fix(render): one fence per frame for the vertex ring; two qt6 adapter fixes

The persistent-mapped instance ring had three slots and recorded a fence per
upload, so a frame recycled a slot whose fence was recorded a few draws earlier
*in that same frame*: from the fourth of the demos' nine uploads on, each one
waited on the frame's own work. It is free on a driver that retires draws
promptly (the GLFW host, 1.07 ms/frame) and ~4 ms of the Qt widget's 7.11 ms
under llvmpipe, and it grows with the trace and cursor counts this library
exists for.

* The ring grows to cover a frame's upload count, the frame's write cursor is
  the ring index (so a frame writes 0, 1, 2, ... and never a slot twice), one
  fence is recorded after the frame's last draw, and the only wait is at the
  start of the next frame. A wait that times out, or a slot written with no
  fence ever recorded behind it, drops the store to the orphan path -- the
  treatment a refused fence already had -- so nothing is ever written into
  storage the GPU may still be reading.
* New test-only counters (PLOT_RING_STATS, the PLOT_PYRAMID_COUNT_* pattern:
  free functions, no member, so no consumer's layout changes) pin a frame's
  upload and wait counts. The new tests assert the frame's slot offsets are
  distinct, that the ring grew past its floor to cover the frame, and that a
  frame waits at most once per store -- read from the counters and from
  glClientWaitSync itself.
* qt6: print the unresolved entry-point names before the load-failure branch,
  which used to return first and leave the one failure this widget can have
  reporting nothing but a generic message.
* qt6: the cached pointer anchor is now in logical pixels and a move's delta is
  the logical difference scaled by the DPR in effect, so a scale change between
  two move events (the window dragged onto another monitor mid-drag) is no
  longer a cross-scale jump applied as a pan. The anchor moved into a
  toolkit-free unit (adapters/qt6/qt_pointer.hpp) with its own test.

GLFW demo headless: 1.07 -> 0.73 ms/frame. Qt widget under xvfb/llvmpipe:
7.1 -> 3.8 ms at dpr 1.0, 6.7 -> 3.6 ms at 1.25, with both upload paths still
rendering and the demo's scripted pan/box-zoom checks passing at both scales.

src/render/buffer.cpp

@@ -1,7 +1,9 @@
 #include <plot/render/buffer.hpp>
 
 #include <plot/gl/api.hpp>
+#include <plot/render/detail/ring_stats.hpp>
 
+#include <algorithm>
 #include <cstring>
 
 namespace plot::render {
@@ -16,7 +18,9 @@ bool InstanceStore::create(UploadMode mode, Status* st) noexcept {
   }
   capacity_ = 0;
   slot_bytes_ = 0;
-  slot_ = kSlots - 1u;  // the first upload takes slot 0
+  slot_count_ = kInitialSlots;
+  slot_ = 0;
+  frame_uploads_ = 0;
   // The mapped path additionally needs its entry points, which are resolved
   // best-effort (see api.hpp): without them the store would never be able to
   // write anything, so it stays on the baseline path instead.
@@ -34,16 +38,26 @@ void InstanceStore::release_storage() noexcept {
     buffer_.unmap();
     mapped_ = nullptr;
   }
-  for (gl::Fence& fence : fences_) {
-    fence.reset();
-  }
+  frame_fence_.reset();
   buffer_.reset();
   slot_bytes_ = 0;
 }
 
