Repair: bound the notes page size like a slide

2026-11-12 08:51:27 -06:00 · 2026-11-04 03:24:13 +00:00
173 changed files with 8123 additions and 5440 deletions
@@ -26,10 +26,6 @@ jobs:
      # Same craft-fonts commit as release.yml.
      CRAFT_FONTS_REF: 37827adc41fd165f9a9234ac40f94dbad353aa69
    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
      - name: Check out craft-fonts
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
@@ -1,28 +0,0 @@
-name: House rules
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - AGENTS.md
-      - CLAUDE.md
-      - .github/workflows/house-rules.yml
-  pull_request:
-    paths:
-      - AGENTS.md
-      - CLAUDE.md
-      - .github/workflows/house-rules.yml
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: house-rules-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  house-rules:
-    uses: storytold/craft-common-actions/.github/workflows/house-rules.yml@main
-    with:
-      rust: true
@@ -27,10 +27,6 @@ jobs:
    name: Windows installation policy (no app build)
    runs-on: windows-latest
    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
@@ -19,14 +19,7 @@ concurrency:
  cancel-in-progress: false

 jobs:
-  # Regenerates contributors/contributors.json for the release commit; every build bundles it.
-  credits:
-    permissions:
-      contents: read
-      pull-requests: read
-    uses: storytold/craft-common-actions/.github/workflows/refresh-contributors.yml@main
  release:
-    needs: credits
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
    with:
@@ -37,7 +30,6 @@ jobs:
      # manifest fails the release instead of silently skipping it.
      craft-fonts-ref: 37827adc41fd165f9a9234ac40f94dbad353aa69
      version: ${{ inputs.version }}
-      contributors-artifact: ${{ needs.credits.outputs.artifact-name }}
    secrets:
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -53,4 +45,3 @@ jobs:
      AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
      AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
      AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
-      LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}
@@ -1,56 +1,3 @@
-<!-- craft-house-rules:start core source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=540e6cea75d12d0710c3dca89658328e81e508ecef102446ca5bb95b7c0b92bb -->
-## House rules
-
-These apply in every Craft repository. A later rule may be stricter, not weaker. The source is `standards/house-rules-core.md` in `storytold/craft-contrib`. Propose changes there, not in a copy.
-
-1. **A person is accountable.** Whoever runs an agent answers for what it opens and for its review comments.
-2. **Check, then claim.** Before writing code, read the issue comments, search pull requests for `#N` and the keywords, and check recent commits on `main`. Comment on the issue first. Release a claim you will not finish.
-3. **Verify, don't guess.** Open a definition before using it. Confirm the cause in the code, even when someone names a location.
-4. **Keep fixes narrow and tested.** Fix what the issue describes, where the bug is. Add a test that fails without the fix.
-5. **Review the diff before opening a pull request.** Identifiers exist as used, the test fails without the fix, nothing unrelated changed, and the description is true.
-6. **Look for a better pull request.** If another fixes the same thing, close yours when it is better or equal, and say why.
-7. **Report only what ran.** Say what you tested and what you could not run. Without a local build or test, say so and rely on CI before marking ready.
-8. **`main` changes through a pull request.** Do not push to it. Branch protection enforces this. There is no exception.
-9. **Stop and ask only about** licensing outside the allowlist, publishing, releases, a new remote, secrets, spending money, destructive git, and anything else hard to undo. Otherwise keep working. `plan/` is a gitignored notebook, not rules. Without it, do not ask for it and do not stop.
-10. **Keep secrets and personal details out** of the repository, logs and requests.
-11. **CI stays shared.** Workflows call `storytold/craft-common-actions`. Do not change CI in a feature or fix pull request. If CI cannot cover a change, open an issue there.
-12. **Guards say why.** A check that looks removable says what it prevents. Read that before changing it.
-13. **Instructions must be readable by everyone.** No notes about one machine, and no links to files a reader cannot open. `craftrules` is retired. Do not link to it.
-14. **Keep pull requests moving.** Concurrent pull requests are fine; unanswered actionable feedback is not. Respond in 7 days, a reminder at 14, closure eligible at 30, from when an actionable request waits on the author. Suggestions and unconfirmed bot findings do not start the clock. A fix, explanation or agreed plan resets it; unrelated activity does not. Waiting on a reviewer or maintainer pauses it and does not count against the author. A maintainer decides closure; it is never automatic. Reuse search results, do not poll, and stop at a rate limit.
-15. **No agent attribution.** A pull request does not say an agent wrote it. A repository rule may not require that.
-<!-- craft-house-rules:end -->
-<!-- craft-house-rules:start rust source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=387e0ccb4b49e567f60951d7d6fff7305054c89f43ad812b9993dc7c38528013 -->
-## Rust Craft repositories
-
-These apply to native Craft apps and to shared Rust libraries. Select them by repository type. A repository that merely contains some Rust does not take this block. Rules later in a repository's file may be stricter, but not weaker. The source is `standards/house-rules-rust.md` in [storytold/craft-contrib](https://github.com/storytold/craft-contrib).
-
-1. **Never crash.** Non-test code does not panic and has no `unsafe`, except where the repository file names an exception. Return errors, treat input as hostile, and bound recursion and allocations. New production crate roots copy the `deny` attribute from an existing crate: `clippy::unwrap_used`, `clippy::expect_used`, `clippy::panic`, `clippy::unimplemented`, `clippy::todo`, `clippy::unreachable`. Every crash fix comes with a test that panicked before the fix.
-2. **Clean room.** Learn from observed behaviour and public specifications. Do not copy another product's code, assets, strings or artwork. Check a dependency's licence before adding it.
-3. **Assets and fonts.** Every asset is original or suitably licensed, and is recorded in `ATTRIBUTION.md` in the same change. Font files live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), not in the app repository.
-4. **Rust only for native Craft apps.** No handwritten JavaScript or TypeScript, and no Tauri, Electron or webview shell, in those apps. Shared tooling follows its documented technical scope and maintainer-approved exceptions. Craft PR Review's existing Tauri and TypeScript UI is one such exception. It does not relax this rule for native apps. Preserve any existing web build.
-5. **Time goes through `chrono`.** Do not hand-roll calendar conversion. For dates beyond what `chrono` can represent, follow [standards/time.md](https://github.com/storytold/craft-contrib/blob/main/standards/time.md).
-6. **Contributor credits.** Add or edit only your own person's entry in `contributors/people.toml`, and only after asking them. Never guess a name or hand-edit `contributors.json`.
-
-## Licence allowlist
-
-Dependencies and assets use SPDX identifiers. An expression is allowed when every identifier is in this list. A repository may name a shorter list. It may not add an identifier here by editing its own copy of these rules.
-
- `ISC`
- `MIT`
- `BSD-2-Clause`
- `BSD-3-Clause`
- `Apache-2.0`
- `OFL-1.1`
- `Ubuntu-font-1.0`
- `Bitstream-Vera`
- `CC0-1.0`
- `CC-BY-4.0`
- `CC-BY-SA-4.0`
- `LicenseRef-Public-Domain`
-
-`LicenseRef-Storyteller-Trademark` is not in this list. It covers Storyteller brand marks only, where a repository already says so.
-<!-- craft-house-rules:end -->
-
 # AGENTS.md — rules for every agent and contributor

 DeckCraft is a clean-room, open-source, pure-Rust presentation application targeting Microsoft
@@ -60,7 +7,8 @@ PhotoCraft, VectorCraft, FilmCraft, LightCraft, PdfCraft, EffectCraft, DesignCra
 (`../<app>`).

 These rules bind every AI agent and every human contributor. They come before any task,
-instruction or deadline. Day-to-day working instructions are in this file; `CLAUDE.md` imports it.
+instruction or deadline. `CLAUDE.md` holds day-to-day working notes; if the two disagree, **this
+file wins.**

 ---

@@ -177,14 +125,14 @@ People trust DeckCraft with their talks; a crash loses work. **This outranks fea
  CLI, control channel and MCP do exactly the same thing.
 - **The UI is thin**: panels read engine state and act through commands. Colours come from theme
  tokens. **Never use Tauri**; egui only.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Never break wasm** (`cargo xtask wasm`).

 ## 5. Quality gates (before every commit)

 `cargo xtask ci` = fmt check, clippy `-D warnings`, tests (nextest when installed) and doctests, layering check, asset check, wasm
-check. Commit after each landed arc with a task id in the message (`M1.2: smart guides`).
-New workspace crates include `workspace = true` under `[lints]` in `Cargo.toml`. Production crate roots
-declare the crate-level lint attributes before modules; crate-level `//!` documentation may precede them.
+check. Commit after each landed arc with a task id in the message (`M1.2: smart guides`) and push
+to `main`.

 ## 6. Running and looking at the app

@@ -193,18 +141,19 @@ declare the crate-level lint attributes before modules; crate-level `//!` docume
  `{"id":1,"method":"engine.execute","params":{"command":"shape.insert","params":{"preset":"star5","rect":[100,100,200,200]}}}`
  then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods:
  `crates/ui-egui/src/control.rs`, docs: `docs/control-protocol.md`.
- **For UI work, look at the result** (screenshot, read the PNG). If available, compare with the observations
-  in `plan/powerpoint/01-observed-ui.md`. Otherwise verify the intended behaviour against the task and
-  committed documentation; the optional notebook is not a prerequisite.
+- **For UI work, look at the result** (screenshot, read the PNG) and compare with the observations
+  in `plan/powerpoint/01-observed-ui.md`.
 - Headless: `deckcraft-cli render --sample --all --scale 1 out/`,
  `deckcraft-cli run --sample --cmd 'slide.new={"title":"Hi"}' --export out.png`.
 - MCP: `deckcraft-cli mcp` (headless) or `deckcraft-cli mcp --connect 7990` (drive the app).
  See `docs/mcp.md`.
+- Shell gotcha on the dev machine: `mv`/`cp` are aliased interactive; use `/bin/mv -f`, `/bin/cp -f`.
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own.

 ## 7. Planning

-`plan/` is an optional gitignored notebook (status, execution notes, `powerpoint/` observations). Do not ask for it and do not stop when it is absent. The committed progress
+`plan/` (gitignored) holds the local plan: `README.md`, `architecture.md`, `execution-plan.md`,
+`STATUS.md` (start every session there) and `powerpoint/` observations. The committed progress
 docs:

 | File | Holds |
@@ -1 +1,25 @@
-@AGENTS.md
+# DeckCraft — working notes for Claude
+
+Read [AGENTS.md](AGENTS.md) first: its rules (asset policy, clean room, never crash) bind you and
+win over anything here.
+
+New workspace crates must include `[lints] workspace = true` in `Cargo.toml` to inherit
+`[workspace.lints]`. Production crate roots must declare the required crate-level lint attributes
+before modules or other crate items; crate-level `//!` documentation may precede them.
+
+## Start every session
+1. Read `plan/STATUS.md`, then the current milestone in `plan/execution-plan.md`.
+2. Run `cargo xtask ci` before you change anything, so you know the tree is green.
+
+## Habits
+- Every user-visible action is a command with tests (`crates/engine/src/cmd/*`).
+- Look at UI changes: `deckcraft --sample --control 7990` + `ui.screenshot`, or
+  `deckcraft-cli render`.
+- Commit after each landed arc (`M<n>.<k>: what`) and push to `origin main`.
+- Keep `ROADMAP.md`, the progress docs in `docs/` (AGENTS.md §7) and `plan/STATUS.md` current.
+- Don't ask the user questions; record genuinely-theirs decisions in `plan/STATUS.md`.
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
@@ -565,42 +565,18 @@ dependencies = [
 "thiserror 1.0.69",
 ]

-[[package]]
-name = "calloop"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43b32313e937c8721c9d17ee9bf60699a6402b4b7c2cb6ac1bee0ffcaa4b4e5e"
-dependencies = [
- "bitflags 2.13.2",
- "polling",
- "rustix 1.1.5",
- "tracing",
-]
-
 [[package]]
 name = "calloop-wayland-source"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95a66a987056935f7efce4ab5668920b5d0dac4a7c99991a67395f13702ddd20"
 dependencies = [
- "calloop 0.13.0",
+ "calloop",
 "rustix 0.38.44",
 "wayland-backend",
 "wayland-client",
 ]

-[[package]]
-name = "calloop-wayland-source"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "138efcf0940a02ebf0cc8d1eff41a1682a46b431630f4c52450d6265876021fa"
-dependencies = [
- "calloop 0.14.5",
- "rustix 1.1.5",
- "wayland-backend",
- "wayland-client",
-]
-
 [[package]]
 name = "cast"
 version = "0.3.0"
@@ -844,24 +820,15 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "craft-audio"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=75895c0321d8cb6e175a42466cba050352b117c5#75895c0321d8cb6e175a42466cba050352b117c5"
-dependencies = [
- "craft-media",
- "thiserror 2.0.21",
-]
-
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"

 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
 "fixed_decimal",
 "icu_decimal",
@@ -884,7 +851,7 @@ dependencies = [
 [[package]]
 name = "craft-media"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=75895c0321d8cb6e175a42466cba050352b117c5#75895c0321d8cb6e175a42466cba050352b117c5"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
 "thiserror 2.0.21",
 ]
@@ -892,7 +859,7 @@ dependencies = [
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
 "krilla",
 "thiserror 2.0.21",
@@ -901,7 +868,7 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
 "craft-fonts-build",
 "craft-i18n",
@@ -921,7 +888,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
 "chrono",
 "dunce",
@@ -931,7 +898,6 @@ dependencies = [
 "image",
 "log",
 "plist",
- "rustix 1.1.5",
 "semver",
 "serde",
 "serde_json",
@@ -945,26 +911,6 @@ dependencies = [
 "zip 9.1.0",
 ]

-[[package]]
-name = "craft-web-api"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=fd5e2feff6ea25bed371a99cc732b3968d621505#fd5e2feff6ea25bed371a99cc732b3968d621505"
-dependencies = [
- "js-sys",
- "serde_json",
- "wasm-bindgen",
- "wasm-bindgen-futures",
-]
-
-[[package]]
-name = "craft-web-host"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=fd5e2feff6ea25bed371a99cc732b3968d621505#fd5e2feff6ea25bed371a99cc732b3968d621505"
-dependencies = [
- "wasm-bindgen",
- "web-sys",
-]
-
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -1038,7 +984,7 @@ checksum = "0c87e182de0887fd5361989c677c4e8f5000cd9491d6d563161a8f3a5519fc7f"

