fix: a zoomed trace is drawn on the x its readout quotes

gather() staged x as f32 relative to the series' own x0() -- the start of
the whole retained window -- so the quantisation was a fraction of the
ring rather than of the view: 1.9 us at 20 s of retained data, which at a
10 us view across a 716 px axis is over 100 px between where a sample is
drawn and the x a readout quotes for it (crosshair_point() reads x_at()
in exact f64). It halved on every zoom out, which is what made it read as
"zooming in makes the crosshair select a point beside the data".

The origin is now the caller's (plotter c2c8c59): the renderer passes the
visible range's minimum, so the error is a fixed 2^-24 of what is on
screen -- about 4e-5 px over a 700 px axis -- at any zoom. The parameter
sits before out_xy so every call site is a compile error rather than a
silent change of behaviour.

The renderer no longer reads series.x0() at paint time at all, which
removes two of the three symptoms of the torn window_x0_ read by
construction; the ink probe's now-vacuous kept_fixed_x0 walk goes with
them, replaced by a drawn-vs-quoted pixel figure. neighbours() still
tests the visible range against x_at(0), so the cache stays load-bearing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -608,10 +608,12 @@ Two lines of the self-check output are assertions in disguise:
   lines and the disarm probe's `axis=`/`snap=` need a fast source to say anything —
   `tools/mock_udpstreamer.py --rate 1300000 --batch 20000` — since at the default 10 kS/s a
   whole window fits in the raw path and the publish is too short to lose a race.
-- `trace ink: N paints checked, C collapsed, S staircase, H short, worst cover P%` plus a
+- `trace ink: N paints checked, C collapsed, S staircase, H short, worst cover P%, worst
+  drawn-vs-quoted D px over R raw paints` plus a
   `[ink] paint N <flags> mode=.. axis=[..] n=.. idx=[..) spp=.. level=.. pts=.. kept=..
-  ink=[..] cover=..% x0=.. x_at=[..] bounds=[..] rel=[..] dx=.. kept_fixed_x0=.. drops=[..]
-  back=..` line per anomalous frame (stderr) — **`collapsed` and `staircase` must both be 0**.
+  ink=[..] cover=..% x0=.. x_at=[..] bounds=[..] rel=[..] dx=.. drops=[..]
+  back=..` line per anomalous frame (stderr) — **`collapsed` and `staircase` must both be 0**,
+  and **`drawn-vs-quoted` must stay far under a pixel** (0.0000 is what a clean run reads).
   This is the only check that can see a frame whose *waveform* vanished: `staged_segments`
   counts geometry including the grid and the instruments, and `lod_traces` counts a trace whose
   points are then collapsed, so both read healthy through the flicker. The probe runs on every
@@ -621,11 +623,22 @@ Two lines of the self-check output are assertions in disguise:
   `collapsed` is fewer than two distinct positions left (nothing to draw at all), `staircase`
   is the filter dropping over three quarters of the points, `short` is ink reaching under a
   quarter of the axis (reported only once the data spans the window, since a filling ring is
-  *meant* to leave its left side empty). `kept_fixed_x0` is the same filter with `x0()` hoisted
-  out of the loop: it exceeding `kept` means `x0()` moved *during* the walk. **`back` ≈ one ring
-  span is the signature** of the torn `x0()` read (see the cached-first-stamp invariant); so is
-  an `ink=` range disjoint from `axis=`, or an `idx=` covering the whole ring with `cover` far
-  over 100%. It is a race, so it needs load and a reason for long frames —
+  *meant* to leave its left side empty). `drawn-vs-quoted` is the other reading, and it is the
+  one that names a *defect of position* rather than of presence: at a raw level a gathered pair
+  **is** sample `first + k`, so the line differences where a sample is drawn
+  (`axis.min + gather[2k]`, the renderer's own reconstruction) against the x a readout quotes
+  for it (`x_at()`, exact f64) and reports the worst of them in pixels. That is the
+  gather-origin invariant below read from the screen's side; it was over a hundred pixels at a
+  deep zoom before the origin became the caller's. It is measured on the raw levels only — above
+  them a gathered point is a bucket's envelope and has no single sample to be off from — so `R`
+  is legitimately below `N`. **`back` ≈ one ring span is the signature** of the torn `x0()` read
+  (see the cached-first-stamp invariant); so is an `ink=` range disjoint from `axis=`, or an
+  `idx=` covering the whole ring with `cover` far over 100%. There was a `kept_fixed_x0` field
+  beside `kept` — the same filter with `x0()` hoisted out of the loop, since the renderer used to
+  re-read `x0()` per point and a ring-backed one advances with the producer. The origin is a
+  local of the renderer's now, so that failure mode is structurally impossible and the field is
+  gone; the `[ink]` walk and the renderer still agree because both add `axis.min`. It is a race,
+  so it needs load and a reason for long frames —
   `tools/mock_udpstreamer.py --rate 1300000 --batch 2000 --clock-jitter 0.4` with the
   measurements *and* cursors panes up:
   `UDPSCOPE_ENABLE_ALL_MS=1000 UDPSCOPE_PROBE_MEASURES_MS=2000 UDPSCOPE_PROBE_CURSORS_MS=3500
@@ -946,15 +959,32 @@ far the largest file.
   `gather()`, `x_at()`, `neighbours()` and `x_bounds()` use the real time ring.
   Nothing may walk that grid to find *which* samples a range covers — the renderer did,
   and it lost the two end segments (see the margin invariant above). `gather()` emits x
