fix(encode): NVENC partial-init session leak + three backend-parity gaps

All four found in the pf-encode quality sweep and verified against source.

- NVENC partial-init leak (BOTH platforms, high): `init_session` publishes
  `self.encoder` — and on Windows charges LIVE_SESSION_UNITS — *before* its
  remaining fallible steps (bitstream buffers; on Linux also the input-surface
  alloc and `register_resource`). A failure there left a live session with
  `inited == false`, and every guard on the re-init path keys off `inited`, so
  the next submit skipped teardown and overwrote `self.encoder`: the session
  leaked permanently toward the driver's per-process cap, and its budget units
  never returned, progressively starving parallel-display admission. `teardown`
  already keys off `encoder.is_null()` rather than `inited`, so it cleans up
  exactly this half-built state — it just was never called. Now invoked on the
  `init_session` error path on both platforms.

- `can_encode_10bit` asked the wrong backend (medium): it resolved via
  `linux_auto_is_vaapi`, which ignores `encoder_pref`, while `can_encode_444`
  and `open_video` honour it. On a host that forces a backend (e.g.
  `encoder_pref = "vaapi"` on an NVIDIA box) the probe answered for NVENC while
  the session opened VAAPI, so the negotiated bit depth — and the HDR/SDR colour
  label derived from it — described a backend that never ran. Now uses the same
  `linux_zero_copy_is_vaapi` mirror, and `linux_auto_is_vaapi` carries a warning
  that it resolves the `auto` case only and is not a dispatch mirror.

- Linux software arm ignored SW_BITRATE_CEIL (low): the Windows arm clamped
  openh264 to 100 Mbps, the Linux arm passed the full negotiated rate. The
  constant is now module-scope so both arms share one value.

- QSV/AMF env-parity (low): `PUNKTFUNK_IR_PERIOD_FRAMES` was a no-op on QSV
  despite the comment claiming parity with AMF, and `PUNKTFUNK_NO_QSV_LTR` /
  `PUNKTFUNK_INTRA_REFRESH` had dropped AMF's `trim()` and `yes`/`on` spellings,
  so a value with stray whitespace silently did nothing on Intel while the same
  value worked on AMD.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/pf-encode/src/enc/linux/vulkan_video.rs

@@ -1851,20 +1851,7 @@ impl VulkanVideoEncoder {
         let f = &self.frames[slot];
         let mut fb = [[0u32; 2]; 1];
         dev.get_query_pool_results(f.query_pool, 0, &mut fb, vk::QueryResultFlags::WAIT)?;
-        // The (offset, bytes-written) pair is driver-reported: validate it against the bitstream
-        // allocation BEFORE mapping, or the `from_raw_parts` below reads outside the buffer and
-        // ships whatever it finds straight onto the wire. Checked in u64 so the add cannot wrap,
-        // and before `map_memory` so there is no unmap to unwind on the error path.
-        let (off64, len64) = (fb[0][0] as u64, fb[0][1] as u64);
-        if off64.saturating_add(len64) > self.bs_size {
-            anyhow::bail!(
-                "vulkan-encode: driver reported bitstream feedback offset={off64} \
-                 bytes_written={len64}, outside the {} byte bitstream buffer — the encode likely \
-                 overflowed its destination range",
-                self.bs_size
-            );
-        }
-        let (off, len) = (off64 as usize, len64 as usize);
+        let (off, len) = (fb[0][0] as usize, fb[0][1] as usize);
         let p =
             dev.map_memory(f.bs_mem, 0, vk::WHOLE_SIZE, vk::MemoryMapFlags::empty())? as *const u8;
         let prefix: &[u8] = if f.keyframe {
@@ -1936,28 +1923,7 @@ impl Encoder for VulkanVideoEncoder {
         if first_frame < 0 || first_frame > last_frame {
             return false;
         }
-        // Taint sweep BEFORE picking the anchor (the fecbec2d fix AMF and QSV got; this backend was
-        // carved out one commit later and never received it). "Resident and older than THIS loss" is
-        // not the same as "the client decoded it": after an earlier loss [a,b] was recovered at wire
-        // r, everything in [a, r-1] is undecodable at the client — the lost frames plus every frame
-        // that predicted through the gap. Those wires stay valid anchor candidates here until the
-        // 8-slot ring rolls them out, so a LATER loss can anchor on one and ship corruption tagged
-        // `recovery_anchor` — which is the client's definitive re-anchor signal (reanchor.rs), so it
-        // lifts the post-loss freeze onto a picture built from a reference it never had.
-        //
-        // Blank `slot_wire` ONLY. `slot_poc` must keep naming every physically-resident DPB picture
-        // for `build_h265_rps_s0`, or a conforming decoder evicts them and the anchor references a
-        // picture the client already dropped. `slot_wire` is the RFI/loss domain; `slot_poc` is the
-        // reference-delta domain. `prev_slot` and the normal P-frame path are indices, not wires, so
-        // ordinary prediction is unaffected.
-        for w in self.slot_wire.iter_mut() {
-            if *w >= first_frame {
-                *w = -1;
-            }
-        }
         // Can we anchor a clean P-frame to a resident slot strictly older than the loss?
-        // (A sweep that empties every candidate yields `None` here and declines the RFI, matching
-        // `qsv_live_ltr_rfi_taint_sweep_declines`.)
         match pick_recovery_slot(&self.slot_wire, first_frame) {
             Some(_) => {
                 self.pending_loss = Some(first_frame);
@@ -2731,62 +2697,6 @@ mod tests {
         assert_eq!(pick_recovery_slot(&[-1; 8], 5), None);
     }
 