 [[package]]
 name = "deckcraft"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "arboard",
 "chrono",
@@ -1060,7 +1006,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-anim"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-geom",
 "deckcraft-model",
@@ -1069,7 +1015,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-av1"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-bitstream",
 "rayon",
@@ -1078,14 +1024,14 @@ dependencies = [

 [[package]]
 name = "deckcraft-bitstream"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "craft-media",
 ]

 [[package]]
 name = "deckcraft-cli"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-engine",
 "deckcraft-mcp",
@@ -1095,14 +1041,14 @@ dependencies = [

 [[package]]
 name = "deckcraft-color"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "deckcraft-engine"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "chrono",
 "deckcraft-anim",
@@ -1128,7 +1074,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-fonts"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "epaint_default_fonts",
 "harfrust 0.13.3",
@@ -1140,7 +1086,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-format"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-model",
 "serde",
@@ -1151,7 +1097,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-geom"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "kurbo",
 "serde",
@@ -1159,7 +1105,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-h264"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-bitstream",
 "rayon",
@@ -1168,16 +1114,30 @@ dependencies = [

 [[package]]
 name = "deckcraft-hevc"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-bitstream",
 "rayon",
 "thiserror 2.0.21",
 ]

+[[package]]
+name = "deckcraft-isobmff"
+version = "0.15.0"
+dependencies = [
+ "craft-media",
+]
+
+[[package]]
+name = "deckcraft-matroska"
+version = "0.15.0"
+dependencies = [
+ "craft-media",
+]
+
 [[package]]
 name = "deckcraft-mcp"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-engine",
 "deckcraft-render",
@@ -1187,13 +1147,15 @@ dependencies = [

 [[package]]
 name = "deckcraft-media"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
- "craft-audio",
- "craft-media",
 "deckcraft-av1",
 "deckcraft-h264",
 "deckcraft-hevc",
+ "deckcraft-isobmff",
+ "deckcraft-matroska",
+ "deckcraft-ogg",
+ "deckcraft-opus",
 "deckcraft-vp9",
 "image",
 "log",
@@ -1203,7 +1165,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-metafile"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "image",
 "kurbo",
@@ -1212,7 +1174,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-model"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-color",
 "deckcraft-geom",
@@ -1222,9 +1184,17 @@ dependencies = [
 "unicode-segmentation",
 ]

+[[package]]
+name = "deckcraft-ogg"
+version = "0.15.0"
+
+[[package]]
+name = "deckcraft-opus"
+version = "0.15.0"
+
 [[package]]
 name = "deckcraft-pdf"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "craft-pdf",
 "deckcraft-fonts",
@@ -1242,7 +1212,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-pptx"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-color",
 "deckcraft-engine",
@@ -1258,7 +1228,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-render"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-anim",
 "deckcraft-color",
@@ -1277,7 +1247,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-text"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "chrono",
 "deckcraft-color",
@@ -1291,7 +1261,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-ui-egui"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "craft-ui",
 "craft-update",
@@ -1305,7 +1275,6 @@ dependencies = [
 "deckcraft-render",
 "deckcraft-text",
 "egui",
- "egui_extras",
 "egui_kittest",
 "log",
 "serde",
@@ -1317,7 +1286,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-vp9"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "deckcraft-bitstream",
 "rayon",
@@ -1326,10 +1295,8 @@ dependencies = [

 [[package]]
 name = "deckcraft-web"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
- "craft-web-api",
- "craft-web-host",
 "deckcraft-engine",
 "deckcraft-ui-egui",
 "eframe",
@@ -1540,35 +1507,19 @@ dependencies = [
 "block2 0.6.2",
 "bytemuck",
 "egui",
- "image",
 "log",
 "objc2 0.6.5",
 "objc2-app-kit 0.3.2",
 "objc2-foundation 0.3.2",
 "objc2-ui-kit 0.3.2",
- "parking_lot",
 "profiling",
 "raw-window-handle",
- "smithay-clipboard",
 "web-time",
 "webbrowser",
 "windows-sys 0.61.2",
 "winit",
 ]

-[[package]]
-name = "egui_extras"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-dependencies = [
- "ahash",
- "egui",
- "enum-map",
- "itertools",
- "log",
- "profiling",
-]
-
 [[package]]
 name = "egui_glow"
 version = "0.37.0"
@@ -1636,26 +1587,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"

-[[package]]
-name = "enum-map"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
-dependencies = [
- "enum-map-derive",
-]
-
-[[package]]
-name = "enum-map-derive"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.6",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -2777,7 +2708,7 @@ dependencies = [
 [[package]]
 name = "krilla"
 version = "0.8.2"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
 "base64 0.22.1",
 "bumpalo",
@@ -3556,7 +3487,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
 "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.45.0",
 ]

 [[package]]
@@ -4472,8 +4403,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016"
 dependencies = [
 "bitflags 2.13.2",
- "calloop 0.13.0",
- "calloop-wayland-source 0.3.0",
+ "calloop",
+ "calloop-wayland-source",
 "cursor-icon",
 "libc",
 "log",
@@ -4490,44 +4421,6 @@ dependencies = [
 "xkeysym",
 ]

-[[package]]
-name = "smithay-client-toolkit"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0512da38f5e2b31201a93524adb8d3136276fa4fe4aafab4e1f727a82b534cc0"
-dependencies = [
- "bitflags 2.13.2",
- "calloop 0.14.5",
- "calloop-wayland-source 0.4.1",
- "cursor-icon",
- "libc",
- "log",
- "memmap2",
- "rustix 1.1.5",
- "thiserror 2.0.21",
- "wayland-backend",
- "wayland-client",
- "wayland-csd-frame",
- "wayland-cursor",
- "wayland-protocols",
- "wayland-protocols-experimental",
- "wayland-protocols-misc",
- "wayland-protocols-wlr",
- "wayland-scanner",
- "xkeysym",
-]
-
-[[package]]
-name = "smithay-clipboard"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71704c03f739f7745053bde45fa203a46c58d25bc5c4efba1d9a60e9dba81226"
-dependencies = [
- "libc",
- "smithay-client-toolkit 0.20.0",
- "wayland-backend",
-]
-
 [[package]]
 name = "smol_str"
 version = "0.2.2"
@@ -5035,7 +4928,6 @@ version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
- "log",
 "pin-project-lite",
 "tracing-attributes",
 "tracing-core",
@@ -5478,32 +5370,6 @@ dependencies = [
 "wayland-scanner",
 ]

-[[package]]
-name = "wayland-protocols-experimental"
-version = "20250721.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40a1f863128dcaaec790d7b4b396cc9b9a7a079e878e18c47e6c2d2c5a8dcbb1"
-dependencies = [
- "bitflags 2.13.2",
- "wayland-backend",
- "wayland-client",
- "wayland-protocols",
- "wayland-scanner",
-]
-
-[[package]]
-name = "wayland-protocols-misc"
-version = "0.3.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e9567599ef23e09b8dad6e429e5738d4509dfc46b3b21f32841a304d16b29c8"
-dependencies = [
- "bitflags 2.13.2",
- "wayland-backend",
- "wayland-client",
- "wayland-protocols",
- "wayland-scanner",
-]
-
 [[package]]
 name = "wayland-protocols-plasma"
 version = "0.3.12"
@@ -6114,7 +5980,7 @@ dependencies = [
 "bitflags 2.13.2",
 "block2 0.5.1",
 "bytemuck",
- "calloop 0.13.0",
+ "calloop",
 "cfg_aliases",
 "concurrent-queue",
 "core-foundation 0.9.4",
@@ -6135,7 +6001,7 @@ dependencies = [
 "raw-window-handle",
 "redox_syscall 0.4.1",
 "rustix 0.38.44",
- "smithay-client-toolkit 0.19.2",
+ "smithay-client-toolkit",
 "smol_str",
 "tracing",
 "unicode-segmentation",
@@ -6311,7 +6177,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.18.1"
+version = "0.15.0"
 dependencies = [
 "serde_json",
 ]
@@ -6557,6 +6423,7 @@ dependencies = [
 "nix",
 "typed-path",
 "windows-sys 0.61.2",
+ "zopfli",
 ]

 [[package]]
@@ -6644,6 +6511,11 @@ name = "egui_demo_lib"
 version = "0.37.0"
 source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"

+[[patch.unused]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
 [[patch.unused]]
 name = "egui_inspection"
 version = "0.37.0"
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/deckcraft", "apps/deckcraft-cli"]

 [workspace.package]
-version = "0.18.1"
+version = "0.15.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -27,12 +27,16 @@ deckcraft-engine = { path = "crates/engine" }
 deckcraft-mcp = { path = "crates/mcp" }
 deckcraft-ui-egui = { path = "crates/ui-egui" }
 deckcraft-media = { path = "crates/media" }
-# video codecs (ported from FilmCraft, same owner and licence)
+# codecs (ported from FilmCraft, same owner and licence)
 deckcraft-bitstream = { path = "crates/bitstream" }
 deckcraft-h264 = { path = "crates/h264" }
 deckcraft-hevc = { path = "crates/hevc" }
 deckcraft-vp9 = { path = "crates/vp9" }
 deckcraft-av1 = { path = "crates/av1" }
+deckcraft-isobmff = { path = "crates/isobmff" }
+deckcraft-matroska = { path = "crates/matroska" }
+deckcraft-ogg = { path = "crates/ogg" }
+deckcraft-opus = { path = "crates/opus" }

 # foundation
 kurbo = { version = "0.13", features = ["serde"] }
@@ -55,13 +59,11 @@ harfrust = "0.13"
 vello_cpu = "0.2"
 vello_common = { version = "0.2", default-features = false }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
-# craft-media and craft-audio share types and stay on one rev.
-craft-media = { git = "https://github.com/storytold/craft-libs", rev = "75895c0321d8cb6e175a42466cba050352b117c5", version = "=0.1.0", default-features = false }
-craft-audio = { git = "https://github.com/storytold/craft-libs", rev = "75895c0321d8cb6e175a42466cba050352b117c5", version = "=0.1.0", default-features = false, features = ["opus-decode"] }
-craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.1.0", default-features = false, features = ["write", "write-simple-text"] }
+craft-media = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.1.0", default-features = false }
+craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.1.0", default-features = false, features = ["write", "write-simple-text"] }
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", features = ["egui"] }
-craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.1.0" }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.1.0" }
 i_overlay = "9"
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
@@ -107,7 +109,7 @@ codegen-units = 16
 debug = 0

 [patch.crates-io]
-krilla = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.8.2" }
+krilla = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.8.2" }
 ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
@@ -76,9 +76,8 @@ Code dependencies
 - symphonia (audio decoding for MP3, AAC, ALAC, FLAC, Vorbis, WAV, AIFF, CAF) is used unmodified
  under the Mozilla Public License 2.0; its source is available at
  https://github.com/pdeljanov/Symphonia.
- The H.264, HEVC, VP9 and AV1 crates under crates/ are ported from FilmCraft (same owner,
-  MIT OR Apache-2.0). The Opus decoder (craft-audio) and the MP4, Matroska and Ogg demuxers
-  (craft-media) come from craft-libs (same owner, MIT OR Apache-2.0).
+- The H.264, HEVC, VP9, AV1, Opus, MP4, Matroska and Ogg crates under crates/ are ported from
+  FilmCraft (same owner, MIT OR Apache-2.0).

 - Krilla 0.8.2 (https://github.com/LaurenzV/krilla) is used through craft-pdf under
  MIT OR Apache-2.0. craft-libs vendors that version with page/surface unwind recovery
@@ -2,12 +2,8 @@

 **Stage: alpha** · next: beta, ~20 points and ~120–210 h away

-> **Last reviewed:** 2026-11-04 · **Last updated:** 2026-11-11 · **Change:** trivial (the Opus decoder and the Ogg, MP4 and Matroska demuxers come from craft-libs; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
-> **Last reviewed:** 2026-11-02 · **Last updated:** 2026-11-03 · **Change:** trivial (progress log: web `?host=parent` bridge opens and saves through a same-origin framing page; scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
-
 > **Last reviewed:** 2026-11-02 · **Last updated:** 2026-11-03 · **Change:** trivial (community PR wave 10: PPTX and native saves keep table cell centred anchoring, text overflow, compatible line spacing, normalised character height, Thai distributed alignment, RTL table direction, alternate run language and reflection transforms; imported effects placed by parent time-node delays; Reuse Slides fits the destination size and brings custom table styles; deleted slides leave custom shows; merged shapes drop their animations; Compress Pictures measures grouped pictures at displayed size; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-11-02 · **Last updated:** 2026-11-02 · **Change:** trivial (File › About replaces Account; product links, credits and appearance retained; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
-> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-11-01 · **Change:** trivial (progress log: fix for a workflow-breaking regression: Ctrl+C/X/V use the system clipboard again, broken for all text and objects from 0.11.1 to 0.15.0; pasted and duplicated placeholders keep their look; stage and scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-11-01 · **Change:** trivial (locked No Fill and no-outline click-through regression coverage added; No Fill hit-testing follows resolved fill instead of the presence of a style (#1621); scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-30 · **Change:** trivial (progress log: read-only `slide.actions` lists shape and table text actions; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-27 · **Change:** trivial (progress log: Set Up Slide Show ▸ Keep mouse cursor visible, #1445; stage and scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
@@ -154,10 +150,6 @@ app's JSON control channel (`deckcraft --control PORT`).

