Fix DeleteLineArea/InsertLineArea panic from stale replay scroll margins (BUG-083)

[anutron]

What

A DECSTBM (CSI Pt;Pb r) or DECSLRM (CSI Pl;Pr s) scroll-region margin the agent set while its PTY was larger than the emulator now replaying its on-disk log survives verbatim into replay/preview byte tails — PTY resizes are never encoded IN the byte stream itself (they arrive out-of-band via SIGWINCH). Neither x/vt's DECSTBM/DECSLRM handlers nor ultraviolet's Buffer.DeleteLineArea/InsertLineArea clamp the margin/area against the emulator's own current Width()/Height(), so the next CSI n M (DL) or CSI n L (IL) the log replays indexes past the end of a Lines row/column slice and panics.

SafeEmuWrite already recovers from this (pre-existing), but its recover-and-drop discards the entire Write() call's content, not just the offending sequence — so every hit silently loses whatever came after the stale margin. Ground truth from ~/.argus/ux.log: ~400 recovered panics/minute during active Hera rail navigation, specifically on coordinator-pane replay binds — far more frequent than the existing code comment's "rare edge case" framing assumed, and a strong candidate for a chunk of the ongoing Hera pane garbling reports (distinct mechanism from the BUG-078/#964/#965/#968/BUG-081/BUG-082 family already fixed this week — same subsystem, no shared root cause).

Root cause, verified

• Minimal standalone repro: xvt.NewEmulator(48, 10).Write([]byte("\x1b[1;50r\x1b[3M")) panics with index out of range [10] with length 10 — the same class as production's [48] with length 48.
• Checked both vendored libraries' newest available upstream commits (2026-09-02, same day as this fix) — neither charmbracelet/x/vt nor charmbracelet/ultraviolet has patched this. PR Fix inert OSC-8 hyperlinks: bump vendored x/vt to upstream parser fix #962's x/vt bump only touched osc.go (unrelated OSC-8 fix); the newest ultraviolet buffer.go diff touches only RenderBuffer.SetCell/Clear/Fill, not DeleteLineArea/InsertLineArea.

Fix

ClampScrollRegion (internal/tui/terminal/marginfilter.go) is a FilterOSC-style one-shot byte-stream filter that recognizes the exact, unambiguous CSI <digits>[;<digits>] r|s shape (no private markers, no intermediates, no sub-parameters — everything else passes through byte-for-byte untouched) and clamps an out-of-bounds second parameter down to the target emulator's rows/cols before the sequence ever reaches x/vt.

Wired into the three "replay a log/ring tail into a freshly-sized emulator" boundaries: asyncReplayRebuild (the reported site), renderLive's readLiveRebuildHistory full-replay feed, and PreviewVT.Feed's full-replay branch. Deliberately not applied to plain incremental/ring-wrap-catch-up feeds, where the emulator is already correctly sized and a genuine live resize goes through emu.Resize() explicitly. SafeEmuWrite's recover-and-drop stays as defense-in-depth for genuinely unknown panics — this fix just removes the known, high-frequency cause.

Testing

• TestClampScrollRegion — table test over the clamp/no-op/pass-through matrix (oversized margins, in-bounds, omitted params, private markers, unrelated CSI finals, plain text).
• TestClampScrollRegion_StaleDECSTBMPanicsWithoutClamping / _FixesTheActualPanic — direct library-level repro, unclamped vs. clamped.
• TestTerminalPane_ReplayStaleScrollRegionDoesNotDropContent — end-to-end through the real asyncReplayRebuild pipeline; fails pre-fix with content written after the oversized DECSTBM missing from the rendered pane.
• Documented in context/knowledge/gotchas/pty-terminal.md as BUG-083.
• make pre-pr: build/vet/fmt-check/lint-pr/test-cover-gate all pass. make vuln fails on pre-existing stdlib CVEs unrelated to this change (CI runs it continue-on-error: true, confirmed in .github/workflows/ci.yml). TestSmoke_NewTaskFormPaste (unrelated internal/tui package, new-task-form paste path) is a known pre-existing -race flake — reproduced failing 1-of-5 in complete isolation on master too, untouched by this change.

🤖 Generated with Claude Code

[github-actions]

Merging this branch will decrease overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/drn/argus/internal/tui/terminal	96.69% (-0.41%)	👎

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/drn/argus/internal/tui/terminal/marginfilter.go	88.68% (+88.68%)	53 (+53)	47 (+47)	6 (+6)	🌟
github.com/drn/argus/internal/tui/terminal/previewvt.go	92.31% (ø)	39	36	3
github.com/drn/argus/internal/tui/terminal/terminalpane.go	97.35% (ø)	945	920	25

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/drn/argus/internal/tui/terminal/marginfilter_test.go