fix(plot,render,gl): live streaming measurements, handed-back GL state

Final whole-branch review fixes.

1 (Important). Plot::measurement() cached on (series pointer, sample count)
only, so a saturated StreamSeries -- whose size() stays pinned while x0()
advances every acquire() -- froze its readout on the first saturated frame
until a cursor moved. The cache key now carries the series' x0() (new
MeasureSlot::last_x0), so a sliding window recomputes and a static series
still does not: asserted with a new macro-gated counter hook
(plot/detail/measure_count.hpp, PLOT_COUNT_MEASURE_RECOMPUTES, wired like the
pyramid and ring counters, absent from the release library). New case
saturated_stream_measurement_tracks_the_sliding_window: saturated ring,
stationary cursors, ramp in absolute x -- zero recomputes for repeated reads
with nothing moving, one per acquire while it slides.

2-3, 9. Spec: 4.3 described a GL_LINE_STRIP path that does not exist (there is
one rasteriser -- instanced anti-aliased quads -- and dense_threshold_spp
selects the gather level, not a primitive); 8 named a PLOT_GL_CHECK() macro
that exists nowhere, and stated no exception policy. The table, the field's
comment and 8 now describe the real gather-level threshold, the real
glGetError() drain plus the stores' drop-to-orphan fallbacks, and the real
policy: library failures return Status/bool, allocating entry points propagate
std::bad_alloc.

4. The frame handed back neither GL_UNPACK_ALIGNMENT (init() sets 1 for the
atlas) nor the clear colour (queried once with a new glGetFloatv entry).
end_frame() restores both and renderer.hpp lists them in the residue
contract.

5. draw() kept a host TextBackend for layout while drawing with its own font.
The renderer now installs its font unconditionally -- strips and labels measure
and draw with one backend -- with a debug-build diagnostic if a different one
was set, and Plot::set_text_backend() is documented as the no-renderer path.
New case renderer_measures_the_labels_it_draws asserts layout, measuring and
the drawn label's ink agree.

6-10. draw()'s style overwrite stated at the call site; the load-sensitive
wall-clock bound in test_measure.cpp replaced by a counter assertion (same
interval, same fold count over a 512x length ratio); dump_frame_ppm drops
noexcept and says why it may allocate; error.txt ignored (not this project's,
not generated here) rather than deleted.

Verified: debug and release build clean (-Wall -Wextra -Wpedantic -Wconversion
-Wshadow), 4/4 ctest entries pass, 130 cases pass (was 127), umbrella and
header self-containment checks pass, and no counter symbol in the release
archive.

docs/superpowers/specs/2026-09-27-plot-library-design.md

@@ -127,14 +127,27 @@ samples, at every level, for every series that uses the measurement index.
   series rasterises ≈ `2 · viewport_width` vertices instead of 100M.
 - Buckets preserve extremes, so spikes are never dropped by decimation.
 
-### 4.3 Hybrid line rasterisation
+### 4.3 One rasteriser, two sampling levels
 
-Chosen per trace, per frame, from observed samples-per-pixel:
+Every trace, every frame, is drawn by one path: instanced anti-aliased quads.
+One instance per segment, four corners expanded from `gl_VertexID` in the vertex
+shader, a fragment shader that does distance-to-segment SDF for smooth edges and
+joins. There is no second primitive anywhere in the renderer — in particular no
+`GL_LINE_STRIP` path — so a sparse trace and a dense one differ in the geometry
+*staged*, never in the call that draws it.
 
-| samples/px | path |
+What the samples-per-pixel threshold selects is therefore the gather level:
+
+| samples/px | geometry staged |
 |---|---|
-| `< 1.5` | `GL_LINE_STRIP`, 1px, no AA — dense data hides aliasing; ~10× cheaper |
-| `>= 1.5` | instanced anti-aliased quads: one instance per segment, 4 verts expanded in the vertex shader, fragment shader does distance-to-segment SDF for smooth edges and joins |
+| `< dense_threshold_spp` (1.5) | the visible window's raw samples: a level-0 `Series::gather()`, a polyline through the window, one instance per sample pair |
+| `>= dense_threshold_spp` (1.5) | the pyramid level whose buckets are ~1 per pixel (`pyramid().level_for(n, samples_per_pixel)`): a min/max envelope pair per bucket, so O(pixels) instances instead of O(samples) |
+
+`Style::dense_threshold_spp` is that threshold and nothing more: it picks the
+gather level, changes no draw call, and the two sides of it are the same shader.
+The dense side is where the work is saved (a 100M-sample window stages O(pixels)
+vertices); the sparse side stages the window itself, which at ~1 sample per pixel
+is ~1 instance per column anyway.
 
 A geometry-shader expansion path was rejected: poor performance and it is the
 one stage macOS cannot be relied on for.
@@ -364,11 +377,24 @@ namespace input {
 
 ## 8. Error handling
 
-- No exceptions cross the public boundary. Fallible operations return `Status`
-  or `bool` plus an out-parameter `Status*`.
+- Library-originated failures never throw: every one of them returns `Status`
+  (or `bool` plus an out-parameter `Status*`), and no code path reports an error
+  by throwing. An allocation failure is the host's process running out of memory,
+  not a library error, and the entry points that allocate host memory --
+  constructing a series, `Plot::add_*`, a frame that stages geometry,
+  `Renderer::dump_frame_ppm()` -- propagate `std::bad_alloc` from the container
+  that ran out. They are therefore not annotated `noexcept`; the entries that can
+  neither fail nor allocate are, so the surface says per entry point what it does
+  rather than claiming a blanket `noexcept`.
 - GL failures are surfaced as `ErrorCode::GLFailure` from `Renderer::init` and
-  recorded on the first occurrence per frame; `PLOT_GL_CHECK()` is a no-op in
-  release builds.
+  recorded for the frame: `Renderer::end_frame()` drains `glGetError()` in a loop
+  and sets the flag `last_frame_had_gl_error()` reports, so the first error cannot
+  hide the ones after it and a stale error cannot be attributed to a later frame.
+  The instance stores report their own refusals through the same flag: a storage,
+  map or fence the driver refuses drops that store to the orphan-and-refill
+  baseline (see §4.5) and marks the frame. There is no `PLOT_GL_CHECK()` macro and
+  no build-dependent error checking -- the drain runs in every build, and it is
+  the flag, not a macro, that a host observes.
 - Unsupported-but-optional capabilities (compute, persistent mapping) degrade
   silently by selecting the 3.3 path; unsupported-and-required ones return
   `ErrorCode::Unsupported` from `init`.