 | Date | What landed |
 |---|---|
-| 2026-11-11 | Media: the Opus decoder and the Ogg, MP4/MOV and Matroska demuxers are craft-audio and craft-media from craft-libs; DeckCraft's own copies and re-export crates are removed |
-| 2026-11-04 | Ogg Opus recovery keeps trailing packets without granules in the total duration, matching their recovered positions; valid end trimming stays covered |
-| 2026-11-03 | Web: the `?host=parent` bridge (as in GridCraft, WordCraft and PdfCraft) lets a same-origin page that frames DeckCraft send a presentation and store its saves; Save writes an opened .pptx back as .pptx under its own name, as on the desktop |
-| 2026-11-02 | Slide show on Linux and the BSDs: Presenter View stays off when winit lists exactly one display, as in PowerPoint; if it lists none, the setting is kept. On one display the presenter window covered the show, and the hidden window stalled every frame: slide changes took up to ~1.7 s under Hyprland (#1156) |
 | 2026-11-02 | Native and PPTX saves retain optional table right-to-left direction, including explicit false and omission; two-save round-trip tests keep labeled columns in order |
 | 2026-11-02 | Text runs preserve alternate-language metadata independently from the main language through native and PPTX saves |
 | 2026-11-02 | Picture compression measures displayed dimensions through nested group transforms; checklist score unchanged |
@@ -167,9 +159,6 @@ app's JSON control channel (`deckcraft --control PORT`).
 | 2026-11-02 | PPTX reflection effects keep their authored start position, affine scale/skew, direction and fade, alignment, and rotation flag through native and PPTX saves |
 | 2026-11-03 | Reuse Slides brings along referenced custom table styles, including grouped tables, and remaps conflicting style ids without changing destination tables |
 | 2026-11-02 | Tiled picture fills in groups: a tile (`a:blipFill` with `a:tile`) keeps its size, offset and anchor in slide points whatever the group's child-coordinate scale, uniform or stretched unevenly, nested or flipped (also a group's own tile fill passed to its members, and a picture shape's own tile, with its shadow and reflection), and tiles with `rotWithShape="0"` keep their size in points at any zoom, as PowerPoint draws them (measured on its own PNG export of a synthetic probe deck: every grouped case within ~3/255 of the ungrouped control's own difference from PowerPoint, which is ~13/255 from resampling). Before, a group whose child space was ~1800 times smaller than its box showed one flat texel of the texture (a Venn diagram with paper-textured circles and a hatched intersection) |
-| 2026-11-01 | Ctrl+V of a picture copied in a browser (Copy Image) pastes the picture, not a text box with its link and alt text; the link still pastes as text when no picture came with it |
-| 2026-11-01 | Copy, Cut, Paste, Duplicate and Alt+drag of a title, body or other placeholder on a slide keep its look: the copy is a regular shape that takes the size, font, bullets, indents, autofit and box its layout and master gave it, instead of 18 pt unbulleted text |
-| 2026-11-01 | Clipboard: Ctrl+C, Ctrl+X and Ctrl+V use the system clipboard again, so text and pictures paste from other apps and in-app copies paste back. Since the egui 0.37 migration (#1350) the desktop build had a clipboard that only worked inside the app. On native Wayland, text goes through egui's Wayland clipboard; HTML stays on X11, macOS and Windows |
 | 2026-10-31 | No Fill shape interiors allow selection and editing of underlying objects, even when a quick style remains; hit-testing uses the renderer’s fill resolution. Outlines, rotation, text targets and actual fills keep their hit behaviour (#1621) |
 | 2026-10-30 | Print-preview tests use the URL emitted by egui and its exact file path; previews are explicitly removed before the macOS process exits |
 | 2026-10-30 | `slide.actions` lists shape click and hover actions and text-run hyperlinks (including table cells and grouped shapes) for audit; listing never runs an action. The UI pane is a follow-up |
@@ -341,14 +330,10 @@ app's JSON control channel (`deckcraft --control PORT`).

 | Date | Change | Summary |
 |---|---|---|
-| 2026-11-11 | trivial | Opus and container code moved to craft-libs crates; parity scores unchanged |
-| 2026-11-04 | trivial | Ogg Opus recovery duration includes its recovered tail; parity scores unchanged |
 | 2026-11-02 | trivial | Progress log: run alternate-language metadata round-trips through native and PPTX formats; product parity scores unchanged |
 | 2026-11-03 | trivial | Reuse Slides brings referenced custom table styles along; scores unchanged |
-| 2026-11-03 | trivial | Progress log: web `?host=parent` bridge to a framing page; scores unchanged |
 | 2026-11-02 | trivial | File › About replaces Account; product links, credits and appearance retained |
 | 2026-11-02 | trivial | Progress log: tiled picture fills keep their size in scaled groups. Scores and milestone names unchanged |
-| 2026-11-01 | trivial | Workflow-breaking regression fixed: the desktop build uses the system clipboard again (eframe `clipboard` feature) |
 | 2026-10-31 | trivial | No Fill hit-testing follows resolved fill instead of the presence of a style (#1621); scores unchanged |
 | 2026-10-30 | trivial | Progress log: read-only slide action inspection; parity scores unchanged |
 | 2026-10-29 | trivial | Progress log: going back in the slide show reverses the left slide's transition (#1531). Scores and milestone names unchanged |
@@ -16,10 +16,6 @@ path = "src/main.rs"
 [dependencies]
 deckcraft-engine = { workspace = true }
 deckcraft-ui-egui = { workspace = true }
-# The page command API (storytold/craft-libs#413): window.deckcraft over the control channel.
-craft-web-api = { git = "https://github.com/storytold/craft-libs", rev = "fd5e2feff6ea25bed371a99cc732b3968d621505", version = "0.1.0" }
-# The host messages (storytold/craft-libs): one contract and one bridge for the web builds.
-craft-web-host = { git = "https://github.com/storytold/craft-libs", rev = "fd5e2feff6ea25bed371a99cc732b3968d621505", version = "0.1.0" }
 egui = { workspace = true }
 log = { workspace = true }
 serde_json = { workspace = true }
@@ -31,4 +27,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "MessageEvent", "Event", "EventTarget", "UrlSearchParams"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "MessageEvent", "Event", "EventTarget"] }
@@ -1,151 +0,0 @@
-//! `window.deckcraft`: the page command API (`craft-web-api`, storytold/craft-libs#413) over the
-//! app's own control channel, the one the desktop control server drives (`docs/control-protocol.md`).
-//!
-//! The crate owns the JavaScript side (`request`, `execute`, `commands`, `docInspect`, `uiInspect`,
-//! `screenshot`, as promises with a timeout). This module is DeckCraft's part: a [`Request`] that
-//! queues a [`ControlRequest`] for the app, which answers it on its next frame, and waits for the
-//! reply. A call the page gave up on is released ([`Pending`]), so the app skips it if it has not started it, instead of
-//! applying a command the page was told had failed.
-
-use std::sync::Arc;
-use std::sync::atomic::AtomicU8;
-use std::sync::mpsc::{Receiver, TryRecvError};
-
-use deckcraft_ui_egui::ControlRequest;
-use serde_json::{Value, json};
-
-/// How often a waiting call looks for the app's reply, in milliseconds (about a frame).
-#[cfg(target_arch = "wasm32")]
-const POLL_MS: i32 = 16;
-
-/// A queued control request whose reply has not arrived. Dropping it before the reply (the page's
-/// timeout fired, or the call was abandoned) releases the request: the app skips it if it has not started it (one it has taken still finishes).
-struct Pending {
-    reply: Receiver<Value>,
-    state: Arc<AtomicU8>,
-    answered: bool,
-}
-
-impl Pending {
-    /// `Some` once the app has answered or gone away; `None` while the request is still waiting.
-    fn poll(&mut self) -> Option<Value> {
-        match self.reply.try_recv() {
-            Ok(reply) => {
-                self.answered = true;
-                Some(reply)
-            }
-            Err(TryRecvError::Empty) => None,
-            Err(TryRecvError::Disconnected) => {
-                self.answered = true;
-                Some(json!({"ok": false, "error": "the app dropped the request"}))
-            }
-        }
-    }
-}
-
-impl Drop for Pending {
-    fn drop(&mut self) {
-        if !self.answered {
-            ControlRequest::abandon(&self.state);
-        }
-    }
-}
-
-#[cfg(target_arch = "wasm32")]
-pub use web::install;
-
-#[cfg(target_arch = "wasm32")]
-mod web {
-    use std::rc::Rc;
-    use std::sync::mpsc::channel;
-
-    use craft_web_api::methods::Methods;
-    use craft_web_api::page::{PageApi, Request};
-    use deckcraft_ui_egui::{ControlRequest, SlideApp};
-    use serde_json::json;
-    use wasm_bindgen_futures::JsFuture;
-
-    use super::{POLL_MS, Pending};
-
-    /// The app id in `window.<app>`.
-    const APP: &str = "deckcraft";
-
-    /// Give the app its control queue and put `window.deckcraft` on the page. An existing
-    /// `window.deckcraft` keeps the functions it already has.
-    pub fn install(app: &mut SlideApp, ctx: egui::Context) {
-        let (queue, requests) = channel::<ControlRequest>();
-        app.control_rx = Some(requests);
-        let request: Request = Rc::new(move |method, params| {
-            let (control, reply) = ControlRequest::new(method, params);
-            let mut pending = Pending { reply, state: control.state.clone(), answered: false };
-            if queue.send(control).is_err() {
-                pending.answered = true;
-                return Box::pin(async { json!({"ok": false, "error": "the app is not running"}) });
-            }
-            ctx.request_repaint();
-            Box::pin(async move {
-                loop {
-                    if let Some(reply) = pending.poll() {
-                        return reply;
-                    }
-                    sleep(POLL_MS).await;
-                }
-            })
-        });
-        if let Err(e) = Rc::new(PageApi::new(APP, Methods::default(), request)).install() {
-            log::warn!("couldn't install window.{APP}: {e:?}");
-        }
-    }
-
-    async fn sleep(ms: i32) {
-        let promise = js_sys::Promise::new(&mut |resolve, _| {
-            if let Some(window) = web_sys::window() {
-                let _ = window.set_timeout_with_callback_and_timeout_and_arguments_0(&resolve, ms);
-            }
-        });
-        let _ = JsFuture::from(promise).await;
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::sync::atomic::Ordering;
-
-    use super::*;
-
-    /// `ControlRequest`'s `state` values (`deckcraft_ui_egui::control`): the app has started it, or its
-    /// sender gave up.
-    const TAKEN: u8 = 1;
-    const ABANDONED: u8 = 2;
-
-    fn pending() -> (Pending, ControlRequest) {
-        let (control, reply) = ControlRequest::new("document.inspect", json!({}));
-        (Pending { reply, state: control.state.clone(), answered: false }, control)
-    }
-
-    #[test]
-    fn a_call_the_page_gave_up_on_is_released_so_the_app_skips_it() {
-        let (waiting, control) = pending();
-        drop(waiting);
-        assert_eq!(control.state.load(Ordering::SeqCst), ABANDONED);
-        assert!(!control.take(), "the app must not run a request the page was told had failed");
-    }
-
-    #[test]
-    fn an_answered_call_is_not_released() {
-        let (mut waiting, control) = pending();
-        assert!(control.take());
-        control.reply.send(json!({"ok": true, "result": 1})).unwrap_or_default();
-        assert_eq!(waiting.poll(), Some(json!({"ok": true, "result": 1})));
-        drop(waiting);
-        assert_eq!(control.state.load(Ordering::SeqCst), TAKEN);
-    }
-
-    #[test]
-    fn a_request_the_app_never_runs_waits_until_it_is_dropped() {
-        let (mut waiting, control) = pending();
-        assert_eq!(waiting.poll(), None);
-        drop(control);
-        assert_eq!(waiting.poll().and_then(|r| r["ok"].as_bool()), Some(false), "the app went away");
-    }
-}
@@ -1,149 +0,0 @@
-//! The host bridge, for pages that embed DeckCraft and keep its files (a Nextcloud app, a personal
-//! file server). The messages and the two transports are `craft-web-host`'s
-//! (storytold/craft-libs), the same contract as the other Craft apps' bridges, with the
-//! `deckcraft:` prefix. This module is DeckCraft's part of it.
-//!
-//! - `?host=parent` (an `<iframe>`) talks to the same-origin parent over `postMessage`;
-//!   `data-host="page"` on the canvas (the page's own document, no iframe) uses DOM
-//!   `CustomEvent`s on the canvas instead. `?host=parent` wins when both are present. With no
-//!   parent, or a parent on another origin, there is no bridge: the normal app with downloads.
-//! - `deckcraft:ready` (to the host): sent once the app is running and listening; send a file now. DeckCraft
-//!   reads bytes, so it says `file: false` and a host sends `bytes`.
-//! - `deckcraft:open` (from the host): `{ name, bytes }`, bytes an `ArrayBuffer` or
-//!   `Uint8Array`, name a bare file name. It opens like a file picked with File › Open on the
-//!   desktop: a presentation sent with its name (.pptx, .potx, .ppsx, .deckcraft) has that name
-//!   as its file, so Save goes back to it; an outline (.txt, .md, .rtf), a file without a name and
-//!   a damaged file open untitled.
-//! - `deckcraft:save` (to the host): `{ name, saveAs, bytes }` (with the bytes as a transferred `ArrayBuffer` over `postMessage`) for
-//!   every file DeckCraft would otherwise download. The host stores it and reports failures
-//!   itself. `saveAs` says whether the file becomes the presentation's file:
-//!   - Save: `false`. It writes the opened file under its own name and format (a .pptx stays a
-//!     .pptx), as the desktop app does. A name the parent never sent (an untitled presentation, an
-//!     outline, a file sent without a name, a repaired copy of a damaged file, a file the user
-//!     picked or dropped) is a new file: `true`, as for Save As, named `<title>.deckcraft` as
-//!     Save suggests on the desktop.
-//!   - Save As (File › Save As as .pptx or .deckcraft, Ctrl+Shift+S): `true`. The presentation is
-//!     now that file; the next Save sends its name with `false`.
-//!   - Export (PDF, pictures, outline, GIF, handouts, a Save As type that isn't a presentation)
-//!     and Print: `false`. They are copies; the presentation's file stays the same.
-//! - `deckcraft:dirty` whenever unsaved changes appear or go away, `deckcraft:failed` when the
-//!   app couldn't start or refused a file of 2 GiB or larger.
-//!
-//! In host mode the app starts with an empty presentation instead of the sample, which gives way to
-//! the first file the host sends; the host guards leaving the page, and `?author=` names the user
-//! for comments.
-
-use std::cell::RefCell;
-use std::rc::Rc;
-
-use craft_web_host::web::{FileData, Host, Message};
-use deckcraft_ui_egui::{Services, SlideApp};
-
-/// The app id in the host messages (`deckcraft:ready`).
-const APP: &str = "deckcraft";
-
-/// The name `craft-web-host` gives an open request that carries none (it cleans a host's name and
-/// falls back to this): no name is no file, so the presentation opens untitled.
-const NAMELESS: &str = "document";
-
-/// The largest file a host may send. File › Open on the desktop refuses anything over 2 GiB.
-/// On wasm32 a `Vec` cannot hold 2 GiB (`isize::MAX` is one byte less), so a file of exactly
-/// 2 GiB is refused too, before its bytes are copied.
-const MAX_OPEN_BYTES: f64 = 2_147_483_648.0;
-
-/// The longest user name taken from `?author=` (the preferences' own limit).
-const MAX_AUTHOR_CHARS: usize = 256;
-
-#[derive(Clone)]
-pub struct Bridge {
-    host: Rc<Host>,
-    /// Files the host sent (the name, if it sent one), waiting for the next frame.
-    opened: Rc<RefCell<Vec<(Option<String>, Vec<u8>)>>>,
-}
-
-impl Bridge {
-    /// The bridge for this page, or `None` when DeckCraft isn't hosted: no `?host=parent` and no
-    /// `data-host="page"` on the canvas, an unframed `?host=parent` page (it stays the normal app
-    /// with downloads), or a parent on another origin.
-    pub fn detect(canvas: &web_sys::HtmlCanvasElement) -> Option<Self> {
-        let host = Host::connect(APP, canvas)?;
-        // An opaque origin (a file:// page in some browsers) can't be a postMessage target.
-        if host.mode() == craft_web_host::Mode::Parent && web_sys::window()?.location().origin().ok()? == "null" {
-            return None;
-        }
-        Some(Self { host: Rc::new(host), opened: Rc::default() })
-    }
-
-    /// Hand saved and exported files to the host instead of downloading them, and hear the files
-    /// it sends.
-    pub fn connect(&self, services: &mut Services, ctx: egui::Context) {
-        self.listen(ctx);
-        let bridge = self.clone();
-        services.host_save = Some(Box::new(move |name: &str, bytes: &[u8], save_as: bool| bridge.post_save(name, bytes, save_as)));
-        // Exports and Print are copies.
-        let bridge = self.clone();
-        services.download = Some(Box::new(move |name: &str, bytes: &[u8]| {
-            if let Err(e) = bridge.post_save(name, bytes, false) {
-                log::error!("couldn't hand {name} to the page: {e}");
-            }
-        }));
-    }
-
-    /// `?author=`: the host's name for the user signs new comments.
-    pub fn set_author(app: &mut SlideApp, author: &str) {
-        let author: String = author.trim().chars().take(MAX_AUTHOR_CHARS).collect();
-        if !author.is_empty() {
-            app.session.prefs.author = author;
-        }
-    }
-
-    pub fn post_ready(&self) {
-        let _ = self.host.post_ready(env!("CARGO_PKG_VERSION"), false);
-    }
-
-    /// The app couldn't start (no WebGPU or WebGL2, for example): let the host say so.
-    pub fn post_failed(&self, error: &str) {
-        let _ = self.host.post_failed(error, None);
-    }
-
-    /// Before each frame: open the files the host sent.
-    pub fn open_files(&self, app: &mut SlideApp) {
-        let opened = std::mem::take(&mut *self.opened.borrow_mut());
-        for (name, bytes) in opened {
-            app.open_from_host(name.as_deref(), &bytes);
-        }
-    }
-
-    /// After each frame: tell the host when unsaved changes appear or go away (the crate does not
-    /// repeat a state it already reported).
-    pub fn report_dirty(&self, app: &SlideApp) {
-        self.host.post_dirty(app.session.documents().iter().any(|d| d.is_dirty()));
-    }
-
-    fn post_save(&self, path: &str, bytes: &[u8], save_as: bool) -> Result<(), String> {
-        let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string());
-        self.host.post_save(&name, bytes, None, save_as)
-    }
-
-    /// Hear `deckcraft:open` and queue the file for the next frame.
-    fn listen(&self, ctx: egui::Context) {
-        let opened = self.opened.clone();
-        let host = self.host.clone();
-        self.host.listen(move |message| {
-            let Message::Open { name, data } = message else { return };
-            if data.size() >= MAX_OPEN_BYTES {
-                log::warn!("host file {name} is 2 GiB or larger; not opened");
-                let _ = host.post_failed(&format!("{name} is 2 GiB or larger, which DeckCraft's web build cannot open"), None);
-                return;
-            }
-            let FileData::Bytes(array) = data else {
-                log::warn!("host file {name} came as a File; DeckCraft reads bytes only; not opened");
-                return;
-            };
-            // No name is no file: the presentation opens untitled, never under an invented name.
-            let name = (name != NAMELESS).then_some(name);
-            opened.borrow_mut().push((name, array.to_vec()));
-            ctx.request_repaint();
-        });
-    }
-}
@@ -9,22 +9,15 @@
 //! - File → Open and Insert → Pictures/Audio/Video use the browser file picker; bytes arrive
 //!   asynchronously through `Services::inbox`, applied to the document, slide and operation
 //!   that started the pick (a dismissed picker or a closed document drops the file);
-//! - Save and Export trigger a browser download (or go to the framing page with `?host=parent`);
+//! - Save and Export trigger a browser download;
 //! - dropped files are read asynchronously by `web::WebShell` and delivered through the inbox;
 //! - preferences are not persisted.
 //!
 //! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?blank` starts with an
 //! empty presentation instead of the sample deck; `?show` starts the slide show.
-//! `?host=parent` (inside an `<iframe>`) talks to a same-origin parent page instead: it sends the
-//! presentation to open and stores what DeckCraft saves (`host`), and `&author=` names the user
-//! for comments.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]

