fix: terminate the Request on non-finite floats and non-reflexive UI values

[linkdata]

Summary

Replaces the scattered NaN/±Inf handling with a uniform fail-fast policy. A non-finite float64, or a jaws.UI value a container cannot use as a child — one that is not comparable at runtime or not equal to itself and so cannot serve as the pool map key (#179), or a nil interface that has no methods to render — is treated as a fatal contract violation: the offending *Request is logged and terminated instead of the value being blanked, deduped, or silently dropped.

Both failure domains converge on the existing Request.Cancel (which cancels the context and logs the cause via Jaws.Logger, mirroring the ErrRequestOverloaded teardown).

Domain A — unusable UI values in containers (fixes #179)

ContainerHelper keys its element pool by jaws.UI; a value containing math.NaN() is a legal comparable map key but NaN != NaN, so every reconcile missed the lookup and recreated the child (losing focus/selection/transitions, churning Remove/Append/Order). A value that is only statically comparable (an interface-held slice/map) additionally panicked when hashed, and a nil interface child later panicked in render.

The container is the only place a raw UI value is used as a map key (tags go through TagExpand; direct elements are keyed by Jid and never reconciled), so it is the guard:

• ContainerHelper validates the whole wanted-children slice before locking u.mu (in both RenderContainer and reconcile) and terminates on the first nil-interface / non-reflexive / runtime-incomparable child — before any child is created, hashed, or rendered. Validation must precede the lock because Request.Cancel runs the user logger synchronously and the locking contract forbids that under a lock — a logger re-entering the container would deadlock (pinned by a reentrant-logger regression test). The scan is cheap: one deferred recover for the whole slice and a plain self-comparison per child.
• Request.NewElement keeps only its original debug-build comparability assertion; it does not re-validate on the hot path, so container updates pay the guard once, not twice.
• jaws.NewErrUnusableUI(ui) produces UI-specific text (the tag package's "implement JawsGetTag" advice does not apply to a raw UI map key) and matches both tag.ErrNotUsableAsTag and tag.ErrNotComparable via errors.Is.

nil semantics. Only a nil interface is special: it is a legal map key but has no methods to render, so containers reject it and a direct NewElement(nil) yields a no-op Element (Element.JawsRender/JawsUpdate no-op a nil interface). A typed nil (a non-nil interface holding a nil pointer, e.g. (*Widget)(nil)) is comparable and equal to itself, so it is treated as usable, dispatches to its Renderer/Updater, and is reused as a stable pool key across updates; tolerating a nil receiver is the concrete type's responsibility (consistent with how the tag system treats typed-nil tags).

Domain B — non-finite floats

InputFloat (renderFloatInput / JawsUpdate / JawsInput) and the click path (runAtof → callEventHandler) terminate on any NaN/±Inf, browser-originated or server-side, dropping the empty-value="" coercion and the NaN self-inequality dedup. Overflow strings like 1e999 (which strconv.ParseFloat returns as ±Inf with a range error) are classified by the parsed result, so they terminate rather than being treated as malformed.

The bind adapter keeps its own guard: sanitizeFloatForT still rejects non-finite input and bind.ErrFloatNotFinite is retained, protecting the converted numeric adapters (MakeSetterFloat64 over an int/uint/float32 setter). A raw Setter[float64] is returned unwrapped and is guarded by the InputFloat widget instead.

Sentinel & docs

• New jaws.ErrValueNotFinite (float domain); the container domain matches tag.ErrNotUsableAsTag.
• Updated the UI / JawsContains contract docs, the exported InputFloat type and methods, Number/Range, and the tracked JAWS skill to describe the container-level guard, NewElement's debug-only assertion, and the nil / typed-nil / non-finite handling.

Performance

This is a no-regression change, not a claimed end-to-end speedup. The guard runs once per child on the update path (no double validation) and is allocation-free.

• End-to-end: the broad container benchmarks (BenchmarkContainerHelperUpdate{AppendHeavy,Mixed}) are dominated by rendering and allocation and are statistically level with main under order-balanced runs (all p ≥ 0.39); allocations unchanged.

• Focused scan (committed regression guard BenchmarkContainerValidateChildren, 1000 children):

  go test -run '^$' -bench BenchmarkContainerValidateChildren -benchmem -count=8 ./lib/ui/
  # ~1.6µs/op, 0 B/op, 0 allocs/op
  

  A one-off benchstat vs the prior per-child validator (baseline: the replaced approach that called NewErrUnusableUI for every child) over -count=8: 4.479µs → 1.608µs, −64.10% (p=0.000, n=8), 0 allocations both sides. This per-child figure is measured with the small benchChild concrete type; the absolute cost of a single self-comparison scales with the child value's type and size.

Tests

NaN/Inf tests assert termination; added coverage for click/context-menu termination (incl. overflow), NewErrUnusableUI (table: nil / NaN / statically- and runtime-incomparable / valid / typed nil, both errors.Is identities), direct NewElement(nil) (no-op, no panic) and typed-nil dispatch, the container across nil / NaN / runtime-incomparable children (terminate) plus a typed-nil child (rendered and reused across updates), whole-slice prevalidation on both render and update (a usable child before an unusable one creates no Element, produces no output, and commits nothing — creation proven absent via a monotonic-Jid probe Element, and on the update path reconcile is exercised directly and asserted to return four empty operation sets so nothing is queued), a reentrant-logger deadlock regression (asserts the callback ran; verified to fail without the pre-lock fix), the InputFloat render/update/input boundaries (incl. overflow), and NewElement's debug comparability assertion.

Verification

gofmt, go vet, staticcheck, golangci-lint (0 issues), gosec (0 issues), go test -race ./..., and go test -tags debug -race ./... — all clean.

Closes #179.