re(flight): a per-frame sampler, and nav oracles that a menu bar cannot break

WIP toward the residual flight-speed-law question (does a 1 s burst reach the
steady angular rate, or is there a per-axis multiplier?). The write-up already
concluded that host-side polling cannot answer it and named a Canary-side hook
as the tool required; that hook now exists (--frame_probe_log, committed as
auto/re-frame-probe in xenia-canary-native) and this is the harness for it.

- `rebuild_canary.sh` -- the surgical rebuild the box can actually do, kept in
  the repo this time instead of in /tmp: compile only the changed objects, `ar`
  them into their archive, and re-run the link command lifted out of the
  generated ninja. A full `ninja` is impossible here (several TUs need dev
  headers the image lacks) and the build cache cannot be re-configured. 31 s.
- `frame_burst.py` -- points the probe at the player craft's transform block
  (pos-112, the three 16-byte-strided rows plus the position) and drives full
  stick holds, recording each hold's start and end in the same clock the probe
  stamps its lines with.
- `frame_session.sh` -- the whole run as ONE blocking foreground call, per the
  session-lifetime rule; REUSE=1 drives a Canary that is already up.
- `nav_to_flight.sh` -- fly_stage.sh's navigation, split out so a live emulator
  can be re-used. A boot to the title costs minutes under lavapipe and a run
  that only failed to NAVIGATE should not pay for it twice.

The navigation change is the one worth reading. Every screen oracle here tested
named pixels ("648,221 is white"), which is only valid while the game image sits
at a known place on the root window -- and it does not: xenia's GTK window has a
menu bar, so on this display the image is ~25 px lower and every constant reads
the wrong row. Nothing errors. One run sat 300 s in front of a plainly visible
MAIN MENU reporting "no main menu"; the next missed the title screen entirely
and let the attract movie loop for ten minutes.

So `screen_id.py` identifies screens by WHOLE-IMAGE statistics instead -- the
fraction of green UI-text pixels, the fraction of near-white pixels, and the
per-channel means -- which no vertical shift, scale or letterbox can move. It is
calibrated against known-good captures and classifies all of them correctly:
title, three different menu screens, in-flight, and four movie frames as
"other". `bin/screenshot` additionally crops the menu bar off saved evidence
shots, deriving the offset from the window's own height rather than a constant.

Not yet a finding: the run has not reached flight, so no rate has been measured.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tools/re-capture/frame_session.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# One blocking foreground session: boot to flight, then measure angular rate with
+# the per-frame probe instead of host polling.
+#
+# Everything (Xvfb, openbox, xenia) is a plain child of THIS script. Anything
+# `setsid`'d is reaped at the agent's turn boundary — see the session-lifetime
+# note in launch_mission.sh — so the whole run has to fit in one call.
+#
+# Usage: frame_session.sh [stage] [hold_s] [repeats]
+set -u
+STAGE="${1:-10}"; HOLD="${2:-3.0}"; REPS="${3:-2}"
+export HOME=/sylph-home/re DISPLAY="${DISPLAY:-:99}" SDL_AUDIODRIVER=dummy
+export XENIA_PAD_FILE=/tmp/xenia_pad.txt
+export XENIA_FRAME_PROBE=/tmp/xenia_frame_probe.txt
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+OUT="$HOME/frameprobe"; mkdir -p "$OUT"
+LOG="$OUT/frame-stage$STAGE.log"
+say() { echo "[$(date +%H:%M:%S)] $*"; }
+
+ensure_display() {
+  if ! xdpyinfo -display "$DISPLAY" >/dev/null 2>&1; then
+    rm -f "/tmp/.X${DISPLAY#:}-lock" 2>/dev/null || true
+    nohup bash -c 'Xvfb "$0" -screen 0 1280x720x24 -ac -nolisten tcp \
+        +extension GLX +extension RANDR >/tmp/xvfb${DISPLAY#:}.log 2>&1
+      echo "$(date +%T) XVFB EXIT $? (128+N means signal N)" >>/tmp/xvfb-exit.log' \
+      "$DISPLAY" </dev/null >/dev/null 2>&1 &
+    for _ in $(seq 1 50); do xdpyinfo -display "$DISPLAY" >/dev/null 2>&1 && break; sleep 0.2; done
+    nohup env DISPLAY="$DISPLAY" HOME=/sylph-home openbox </dev/null >/tmp/openbox${DISPLAY#:}.log 2>&1 &
+    sleep 1
+  fi
+  xdpyinfo -display "$DISPLAY" >/dev/null 2>&1 || { say "DISPLAY UNAVAILABLE"; exit 1; }
+}
+
+ensure_display
+# A stale control file would make the probe log the PREVIOUS run's addresses from
+# the first frame, which land in whatever occupies them now.
+rm -f "$XENIA_FRAME_PROBE"
+
+# REUSE=1 drives a Canary that is already up (it must have been launched with the
+# same --frame_probe_log). Booting to the title costs minutes under lavapipe and
+# a run that only failed to navigate should not pay for it again.
+if [ "${REUSE:-0}" = 1 ] && pgrep -x xenia_canary >/dev/null; then
+  say "re-using the running emulator; navigating to stage $STAGE"
+  "$HERE/nav_to_flight.sh" "$STAGE" 300 || { say "navigation failed ($?)"; exit 2; }
+else
+  rm -f "$LOG"
+  say "booting to flight on stage $STAGE with the per-frame probe armed"
+  CANARY_EXTRA="--frame_probe_log=$LOG --frame_probe=$XENIA_FRAME_PROBE" \
+    "$HERE/fly_stage.sh" "$STAGE" 300 || { say "boot failed ($?)"; exit 2; }
+fi
+
+say "arming the probe on the player craft and driving the bursts"
+python3 "$HERE/frame_burst.py" "$OUT/events-stage$STAGE.csv" "$HOLD" "$REPS"
+rc=$?
+# Stop sampling before the emulator is torn down, so the log ends cleanly.
+rm -f "$XENIA_FRAME_PROBE"
+say "frame log: $LOG ($(wc -l < "$LOG" 2>/dev/null || echo 0) lines)"
+exit $rc