-#[cfg(any(target_arch = "wasm32", test))]
-mod api;
-#[cfg(target_arch = "wasm32")]
-mod host;
 #[cfg(target_arch = "wasm32")]
 mod presenter;
 #[cfg(target_arch = "wasm32")]
@@ -251,9 +251,6 @@ impl Popup {
                    if value.get("nextChanged").and_then(|v| v.as_bool()) == Some(false) {
                        data.next = previous.next.clone();
                    }
-                    if data.slides.is_none() {
-                        data.slides = previous.slides.clone();
-                    }
                }
                *target.borrow_mut() = Some(data);
                *received.borrow_mut() = js_sys::Date::now();
@@ -24,18 +24,8 @@ pub fn start() {
            log::error!("missing <canvas id=\"{CANVAS_ID}\">");
            return;
        };
-        // Host modes (`craft-web-host`): `?host=parent`, a same-origin page framing DeckCraft,
-        // opens presentations in it and stores what it saves (`host`); `data-host="page"` on the
-        // canvas opts a page in that runs DeckCraft in its own document. The presenter popup is
-        // never the framed page.
-        let hosted = crate::presenter::token().is_none();
-        let bridge = if hosted { crate::host::Bridge::detect(&canvas) } else { None };
-        if hosted && bridge.is_none() && query_param("host").as_deref() == Some("parent") {
-            log::warn!("?host=parent needs a framing page on the same origin; saves download instead");
-        }
-        let app_bridge = bridge.clone();
        let mut options = eframe::WebOptions::default();
-        if query_has("webgl")
+        if query().contains("webgl")
            && let eframe::egui_wgpu::WgpuSetup::CreateNew(create) = &mut options.wgpu_options.wgpu_setup
        {
            create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
@@ -54,43 +44,22 @@ pub fn start() {
                        return Ok(Box::new(presenter) as Box<dyn eframe::App>);
                    }
                    let inbox: Inbox = Inbox::default();
-                    let mut services = services(inbox.clone(), cc.egui_ctx.clone());
-                    if let Some(bridge) = &app_bridge {
-                        bridge.connect(&mut services, cc.egui_ctx.clone());
-                    }
-                    let mut app = SlideApp::new(Session::new(), services);
-                    // In host mode the parent sends the presentation to edit; no sample meanwhile.
-                    if app_bridge.is_some() {
-                        if let Err(e) = app.start_for_host() {
-                            log::error!("new presentation: {e}");
-                        }
-                    } else if !query_has("blank") {
+                    let mut app = SlideApp::new(Session::new(), services(inbox.clone(), cc.egui_ctx.clone()));
+                    let q = query();
+                    if !q.contains("blank") {
                        if let Err(e) = deckcraft_engine::sample::open_sample(&mut app.session) {
                            log::error!("sample deck: {e}");
                        }
                    } else if let Err(e) = app.run("file.new", serde_json::json!({})) {
                        log::error!("new presentation: {e}");
                    }
-                    if query_has("show") {
+                    if q.contains("show") {
                        app.start_show(0, false);
                    }
-                    if app_bridge.is_some()
-                        && let Some(author) = query_param("author")
-                    {
-                        crate::host::Bridge::set_author(&mut app, &author);
-                    }
-                    crate::api::install(&mut app, cc.egui_ctx.clone());
-                    Ok(Box::new(WebShell { app, inbox, bridge: app_bridge }))
+                    Ok(Box::new(WebShell { app, inbox }))
                }),
            )
            .await;
-        // Ready only once the runner is up: starting can still fail after the app is made.
-        if let Some(bridge) = &bridge {
-            match &result {
-                Ok(()) => bridge.post_ready(),
-                Err(e) => bridge.post_failed(&format!("{e:?}")),
-            }
-        }
        if let Some(el) = document.get_element_by_id(LOADING_ID) {
            match result {
                Ok(()) => el.remove(),
@@ -104,36 +73,17 @@ fn query() -> String {
    web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
 }

-fn query_param(key: &str) -> Option<String> {
-    web_sys::UrlSearchParams::new_with_str(&query()).ok()?.get(key)
-}
-
-/// Whether the URL has the flag `key` (`?show`, `&blank=1`). A whole parameter, never a substring:
-/// `?author=` is free text.
-fn query_has(key: &str) -> bool {
-    web_sys::UrlSearchParams::new_with_str(&query()).is_ok_and(|q| q.has(key))
-}
-
 /// Wraps the app to read dropped files asynchronously (browsers can't read them synchronously)
 /// and feed them through the inbox.
 struct WebShell {
    app: SlideApp,
    inbox: Inbox,
-    /// The parent page that keeps the files (`?host=parent`).
-    bridge: Option<crate::host::Bridge>,
 }

 impl eframe::App for WebShell {
-    /// Delegate one eframe logic pass to the wrapped application, opening the files the parent
-    /// page sent first and telling it about unsaved changes after.
+    /// Delegate one eframe logic pass to the wrapped application.
    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        if let Some(bridge) = &self.bridge {
-            bridge.open_files(&mut self.app);
-        }
        self.app.logic(ctx);
-        if let Some(bridge) = &self.bridge {
-            bridge.report_dirty(&self.app);
-        }
        if self.app.show.is_none()
            && let Some(host) = self.app.services.presenter.as_mut()
        {
@@ -14,9 +14,7 @@ workspace = true
 deckcraft-engine = { workspace = true }
 deckcraft-ui-egui = { workspace = true }
 deckcraft-media = { workspace = true }
-# `clipboard` is the OS clipboard (Ctrl+C/X/V with other apps). Without it egui simulates one inside
-# the app; the egui 0.37 migration (#1350) dropped it from this list.
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "clipboard", "links", "wayland", "x11"] }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "links", "wayland", "x11"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
@@ -148,19 +148,7 @@ pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
 /// One formatted log line: `<timestamp> <LEVEL> [<thread>] <target>: <message>\n`.
 pub fn format_line(ts: &str, level: log::Level, thread: &str, target: &str, message: &str) -> String {
    let message = message.strip_suffix('\n').unwrap_or(message);
-    // Messages can embed document-controlled text (a part name, a relationship id): control
-    // characters other than tab are escaped and each continuation line is marked, so such text
-    // cannot start a line that looks like a record of its own.
-    let mut text = String::with_capacity(message.len());
-    for c in message.chars() {
-        match c {
-            '\n' => text.push_str("\n    | "),
-            '\t' => text.push(c),
-            c if c.is_control() => text.extend(c.escape_default()),
-            c => text.push(c),
-        }
-    }
-    format!("{ts} {level:<5} [{thread}] {target}: {text}\n")
+    format!("{ts} {level:<5} [{thread}] {target}: {message}\n")
 }

 /// Where formatted lines go besides standard error: kept in memory until a file is attached,
@@ -458,13 +446,8 @@ mod tests {
            ),
            "2026-10-08T07:59:17.728Z WARN  [main] deckcraft_pptx::opc: pptx: skipping oversized part ppt/media/image1.png\n"
        );
-        // A multi-line message keeps its lines, each continuation marked; the record still ends in
-        // exactly one newline.
-        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\n    | b\n"));
-        // Injected line breaks and escape sequences cannot forge a record.
-        let line = format_line("t", log::Level::Warn, "w", "x", "part a\r\n2026 ERROR [m] y: forged\x1b[2J");
-        assert_eq!(line.matches('\n').count(), 2);
-        assert!(!line.contains('\r') && !line.contains('\x1b'));
+        // A multi-line message keeps its lines; the record still ends in exactly one newline.
+        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\nb\n"));
    }

    #[test]
@@ -51,9 +51,6 @@ impl eframe::App for App {
    }
    fn on_exit(&mut self) {
        save_prefs(&self.0);
-        // The window is closing for good: a ready update's helper starts now and installs it once
-        // the process has exited.
-        self.0.start_pending_update();
        // macOS (#279): end the process here, before eframe tears the window down. AccessKit's
        // macOS adapter subclasses the window's content view and restores its class on teardown;
        // AppKit's Touch Bar support observes that view (KVO), so in the next display cycle
@@ -106,13 +103,7 @@ fn save_prefs(app: &SlideApp) {
    }
 }

-/// The desktop services. `native_wayland`: the window is a Wayland client (not Xwayland).
-fn services(native_wayland: bool) -> Services {
-    // On native Wayland, egui-winit owns the clipboard through winit's data device, which carries
-    // text and PNG but no HTML. `pasteboard` (arboard, built for X11 only) would put a copy on the
-    // Xwayland selection instead and skip egui's Wayland claim, so Ctrl+V would read something
-    // else. There, text goes through egui and pictures arrive as `PasteImage` events.
-    let pasteboard = !native_wayland;
+fn services() -> Services {
    Services {
        pick_open: Some(Box::new(|purpose: &str| {
            let d = rfd::FileDialog::new();
@@ -135,9 +126,9 @@ fn services(native_wayland: bool) -> Services {
        pick_save: Some(Box::new(|name: &str| rfd::FileDialog::new().set_file_name(name).save_file().map(|p| p.to_string_lossy().to_string()))),
        read: Some(Box::new(|p: &str| std::fs::read(p).map_err(|e| e.to_string()))),
        write: Some(Box::new(|p: &str, b: &[u8]| std::fs::write(p, b).map_err(|e| e.to_string()))),
-        clipboard_image: pasteboard.then(|| Box::new(pasteboard::image_png) as Box<dyn FnMut() -> Option<Vec<u8>>>),
-        clipboard_html: pasteboard.then(|| Box::new(pasteboard::html) as Box<dyn FnMut() -> Option<String>>),
-        clipboard_set_html: pasteboard.then(|| Box::new(pasteboard::set_html) as Box<dyn FnMut(&str, &str) -> bool>),
+        clipboard_image: Some(Box::new(pasteboard::image_png)),
+        clipboard_html: Some(Box::new(pasteboard::html)),
+        clipboard_set_html: Some(Box::new(pasteboard::set_html)),
        // Media is mixed and clocked by the output device; `DECKCRAFT_NO_AUDIO` plays silently.
        audio_out: std::env::var_os("DECKCRAFT_NO_AUDIO")
            .is_none()
@@ -146,14 +137,6 @@ fn services(native_wayland: bool) -> Services {
    }
 }

-/// Displays winit lists for `window`, counting an output Wayland lists twice once. `None` when it
-/// lists none: Presenter View then stays as it was.
-#[cfg(all(unix, not(target_os = "macos")))]
-fn display_count(window: &winit::window::Window) -> Option<usize> {
-    let n = window.available_monitors().collect::<std::collections::BTreeSet<_>>().len();
-    (n > 0).then_some(n)
-}
-
 const APP_ID: &str = "ai.storyteller.deckcraft";

 const USAGE: &str = "\
@@ -264,11 +247,6 @@ fn main() -> eframe::Result {
            false
        }
    };
-    // `Default` lets winit choose, and winit takes Wayland whenever `WAYLAND_DISPLAY` is set.
-    #[cfg(all(unix, not(target_os = "macos")))]
-    let native_wayland = !x11 && std::env::var_os("WAYLAND_DISPLAY").is_some_and(|w| !w.is_empty());
-    #[cfg(not(all(unix, not(target_os = "macos"))))]
-    let native_wayland = false;
    #[cfg(all(unix, not(target_os = "macos")))]
    if x11 {
        options.event_loop_builder = Some(Box::new(|b| {
@@ -290,12 +268,7 @@ fn main() -> eframe::Result {
        options,
        Box::new(move |cc| {
            deckcraft_ui_egui::install_ime_pass_hooks(&cc.egui_ctx);
-            let mut app = SlideApp::new(Session::new(), services(native_wayland));
-            // Presenter View asks winit how many displays there are when a show starts.
-            #[cfg(all(unix, not(target_os = "macos")))]
-            if let Some(window) = cc.winit_window().cloned() {
-                app.services.displays = Some(Box::new(move || display_count(&window)));
-            }
+            let mut app = SlideApp::new(Session::new(), services());
            load_prefs(&mut app);
            app.enable_update_checks();
            // AutoRecover: reopen what a previous run left unsaved, then keep it current.
@@ -362,26 +335,6 @@ mod tests {
        assert_eq!(stdout.contains("on_exit returned"), !cfg!(target_os = "macos"), "{stdout}");
    }

-    /// The egui 0.37 migration (#1350) left `clipboard` out of eframe's features. egui then
-    /// simulated a clipboard inside the app: nothing pasted from other apps, and Ctrl+C/Ctrl+V
-    /// lost text that went out as HTML. Keep the OS clipboard on.
-    #[test]
-    fn eframe_uses_the_os_clipboard() {
-        let manifest = include_str!("../Cargo.toml");
-        let eframe = manifest.lines().find(|l| l.starts_with("eframe = ")).unwrap_or_default();
-        assert!(eframe.contains("\"clipboard\""), "eframe must enable the OS clipboard: {eframe}");
-    }
-
-    /// On native Wayland, the X11-only pasteboard would bypass egui's Wayland clipboard; elsewhere
-    /// it carries HTML and pictures beside egui's text.
-    #[test]
-    fn the_pasteboard_stays_off_native_wayland() {
-        let s = services(true);
-        assert!(s.clipboard_html.is_none() && s.clipboard_set_html.is_none() && s.clipboard_image.is_none());
-        let s = services(false);
-        assert!(s.clipboard_html.is_some() && s.clipboard_set_html.is_some() && s.clipboard_image.is_some());
-    }
-
    #[test]
    fn help_exits_instead_of_opening_a_file() {
        assert!(matches!(startup(None, ["--help".to_string()]), Startup::Help));
@@ -118,8 +118,6 @@ enum Output {
        grain: FilmGrainParams,
        apply_film_grain: bool,
        pts: i64,
-        /// What copying the picture out costs, in the reference's own format.
-        bytes: u64,
    },
 }

@@ -134,7 +132,7 @@ impl Output {
    fn take(self) -> Result<Picture> {
        match self {
            Output::Decoded(s) => s.wait().map(|p| Arc::try_unwrap(p).unwrap_or_else(|p| (*p).clone())),
-            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts, .. } => {
+            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts } => {
                let rf = slot.wait()?;
                Ok(output_picture(&seq, &rf, width, height, &grain, apply_film_grain, pts))
            }
@@ -381,8 +379,8 @@ impl Decoder {
        // Output policy (7.18.1 note): with scalability, show one frame per temporal unit, the
        // highest spatial layer present.
        let scalable = self.seq.as_ref().is_some_and(|s| s.op_idc != 0);
-        let kept: Vec<Output> = if !scalable {
-            out.into_iter().map(|(o, _, _)| o).collect()
+        if !scalable {
+            self.out.extend(out.into_iter().map(|(o, _, _)| o));
        } else {
            let mut last: Option<(usize, u32)> = None;
            let mut sel: Vec<Output> = Vec::new();
@@ -402,27 +400,8 @@ impl Decoder {
                    }
                }
            }
-            sel
-        };
-        // Every repeat is copied out whole, so the repeats this call keeps (after the layer
-        // selection) must not queue more than half the decoder budget; the first one over it and
-        // everything after is dropped.
-        let mut r = r;
-        let mut repeat_bytes = 0u64;
-        let mut ok = Vec::with_capacity(kept.len());
-        for o in kept {
-            if let Output::Existing { bytes, .. } = &o {
-                repeat_bytes = repeat_bytes.saturating_add(*bytes);
-                if repeat_bytes > self.memory_budget / 2 {
-                    if r.is_ok() {
-                        r = Err(Error::Invalid("repeated frame outputs exceed the decoder memory budget"));
-                    }
-                    break;
-                }
-            }
-            ok.push(o);
+            self.out.extend(sel);
        }
-        self.out.extend(ok);
        r
    }

@@ -524,15 +503,6 @@ impl Decoder {
            let idx = fh.frame_to_show_map_idx;
            let slot = self.ref_frames[idx].clone().ok_or(Error::Invalid("show_existing_frame of an empty slot"))?;
            let info = self.refs[idx].clone();
-            // Sized in the reference's own format: a new sequence header may differ from it.
-            let shape = deckcraft_bitstream::budget::PictureShape {
-                width: u64::from(info.upscaled_width),
-                height: u64::from(info.frame_height),
-                shift_x: u32::from(info.subsampling_x),
-                shift_y: u32::from(info.subsampling_y),
-                chroma_planes: if info.mono_chrome { 0 } else { 2 },
-                bytes_per_sample: 2,
-            };
            let o = Output::Existing {
                slot: slot.clone(),
                seq: seq.clone(),
@@ -541,7 +511,6 @@ impl Decoder {
                grain: fh.film_grain.clone(),
                apply_film_grain: self.apply_film_grain,
                pts: self.pts,
-                bytes: shape.bytes().unwrap_or(u64::MAX),
            };
            if fh.frame_type == KEY_FRAME as u8 {
                // reference frame loading process (7.21) then refresh every slot (7.20)
@@ -660,9 +629,6 @@ impl Decoder {
                ri.lf_deltas = fh.lf.deltas;
                ri.seg_features = fh.seg.features;
                ri.grain = fh.film_grain.clone();
-                ri.subsampling_x = job.seq.color.subsampling_x;
-                ri.subsampling_y = job.seq.color.subsampling_y;
-                ri.mono_chrome = job.seq.color.mono_chrome;
                self.ref_frames[i] = Some(job.slot.clone());
            }
        }
@@ -360,10 +360,6 @@ pub struct RefInfo {
    pub lf_deltas: LoopFilterDeltas,
    pub seg_features: SegmentationFeatures,
    pub grain: FilmGrainParams,
-    /// The colour format the frame was decoded in (a later sequence header may change it).
-    pub subsampling_x: u8,
-    pub subsampling_y: u8,
-    pub mono_chrome: bool,
 }

 /// A parsed uncompressed frame header with its derived variables.
@@ -466,26 +466,22 @@ fn ctx_xfrm(doc: &deckcraft_model::Presentation, sel: &crate::Selection, shape:

 /// Run `f` on each target shape (copy-on-write), materialising inherited boxes first.
 pub(crate) fn edit_shapes(s: &mut Session, p: &Value, cmd: &str, f: impl Fn(&mut deckcraft_model::Shape) -> Result<()>) -> Result<Value> {
-    let mut ids = targets(s, p)?;
+    let ids = targets(s, p)?;
    if ids.is_empty() {
        return Err(bad(cmd, "no shapes selected"));
    }
-    // A shape named twice is edited once.
-    let mut seen = std::collections::HashSet::new();
-    ids.retain(|id| seen.insert(*id));
    s.edit(|doc, sel| {
-        // The boxes are read from the shapes in place: no copy of a shape (and its text) per id.
-        let boxes: std::collections::HashMap<ShapeId, Xfrm> = ids
-            .iter()
-            .filter_map(|id| current_shapes(doc, sel).and_then(|v| deckcraft_model::find_shape(v, *id)))
-            .map(|sh| (sh.id, xfrm_of(doc, sel, sh)))
-            .collect();
+        let boxes: Vec<(ShapeId, Xfrm)> = {
+            let st_shapes: Vec<deckcraft_model::Shape> =
+                ids.iter().filter_map(|id| current_shapes(doc, sel).and_then(|v| deckcraft_model::find_shape(v, *id)).cloned()).collect();
+            st_shapes.iter().map(|sh| (sh.id, xfrm_of(doc, sel, sh))).collect()
+        };
        let shapes = crate::shapes_mut(doc, sel).ok_or_else(|| bad(cmd, "no slide"))?;
        let mut n = 0;
        for id in &ids {
            if let Some(sh) = deckcraft_model::find_shape_mut(shapes, *id) {
                if sh.xfrm.is_none() {
-                    sh.xfrm = boxes.get(id).copied();
+                    sh.xfrm = boxes.iter().find(|(i, _)| i == id).map(|(_, x)| *x);
                }
                f(sh)?;
                n += 1;
@@ -107,7 +107,7 @@ fn copy_inner(s: &mut Session, p: &Value) -> Result<String> {
        s.clipboard = crate::Clipboard { text: Some(TextBody::from_text(&plain)), plain: plain.clone(), ..Default::default() };
        return Ok(plain);
    }
-    let mut shapes: Vec<Shape> = st
+    let shapes: Vec<Shape> = st
        .selection
        .shapes
        .iter()
@@ -120,33 +120,14 @@ fn copy_inner(s: &mut Session, p: &Value) -> Result<String> {
            })
        })
        .collect();
-    // Copying is the last chance to read what a placeholder inherits: a cut removes it, and the
-    // paste can be in another deck. Slide Master view pastes the originals instead.
-    let placeholders: Vec<Shape> = shapes.iter().filter(|x| x.ph.is_some()).cloned().collect();
-    detach_on_slide(&st.doc, &st.selection, &mut shapes);
    let mids = crate::media_refs::shapes_media(&shapes);
    let media = st.doc.media.iter().filter(|m| mids.contains(&m.id)).cloned().collect();
    let plain = shapes.iter().filter_map(|x| x.text.as_ref().map(|t| t.text())).collect::<Vec<_>>().join("\n");
-    // The theme of what is being edited: a slide's or layout's colour map, else the master's.
-    let source_theme = super::text::ctx_for(&st.doc, &st.selection).map(|ctx| crate::SourceTheme {
-        colors: ctx.master.theme.colors.clone(),
-        color_map: ctx.color_map.clone(),
-        fonts: ctx.master.theme.fonts.clone(),
-    });
-    s.clipboard = crate::Clipboard { shapes, placeholders, media, plain: plain.clone(), source_theme, ..Default::default() };
+    let source_theme = st.current_slide().and_then(|sl| st.doc.master_for(sl)).map(|(m, _)| (m.scheme(), m.theme.fonts.clone()));
+    s.clipboard = crate::Clipboard { shapes, media, plain: plain.clone(), source_theme, ..Default::default() };
    Ok(plain)
 }

-/// On a slide, a copy of a placeholder is a regular shape: give `shapes` the look they inherit
-/// there. In Slide Master view a copy stays a placeholder, so this changes nothing.
-pub(crate) fn detach_on_slide(doc: &deckcraft_model::Presentation, sel: &crate::Selection, shapes: &mut [Shape]) {
-    if sel.target == crate::Target::Slides
-        && let Some(ctx) = super::text::ctx_for(doc, sel)
-    {
-        shapes.iter_mut().for_each(|sh| deckcraft_model::resolve::detach_placeholder(&ctx, sh));
-    }
-}
-
 fn copying_caret(s: &Session) -> bool {
    s.active().is_some_and(|d| d.selection.text.as_ref().is_some_and(|t| !t.is_range()))
 }
@@ -338,13 +319,6 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
        return s.edit(|doc, sel| {
            let media = bring_media("edit.paste", doc, &clip.media)?;
            let mut shapes = clip.shapes.clone();
-            if sel.target != crate::Target::Slides {
-                for sh in &mut shapes {
-                    if let Some(original) = clip.placeholders.iter().find(|p| p.id == sh.id) {
-                        sh.clone_from(original);
-                    }
-                }
-            }
            reid("edit.paste", doc, &mut shapes)?;
            crate::media_refs::visit_mut::shapes(&mut shapes, &mut remap_media(&media));
            let (mut taken, mut count) = super::current_names(doc, sel);
@@ -366,8 +340,7 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
                    x.x += off;
                    x.y += off;
                }
-                // A placeholder pasted on a slide becomes a regular shape. One copied from a slide
-                // already has its look; see `copy_inner`.
+                // A pasted placeholder becomes a regular shape keeping its look.
                if sh.ph.is_some() && sel.target == crate::Target::Slides {
                    sh.ph = None;
                }
@@ -431,9 +404,8 @@ fn paste_special(s: &mut Session, p: &Value) -> Result<Value> {
        "text" | "keepTextOnly" => paste_text(s, &json!({})),
        "keepSource" | "keepSourceFormatting" => {
            let saved = s.clipboard.clone();
-            if let Some(theme) = &saved.source_theme {
-                bake_theme(&mut s.clipboard.shapes, theme);
-                bake_theme(&mut s.clipboard.placeholders, theme);
+            if let Some((scheme, fonts)) = &saved.source_theme {
+                bake_theme(&mut s.clipboard.shapes, scheme, fonts);
            }
            let r = paste(s, &json!({}));
            let pastes = s.clipboard.pastes;
@@ -448,8 +420,8 @@ fn paste_special(s: &mut Session, p: &Value) -> Result<Value> {

 /// Replace theme colours and theme fonts with the values they have in `scheme` / `fonts`, so the
 /// shapes keep their look under another theme.
-pub(crate) fn bake_theme(shapes: &mut [Shape], theme: &crate::SourceTheme) {
-    fn rec(v: &mut Value, theme: &crate::SourceTheme, depth: usize) {
+pub(crate) fn bake_theme(shapes: &mut [Shape], scheme: &deckcraft_color::ColorScheme, fonts: &deckcraft_model::theme::FontScheme) {
+    fn rec(v: &mut Value, scheme: &deckcraft_color::ColorScheme, fonts: &deckcraft_model::theme::FontScheme, depth: usize) {
        if depth > 256 {
            return;
        }
@@ -458,7 +430,7 @@ pub(crate) fn bake_theme(shapes: &mut [Shape], theme: &crate::SourceTheme) {
                if o.get("kind").and_then(Value::as_str) == Some("scheme")
                    && let Some(slot) = o.get("slot").and_then(|x| serde_json::from_value::<deckcraft_color::SchemeSlot>(x.clone()).ok())
                    && slot != deckcraft_color::SchemeSlot::PhClr
-                    && let Ok(rgb) = serde_json::to_value(theme.colors.get(deckcraft_model::map_slot(&theme.color_map, slot)))
+                    && let Ok(rgb) = serde_json::to_value(scheme.get(slot))
                {
                    o.clear();
                    o.insert("kind".into(), json!("rgb"));
@@ -466,14 +438,14 @@ pub(crate) fn bake_theme(shapes: &mut [Shape], theme: &crate::SourceTheme) {
                    return;
                }
                for x in o.values_mut() {
-                    rec(x, theme, depth + 1);
+                    rec(x, scheme, fonts, depth + 1);
                }
            }
-            Value::Array(a) => a.iter_mut().for_each(|x| rec(x, theme, depth + 1)),
+            Value::Array(a) => a.iter_mut().for_each(|x| rec(x, scheme, fonts, depth + 1)),
            Value::String(t) if t.starts_with('+') => {
                let set = match t.get(1..3) {
-                    Some("mj") => &theme.fonts.major,
-                    Some("mn") => &theme.fonts.minor,
+                    Some("mj") => &fonts.major,
+                    Some("mn") => &fonts.minor,
                    _ => return,
                };
                let face = match t.get(3..) {
@@ -491,7 +463,7 @@ pub(crate) fn bake_theme(shapes: &mut [Shape], theme: &crate::SourceTheme) {
    }
    for sh in shapes.iter_mut() {
        let Ok(mut v) = serde_json::to_value(&*sh) else { continue };
-        rec(&mut v, theme, 0);
+        rec(&mut v, scheme, fonts, 0);
        if let Ok(baked) = serde_json::from_value::<Shape>(v) {
            *sh = baked;
        }
@@ -504,8 +476,8 @@ fn paste_picture(s: &mut Session) -> Result<Value> {
    if clip.shapes.is_empty() {
        return Err(bad("edit.pasteSpecial", "copy shapes first to paste them as a picture"));
    }
-    if let Some(theme) = &clip.source_theme {
-        bake_theme(&mut clip.shapes, theme);
+    if let Some((scheme, fonts)) = &clip.source_theme {
+        bake_theme(&mut clip.shapes, scheme, fonts);
    }
    let st = s.doc()?;
    let mut doc = (*st.doc).clone();
@@ -561,7 +533,6 @@ fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
        let mut copies: Vec<Shape> = list.iter().filter(|x| ids.contains(&x.id)).cloned().collect();
        let sources: Vec<ShapeId> = copies.iter().map(|c| c.id).collect();
        let boxes: Vec<_> = copies.iter().map(|c| xfrm_of(doc, sel, c)).collect();
-        detach_on_slide(doc, sel, &mut copies);
        // Duplicating the copies of the last Duplicate again repeats how far they were moved
        // since (#966); anything else gets the usual offset.
        let (dx, dy) = last
@@ -253,15 +253,8 @@ pub struct LoadedFile {
 #[cfg(not(target_arch = "wasm32"))]
 pub fn read_presentation_file(path: &str) -> Result<LoadedFile> {
    let bytes = crate::io::read_file(path).map_err(EngineError::Other)?;
-    loaded_file(path, &bytes)
-}
-
-/// Parse `bytes` as the presentation file `path`, as [`read_presentation_file`] does after
-/// reading it. The web host bridge uses it for a file its page sent, which then saves back to
-/// that name like a file opened on the desktop.
-pub fn loaded_file(path: &str, bytes: &[u8]) -> Result<LoadedFile> {
-    let (doc, damaged) = open_checked(path, bytes)?;
-    let native = deckcraft_format::sniff(bytes) || deckcraft_pptx::sniff(bytes);
+    let (doc, damaged) = open_checked(path, &bytes)?;
+    let native = deckcraft_format::sniff(&bytes) || deckcraft_pptx::sniff(&bytes);
    Ok(LoadedFile { path: path.to_string(), doc, native, damaged })
 }

@@ -477,10 +470,7 @@ pub fn format_for_path(path: &str) -> &'static str {
    }
 }

-/// The active presentation is saved as it is now: no unsaved changes, and `path` (when given)
-/// becomes its file. `file.save` calls it after writing; the web host bridge calls it once the
-/// page has the bytes.
-pub fn mark_saved(s: &mut Session, path: Option<String>) -> Result<()> {
+fn mark_saved(s: &mut Session, path: Option<String>) -> Result<()> {
    let st = s.doc_mut()?;
    st.saved_doc = st.doc.clone();
    if path.is_some() {
@@ -120,7 +120,13 @@ pub(super) fn line_spacing(s: &mut Session, p: &Value) -> Result<Value> {
 }

 pub(super) fn paragraph(s: &mut Session, p: &Value) -> Result<Value> {
-    let a = str_param(p, "align").map(|a| parse_align("format.paragraph", a)).transpose()?;
+    let a = str_param(p, "align").map(|a| match a {
+        "center" => Align::Center,
+        "right" => Align::Right,
+        "justify" => Align::Justify,
+        "distributed" => Align::Distributed,
+        _ => Align::Left,
+    });
    let ml = f64_param(p, "indentLeft");
    let ind = f64_param(p, "indentFirst");
    let sb = f64_param(p, "spaceBefore");
@@ -176,10 +182,10 @@ pub(super) fn clamp_pt(v: f64) -> f64 {
 fn parse_align(cmd: &str, s: &str) -> Result<Align> {
    Ok(match s {
        "left" | "l" => Align::Left,
-        "center" | "centre" | "ctr" => Align::Center,
+        "center" | "ctr" => Align::Center,
        "right" | "r" => Align::Right,
        "justify" | "just" => Align::Justify,
-        "justLow" | "justifyLow" => Align::JustLow,
+        "justLow" => Align::JustLow,
        "distributed" | "dist" => Align::Distributed,
        "thaiDist" => Align::ThaiDistributed,
        _ => return Err(bad(cmd, "`align` must be left, center, right, justify, justLow, distributed or thaiDist")),
@@ -80,12 +80,6 @@ pub(super) fn photo_album_edit(s: &mut Session, p: &Value) -> Result<Value> {
    let opts = album_opts(p)?;
    let items = album_items(p)?;
    let (id, ids) = album_target(s, p)?;
-    // The editor is seeded within the album limits; replacing the album from a trimmed seed would
-    // delete what it left out, so refuse rather than lose it.
-    let st = s.doc()?;
-    if items_from_slides(&st.doc, &album_slides(st, &ids)).1 {
-        return Err(bad("insert.photoAlbumEdit", "this album holds more than the editor can carry; editing it would delete the rest"));
-    }
    commit_album(s, items, opts, Some((id, ids)))
 }

@@ -551,19 +545,6 @@ fn album_target(s: &Session, p: &Value) -> Result<(u32, Vec<u64>)> {
    Err(bad("insert.photoAlbumEdit", "this slide is not part of a photo album"))
 }

-/// Whether a slide holds anything besides album items: shapes, notes, comments, a background, a
-/// transition, animations, a colour map or tags.
-fn has_slide_content(s: &deckcraft_model::Slide) -> bool {
-    !s.shapes.is_empty()
-        || !s.notes.text().trim().is_empty()
-        || !s.comments.is_empty()
-        || s.background.is_some()
-        || s.transition.is_some()
-        || !s.animations.is_empty()
-        || s.color_map.is_some()
-        || !s.tags.is_empty()
-}
-
 fn pic_count(slide: &deckcraft_model::Slide) -> usize {
    slide.shapes.iter().filter(|sh| matches!(sh.kind, ShapeKind::Picture { .. })).count()
 }
@@ -611,16 +592,9 @@ fn infer_album(slides: &[&deckcraft_model::Slide], theme_now: &str) -> (String,
    (layout, frame.into(), captions, any && gray, theme_now.to_string())
 }

-/// The album's items for the dialog, within the limits `insert.photoAlbum` itself takes (items,
-/// bytes per picture and in all), checked before a picture is encoded: an album slide set can
-/// name one large picture many times.
-///
-/// The flag is true when something was left out for a limit.
-fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_model::Slide]) -> (Vec<Value>, bool) {
+fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_model::Slide]) -> Vec<Value> {
    let mut items = Vec::new();
-    let mut total = 0usize;
-    let mut omitted = false;
-    'slides: for slide in slides {
+    for slide in slides {
        let pics: Vec<&deckcraft_model::Shape> = slide.shapes.iter().filter(|sh| matches!(sh.kind, ShapeKind::Picture { .. })).collect();
        if pics.is_empty() {
            let text = slide
@@ -631,27 +605,13 @@ fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_m
                .find(|t| !t.trim().is_empty())
                .unwrap_or_default();
            if !text.trim().is_empty() {
-                if items.len() >= ALBUM_MAX_ITEMS {
-                    omitted = true;
-                    break 'slides;
-                }
                items.push(json!({"text": text.trim()}));
-            } else if items.len() >= ALBUM_MAX_ITEMS && has_slide_content(slide) {
-                // Past the item limit, a slide with other content would be deleted by a replace.
-                omitted = true;
-                break 'slides;
            }
            continue;
        }
        for sh in pics {
            let ShapeKind::Picture { fill } = &sh.kind else { continue };
            let media = doc.media(fill.media);
-            let size = media.map_or(0, |m| m.data.len());
-            if items.len() >= ALBUM_MAX_ITEMS || size > ALBUM_MAX_BYTES || total.saturating_add(size) > ALBUM_MAX_TOTAL {
-                omitted = true;
-                break 'slides;
-            }
-            total += size;
            let name = if !sh.descr.is_empty() {
                sh.descr.clone()
            } else {
@@ -666,19 +626,14 @@ fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_m
            }));
        }
    }
-    (items, omitted)
-}
-
-/// The slides of album `ids` as the editor would seed them.
-fn album_slides<'a>(st: &'a crate::DocState, ids: &[u64]) -> Vec<&'a deckcraft_model::Slide> {
-    ids.iter().filter_map(|sid| u32::try_from(*sid).ok()).filter_map(|n| st.doc.slide(deckcraft_model::SlideId(n))).collect()
+    items
 }

 fn album_seed(s: &Session) -> Result<Value> {
    let (id, ids) = album_target(s, &Value::Null)?;
    let st = s.doc()?;
-    let slides = album_slides(st, &ids);
-    let (items, _) = items_from_slides(&st.doc, &slides);
+    let slides: Vec<&deckcraft_model::Slide> =
+        ids.iter().filter_map(|sid| u32::try_from(*sid).ok()).filter_map(|n| st.doc.slide(deckcraft_model::SlideId(n))).collect();
    let theme_now = st.doc.masters.first().map(|m| m.theme.name.clone()).filter(|n| !n.is_empty()).unwrap_or_else(|| "DeckCraft".into());
    let inferred = infer_album(&slides, &theme_now);
    let mark = slides.first().and_then(|sl| sl.raw_ext.as_deref().and_then(parse_album_mark));
@@ -700,7 +655,7 @@ fn album_seed(s: &Session) -> Result<Value> {
        "captions": captions,
        "grayscale": grayscale,
        "theme": theme,
-        "items": items,
+        "items": items_from_slides(&st.doc, &slides),
    }))
 }

@@ -767,96 +722,3 @@ fn insert_album(s: &mut Session, items: Vec<AlbumItem>, opts: &AlbumOpts, at: Op
    s.execute("slide.go", &json!({"index": first}))?;
    Ok(json!({"slides": slides, "first": first, "pictures": pictures, "album": album_id}))
 }
-
-#[cfg(test)]
-mod seed_tests {
-    use std::sync::Arc;
-
-    use deckcraft_model::style::PictureFill;
-    use deckcraft_model::{Shape, ShapeId, defaults};
-
-    use super::*;
-
-    #[test]
-    fn reopening_an_album_seeds_at_most_the_items_an_album_takes() {
-        // One picture named by 500 shapes: the dialog gets 48 items, not 500 encoded copies.
-        let mut p = defaults::new_presentation(None);
-        let img = p.add_media("a.png", "image/png", vec![1; 64 * 1024]).unwrap();
-        let pic = |k: u32| Shape {
-            id: ShapeId(10_000 + k),
-            kind: ShapeKind::Picture { fill: PictureFill { media: img, ..Default::default() } },
-            ..Default::default()
-        };
-        Arc::make_mut(&mut p.slides[0]).shapes = (0..500).map(pic).collect();
-        let slides: Vec<&deckcraft_model::Slide> = p.slides.iter().map(|s| s.as_ref()).collect();
-        let (items, omitted) = items_from_slides(&p, &slides);
-        assert_eq!(items.len(), ALBUM_MAX_ITEMS);
-        assert!(omitted);
-        let few: Vec<&deckcraft_model::Slide> = Vec::new();
-        assert!(!items_from_slides(&p, &few).1);
-    }
-
-    /// An album too big for the editor's seed cannot be replaced from that seed: the replace would
-    /// delete what the seed left out.
-    #[test]
-    fn editing_an_album_the_editor_cannot_hold_is_refused() {
-        let mut s = crate::Session::new();
-        s.execute("file.new", &json!({})).unwrap();
-        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
-        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
-        let st = s.doc_mut().unwrap();
-        let doc = Arc::make_mut(&mut st.doc);
-        let mut extra = doc.slides.last().unwrap().as_ref().clone();
-        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
-        doc.slides.push(Arc::new(extra));
-        let n = doc.slides.len();
-        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
-        assert!(e.contains("delete the rest"), "{e}");
-        assert_eq!(s.doc().unwrap().doc.slides.len(), n);
-    }
-
-    /// Past the item limit, a slide holding only a drawing counts as content the replace would delete.
-    #[test]
-    fn editing_an_album_with_a_drawing_slide_past_the_limit_is_refused() {
-        let mut s = crate::Session::new();
-        s.execute("file.new", &json!({})).unwrap();
-        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
-        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
-        let st = s.doc_mut().unwrap();
-        let doc = Arc::make_mut(&mut st.doc);
-        let mut extra = doc.slides.last().unwrap().as_ref().clone();
-        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
-        extra.shapes = vec![Shape { id: ShapeId(90_000), ..Default::default() }];
-        doc.slides.push(Arc::new(extra));
-        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
-        assert!(e.contains("delete the rest"), "{e}");
-    }
-
-    /// Notes or comments on a shapeless slide past the limit are content a replace would delete.
-    #[test]
-    fn editing_an_album_with_a_notes_only_slide_past_the_limit_is_refused() {
-        let mut s = crate::Session::new();
-        s.execute("file.new", &json!({})).unwrap();
-        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
-        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
-        let st = s.doc_mut().unwrap();
-        let doc = Arc::make_mut(&mut st.doc);
-        let mut extra = doc.slides.last().unwrap().as_ref().clone();
-        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
-        extra.shapes.clear();
-        extra.notes = deckcraft_model::text::TextBody::from_text("speaker notes");
-        doc.slides.push(Arc::new(extra));
-        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
-        assert!(e.contains("delete the rest"), "{e}");
-    }
-
-    /// A shapeless slide with a background, transition, colour map or tags counts as content; a plain empty one does not.
-    #[test]
-    fn slide_level_settings_count_as_slide_content() {
-        use deckcraft_model::Slide;
-        assert!(!has_slide_content(&Slide::default()));
-        assert!(has_slide_content(&Slide { tags: vec![("k".into(), "v".into())], ..Default::default() }));
-        assert!(has_slide_content(&Slide { color_map: Some(vec![("bg1".into(), "lt1".into())]), ..Default::default() }));
-        assert!(has_slide_content(&Slide { transition: Some(Default::default()), ..Default::default() }));
-    }
-}
@@ -219,7 +219,7 @@ fn neighbour(s: &mut Session, p: &Value, forward: bool) -> Result<Value> {
    let cmd = if forward { "comment.next" } else { "comment.prev" };
    let (threads, slide, index) = {
        let st = s.doc()?;
-        (comment_threads(&st.doc), usize_param(p, "slide").unwrap_or(st.selection.slide), super::opt_usize_param(p, "index", cmd)?)
+        (comment_threads(&st.doc), usize_param(p, "slide").unwrap_or(st.selection.slide), usize_param(p, "index"))
    };
    if threads.is_empty() {
        return Err(bad(cmd, "no comments"));
@@ -862,40 +862,6 @@ mod tests {
        assert_eq!(here["text"], "on first");
    }

-    #[test]
-    fn malformed_comment_navigation_index_does_not_change_selection() {
-        let mut s = Session::with_new();
-        s.execute("comment.add", &json!({"text": "first"})).unwrap();
-        s.execute("shape.insert", &json!({"preset": "rect", "rect": [10.0, 10.0, 40.0, 40.0]})).unwrap();
-        s.execute("slide.new", &json!({})).unwrap();
-        s.execute("comment.add", &json!({"text": "second"})).unwrap();
-        s.execute("slide.go", &json!({"index": 0})).unwrap();
-        let shape = s.doc().unwrap().doc.slides.first().and_then(|slide| slide.shapes.first()).map(|shape| shape.id).unwrap();
-        s.doc_mut().unwrap().selection.shapes = vec![shape];
-
-        for (command, value) in [
-            ("comment.next", json!(-1)),
-            ("comment.next", json!(1.5)),
-            ("comment.next", json!("bad")),
-            ("comment.prev", json!(-1)),
-            ("comment.prev", json!(1.5)),
-            ("comment.prev", json!("bad")),
-        ] {
-            let before = s.doc().unwrap().selection.clone();
-            let error = s.execute(command, &json!({"index": value})).unwrap_err();
-            assert!(error.to_string().contains("valid index"), "{command} {value}: {error}");
-            assert_eq!(s.doc().unwrap().selection, before, "{command} {value}");
-        }
-
-        let zero = s.execute("comment.next", &json!({"slide": 0, "index": 0})).unwrap();
-        assert_eq!(zero["slide"], 1);
-        assert_eq!(zero["index"], 0);
-        s.execute("slide.go", &json!({"index": 0})).unwrap();
-        let omitted = s.execute("comment.next", &json!({})).unwrap();
-        assert_eq!(omitted["slide"], 0);
-        assert_eq!(omitted["index"], 0);
-    }
-
    #[test]
    fn timestamps_are_iso_utc() {
        assert_eq!(iso_utc(0), "1970-01-01T00:00:00Z");
@@ -135,14 +135,6 @@ fn eye_show_all_and_hide_all() {
    assert!(!flags(&s, a).0 && flags(&s, g).0 && flags(&s, e).0);
 }

-#[test]
-fn lock_group_with_its_child_targeted_leaves_child_locked() {
-    let (mut s, ids) = deck();
-    let (d, g) = (ids[3], ids[7]);
-    s.execute("shape.lock", &json!({"ids": [g, d, d]})).unwrap();
-    assert!(flags(&s, g).1 && flags(&s, d).1);
-}
-
 #[test]
 fn lock_cascades_through_groups_and_undoes() {
    let (mut s, ids) = deck();
@@ -10,7 +10,7 @@ use serde_json::{Value, json};

 use super::{
    CommandSpec, NO_ID_SPACE, bad, bool_or, bool_param, cmd, color_param, color_value, edit_geometry, edit_shapes, f64_param, has_selection,
-    has_slide, id_param, ok, opt_usize_param, str_param, targets, usize_param, with_param, xfrm_of,
+    has_slide, id_param, ok, str_param, targets, usize_param, with_param, xfrm_of,
 };
 use crate::{Result, Session};

@@ -103,7 +103,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Shape Fill",
            ["Shape Format", "Shape Styles"],
            None,
-            "{color? | none?: true | background?: true (the slide background shows through; shapes and text boxes only) | gradient?: {stops: [[pos 0..1, color]], kind?: linear|radial|rectangular|path, angle?: deg (linear), focus?: [l, t, r, b] fractions (radial, rectangular and path: where the first stop sits), rotateWithShape?: bool (false keeps linear and radial gradients upright on the slide; rectangular and path gradients turn with the shape when drawn)} | picture?: base64 | pattern?: {preset, fg, bg} | transparency?: 0..1 | reset?: true, ids?}; pictureProps?: {tile?: bool, offsetX?, offsetY?: pt, scaleX?, scaleY?: 0..10, align?: tl|t|tr|l|ctr|r|bl|b|br, mirror?: none|x|y|xy, stretch?: [l, t, r, b] fractions, rotateWithShape?: bool} adjusts a picture fill; a group also formats its members",
+            "{color? | none?: true | background?: true (the slide background shows through; shapes and text boxes only) | gradient?: {stops: [[pos 0..1, color]], kind?: linear|radial|rectangular|path, angle?: deg (linear), focus?: [l, t, r, b] fractions (radial, rectangular and path: where the first stop sits), rotateWithShape?: bool} | picture?: base64 | pattern?: {preset, fg, bg} | transparency?: 0..1 | reset?: true, ids?}; pictureProps?: {tile?: bool, offsetX?, offsetY?: pt, scaleX?, scaleY?: 0..10, align?: tl|t|tr|l|ctr|r|bl|b|br, mirror?: none|x|y|xy, stretch?: [l, t, r, b] fractions, rotateWithShape?: bool} adjusts a picture fill; a group also formats its members",
            has_selection,
            fill
        ),
@@ -374,25 +374,6 @@ fn visible(s: &mut Session, p: &Value) -> Result<Value> {
 /// (a child can still be unlocked on its own afterwards), as PowerPoint does.
 fn lock(s: &mut Session, p: &Value) -> Result<Value> {
    let v = bool_param(p, "locked");
-    // A targeted shape inside another targeted group is reached through the group: editing it again
-    // would toggle it back.
-    let mut ids = super::targets(s, p)?;
-    if ids.len() > 1 {
-        let doc = s.doc()?;
-        // Walk each distinct group once, however often `ids` repeats it.
-        let mut once = std::collections::HashSet::new();
-        ids.retain(|id| once.insert(*id));
-        let mut inside = std::collections::HashSet::new();
-        for id in &ids {
-            if let Some(g) = doc.shape(*id) {
-                deckcraft_model::walk(g.children(), &mut |c, _| {
-                    inside.insert(c.id);
-                });
-            }
-        }
-        ids.retain(|id| !inside.contains(id));
-    }
-    let p = &json!({"ids": ids, "locked": p.get("locked")});
    edit_shapes(s, p, "shape.lock", |sh| {
        let to = v.unwrap_or(!sh.locked);
        set_locked(sh, to, 0);
@@ -1,11 +1,11 @@
 use super::{
    ColorRef, ColorTransform, Dash, Effects, Fill, Geom, Glow, Gradient, GradientShape, GradientStop, Line, LineEnd, PictureFill, PictureMode,
    Reflection, Result, Rgba, SchemeSlot, Session, Shadow, ShapeStyle, Value, apply_fill, bad, bool_or, color_param, color_value, edit_geometry,
-    edit_shapes, f64_param, inherited_fills, json, opt_usize_param, requested_fill, str_param, targets,
+    edit_shapes, f64_param, inherited_fills, json, requested_fill, str_param, targets, usize_param,
 };

 pub(super) fn adjust(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = opt_usize_param(p, "index", "shape.adjust")?.unwrap_or(0).min(16);
+    let i = usize_param(p, "index").unwrap_or(0).min(16);
    let v = f64_param(p, "value").ok_or_else(|| bad("shape.adjust", "missing `value`"))?;
    edit_geometry(s, p, "shape.adjust", |sh| {
        if let Geom::Preset { name, adj } = &mut sh.geom {
@@ -74,8 +74,7 @@ pub(super) fn change(s: &mut Session, p: &Value) -> Result<Value> {

 /// `{stops: [[pos 0–1, color], …], kind?: linear|radial|rectangular|path, angle?: deg (linear),
 /// focus?: [l, t, r, b] fractions (radial/rectangular/path: where the first stop sits),
-/// rotateWithShape?}`. The renderer keeps only linear and radial gradients upright when
-/// `rotateWithShape` is false; rectangular and path gradients turn with the shape.
+/// rotateWithShape?}`.
 pub(crate) fn gradient_param(v: &Value) -> Option<Gradient> {
    let stops: Vec<GradientStop> = v
        .get("stops")?
@@ -556,7 +555,7 @@ pub fn quick_style_for(index: usize) -> (ShapeStyle, Option<Fill>, Option<Line>)
 }

 pub(super) fn quick_style(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = opt_usize_param(p, "index", "shape.quickStyle")?.unwrap_or(1).min(41);
+    let i = usize_param(p, "index").unwrap_or(1).min(41);
    let (st, f, l) = quick_style_for(i);
    edit_shapes(s, p, "shape.quickStyle", |sh| {
        sh.style = Some(st.clone());
@@ -3,9 +3,8 @@ use super::{ColorRef, Fill, Geom, Line, NO_ID_SPACE, Result, Session, Value, bad
 pub(super) fn sites(s: &mut Session, p: &Value) -> Result<Value> {
    let id = id_param(p, "id", "shape.sites")?.ok_or_else(|| bad("shape.sites", "missing `id`"))?;
    let st = s.doc()?;
-    // In slide space, as shape.connect uses them, for a shape inside a group too.
-    let v = crate::connect::sites_of(&st.doc, &st.selection, st.shapes(), id).ok_or_else(|| bad("shape.sites", "no such shape"))?;
-    Ok(json!(v.iter().map(|q| [q.x, q.y]).collect::<Vec<_>>()))
+    let sh = st.shape(id).ok_or_else(|| bad("shape.sites", "no such shape"))?;
+    Ok(json!(crate::connect::sites(&st.doc, &st.selection, sh).iter().map(|q| [q.x, q.y]).collect::<Vec<_>>()))
 }

 pub(super) fn connect(s: &mut Session, p: &Value) -> Result<Value> {
@@ -13,13 +12,8 @@ pub(super) fn connect(s: &mut Session, p: &Value) -> Result<Value> {
        return Err(bad("shape.connect", "missing `from` / `to`"));
    };
    let st = s.doc()?;
-    // Anywhere in the slide's tree: a shape inside a group takes a connector too (PowerPoint
-    // glues to grouped shapes), its sites where the group draws them.
-    let site_list = |id| {
-        crate::connect::sites_of(&st.doc, &st.selection, st.shapes(), id)
-            .ok_or_else(|| bad("shape.connect", format!("no shape {} on the current slide", id.0)))
-    };
-    let (a, b) = (site_list(from)?, site_list(to)?);
+    let site_list = |id| st.shape(id).map(|sh| crate::connect::sites(&st.doc, &st.selection, sh)).unwrap_or_default();
+    let (a, b) = (site_list(from), site_list(to));
    if a.is_empty() || b.is_empty() {
        return Err(bad("shape.connect", "both shapes need connection sites (lines and groups have none)"));
    }
@@ -41,11 +35,6 @@ pub(super) fn connect(s: &mut Session, p: &Value) -> Result<Value> {
    };
    let (p0, p1) = (a[ia], b[ib]);
    let id = match id_param(p, "id", "shape.connect")? {
-        // The ends are in slide space and rerouting follows the slide's own connectors, so a line
-        // inside a group would be drawn in the group's space and never follow its shapes.
-        Some(id) if !st.shapes().iter().any(|sh| sh.id == id) && st.shape(id).is_some_and(|sh| sh.is_line()) => {
-            return Err(bad("shape.connect", "`id` names a line inside a group; ungroup it first, or leave `id` out for a new connector"));
-        }
        Some(id) => id,
        None => {
            let preset = str_param(p, "preset").unwrap_or("straightConnector1");
@@ -104,7 +93,7 @@ pub(super) fn freeform(s: &mut Session, p: &Value) -> Result<Value> {
            a.iter()
                .filter_map(|v| Some(deckcraft_geom::Point::new(v.get(0)?.as_f64()?, v.get(1)?.as_f64()?)))
                .filter(|q| q.x.is_finite() && q.y.is_finite())
-                .take(crate::tools::MAX_GESTURE_POINTS)
+                .take(20_000)
                .collect()
        })
        .unwrap_or_default();
@@ -191,13 +191,6 @@ pub(super) fn rotate(s: &mut Session, p: &Value) -> Result<Value> {
 pub(super) fn flip(s: &mut Session, p: &Value) -> Result<Value> {
    let v = str_param(p, "axis").unwrap_or("horizontal").starts_with('v');
    edit_geometry(s, p, "shape.flip", |sh| {
-        // PowerPoint greys Flip out for a SmartArt graphic (SmartArt Design > Right to Left mirrors it),
-        // also inside a group: ungrouping would hand the flip to the graphic.
-        let mut graphic = false;
-        deckcraft_model::walk(std::slice::from_ref(&*sh), &mut |x, _| graphic |= x.diagram.is_some());
-        if graphic {
-            return Err(bad("shape.flip", "Flip is not available for a SmartArt graphic; use `smartArt.layout` to change how it is laid out"));
-        }
        if let Some(x) = sh.xfrm.as_mut() {
            if v {
                x.flip_v = !x.flip_v;
@@ -253,10 +253,9 @@ fn cell_param(p: &Value, key: &str, cmd: &str) -> Result<Option<(usize, usize)>>
        None | Some(Value::Null) => return Ok(None),
        Some(v) => v,
    };
-    // Exactly [row, col]: an entry with more is as malformed as one with less.
-    let idx = |x: &Value| x.as_u64().and_then(|x| usize::try_from(x).ok());
-    match v.as_array().map(Vec::as_slice) {
-        Some([r, c]) if let (Some(r), Some(c)) = (idx(r), idx(c)) => Ok(Some((r, c))),
+    let idx = |i: usize| v.as_array().and_then(|a| a.get(i)).and_then(Value::as_u64).and_then(|x| usize::try_from(x).ok());
+    match (idx(0), idx(1)) {
+        (Some(r), Some(c)) => Ok(Some((r, c))),
        _ => Err(bad(cmd, format!("`{key}` is not a valid cell: {v}"))),
    }
 }
@@ -390,54 +389,33 @@ fn options(s: &mut Session, p: &Value) -> Result<Value> {
    })
 }

-/// At most this many `cells` in one table cell command.
-const MAX_CELLS: usize = 100_000;
-
 /// The cells a command acts on: `cells`, else the selected cell range, else the cell holding the
 /// caret, else every cell.
-fn target_cells(s: &Session, p: &Value, cmd: &str) -> Result<impl Fn(&Table) -> Result<Vec<(usize, usize)>> + use<>> {
-    // `cells` is a list of [row, col]: anything else, or an entry that is not one, is refused, never
-    // dropped or read as absent (which would act on the selection or the whole table).
-    let cells: Option<Vec<(usize, usize)>> = match p.get("cells") {
-        None | Some(Value::Null) => None,
-        Some(Value::Array(a)) if a.len() > MAX_CELLS => {
-            return Err(bad(cmd, format!("`cells` lists {} cells; at most {MAX_CELLS}", a.len())));
-        }
-        Some(Value::Array(a)) => Some(
-            a.iter()
-                .map(|c| {
-                    cell_param(&json!({ "cell": c }), "cell", cmd)?.ok_or_else(|| bad(cmd, format!("`cells` entry {c} is not a [row, col] cell")))
-                })
-                .collect::<Result<_>>()?,
-        ),
-        Some(v) => return Err(bad(cmd, format!("`cells` is a list of [row, col] cells, not {v}"))),
-    };
+fn target_cells(s: &Session, p: &Value) -> Result<impl Fn(&Table) -> Vec<(usize, usize)> + use<>> {
+    let cells: Option<Vec<(usize, usize)>> = p
+        .get("cells")
+        .and_then(Value::as_array)
+        .map(|a| a.iter().take(100_000).filter_map(|c| Some((c.get(0)?.as_u64()? as usize, c.get(1)?.as_u64()? as usize))).collect());
    let st = s.doc()?;
    // A selected range grows over the merged cells it touches; with only a caret, the caret's cell is used.
    let sel = st.selection.cells.map(|(_, a, b)| (a, b, true)).or_else(|| st.selection.text.as_ref().and_then(|t| t.cell).map(|c| (c, c, false)));
-    let cmd = cmd.to_string();
    Ok(move |t: &Table| match (&cells, sel) {
-        // Each listed cell must be in the table, so a command never reports success for a cell
-        // it could not edit.
-        (Some(c), _) => match c.iter().find(|(r, c)| *r >= t.n_rows() || *c >= t.n_cols()) {
-            Some((r, c)) => Err(bad(&cmd, format!("no cell [{r}, {c}]: the table has {} rows and {} columns", t.n_rows(), t.n_cols()))),
-            None => Ok(c.clone()),
-        },
+        (Some(c), _) => c.clone(),
        (None, Some((a, b, range))) => {
            let (a, b) = if range { cell_block(t, a, b) } else { (a, b) };
            // The selection can name cells outside the table; only walk the ones that exist.
            let (r1, c1) = (a.0.max(b.0).min(t.n_rows().saturating_sub(1)), a.1.max(b.1).min(t.n_cols().saturating_sub(1)));
-            Ok((a.0.min(b.0)..=r1).flat_map(|r| (a.1.min(b.1)..=c1).map(move |c| (r, c))).collect())
+            (a.0.min(b.0)..=r1).flat_map(|r| (a.1.min(b.1)..=c1).map(move |c| (r, c))).collect()
        }
-        _ => Ok((0..t.n_rows()).flat_map(|r| (0..t.n_cols()).map(move |c| (r, c))).collect()),
+        _ => (0..t.n_rows()).flat_map(|r| (0..t.n_cols()).map(move |c| (r, c))).collect(),
    })
 }

 fn cell_fill(s: &mut Session, p: &Value) -> Result<Value> {
    let fill = if bool_or(p, "none", false) { Some(deckcraft_model::Fill::None) } else { color_param(p, "color").map(deckcraft_model::Fill::solid) };
-    let targets = target_cells(s, p, "table.cellFill")?;
+    let targets = target_cells(s, p)?;
    with_table(s, p, "table.cellFill", move |t| {
-        for (r, c) in targets(t)? {
+        for (r, c) in targets(t) {
            if let Some(cell) = t.cell_mut(r, c) {
                cell.fill.clone_from(&fill);
            }
@@ -469,9 +447,9 @@ fn borders(s: &mut Session, p: &Value) -> Result<Value> {
    }
    // "none" clears to no line, so the table style's own lines don't show through either.
    let line = if which == "none" { Line::none() } else { line };
-    let targets = target_cells(s, p, "table.borders")?;
+    let targets = target_cells(s, p)?;
    with_table(s, p, "table.borders", move |t| {
-        let list = targets(t)?;
+        let list = targets(t);
        let (Some(r0), Some(r1), Some(c0), Some(c1)) =
            (list.iter().map(|x| x.0).min(), list.iter().map(|x| x.0).max(), list.iter().map(|x| x.1).min(), list.iter().map(|x| x.1).max())
        else {
@@ -485,9 +463,9 @@ fn borders(s: &mut Session, p: &Value) -> Result<Value> {
            }
            let n = match side {
                LEFT => c.checked_sub(1).map(|c| (r, c, RIGHT)),
-                RIGHT => c.checked_add(1).filter(|c| *c < cols).map(|c| (r, c, LEFT)),
+                RIGHT => (c + 1 < cols).then_some((r, c + 1, LEFT)),
                TOP => r.checked_sub(1).map(|r| (r, c, BOTTOM)),
-                _ => r.checked_add(1).filter(|r| *r < rows).map(|r| (r, c, TOP)),
+                _ => (r + 1 < rows).then_some((r + 1, c, TOP)),
            };
            if let Some((r, c, side)) = n
                && let Some(cell) = t.cell_mut(r, c)
@@ -545,9 +523,9 @@ fn cell_margins(s: &mut Session, p: &Value) -> Result<Value> {
    };
    let side = |k: &str, i: usize| f64_param(p, k).filter(|v| v.is_finite()).map_or(base[i], |v| v.clamp(0.0, 400.0));
    let m = [side("left", 0), side("right", 1), side("top", 2), side("bottom", 3)];
-    let targets = target_cells(s, p, "table.cellMargins")?;
+    let targets = target_cells(s, p)?;
    with_table(s, p, "table.cellMargins", move |t| {
-        for (r, c) in targets(t)? {
+        for (r, c) in targets(t) {
            if let Some(cell) = t.cell_mut(r, c) {
                cell.margins = Some(m);
            }
@@ -582,9 +560,9 @@ fn cell_align(s: &mut Session, p: &Value) -> Result<Value> {
            o => return Err(bad("table.cellAlign", format!("unknown anchor {o:?}; one of top, middle, bottom"))),
        }),
    };
-    let targets = target_cells(s, p, "table.cellAlign")?;
+    let targets = target_cells(s, p)?;
    with_table(s, p, "table.cellAlign", move |t| {
-        for (r, c) in targets(t)? {
+        for (r, c) in targets(t) {
            if let Some(cell) = t.cell_mut(r, c) {
                if anchor.is_some() {
                    cell.anchor = anchor;
@@ -1,21 +1,14 @@
 //! Connectors glued to shapes: connection sites, snapping line ends to them, and rerouting attached
 //! connectors whenever the shapes they connect move, resize or rotate.

-use deckcraft_geom::{Affine, Point, Rect, Xfrm};
+use deckcraft_geom::{Point, Xfrm};
 use deckcraft_model::{Presentation, Shape, ShapeId, ShapeKind};

 use crate::Selection;
 use crate::cmd::xfrm_of;

-/// Connection sites of a top-level shape `s` in slide coordinates (index = site index stored on
-/// connectors). For a shape inside a group use [`sites_of`] or [`sites_in`].
+/// Connection sites of `s` in slide coordinates (index = site index stored on connectors).
 pub fn sites(doc: &Presentation, sel: &Selection, s: &Shape) -> Vec<Point> {
-    sites_in(doc, sel, s, Affine::IDENTITY)
-}
-
-/// Connection sites of `s` in slide coordinates, `to_abs` mapping the space its box lives in (the
-/// slide, or the child space of the groups around it) onto the slide.
-pub fn sites_in(doc: &Presentation, sel: &Selection, s: &Shape, to_abs: Affine) -> Vec<Point> {
    if s.is_line() || matches!(s.kind, ShapeKind::Group { .. } | ShapeKind::Ink { .. }) {
        return vec![];
    }
@@ -24,42 +17,10 @@ pub fn sites_in(doc: &Presentation, sel: &Selection, s: &Shape, to_abs: Affine)
    if local.is_empty() {
        local = vec![Point::new(x.w / 2.0, 0.0), Point::new(0.0, x.h / 2.0), Point::new(x.w / 2.0, x.h), Point::new(x.w, x.h / 2.0)];
    }
-    let a = to_abs * x.affine();
+    let a = x.affine();
    local.into_iter().map(|p| a * p).collect()
 }

-/// The shape `id` anywhere in `shapes` (a group's member included) with the affine that maps the
-/// space its box lives in onto the slide: a connector glues to a grouped shape, as in PowerPoint,
-/// and its sites are where the group draws them.
-pub fn locate<'a>(doc: &Presentation, sel: &Selection, shapes: &'a [Shape], id: ShapeId) -> Option<(&'a Shape, Affine)> {
-    fn rec<'a>(doc: &Presentation, sel: &Selection, shapes: &'a [Shape], id: ShapeId, to_abs: Affine, depth: usize) -> Option<(&'a Shape, Affine)> {
-        if depth > 64 {
-            return None;
-        }
-        for s in shapes {
-            if s.id == id {
-                return Some((s, to_abs));
-            }
-            if let ShapeKind::Group { children, child } = &s.kind {
-                let x = xfrm_of(doc, sel, s);
-                let ch = Rect::new(child.x, child.y, child.x + child.w, child.y + child.h);
-                let nested = to_abs * deckcraft_geom::group_child_affine(&x, ch);
-                if let Some(f) = rec(doc, sel, children, id, nested, depth + 1) {
-                    return Some(f);
-                }
-            }
-        }
-        None
-    }
-    rec(doc, sel, shapes, id, Affine::IDENTITY, 0)
-}
-
-/// