xorg: refuse a window that is not on the screen, and keep an inline screenshot within the bus (review of #154)

A window that is unmapped or on a hidden workspace was cut from the screen anyway, which shows what is
there instead of it. An inline image of up to 4 MiB could not cross the bus, whose largest message is
1 MiB; it is now held to 700 KiB and halved in size until it fits, saying so.

modules/xorg/README.md

@@ -71,7 +71,7 @@ which is a cpp directive error under plain `xrdb -merge` but is skipped here.
 | `xorg_input_devices` | r | the input devices, and each pointer's libinput settings |
 | `xorg_input_set` | a | tap, tap drag, natural scroll, disable while typing, left handed, middle emulation, enabled, acceleration, by device id or name |
 | `xorg_keyboard` | r/a | the XKB map; set layout, variant, model, options |
-| `xorg_screenshot` | d | a PNG of the screen, one output or one window, inside the home (default `~/Pictures/Screenshots/`); with `inline`, the PNG in the answer as base64 (at most 4 MiB) |
+| `xorg_screenshot` | d | a PNG of the screen, one output or one window, inside the home (default `~/Pictures/Screenshots/`); with `inline`, the PNG in the answer as base64 (at most 700 KiB; a larger one is halved in size until it fits, and `inline_scale` says so). A window that is not viewable is refused |
 | `xorg_windows` | r | the windows as the X server knows them, managed or not: id, name, instance and class, size and place; with a class or name filter (or `detail`), each one's depth (`argb`), visual, map state, override-redirect, types, states, role and own opacity |
 | `xorg_x_log` | r | the X server's log for the running session: version, start, errors (and warnings) |
 
@@ -95,8 +95,11 @@ into a PNG itself. **A window is cut from the dump of the whole screen** at the
 never dumped by its id: `xwd -id` asks the server for the window's colormap entries, which a window of
 a 32-bit (alpha) visual refused with `BadColor (X_QueryColors)` on a workstation (2026-10-09), and the
 cut shows the window as the compositor shows it, which is what a question about a window that looks
-wrong needs. A window under another one shows what covers it. `inline` answers the image itself, for a
-session that cannot read the machine's files.
+wrong needs. A window under another one shows what covers it, and a window that is not viewable (unmapped, or on a
+workspace not shown) is refused rather than photographed as whatever is at its place. `inline` answers
+the image itself, for a session that cannot read the machine's files: a tool's answer crosses the bus,
+whose largest message is NATS's default of 1 MiB (the `nats` module sets no other), so the PNG is held to
+700 KiB (about 935 KiB as base64) and halved in size until it fits.
 
 `xorg_windows` exists because a window manager lists only the windows it manages, and says nothing a
 compositor goes by. A window of depth 32 has an alpha channel: the compositor blends it with what is