Rate control: rebuilt per-frame, wired in, and gated at zero drift

FINDINGS 26 stopped the session-5 rate controller before it shipped: it built a
lam-ladder of independent whole-sequence encodes and picked frames off it, so
SKIP blocks referenced reconstructions the decoder never saw -- 111 of 120
frames drifted. The fix is the structural one 26.1 said it had to be.

vq_hybrid is now frame-drivable -- frame_ctx / decide / paint -- and encode() is
a thin loop over it. Rate control drives the same three calls, bisects lam per
frame under the leaky bucket, and feeds back the frame it actually emitted. The
desync has no way to occur, and 09_ratectl_drift.py goes 111/120 -> 0/120. That
test is now part of check.sh, which is ~2 min rather than ~40 s.

Both overshoots on the worst sustained window are closed for under 1 dB, totals
including audio: sasi 137.4 -> 109.5 KB/s (-0.60 dB), scsi 381.6 -> 280.0 KB/s
(-0.91 dB). Zero frames hit the lam=800 cliff, so nothing was destroyed to get
there. Rate control also makes the display path cheaper -- scsi's median drops
53.6% -> 47.1% -- because raising lam moves blocks to SKIP and V1.

Two knobs measured rather than guessed. --rc-floor is worth 0.00 dB on that
window and defaults to the profile lam, so rate control cannot regress content
that already fits. --prefill defaults to 0 and is documented as a trap: it buys
a permission to overshoot of exactly bucket/nframes, and on a 14-frame clip it
disables the controller outright.

FINDINGS 26.5 was wrong in both halves and 27.6 records it. _paint was not the
bottleneck (14% of a frame, though vectorising it was still right at 17.1x) and
the ladder was never "minutes" -- those were k-means in build(). What makes
per-frame rate control affordable is that VQ.assign depends on neither lam nor
prev, so it is cached one frame deep: a 12-step search over 120 frames costs
0.31 s against 49.1 s.

Also caught: fixed-lam sasi was already 5% over target on 00020, the clip
everyone called easy. Nothing noticed because the profile table quotes PSNR and
not bitrate.

check.sh: ALL GREEN.

Claude-Session: https://claude.ai/code/session_01194oWYW8DQXK1SZ2DnChW6

tools/bench/check.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
-# Green-light check: re-runs both display regression tests from the Blu-ray.
-# ~40 s. Run from the repo root. Any non-zero exit means something drifted.
+# Green-light check: re-runs both display regression tests AND the rate-control
+# drift test, from the Blu-ray. ~2 min. Run from the repo root. Any non-zero
+# exit means something drifted.
 set -e
 cd "$(dirname "$0")/../.."
 [ -d /media/reala-misaki/BDROM ] || {
@@ -27,4 +28,16 @@ python3 tools/bench/prep_frame.py tmp/fr_00020 tmp/frame256.bin 0 --reserve-blac
 run show_frame256.lua snap256
 python3 tools/bench/verify_frame256.py
 
+echo "--- session 6: rate-control drift (FINDINGS 26/27) ---"
+# The codec is temporally recursive, so a rate controller can report quality for
+# a reconstruction no decoder will ever produce -- silently. This asserts that a
+# decoder replaying the emitted stream rebuilds exactly what the encoder
+# recorded. ~55 s, nearly all of it k-means in H.build.
+[ -d tmp/fr_singe ] || python3 tools/encoder/extract.py 00223 tmp/fr_singe 12 crop 539.4 10.0
+# NOT piped into tail: a pipeline's exit status is the last command's, which
+# would swallow the failure this whole script exists to catch.
+python3 tools/analysis/09_ratectl_drift.py > tmp/drift_check.log 2>&1 \
+  || { cat tmp/drift_check.log; exit 1; }
+tail -9 tmp/drift_check.log
+
 echo "ALL GREEN"