fix(render): one fence per frame for the vertex ring; two qt6 adapter fixes

The persistent-mapped instance ring had three slots and recorded a fence per
upload, so a frame recycled a slot whose fence was recorded a few draws earlier
*in that same frame*: from the fourth of the demos' nine uploads on, each one
waited on the frame's own work. It is free on a driver that retires draws
promptly (the GLFW host, 1.07 ms/frame) and ~4 ms of the Qt widget's 7.11 ms
under llvmpipe, and it grows with the trace and cursor counts this library
exists for.

* The ring grows to cover a frame's upload count, the frame's write cursor is
  the ring index (so a frame writes 0, 1, 2, ... and never a slot twice), one
  fence is recorded after the frame's last draw, and the only wait is at the
  start of the next frame. A wait that times out, or a slot written with no
  fence ever recorded behind it, drops the store to the orphan path -- the
  treatment a refused fence already had -- so nothing is ever written into
  storage the GPU may still be reading.
* New test-only counters (PLOT_RING_STATS, the PLOT_PYRAMID_COUNT_* pattern:
  free functions, no member, so no consumer's layout changes) pin a frame's
  upload and wait counts. The new tests assert the frame's slot offsets are
  distinct, that the ring grew past its floor to cover the frame, and that a
  frame waits at most once per store -- read from the counters and from
  glClientWaitSync itself.
* qt6: print the unresolved entry-point names before the load-failure branch,
  which used to return first and leave the one failure this widget can have
  reporting nothing but a generic message.
* qt6: the cached pointer anchor is now in logical pixels and a move's delta is
  the logical difference scaled by the DPR in effect, so a scale change between
  two move events (the window dragged onto another monitor mid-drag) is no
  longer a cross-scale jump applied as a pan. The anchor moved into a
  toolkit-free unit (adapters/qt6/qt_pointer.hpp) with its own test.

GLFW demo headless: 1.07 -> 0.73 ms/frame. Qt widget under xvfb/llvmpipe:
7.1 -> 3.8 ms at dpr 1.0, 6.7 -> 3.6 ms at 1.25, with both upload paths still
rendering and the demo's scripted pan/box-zoom checks passing at both scales.

tests/test_render_smoke.cpp

@@ -9,8 +9,11 @@
 #include <plot/gl/api.hpp>
 #include <plot/gl/loader.hpp>
 #include <plot/data/array_series.hpp>
+#include <plot/render/buffer.hpp>
+#include <plot/render/detail/ring_stats.hpp>
 #include <plot/render/renderer.hpp>
 
+#include <atomic>
 #include <cmath>
 #include <cstdlib>
 #include <vector>
@@ -151,6 +154,37 @@ class RefuseFenceSync {
   decltype(plot::gl::glFenceSync) saved_;
 };
 
+/// Counts the calls the ring's fence waits make through `glClientWaitSync` -- the
+/// one entry point every wait goes through, whatever the store's own bookkeeping
+/// says. The test-only counters in <plot/render/detail/ring_stats.hpp> report how
+/// often a store decides to wait; this reports what reached the driver, so the two
+/// cannot agree by construction.
+u64 g_fence_wait_calls = 0;
+decltype(plot::gl::glClientWaitSync) g_fence_wait_saved = nullptr;
+
+plot::gl::GLenum count_fence_wait(plot::gl::GLsync sync, plot::gl::GLbitfield flags,
+                                 plot::gl::GLuint64 timeout) {
+  ++g_fence_wait_calls;
+  return g_fence_wait_saved(sync, flags, timeout);
+}
+
+class CountFenceWaits {
+ public:
+  CountFenceWaits() noexcept : saved_(plot::gl::glClientWaitSync) {
+    g_fence_wait_saved = saved_;
+    plot::gl::glClientWaitSync = &count_fence_wait;
+  }
+  ~CountFenceWaits() { plot::gl::glClientWaitSync = saved_; }
+  CountFenceWaits(const CountFenceWaits&) = delete;
+  CountFenceWaits& operator=(const CountFenceWaits&) = delete;
+
+  /// Calls made since the counter was installed.
+  u64 calls() const noexcept { return g_fence_wait_calls; }
+
+ private:
+  decltype(plot::gl::glClientWaitSync) saved_;
+};
+
 }  // namespace
 
