trace: paint the execution trail — including on the decompiler

Both code views now show where you came from and where you're going: the
instruction you're on ('now'), the ~96 steps behind it ('past', warm) and the
~96 ahead ('future', cool).

A trail, not all of history. Painting every address the trace ever touched says
almost nothing on a loop-heavy program; the last and next few dozen steps say
how you GOT here. Where an address appears on both sides — a loop body, which is
most of them — the nearer side wins, because that's the one explaining the step
you just took or are about to.

**The pseudocode is painted too**, which is the reason to build this here rather
than use Tenet. A trace records instructions, so that's what Tenet paints. We
already have decomp_map from the split-view work, saying which instructions each
C line covers, so the same trail lands on the decompilation:

    line  46 now    | v3 = getenv("POSIXLY_CORRECT");
    line  47 future | v4 = (__int64)*a2;
    line  49 future | if ( v3 )

A C line covers many instructions, so it takes the strongest kind present: now
beats past beats future — if the instruction you're standing on belongs to this
line, this line is where you are.

Two things kept cheap: the trail is recomputed per SEEK rather than per repaint
(~200 lookups, and repaints vastly outnumber steps), and decomp_map is cached
per function because it's an RPC and stepping is interactive.

The colours sit deliberately under the code palette — the trail says "you came
through here", the text still has to read as code.

tests: +8 UI (21) — the listing carries now/past/future and it reaches the
screen; pseudocode is painted; exactly ONE C line is 'now' and it is the line
covering the current instruction (not merely some executed line, which is the
mistake this check exists to catch). 209/0 scenarios, 27/0 model, 10/0 diff.

1 files changed, 39 insertions, 0 deletions

diff --git a/idatui/trace.py b/idatui/trace.py
index 514a97a..2afc8f6 100644
--- a/idatui/trace.py
+++ b/idatui/trace.py
@@ -296,6 +296,45 @@ class Trace:
                 out[ea] = len(ts)
         return out
 
+    def prev_ips(self, idx: int, n: int) -> list[int]:
+        """Addresses executed in the ``n`` steps before ``idx`` (nearest first).
+
+        A trail, not all of history: showing every address the trace ever
+        touched says almost nothing on a loop-heavy program, whereas the last
+        few dozen steps say how you GOT here.
+        """
+        lo = max(idx - n, 0)
+        return [self.ips[i] + self.slide for i in range(idx - 1, lo - 1, -1)]
+
+    def next_ips(self, idx: int, n: int) -> list[int]:
+        """Addresses executed in the ``n`` steps after ``idx`` (nearest first)."""
+        hi = min(idx + n + 1, self.length)
+        return [self.ips[i] + self.slide for i in range(idx + 1, hi)]
+
+    def trail(self, idx: int, n: int = 96) -> dict[int, str]:
+        """{address: 'now' | 'past' | 'future'} around ``idx``.
+
+        Where an address appears on both sides — a loop body, which is most of
+        them — the nearer side wins, because that's the one that explains the
+        step you are about to take or just took.
+        """
+        out: dict[int, str] = {}
+        for k, ea in enumerate(self.next_ips(idx, n)):
+            out.setdefault(ea, "future")
+        for k, ea in enumerate(self.prev_ips(idx, n)):
+            prev = out.get(ea)
+            if prev is None:
+                out[ea] = "past"
+            elif prev == "future":
+                # Same distance rule as above, resolved by which loop found it
+                # first would be arbitrary; compare real distances instead.
+                fwd = next((i for i, a in enumerate(self.next_ips(idx, n)) if a == ea), n)
+                if k < fwd:
+                    out[ea] = "past"
+        if 0 <= idx < self.length:
+            out[self.ips[idx] + self.slide] = "now"
+        return out
+
     def first_execution(self, ea: int) -> int | None:
         ts = self.executions(ea)
         return ts[0] if ts else None