fix(ui): harden responsive_columns against stride-canceling spacing (#189)

* fix(ui): harden responsive_columns against stride-canceling spacing

Review follow-ups for the merged #187 responsive-grid work.

- responsive_columns clamps the per-tile stride to a positive value. A caller
  passing a spacing that cancels MIN_TILE_CELL_W previously divided by zero into
  an inf-derived usize::MAX column count, so the helper reported `preferred`
  columns even when far fewer tiles fit. Pinned with a regression test, plus a
  test for the preferred_columns == 0 -> 1 floor that had no coverage.
- deny.toml: mark the two unmaintained-crate advisory ignores with explicit
  drop-conditions, and record that RUSTSEC-2026-0192 (ttf-parser) is an
  unmaintained notice, not a memory-safety CVE (verified against the local
  RustSec advisory DB: informational = "unmaintained").

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* style: apply cargo fmt to tile_layout

Fixes the CI lint (cargo fmt --check) failure on this branch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(deny): ignore quick-xml RUSTSEC-2026-0194/0195 pending upstream bump

Both advisories are DoS-via-untrusted-XML in quick-xml < 0.41. The sole
consumer is wayland-scanner, a build-time proc-macro parsing vendored
Wayland protocol XML; no untrusted XML is parsed at runtime, so neither
issue is reachable in the shipped binary. wayland-scanner 0.31.10
(latest) still pins quick-xml ^0.39 — drop these ignores when it moves
to 0.41.

Closes #192.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: thewrz

deny.toml

@@ -13,9 +13,12 @@ db-urls = ["https://github.com/rustsec/advisory-db"]
 ignore = [
     # paste is unmaintained; transitive dep via lofty. No fix available without
     # lofty dropping its paste dependency upstream.
+    # TODO: drop this ignore once lofty releases a build free of paste.
     { id = "RUSTSEC-2024-0436", reason = "transitive via lofty, no patched version available upstream" },
-    # ttf-parser is unmaintained; transitive via iced's font stack. No safe
-    # upgrade is available until iced/cosmic-text/winit move off it upstream.
+    # ttf-parser is unmaintained (informational advisory, not a memory-safety
+    # CVE); transitive via iced's font stack. No safe upgrade until
+    # iced/cosmic-text move off it upstream.
+    # TODO: drop this ignore once the iced font stack no longer pulls ttf-parser.
     { id = "RUSTSEC-2026-0192", reason = "transitive via iced font dependencies, no patched version available upstream" },
     # quick-xml < 0.41 DoS via untrusted XML (quadratic attribute check /
     # unbounded namespace allocations). Sole consumer here is wayland-scanner,

src/ui/tile_layout.rs

@@ -34,9 +34,11 @@ pub fn fitted_tile_size(slot: Size) -> Size {
 pub fn responsive_columns(available_width: f32, preferred_columns: usize, spacing: f32) -> usize {
     let preferred = preferred_columns.max(1);
     let usable_width = available_width.max(0.0);
-    let columns_that_fit = ((usable_width + spacing) / (MIN_TILE_CELL_W + spacing))
-        .floor()
-        .max(1.0) as usize;
+    // Clamp the per-tile stride to a positive value: a caller-supplied spacing
+    // that cancels MIN_TILE_CELL_W would otherwise divide by zero into an
+    // inf-derived (usize::MAX) column count.
+    let stride = (MIN_TILE_CELL_W + spacing).max(1.0);
+    let columns_that_fit = ((usable_width + spacing) / stride).floor().max(1.0) as usize;
 
     preferred.min(columns_that_fit)
 }
@@ -161,4 +163,21 @@ mod tests {
     fn responsive_columns_never_exceeds_preferred_columns() {
         assert_eq!(responsive_columns(1128.0, 1, theme::space::LG), 1);
     }
+
+    #[test]
+    fn responsive_columns_floors_zero_preferred_to_one() {
+        assert_eq!(responsive_columns(1128.0, 0, theme::space::LG), 1);
+    }
+
+    #[test]
+    fn responsive_columns_does_not_overflow_on_stride_canceling_spacing() {
+        // A pathological spacing that cancels the tile stride must not divide by
+        // zero into an inf-derived usize::MAX column count: a 185px width fits
+        // far fewer than the 8 preferred tiles, so it must report fewer.
+        let cols = responsive_columns(185.0, 8, -MIN_TILE_CELL_W);
+        assert!(
+            cols < 8,
+            "stride-canceling spacing inflated columns to {cols}"
+        );
+    }
 }