fix(encode): harden loss-recovery correctness across host encoders (F1–F7)

Phases 1–4 of design/encoder-recovery-hardening.md — make the shipped RFI/
freeze-until-reanchor recovery honest and rebuild-safe across every backend.

F1 — frame-index domain desync: the encode loop now owns a session-lifetime
`au_seq`; `Encoder::submit_indexed(au_seq + inflight)` pins NVENC inputTimeStamp
and AMF LTR slots to the WIRE frame index, so `invalidate_ref_frames` compares
client frame numbers in the same domain and survives adaptive-bitrate rebuilds
(an internal counter desynced on the first rebuild → RFI silently dead / an AMF
force-ref onto a never-decoded frame). `FrameMsg.frame_index` →
`Session::seal_frame_at`; GameStream gets the same via `VideoPacketizer::
packetize(.., Some(idx))`.

F2 — Windows NVENC left the client frozen ~1s per loss: NVENC RFI was
transparent (no anchor tag) while the session glue armed the 750ms IDR cooldown,
so the freeze only lifted on the ~1s keyframe re-ask. NVENC now mirrors AMF —
`pending_anchor` tags the first post-invalidate AU (the clean re-anchor
P-frame) `recovery_anchor`, incl. the covering-range dedupe re-arm; the client
lifts at ~RTT.

F3 — speed-test probe filler burned video frame indexes: moved to its own index
space (`Packetizer::alloc_probe_index` + `Session::submit_probe_frame`) with a
second client reassembly window routed on FLAG_PROBE, gated on the new
VIDEO_CAP_PROBE_SEQ Hello bit (mid-session probes declined for older clients).

F4 — RFI range sanity cap: forward gaps wider than `packet::RFI_MAX_RANGE` (256)
resync via keyframe instead of an out-of-range RFI, host- and client-side
(client huge-gap → keyframe in `RfiRecovery::observe` + the pf-client-core pump).

F5 — reset() parity: Windows NVENC (teardown + lazy re-init), Linux VAAPI
(drop-inner), Linux NVENC (reopen from stored OpenArgs) now give the stall
watchdog a heal lever instead of ending the session.

F6 — sw.rs `pending: VecDeque` (was `Option`), killing the silent AU drop at
capturer pipeline depth > 1. F7 — doc sweep on the RFI/anchor comments.

Verified: punktfunk-core lib tests (macOS + Linux), full punktfunk-host suite on
Linux (RTX 5070 Ti), Windows compile. Owed: the on-glass client matrix (F2
freeze A/B, AMF LTR spike across a bitrate rebuild).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/encode/sw.rs

@@ -20,6 +20,7 @@ use openh264::encoder::{
 };
 use openh264::formats::YUVSlices;
 use openh264::OpenH264API;
+use std::collections::VecDeque;
 
 pub struct OpenH264Encoder {
     enc: Oh264,
@@ -34,8 +35,11 @@ pub struct OpenH264Encoder {
     v_plane: Vec<u8>,
     frame_idx: i64,
     force_kf: bool,
-    /// At most one AU per submit (no lookahead), handed back by the next `poll`.
-    pending: Option<EncodedFrame>,
+    /// One AU per submit (no lookahead), handed back FIFO by `poll`. A queue, not an `Option`:
+    /// the session loop pipelines up to `capturer.pipeline_depth()` submits before polling, and a
+    /// single-slot pending would silently overwrite (lose) the older AUs — including the opening
+    /// IDR — and permanently skew the loop's FIFO pts pairing.
+    pending: VecDeque<EncodedFrame>,
 }
 
 // openh264's Encoder holds a raw C handle (not auto-Send); it lives on the single encode thread.
@@ -88,7 +92,7 @@ impl OpenH264Encoder {
             v_plane: vec![0; (w / 2) * (h / 2)],
             frame_idx: 0,
             force_kf: false,
-            pending: None,
+            pending: VecDeque::new(),
         })
     }
 
@@ -207,7 +211,7 @@ impl Encoder for OpenH264Encoder {
         if !data.is_empty() {
             let keyframe = matches!(bs.frame_type(), FrameType::IDR | FrameType::I);
             let pts_ns = self.frame_idx as u64 * 1_000_000_000 / self.fps.max(1) as u64;
-            self.pending = Some(EncodedFrame {
+            self.pending.push_back(EncodedFrame {
                 data,
                 pts_ns,
                 keyframe,
@@ -223,7 +227,7 @@ impl Encoder for OpenH264Encoder {
     }
 
     fn poll(&mut self) -> Result<Option<EncodedFrame>> {
-        Ok(self.pending.take())
+        Ok(self.pending.pop_front())
     }
 
     fn flush(&mut self) -> Result<()> {