-bool InstanceStore::grow_persistent(usize bytes) noexcept {
-  // Deleting the old buffer is safe while the GPU may still be reading it: GL
-  // keeps the storage alive until the last command that references it retires.
+void InstanceStore::drop_to_orphan() noexcept {
+  // The hazard the ring exists to prevent -- writing storage the GPU may still be
+  // reading -- can no longer be guarded, and a frame that draws through the
+  // baseline path beats one that draws nothing. The old buffer is deleted while
+  // the GPU may still read it, which is safe: GL keeps its storage alive until the
+  // last command that references it retires.
+  release_storage();
+  mode_ = UploadMode::Orphan;
+  capacity_ = 0;
+  frame_uploads_ = 0;
+  Status retry;
+  (void)buffer_.create(&retry);  // a failed retry leaves nothing to draw with
+}
+
+bool InstanceStore::grow_persistent(usize bytes, u32 slots) noexcept {
   release_storage();
   Status st;
   if (!buffer_.create(&st)) {
@@ -53,8 +67,9 @@ bool InstanceStore::grow_persistent(usize bytes) noexcept {
   }
   const gl::GLbitfield flags =
       gl::GL_MAP_WRITE_BIT | gl::GL_MAP_PERSISTENT_BIT | gl::GL_MAP_COHERENT_BIT;
-  buffer_.storage(kSlots * bytes, flags);
-  mapped_ = static_cast<u8*>(buffer_.map_range(0, kSlots * bytes, flags));
+  const usize total = usize(slots) * bytes;
+  buffer_.storage(total, flags);
+  mapped_ = static_cast<u8*>(buffer_.map_range(0, total, flags));
   if (mapped_ == nullptr) {
     // The driver refused the storage or the mapping. A frame that draws through
     // the baseline path beats one that draws nothing, so re-create the empty
@@ -62,25 +77,72 @@ bool InstanceStore::grow_persistent(usize bytes) noexcept {
     // array's attribute pointers went out with the buffer they captured, and the
     // epoch reports it (`gl::Buffer::generation()`), which is what re-points them
     // at this buffer before the draw.
-    release_storage();
-    mode_ = UploadMode::Orphan;
-    capacity_ = 0;
-    Status retry;
-    (void)buffer_.create(&retry);  // a failed retry leaves nothing to draw with
+    drop_to_orphan();
     return false;
   }
   slot_bytes_ = bytes;
-  slot_ = kSlots - 1u;  // fresh storage: the first upload takes slot 0
+  slot_count_ = slots;
+  slot_ = 0;
+  // Fresh storage: every one of its slots is unwritten, so the frame's slot
+  // cursor restarts at 0. The draws that read the old buffer are already in the
+  // command stream and keep it alive until they retire.
+  frame_uploads_ = 0;
+#ifdef PLOT_RING_STATS
+  note_ring_slots(slot_count_);
+#endif
   return true;
 }
 
+bool InstanceStore::begin_frame() noexcept {
+  const u32 written = frame_uploads_;
+  frame_uploads_ = 0;
+  if (mode_ != UploadMode::PersistentMapped || mapped_ == nullptr) {
+    return true;  // nothing the GPU reads, so no slot has to be waited for
+  }
+  if (written == 0) {
+    return true;  // the frame before this one never read the ring
+  }
+  if (!frame_fence_) {
+    // Slots were written and no fence was ever recorded for them: the caller
+    // skipped mark_drawn(), so those slots are unguarded and writing any of them
+    // again could race a read still in flight. The ring is abandoned rather than
+    // reused, exactly as a refused fence's is.
+    drop_to_orphan();
+    return false;
+  }
+#ifdef PLOT_RING_STATS
+  ring_waits().fetch_add(1, std::memory_order_relaxed);
+#endif
+  // The slots this frame is about to write were all last written a frame ago, and
+  // this one fence sits behind every draw that read them -- unless the driver has
+  // not retired it, in which case writing would race the GPU and the ring is
+  // abandoned for the baseline path. The non-blocking check is the common case.
+  const bool retired = frame_fence_.wait(0) || frame_fence_.wait(kFenceWaitNs);
+  frame_fence_.reset();
+  if (retired) {
+    return true;
+  }
+  drop_to_orphan();
+  return false;
+}
+
 void InstanceStore::upload(const void* data, u32 count, usize instance_bytes) noexcept {
   if (buffer_.id() == 0 || data == nullptr || count == 0 || instance_bytes == 0) {
     return;
   }
   const usize bytes = usize(count) * instance_bytes;
-  if (mode_ == UploadMode::PersistentMapped && bytes > slot_bytes_ && !grow_persistent(bytes)) {
-    // The fallback already replaced the store with an orphan buffer.
+  if (mode_ == UploadMode::PersistentMapped &&
+      (bytes > slot_bytes_ || frame_uploads_ >= slot_count_)) {
+    // The frame has written every slot the ring has, or this instance payload is
+    // wider than a slot: grow rather than wrap. Covering the frame's upload count
+    // is what lets a single fence, recorded after its last draw, guard all of its
+    // slots -- and doubling makes the growth rare for a workload whose upload
+    // count has settled.
+    const usize want_bytes = std::max(bytes, slot_bytes_);
+    const u32 want_slots = frame_uploads_ >= slot_count_
+                               ? std::max(frame_uploads_ + 1u, slot_count_ * 2u)
+                               : slot_count_;
+    (void)grow_persistent(want_bytes, want_slots);  // a failure leaves the orphan path
   }
 
