Put the ring on the 68000, and find the disc stops whenever the player is not asking

ROADMAP P5. The loader moved in session 21 and the frame clock in 22; the ring
producer was the last policy living outside the machine. src/player/ring.i does
`aligned` placement, the descriptor ring, a prefill, 51.2's slack rule and a
seek, and the host keeps only the transport.

It needed a container change. `aligned` asks whether the next record fits
before the end of the ring -- a length asked BEFORE the record is fetched -- and
every reader in this tree answered that by walking the frame stream, which is
exactly what a player streaming off a disc cannot do. DLX4 carries nframes u16
record lengths in the scene header. Frame payloads are byte-identical to the
DLX3 encode, so no fitted constant moves; the scene header goes 5,920 to 6,164 B.

The producer reproduces the host's tiling exactly: 18 wraps, 14.7 KB mean hole,
pixel-exact, a third independent implementation of the same policy.

What it exposed is bigger than the item. A channel only moves bytes while it has
a request and only the CPU can issue one, so the disc stands still between
records by an amount the PLAYER sets, not the medium -- and no host-filled run
could see it. At 488 KB/s in a 256 KB ring a one-deep request queue gives away
6.8% of the pipe and underruns 59 of 120 frames; two-deep gives away 3.4% and
underruns none. The container's whole surplus over the wire is 8.7%, so the
player's own loop was spending most of the slack a branch point saves up.
Prefill is the weaker lever: six records of it still leaves 24 underruns.

Three silent bugs are recorded in FINDINGS 55.7 -- all produced wrong pixels or
a desync rather than a fault -- plus a rig one: MAME renders a screen line by
line, so snapshotting the frame the decoder finished in captures a tear that
reads exactly like a decoder bug.

check.sh gains the machine-owned ring and a seek with the decode after it.
decode.bin is unchanged at 1,296 B and a host-filled run executes none of the
new code, so every FINDINGS 49/51 figure stands. ALL GREEN before and after.

Claude-Session: https://claude.ai/code/session_01194oWYW8DQXK1SZ2DnChW6

tools/encoder/dlx.py

@@ -38,14 +38,16 @@ class DLX:
         # (FINDINGS 28.3), so the padding is part of the format, not a loader
         # convenience -- but DLX1 containers stay readable, because every
         # measurement in FINDINGS 28-31 was taken on one.
-        if b[:4] not in (b"DLX1", b"DLX2", b"DLX3"):
+        if b[:4] not in (b"DLX1", b"DLX2", b"DLX3", b"DLX4"):
             raise ValueError(f"{path}: not a DLX container")
         self.version = int(b[3:4])
         self.aligned = self.version >= 2
         self.has_spans = self.version >= 3
+        self.has_index = self.version >= 4
         (self.W, self.H, self.fps, self.nframes,
          self.k1, self.k4) = struct.unpack(">HHHHHH", b[4:16])
         off_pal, off_cb1, off_cb4, off_frm = struct.unpack(">IIII", b[16:32])
+        off_idx = struct.unpack(">I", b[32:36])[0] if self.has_index else None
 
         self.pal = np.frombuffer(b, np.uint8, 256 * 3, off_pal).reshape(256, 3)
         self.cb1 = np.frombuffer(b, np.uint8, self.k1 * 16,
@@ -77,6 +79,33 @@ class DLX:
             raise ValueError(f"{path}: {slack} trailing bytes after "
                              f"{self.nframes} frames")
 
+        # DLX4's record index, and it is CHECKED rather than trusted.  The
+        # walk above is what every reader in this tree did before there was an
+        # index -- read a record's length word to find the next one -- and it is
+        # exactly what a player streaming off a disc cannot do, because the
+        # length word of record i+1 is one of the bytes it has not fetched.  So
+        # the two are computed independently here and required to agree: the
+        # index is the producer's only source of record geometry, and an index
+        # that disagrees with the stream places records at wrong addresses,
+        # which the block loop reads without a bounds check (49.2).
+        self.index = None
+        if self.has_index:
+            self.index = list(struct.unpack(
+                f">{self.nframes}H", b[off_idx:off_idx + 2 * self.nframes]))
+            walked = [(-(4 + n) % 4 + 4 + n) // 4 for _, n in self.frames]
+            if self.index != walked:
+                bad = next(i for i in range(self.nframes)
+                           if self.index[i] != walked[i])
+                raise ValueError(
+                    f"{path}: record index disagrees with the frame stream at "
+                    f"frame {bad}: index says {self.index[bad]} longwords, the "
+                    f"stream is {walked[bad]}")
+            if off_frm + 4 * sum(self.index) != len(b):
+                raise ValueError(
+                    f"{path}: the index accounts for "
+                    f"{off_frm + 4 * sum(self.index)} bytes and the file is "
+                    f"{len(b)} -- a producer trusting it would run off the end")
+
     def modes(self, f):
         o, _ = self.frames[f]
         h = np.frombuffer(self.raw, np.uint8, self.mode_bytes, o)