 PLOT_TEST(renders_visible_trace_across_viewport) {
@@ -714,3 +748,168 @@ PLOT_TEST(refused_fence_drops_the_mapped_ring) {
   }
   ctx.destroy();
 }
+
+/// The ring must absorb a frame that issues more uploads than it starts with
+/// slots. The shape it replaced -- three slots and a fence per upload -- wrapped
+/// within such a frame: from the fourth upload on, each one waited on a fence
+/// recorded a few draws *earlier in the same frame*, i.e. an effective per-frame
+/// GPU sync. That is free when the driver retires draws promptly (the GLFW host,
+/// 1.07 ms a frame) and ~4 ms of the Qt widget's 7.11 ms under llvmpipe, which is
+/// exactly the difference `PLOT_FORCE_GL33_UPLOAD=1` shows -- and it is a cliff
+/// that grows with the trace and cursor counts this library exists for.
+///
+/// The ring now grows to cover the frame's uploads, records one fence after the
+/// frame's last draw, and waits once, at the start of the next frame, so a frame
+/// never synchronises with work it issued itself. None of that is visible in the
+/// pixels -- a syncing ring draws the same image -- so the test pins the three
+/// properties directly: a frame writes distinct slots (the offsets it hands the
+/// vertex array), the ring grows past its floor to cover them, and a frame
+/// performs at most one wait.
+PLOT_TEST(ring_grows_to_cover_a_frame_and_waits_once_at_its_start) {
+  plottest::HeadlessContext ctx(kW, kH);
+  plot::Status st;
+  PLOT_CHECK(ctx.create(&st));
+  PLOT_CHECK(plot::gl::load(nullptr));
+
+  plot::render::detail::InstanceStore store;
+  PLOT_CHECK(store.create(plot::render::UploadMode::PersistentMapped, &st));
+  if (!store.persistent()) {
+    ctx.destroy();  // no persistent-mapping path on this driver: nothing to pin
+    return;
+  }
+
+  constexpr plot::u32 kUploadsPerFrame = 6;  // more than the ring's three-slot floor
+  plot::f32 data[4 * kUploadsPerFrame];
+  for (plot::u32 i = 0; i < 4 * kUploadsPerFrame; ++i) data[i] = static_cast<plot::f32>(i);
+
+  auto counter = [](const std::atomic<plot::u64>& c) {
+    return c.load(std::memory_order_relaxed);
+  };
+  plot::render::detail::ring_uploads().store(0, std::memory_order_relaxed);
+  plot::render::detail::ring_waits().store(0, std::memory_order_relaxed);
+  plot::render::detail::ring_slots().store(0, std::memory_order_relaxed);
+
+  // The first frame has no fence outstanding, so it must not wait at all -- and it
+  // must have grown the ring past its floor, because six uploads do not fit in
+  // three slots.
+  PLOT_CHECK(store.begin_frame());
+  for (plot::u32 i = 0; i < kUploadsPerFrame; ++i) {
+    store.upload(data, kUploadsPerFrame, sizeof(plot::render::LineInstance));
+  }
+  PLOT_CHECK(store.mark_drawn());
+  PLOT_CHECK(counter(plot::render::detail::ring_uploads()) == kUploadsPerFrame);
+  PLOT_CHECK(counter(plot::render::detail::ring_waits()) == 0);
+  PLOT_CHECK(counter(plot::render::detail::ring_slots()) > store.kInitialSlots);
+  PLOT_CHECK(counter(plot::render::detail::ring_slots()) >= kUploadsPerFrame);
+
+  // The second frame, measured upload by upload. The ring covers it now, so the
+  // slot each upload lands in -- the offset the vertex array re-points at -- is
+  // readable, and the invariant is the offsets being distinct: a slot written
+  // twice in a frame would be one the GPU could still be reading the first copy
+  // from, because the only fence is the one at the end of the frame.
+  PLOT_CHECK(store.begin_frame());
+  plot::usize offsets[kUploadsPerFrame] = {};
+  for (plot::u32 i = 0; i < kUploadsPerFrame; ++i) {
+    store.upload(data, kUploadsPerFrame, sizeof(plot::render::LineInstance));
+    offsets[i] = store.slot_offset();
+  }
+  PLOT_CHECK(store.mark_drawn());
+  for (plot::u32 i = 0; i < kUploadsPerFrame; ++i) {
+    for (plot::u32 j = i + 1u; j < kUploadsPerFrame; ++j) {
+      PLOT_CHECK(offsets[i] != offsets[j]);  // no slot reused within the frame
+    }
+  }
+  // ... and this frame waited exactly once: on the fence the first one recorded,
+  // never on its own work.
+  PLOT_CHECK(counter(plot::render::detail::ring_uploads()) == 2u * kUploadsPerFrame);
+  PLOT_CHECK(counter(plot::render::detail::ring_waits()) == 1);
+
+  // A third frame the same, so the wait is per frame and not per upload: six
+  // uploads a frame would be five waits a frame under the shape this replaced.
+  PLOT_CHECK(store.begin_frame());
+  for (plot::u32 i = 0; i < kUploadsPerFrame; ++i) {