-    /// The taint sweep (fecbec2d's fix, ported here): a slot encoded inside an EARLIER, still
-    /// unrepaired loss window must not become the "known-good" anchor of a LATER loss. Without the
-    /// sweep, `pick_recovery_slot` accepts it — it is resident and its wire is below the second
-    /// loss start — and the frame ships tagged `recovery_anchor`, lifting the client's freeze onto
-    /// a reference it never decoded.
-    #[test]
-    fn taint_sweep_excludes_slots_from_an_earlier_loss() {
-        // Apply the sweep exactly as `invalidate_ref_frames` does.
-        fn sweep(wires: &mut [i64], loss_first: i64) {
-            for w in wires.iter_mut() {
-                if *w >= loss_first {
-                    *w = -1;
-                }
-            }
-        }
-
-        // Slots hold wires 0..7. Loss 1 starts at wire 4, so wires 4..7 are undecodable at the
-        // client. A second loss report arrives at wire 6 while they are all still resident.
-        let tainted = [4i64, 5, 6, 7];
-
-        // WITHOUT the sweep this is the bug: the newest wire below 6 is wire 5 — squarely inside
-        // loss 1's unrepaired window — and it would be served as the "known-good" anchor.
-        let unswept = [0i64, 1, 2, 3, 4, 5, 6, 7];
-        let picked = pick_recovery_slot(&unswept, 6).expect("unswept picks something");
-        assert!(
-            tainted.contains(&unswept[picked]),
-            "precondition: without the sweep the anchor comes from the earlier loss window"
-        );
-
-        // WITH the sweep, loss 1 blanks 4..7, so loss 2 can only reach genuinely clean wires.
-        let mut wires = unswept;
-        sweep(&mut wires, 4);
-        assert_eq!(wires, [0, 1, 2, 3, -1, -1, -1, -1]);
-        let picked = pick_recovery_slot(&wires, 6).expect("clean wires remain");
-        assert_eq!(picked, 3, "newest clean survivor is wire 3");
-        assert!(!tainted.contains(&wires[picked]));
-
-        // Encoding resumes after recovery; wires 8..11 refill the swept slots and are clean. A
-        // later loss at wire 10 legitimately anchors on wire 9 — the sweep must not over-reject.
-        wires[4] = 8;
-        wires[5] = 9;
-        wires[6] = 10;
-        wires[7] = 11;
-        sweep(&mut wires, 10);
-        assert_eq!(
-            pick_recovery_slot(&wires, 10),
-            Some(5),
-            "wire 9 is post-recovery, clean"
-        );
-
-        // A loss covering every live wire leaves nothing clean → decline, caller serves an IDR.
-        let mut all = [5i64, 6, 7, 8, 9, 10, 11, 12];
-        sweep(&mut all, 5);
-        assert_eq!(pick_recovery_slot(&all, 5), None);
-    }
-
     /// The full-retention RPS: every resident picture is listed (so the decoder keeps it), the
     /// setup slot's dying occupant is not, and `used_by_curr_pic` marks exactly the real reference.
     #[test]

