'s `LICE_SysBitmap` pixel accessor: `(h-1-y)*rowspan + x`).
+inline std::size_t rasterRowOffset(int y, int height, int rowSpan, bool flipped) {
+    const int row = flipped ? height - 1 - y : y;
+    return static_cast<std::size_t>(row) * static_cast<std::size_t>(rowSpan);
+}
+
 }  // namespace reasampler::ui