+    store.upload(data, kUploadsPerFrame, sizeof(plot::render::LineInstance));
+  }
+  PLOT_CHECK(store.mark_drawn());
+  PLOT_CHECK(counter(plot::render::detail::ring_waits()) == 2);
+  ctx.destroy();
+}
+
+/// The same property at the level the demos run at. A frame of this plot stages
+/// what the demos stage -- two grid colour groups, the axis lines, tick labels and
+/// titles, the trace, two cursors and the measurement band -- nine-ish uploads, or
+/// three times the slots the ring used to have, so the old ring wrapped within the
+/// frame several times over. The frame must absorb them with at most one wait per
+/// store (two stores), and the upload counter must agree with the draw calls the
+/// frame reports, so it is counting this frame's staging and nothing else.
+///
+/// The wait is checked twice over: once from the store's own counter, and once at
+/// `glClientWaitSync`, the call every wait is made through. A nine-upload frame
+/// under the shape this replaced made six mid-frame wait sites, each costing the
+/// non-blocking probe plus the bounded wait behind it.
+PLOT_TEST(a_dense_frame_uploads_more_than_the_ring_floor_without_waiting) {
+  plottest::HeadlessContext ctx(kW, kH);
+  plot::Status st;
+  PLOT_CHECK(ctx.create(&st));
+  PLOT_CHECK(plot::gl::load(nullptr));
+  plot::Renderer r;
+  PLOT_CHECK(r.init(&st));
+  if (!r.using_persistent_upload()) {
+    ctx.destroy();  // no persistent-mapping path on this driver: nothing to pin
+    return;
+  }
+
+  plot::data::ArraySeries s(sine_samples(), 0.0, 1.0);
+  plot::Plot p;
+  p.set_viewport({0, 0, static_cast<plot::f32>(kW), static_cast<plot::f32>(kH)});
+  const plot::u32 ax = p.add_x_axis({"t", s.x_bounds(), true, plot::AxisPlace::Bottom, false});
+  const plot::u32 ay = p.add_y_axis({"v", {-1.0, 1.0}, true, plot::AxisPlace::Left, false});
+  const plot::u32 tr = p.add_trace({&s, plot::Color::hex(0x40C0FF), 1.5f, ax, ay});
+  p.set_x_range(ax, {0.0, 640.0});
+  const plot::u32 ca = p.add_cursor(100.0, plot::Color::hex(0x00FF00));
+  const plot::u32 cb = p.add_cursor(300.0, plot::Color::hex(0xFF00FF));
+  PLOT_CHECK(p.add_measure(ca, cb, tr) == 0);
+
+  auto counter = [](const std::atomic<plot::u64>& c) {
+    return c.load(std::memory_order_relaxed);
+  };
+  plot::render::detail::ring_uploads().store(0, std::memory_order_relaxed);
+  plot::render::detail::ring_waits().store(0, std::memory_order_relaxed);
+  plot::render::detail::ring_slots().store(0, std::memory_order_relaxed);
+  CountFenceWaits driver_waits;  // installed after load(), restored with the test
+
+  for (plot::u32 index = 0; index < 3u; ++index) {
+    const plot::u64 uploads_before = counter(plot::render::detail::ring_uploads());
+    const plot::u64 waits_before = counter(plot::render::detail::ring_waits());
+    const plot::u64 calls_before = driver_waits.calls();
+
+    r.begin_frame(kW, kH, {0, 0, static_cast<plot::f32>(kW), static_cast<plot::f32>(kH)});
+    r.draw(p);
+    r.end_frame();
+    PLOT_CHECK(!r.last_frame_had_gl_error());
+
+    const plot::u64 uploads = counter(plot::render::detail::ring_uploads()) - uploads_before;
+    const plot::u64 waits = counter(plot::render::detail::ring_waits()) - waits_before;
+    // Every upload lands in a draw this frame reported, so the counter describes
+    // this frame's staging and no other store's.
+    PLOT_CHECK(uploads == r.stats().draw_calls);
+    // The scenario: more uploads than the ring's floor of slots.
+    PLOT_CHECK(uploads > plot::render::detail::InstanceStore::kInitialSlots);
+    // ... and not one of them waited: the only wait is the next frame's start,
+    // one per store.
+    PLOT_CHECK(waits <= 2);
+    if (index == 0) PLOT_CHECK(waits == 0);
+    // At the driver call too: one wait site per store, and a site costs at most
+    // two calls -- the non-blocking probe, then the bounded wait behind it. Six
+    // uploads past the old ring's three slots used to cost six sites on their own,
+    // inside the frame that made them.
+    const plot::u64 calls = driver_waits.calls() - calls_before;
+    PLOT_CHECK(calls <= 4u);
+    if (index == 0) PLOT_CHECK(calls == 0u);
+  }
+  // The ring really grew past its floor: what covers a nine-upload frame is not
+  // what three slots covered.
+  PLOT_CHECK(counter(plot::render::detail::ring_slots()) >
+             plot::render::detail::InstanceStore::kInitialSlots);
+  ctx.destroy();
+}