fix(pf-encode/pyrowave): the bitrate pin holds on the WIRE, not the raw bitstream

A datagram-aligned PyroWave session inflates the codec bitstream ×1.2–1.3
on its way to the wire — greedy packing of few-hundred-byte atomic block
packets into 1408 B windows zero-pads most window tails, plus the 4-byte
prefixes and FRAG chains. The 2026-07 field report's 1440p60 10-bit
"Automatic" pin of 407 Mb/s put a measured 550 Mb/s on a 1 GbE link;
nothing enforced the pin past the rate controller.

New shared WireBudget (pyrowave_wire.rs, both backends): tracks the real
per-frame AU/bitstream ratio as a ×1024 fixed-point EMA (prior ×1.25,
weight 1/8, clamped ×1.0–×2.0) and deflates the budget handed to
pyrowave's rate control by it, so the windowed AU lands on the configured
rate. Sealed-datagram framing (+4.5%) and FEC parity stay uncompensated —
H.26x sessions carry those on top of the configured bitrate too, and the
pin must mean the same thing for every codec.

Dense (non-chunked) sessions are untouched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/pf-encode/src/enc/linux/pyrowave.rs

@@ -395,6 +395,9 @@ pub struct PyroWaveEncoder {
     /// packet to it, so each wire shard carries whole self-delimiting packets. `None` =
     /// one packet per AU (the dense MVP shape).
     wire_chunk: Option<usize>,
+    /// Measured windowing inflation → rate-budget deflation, so the bitrate pin holds on the
+    /// WIRE, not just the raw bitstream (see [`crate::pyrowave_wire::WireBudget`]).
+    wire_budget: crate::pyrowave_wire::WireBudget,
     bitstream: Vec<u8>,
     pending: VecDeque<EncodedFrame>,
     frame_count: u64,
@@ -653,6 +656,7 @@ impl PyroWaveEncoder {
             chroma444,
             frame_budget: budget_for(bitrate, fps),
             wire_chunk: None,
+            wire_budget: crate::pyrowave_wire::WireBudget::new(),
             bitstream: Vec::new(),
             pending: VecDeque::new(),
             frame_count: 0,
@@ -1120,6 +1124,16 @@ impl PyroWaveEncoder {
         Ok(self.cpu_img.unwrap().2)
     }
 
+    /// The per-frame budget handed to pyrowave rate control: `frame_budget`, deflated by the
+    /// measured windowing inflation when the datagram-aligned wire is on — the bitrate pin is
+    /// a promise about the wire, not the raw bitstream (see [`crate::pyrowave_wire::WireBudget`]).
+    fn rate_budget(&self) -> usize {
+        match self.wire_chunk {
+            Some(_) => self.wire_budget.deflate(self.frame_budget).max(64 * 1024),
+            None => self.frame_budget,
+        }
+    }
+
     /// One frame, synchronously: ingest → CSC → pyrowave encode (recorded into our command
     /// buffer) → submit + fence wait (sub-ms) → packetize into an `EncodedFrame`.
     unsafe fn encode_frame(&mut self, frame: &CapturedFrame) -> Result<()> {
@@ -1175,6 +1189,8 @@ impl PyroWaveEncoder {
         // paths propagate untouched and the recovery (`reset()`/`Drop`) `device_wait_idle()`s
         // before anything touches `cmd`; a buffer that completed its one-time submit is INVALID,
         // which the next `begin` may implicitly reset.
+        // Resolved before the closure (which borrows `self` mutably for the recording calls).
+        let rate_budget = self.rate_budget();
         let record_and_submit = (|| -> Result<()> {
             dev.begin_command_buffer(
                 self.cmd,
@@ -1396,7 +1412,7 @@ impl PyroWaveEncoder {
                 ],
             };
             let rc = pw::pyrowave_rate_control {
-                maximum_bitstream_size: self.frame_budget,
+                maximum_bitstream_size: rate_budget,
             };
             pw::pyrowave_device_set_command_buffer(
                 self.pw_dev,
@@ -1476,6 +1492,10 @@ impl PyroWaveEncoder {
         // single packet, or the datagram-aligned windowed AU (§4.4).
         let pkts: Vec<(usize, usize)> = packets.iter().map(|p| (p.offset, p.size)).collect();
         let au = crate::pyrowave_wire::build_au(&pkts, &self.bitstream, self.wire_chunk);
+        if self.wire_chunk.is_some() {
+            let raw: usize = pkts.iter().map(|&(_, s)| s).sum();
+            self.wire_budget.observe(raw, au.len());
+        }
         self.frame_count += 1;
         self.pending.push_back(EncodedFrame {
             data: au,