forked from unom/punktfunk
enricobuehler
93c1ed0723
The slot-family RFI backends choose a recovery anchor over `slot_wire`, which answers "did the client RECEIVE this frame" when the question is "did the client DECODE it intact". The taint sweep exists precisely to bridge that gap -- rfi.rs says so -- but it only ever runs inside invalidate_ref_frames, reachable from exactly ONE of the client's five damage signals (the frame-index gap). The other four send a plain keyframe request, which sets force_kf and taints nothing. That is self-healing while the IDR is actually emitted. It is not when the request is coalesced away by the 750 ms IDR cooldown: the client's damage then goes unrepaired AND unrecorded, and those references stay anchor candidates for the next loss -- so the host serves an anchor over damage the client already told it about, tagged as the client's definitive clean re-anchor. The client-side half of this fix now refuses such an anchor; this is the other half, which stops it being offered. Adds Encoder::distrust_references (defaulted no-op, forwarded through TrackedEncoder -- unforwarded it would have been a silent no-op for every session), implemented by the three slot-family backends through their own persistence markers, which rfi.rs explicitly says not to harmonize: Vulkan Video blanks slot_wire ONLY and leaves slot_poc naming every resident, or build_h265_rps_s0 stops retaining them and a conforming decoder evicts pictures the encoder still references -- a separate grey bug that file already documents. AMF clears its mirror slot; QSV raises ltr_tainted rather than clearing its mirror, because the RejectedRefList only names Some slots and a cleared entry would skip the very reference being distrusted. Called on the IDR-cooldown branch, where the client is still reporting damage and nothing in the table is honestly known-good until the in-flight IDR lands. Deliberately NOT on the RFI-echo branch while its budget holds: that branch's premise is that the request echoes the loss the RFI just repaired, and distrusting on the first echo would poison the table after EVERY successful recovery, so RFI could never fire twice running and a sustained-loss session would fall back to the IDR path this block exists to keep it off. RFI_ECHO_MAX_SWALLOWED is already the hedge for that premise being wrong: when the client keeps asking past the budget, the anchor demonstrably did not heal it, and the escalation arm withdraws trust then -- on evidence rather than on suspicion. Distrust never touches prediction (that runs off slot indices, not the wire domain) and all three markers self-correct within a few frames, so the suppression is brief by construction and never spans a session.