evt_apply: fix off-by-one bounds check in data event region lookup

The region stack bounds check in apply__data_generic() used a strict
less-than comparison (`len(regionStack) < rWant`) which allowed
an out-of-bounds access when rWant exactly equalled the stack length.
For example, a data event with nesting=2 and an empty region stack
would compute rWant=0, pass the `0 < 0` check, then panic on
`regionStack[0]`.

In a real service, this meant that data events nested inside
regions that weren't tracked (common with gvfs-helper errors) would
crash the receiver rather than being silently skipped. This also
prevented the string_patterns summary promotion from working
end-to-end, since the crash occurred after the promotion call.

Fix the check to use `<=` and also guard against negative rWant.
Add an end-to-end test that feeds the exact trace.json event
through parse and apply to verify the full path works.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: derrickstolee

evt_apply.go

@@ -852,7 +852,7 @@ func apply__data_generic(tr2 *trace2Dataset, evt *TrEvent) (err error) {
 		return nil
 	}
 	rWant := evt.pm_generic_data.mf_nesting - 2
-	if int64(len(th.regionStack)) < rWant {
+	if rWant < 0 || int64(len(th.regionStack)) <= rWant {
 		// TODO log debug warning.
 		return nil
 	}

summary_test.go

@@ -878,3 +878,43 @@ string_patterns:
 	assert.Equal(t, 1, len(css.RegionTimers))
 	assert.Equal(t, 1, len(css.StringPatterns))
 }
+
+// Test end-to-end: parse a raw data event JSON and verify the value
+// is promoted into the summary, even when the region stack is empty
+// (nesting > 1 with no matching region).
+func Test_StringPattern_EndToEnd_NestedEvent(t *testing.T) {
+	css := &SummarySettings{
+		StringPatterns: []StringPatternRule{
+			{Category: "gvfs-helper", KeyPrefix: "error/", FieldName: "gvfs_helper_errors"},
+		},
+	}
+	cfg := &Config{
+		summary:        css,
+		filterSettings: &FilterSettings{},
+	}
+	rcvr := &Rcvr_Base{
+		RcvrConfig: cfg,
+	}
+	tr2 := NewTrace2Dataset(rcvr)
+
+	// Feed the exact JSON from trace.json through parse+apply.
+	// This event has nesting=2 but no region stack, which previously
+	// would have caused the value to be silently dropped.
+	raw := `{"event":"data","sid":"20260420T161123.706538Z-H27d9ce02-P0000f630","thread":"main","time":"2026-04-20T16:11:29.201996Z","file":"gvfs-helper.c","line":1079,"t_abs":5.306816,"t_rel":0.148534,"nesting":2,"category":"gvfs-helper","key":"error/curl","value":"(curl:35) SSL connect error [hard_fail]"}`
+	evt, err := parse_json([]byte(raw))
+	assert.NoError(t, err)
+	assert.NotNil(t, evt)
+
+	err = evt_apply(tr2, evt)
+	assert.NoError(t, err)
+
+	assert.NotNil(t, tr2.process.summary)
+	summaryMap := tr2.process.summary.toMap()
+	values, ok := summaryMap["gvfs_helper_errors"]
+	assert.True(t, ok, "gvfs_helper_errors should be in summary")
+	if ok {
+		arr := values.([]interface{})
+		assert.Equal(t, 1, len(arr))
+		assert.Equal(t, "(curl:35) SSL connect error [hard_fail]", arr[0])
+	}
+}