chore(electron): 34 → 44 (Chromium 132 → 152, Node 20 → 24)

[CSSFrancis]

Electron 34 is ten majors behind and long past end of life. Support covers the latest three majors, so 34.5.8 is the final release of that line and will never be patched again — ~20 Chromium majors of unfixed CVEs in an app that renders HTML figures and fetches example data over the network.

	before	after
Electron	34.5.8	44.0.0
Chromium	132	152
Node	20.19.1	24.18.1

Pinned exactly in both package.json files, which must agree — see d70f4fb. The workspace hoists electron out of electron/node_modules, so electron-builder can't read the installed version, falls back to parsing the spec, and refuses a range. That failure is release-only and is what killed the v0.4.0 tag build.

What actually broke: two APIs

Both caught by typecheck.

• printToPDF's marginType is gone. The 'default' it named is now what you get by omitting margins entirely (1 cm a side), so the fix is a deletion.
• clipboard.writeImage is gone; the module is rearchitected to the W3C shape — MIME-typed ClipboardItems, all methods async. The nativeImage decode stays as the validity check that keeps junk off the user's clipboard.

CI needs one new step

Electron 42 dropped the postinstall binary download. npm ci now leaves node_modules/electron/dist empty and the ~100 MB fetch happens lazily on the first require('electron') — which in CI is inside the first spec that launches the app, where a slow or failed download reads as a mystery test timeout. npx install-electron makes it fail loudly on its own line.

Swept, not assumed

Checked every 35→44 breaking change against this codebase: Unity/Linux badge + progress APIs, pre-macOS-13 login-item attributes, win32-ia32/linux-armv7l targets, renderer-side clipboard, ANGLE static linking, webRequest filters, setPreloads, webFrame.routingId, desktopCapturer, session extension APIs. None are used here.

console-message keeps working — the WebContents overload still emits the positional arguments — but level was remapped, so the comment describing it was wrong and is corrected: 0=verbose 1=info 2=warning 3=error, which makes level >= 2 warnings-and-errors rather than errors-and-infos. Electron now logs a deprecation notice for the positional form; worth migrating before a future major drops it (the shell's own tee already reads either shape).

Verification

Full e2e suite: 422 passed / 12 failed / 22 skipped (52 min, workers: 1). Every failure classified by re-running the same specs on main with Electron 34, same machine:

Cause	n	Status
Test called clipboard.readImage, removed in v44	1	fixed here
Stale local Playwright browser cache (env, not code)	1	fixed locally
Test race exposed by Chromium 152 timing	1	fixed here
Pre-existing — fails identically on main/Electron 34	9	not from this PR

Zero application regressions.

The one that looked like a real regression was report_delete_undo — deterministic, 3/3 on 44, passing on 34. It is a test race: the helper does click add → dblclick last cell → fill → Ctrl+Enter with no waits, and every step addresses "the last cell", so each is wrong if it runs early. A probe driving the identical gestures with waits passes, and the screenshot shows Alpha/Beta/Gamma committing correctly. Helper fixed; 12/12 across three runs.

Packaging — npm run dist:dir produces a 348 MB SpyDE.app carrying Electron Framework 44.0.0, no errors. This is the check that would otherwise not run until a tag build.

GPU parity — gpu_image_parity.spec.ts passes with meanDiff: 0, maxDiff: 2 between the WebGPU and Canvas2D renders; screenshots compared by eye and indistinguishable. Worth having across a Chromium 132 → 152 jump.

Two things reviewers should know

1. Nine tests are red on main today on my machine, independent of this PR: the whole ebsd_workflow file, both examples_menu tests, fit_from_composition, and the ui_fixes Rebin click. Some are clearly environmental — examples_menu asserts "Not downloaded" against a dataset I have cached — but I would not assume all of them are. I could not use CI as a baseline: main's last two runs were cancelled by concurrency and the one before failed.
2. Separately, spyde/backend/dask_stats.py:113 is broken and not touched here. client.run(_trim_process_memory, wait=False) trips distributed 2026.3.0's assert wait or is_coro, so every post-batch worker memory trim fails and logs three tracebacks. Only the backend's own local trim runs. is_coro also satisfies the assert, so an async def wrapper restores the deliberate fire-and-forget. Worth its own PR.