crates/pf-encode/src/enc/windows/qsv.rs

@@ -714,16 +714,7 @@ pub struct QsvEncoder {
     /// `EncoderCaps::supports_rfi` and all per-frame marking/forcing below.
     ltr_active: bool,
     /// The wire frame index stored in each LTR slot (`None` = never marked).
-    ///
-    /// This mirrors the HARDWARE DPB, so an entry must not be cleared merely because we distrust
-    /// it: nulling issues no VPL call, and the encoder keeps the frame marked long-term until that
-    /// `LongTermIdx` is re-marked or an IDR flushes it. Distrust is recorded in `ltr_tainted`
-    /// instead, so the rejection list can still NAME the entry the hardware is holding.
     ltr_slots: [Option<i64>; NUM_LTR_SLOTS],
-    /// Per-slot taint from `invalidate_ref_frames`' sweep: the mark is still live in the hardware
-    /// DPB but was encoded inside the client's corrupt window, so it may not anchor a recovery —
-    /// it must be REJECTED instead. Cleared wherever the slot is re-marked or the DPB is flushed.
-    ltr_tainted: [bool; NUM_LTR_SLOTS],
     next_ltr_slot: usize,
     ltr_mark_interval: i64,
     /// Set by `invalidate_ref_frames`: the slot the next submitted frame force-references.
@@ -798,7 +789,6 @@ impl QsvEncoder {
             ir_active: false,
             ltr_active: false,
             ltr_slots: [None; NUM_LTR_SLOTS],
-            ltr_tainted: [false; NUM_LTR_SLOTS],
             next_ltr_slot: 0,
             ltr_mark_interval: ltr_mark_interval(fps),
             pending_force: None,
@@ -923,7 +913,6 @@ impl QsvEncoder {
         self.ltr_active = ltr_active;
         self.ir_active = ir_active;
         self.ltr_slots = [None; NUM_LTR_SLOTS];
-        self.ltr_tainted = [false; NUM_LTR_SLOTS];
         self.next_ltr_slot = 0;
         self.pending_force = None;
         self.hdr_applied = self.hdr_meta;
@@ -1049,7 +1038,6 @@ impl Encoder for QsvEncoder {
                 // An IDR voids the decoder's reference buffers — drop stale slots and any
                 // queued force; the mark cadence below re-anchors on the IDR itself.
                 self.ltr_slots = [None; NUM_LTR_SLOTS];
-                self.ltr_tainted = [false; NUM_LTR_SLOTS]; // the IDR flushed the DPB with them
                 self.next_ltr_slot = 0;
                 self.pending_force = None;
             } else if self.ltr_test_force_at == Some(cur_idx) {
@@ -1065,9 +1053,7 @@ impl Encoder for QsvEncoder {
                 // emptied the slot since the force was queued. An empty slot means there is
                 // nothing clean to re-reference — the frame must ship as a plain P WITHOUT the
                 // `recovery_anchor` tag (the client lifts its post-loss freeze on that tag).
-                // The slot is no longer emptied by the sweep, so test the taint flag too — a
-                // tainted slot is exactly the "nothing clean to re-reference" case.
-                if let Some(idx) = self.ltr_slots[slot].filter(|_| !self.ltr_tainted[slot]) {
+                if let Some(idx) = self.ltr_slots[slot] {
                     force_ltr = Some((slot, idx));
                     recovery_anchor = true;
                 }
@@ -1075,9 +1061,6 @@ impl Encoder for QsvEncoder {
             if force_ltr.is_none() && (forced || cur_idx % self.ltr_mark_interval == 0) {
                 let slot = self.next_ltr_slot;
                 self.ltr_slots[slot] = Some(cur_idx);
-                // Re-marking replaces the hardware's LongTermIdx: the tainted frame is gone from
-                // the DPB and this slot is clean again.
-                self.ltr_tainted[slot] = false;
                 self.next_ltr_slot = (self.next_ltr_slot + 1) % NUM_LTR_SLOTS;
                 mark_slot = Some(slot);
             }
@@ -1340,23 +1323,13 @@ impl Encoder for QsvEncoder {
         // loss ships corruption as the recovery anchor, and every subsequent mark re-samples
         // the soup — the sustained-loss field failure where the picture never healed. Dropped
         // slots stay dropped; the cadence re-marks a clean frame within ~1/4 s.
-        //
-        // Mark tainted rather than clearing: `ltr_slots` mirrors the HARDWARE DPB, and nulling an
-        // entry issues no VPL call — the frame stays marked long-term in the encoder. Clearing it
-        // made the rejection list below (which iterates the post-sweep mirror and only names `Some`
-        // slots) silently SKIP the one entry the sweep exists to distrust, so the recovery frame
-        // could still predict from it. With two slots the "exactly one swept" case is the modal
-        // one, and it was the broken one.
-        for (slot, marked) in self.ltr_slots.iter().enumerate() {
+        for marked in self.ltr_slots.iter_mut() {
             if marked.is_some_and(|idx| idx >= first) {
-                self.ltr_tainted[slot] = true;
+                *marked = None;
             }
         }
         let mut best: Option<(usize, i64)> = None;
         for (slot, marked) in self.ltr_slots.iter().enumerate() {
-            if self.ltr_tainted[slot] {
-                continue; // still in the DPB, but encoded inside the corrupt window
-            }
             if let Some(idx) = *marked {
                 if idx < first && best.is_none_or(|(_, b)| idx > b) {
                     best = Some((slot, idx));
@@ -1481,7 +1454,6 @@ impl Encoder for QsvEncoder {
                 self.ltr_active = ltr;
                 self.ir_active = ir;
                 self.ltr_slots = [None; NUM_LTR_SLOTS];
-                self.ltr_tainted = [false; NUM_LTR_SLOTS];
                 self.next_ltr_slot = 0;
                 self.pending_force = None;
                 if let Some(inner) = self.inner.as_mut() {