   if (mode_ == UploadMode::Orphan) {
@@ -92,18 +154,16 @@ void InstanceStore::upload(const void* data, u32 count, usize instance_bytes) no
     return;
   }
 
-  // Advance the ring, then make sure the draw that last read this slot has
-  // retired. The non-blocking check is the common case; the bounded wait only
-  // costs anything when three frames' geometry is still in flight.
-  slot_ = (slot_ + 1u) % kSlots;
-  if (fences_[slot_]) {
-    if (!fences_[slot_].wait(0)) {
-      (void)fences_[slot_].wait(kFenceWaitNs);
-    }
-    fences_[slot_].reset();
-  }
+  // The slot this frame has not written yet: the frame's write cursor is the ring
+  // index, so a frame writes 0, 1, 2, ... and never reaches a slot it already
+  // filled. That is the whole reason one fence at the end of the frame is enough.
+  slot_ = frame_uploads_;
+#ifdef PLOT_RING_STATS
+  ring_uploads().fetch_add(1, std::memory_order_relaxed);
+#endif
   // MAP_COHERENT storage needs no explicit flush, so this is the whole transfer.
   std::memcpy(mapped_ + usize(slot_) * slot_bytes_, data, bytes);
+  ++frame_uploads_;
   ++slot_epoch_;
 }
 
@@ -111,22 +171,20 @@ bool InstanceStore::mark_drawn() noexcept {
   if (mode_ != UploadMode::PersistentMapped || mapped_ == nullptr) {
     return true;  // nothing reads the store after the draw
   }
+  if (frame_uploads_ == 0) {
+    return true;  // no draw read the ring this frame, so it needs no guard
+  }
   Status st;
-  fences_[slot_].reset();
-  if (fences_[slot_].create(&st)) {
+  frame_fence_.reset();
+  if (frame_fence_.create(&st)) {
     return true;
   }
-  // A slot whose fence the driver refused can never be reused safely: the next
+  // A frame whose fence the driver refused leaves the slots it wrote
+  // unsynchronised, and such a slot can never be written again safely: the next
   // upload would memcpy into storage the GPU may still be reading, which is the
-  // tearing the ring exists to prevent. So the ring is abandoned rather than
-  // rotated through -- the map failure's treatment, one step later -- and the
-  // fresh buffer the orphan path needs is created. Deleting the mapped buffer is
-  // safe while the draw still reads it: GL keeps the storage alive until then.
-  release_storage();
-  mode_ = UploadMode::Orphan;
-  capacity_ = 0;
-  Status retry;
-  (void)buffer_.create(&retry);  // a failed retry leaves nothing to draw with
+  // tearing the ring exists to prevent. So the ring is abandoned for the orphan
+  // path, which is what the map failure's treatment does one step earlier.
+  drop_to_orphan();
   return false;
 }