perf(latency): T1.1 frame-driven encode trigger + T1.4 time-based flush thresholds

design/latency-reduction-2026-07.md tier 1, remaining halves:

- T1.1: the native encode loop wakes on the capture's ACTUAL arrival instead of
  sampling at a free-running tick — deletes the sample-and-hold (~half a frame
  interval on average, a full one worst-case: ~8ms avg @60fps). New
  Capturer::supports_arrival_wait/wait_arrival pair (IDD-push waits its
  frame-ready event against the shared-header token; the PipeWire portal blocks
  its channel with a pending stash); backends without an arrival signal — and
  PUNKTFUNK_FRAME_DRIVEN=0 — keep the legacy tick bit-identically. A
  0.9x-interval rate floor caps encode at ~1.11x target when the compositor
  outruns the session; a +0.5x-interval keepalive keeps static desktops
  re-encoding at 1.5x-interval cadence. Pacing deadlines re-anchor to the
  actual submit so they can't drift against the arrival clock. GameStream
  plane untouched.
- T1.4: the jump-to-live detectors run on WALL-CLOCK now (STANDING_TIME /
  FLUSH_AFTER = 250ms) instead of 30-frame counts whose meaning scaled with
  fps (500ms @60 but 125ms @240 — and stretching further under T1.1's slower
  static-scene repeats). The queue trip also requires depth still >= high, so
  a hysteresis-band hover can't fire on elapsed time alone.

Validated: .21 Linux 185 core + 177 host + pf-capture tests, clippy
-D warnings; .133 Windows cargo check of pf-capture + punktfunk-host green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/pf-capture/src/linux/mod.rs

@@ -35,6 +35,10 @@ use std::time::Duration;
 /// and no second session to conflict with).
 pub struct PortalCapturer {
     frames: Receiver<CapturedFrame>,
+    /// A frame [`wait_arrival`](Capturer::wait_arrival) received while blocking (the channel
+    /// can't be peeked, so the wait must consume) — always the FIRST candidate the next
+    /// `try_latest`/`next_frame` considers, before draining anything newer off the channel.
+    pending: Option<CapturedFrame>,
     active: Arc<AtomicBool>,
     /// Set true once the PipeWire stream agrees a video format. Read in [`next_frame`]'s timeout
     /// branch to tell "format never negotiated" (modifier/format mismatch) apart from "negotiated
@@ -166,6 +170,7 @@ impl PwHandles {
     fn into_capturer(self, node_id: u32, keepalive: Option<Box<dyn Send>>) -> PortalCapturer {
         PortalCapturer {
             frames: self.frames,
+            pending: None,
             active: self.active,
             negotiated: self.negotiated,
             streaming: self.streaming,
@@ -266,6 +271,9 @@ impl Capturer for PortalCapturer {
                     self.node_id
                 ));
             }
+            if let Some(f) = self.pending.take() {
+                return Ok(f); // a wait_arrival stash outranks the channel (it's older)
+            }
             let slice = Duration::from_millis(500)
                 .min(deadline.saturating_duration_since(std::time::Instant::now()));
             match self.frames.recv_timeout(slice) {
@@ -276,6 +284,27 @@ impl Capturer for PortalCapturer {
         }
     }
 
+    fn supports_arrival_wait(&self) -> bool {
+        true
+    }
+
+    fn wait_arrival(&mut self, deadline: std::time::Instant) {
+        // Frame-driven trigger (latency plan T1.1): block on the PipeWire channel until the
+        // compositor delivers a frame or the deadline passes. The channel can't be peeked, so
+        // the received frame is stashed in `pending` — `try_latest` starts from it and still
+        // drains anything newer. A broken/ended stream just returns; the following
+        // `try_latest` surfaces the error through its existing paths.
+        if self.pending.is_some() || self.broken.load(Ordering::Relaxed) {
+            return;
+        }
+        let Some(left) = deadline.checked_duration_since(std::time::Instant::now()) else {
+            return;
+        };
+        if let Ok(f) = self.frames.recv_timeout(left) {
+            self.pending = Some(f);
+        }
+    }
+
     fn try_latest(&mut self) -> Result<Option<CapturedFrame>> {
         if self.broken.load(Ordering::Relaxed) {
             return Err(anyhow!(
@@ -285,8 +314,9 @@ impl Capturer for PortalCapturer {
             ));
         }
         // Drain to the newest queued frame without blocking; `None` means the compositor
-        // hasn't produced a new frame since last call (static/idle desktop).
-        let mut latest = None;
+        // hasn't produced a new frame since last call (static/idle desktop). A frame
+        // `wait_arrival` stashed is the oldest candidate — anything on the channel is newer.
+        let mut latest = self.pending.take();
         loop {
             match self.frames.try_recv() {
                 Ok(frame) => latest = Some(frame),