-  relative to `x0()` because absolute epoch seconds do not survive `f32`.
-- **`gather()` emits x relative to `x0()` in *every* series here**, `EventSeries`
-  included, and the renderer adds `x0()` back. An event's stamps are small (edge
-  relative, `[-pre, +post]`), so emitting them absolute does not overflow anything and
-  does not look like a bug — it just draws the whole capture `x0()` = one pre-trigger
-  window to the left of the axis. That was the "half the plot is empty / the marker sits
-  at the end of the data / nothing is drawn but the crosshair reads values" defect: the
-  crosshair reads `x_at()`, which was right all along. The probe's `data=` vs `drawn=`
-  is the guard.
+  relative to an origin because absolute epoch seconds do not survive `f32`.
+- **`gather()` emits x relative to an origin *the caller names*, in every series here**,
+  `EventSeries` included, and the consumer adds that same origin back in `f64`. Two separate
+  rules live here and both were learned from a defect.
+  (1) **It must be relative at all.** An event's stamps are small (edge relative,
+  `[-pre, +post]`), so emitting them absolute does not overflow anything and does not look
+  like a bug — it just draws the whole capture `x0()` = one pre-trigger window to the left of
+  the axis. That was the "half the plot is empty / the marker sits at the end of the data /
+  nothing is drawn but the crosshair reads values" defect: the crosshair reads `x_at()`, which
+  was right all along. `[trig-probe]`'s `data=` vs `drawn=` is the guard.
+  (2) **The origin is the *view's* minimum, not `x0()`.** `x0()` is the start of the
+  **retained window**, so the f32 had to resolve 2^-24 of the whole ring however little of it
+  was on screen: 1.9 µs over 20 s of retained data, which at a view 10 µs wide across a 716 px
+  axis is over a hundred pixels between where a sample is drawn and the x `x_at()` quotes for
+  it — and it halved on every zoom out, so it read as "zooming in makes the crosshair select a
+  point beside the data". `Renderer::draw_traces` passes `x_range.min`, making the error a fixed
+  4e-5 of a pixel at any zoom. The parameter sits **before** `out_xy` deliberately, so a call
+  site that was not thought about is a compile error rather than silent drift. A caller that has
+  no view in mind may still pass `x0()`, and `[trig-probe]`'s `drawn=`/`data=` does exactly that
+  on purpose: it reads the series' *whole* span, which is the widest relative value a gather can
+  be asked to stage. The two guards are upstream's
+  `a_gather_origin_at_the_view_keeps_a_deep_zoom_on_the_sample_it_quotes` and the
+  `trace ink:` line's `drawn-vs-quoted` figure.
+  **A probe that recomputes what the renderer gathers must pass the same origin the renderer
+  does** (`[ink]` and `[zoom-probe]` both pass the axis minimum), or its reconstruction stops
+  being the renderer's and its pixel readings mean nothing.
 - **Every series bound to a trace must carry a real `MinMaxPyramid`**, including an
   immutable one. `MinMaxPyramid::level_for()` descends to level 0 — raw samples — on a
   pyramid with no levels, whatever `n` is, so a series that answers `pyramid()` with an
@@ -1010,14 +1040,19 @@ far the largest file.
   sample 0 is the ring's oldest, the very slot the producer is about to overwrite. `time_of()`
   checks the bounds and then copies, and when the producer laps the slot in between the stamp it
   returns is **one whole ring-span too new**. Everything else on a `ChannelBuffer` is read at
-  paint time with no lock, and `x0()` is the origin the renderer reconstructs every trace point
-  from (`gather[i] + series.x0()`), read both inside its increasing-suffix filter and again at
-  `stage_xy()` — so one torn read of that one slot produced three pictures, all of them "the
+  paint time with no lock, and `x0()` *was* the origin the renderer reconstructed every trace
+  point from (`gather[i] + series.x0()`), read both inside its increasing-suffix filter and again
+  at `stage_xy()` — so one torn read of that one slot produced three pictures, all of them "the
   waveform is gone while the grid and the axes stay": `neighbours()` tests against `x_at(0)` and
   refused the whole visible range (the renderer then gathered the *entire* ring at a coarse level
   and drew it off the axis — `idx=[0..8388608) level=7 cover=320%`); `x0()` changing *during* the
   filter loop dropped three quarters of the points; and `stage_xy()` shifted the finished polyline
-  a ring-span off its axis. That is the "with measurements and cursors active the plot flickers as
+  a ring-span off its axis. The gather origin is the *view's* minimum now (see the `gather()`
+  invariant), a local of the renderer's, so the second and third of those are structurally
+  impossible — but **the first is not**, `x_at(0)` is still what `neighbours()` tests the visible
+  range against, and that is the one that gathered the whole ring. The cache is load-bearing for
+  that reason; do not read the slot at paint time because two of its three symptoms are gone.
+  That is the "with measurements and cursors active the plot flickers as
   if there were no data, at no constant frequency" defect. It is **live only** (a snapshot is
   immutable, so `x0()` is constant for `Held`/`Paused`), it is a race against packet arrival so it
   is irregular, and the measurements pane makes it both likelier and larger: the pane holds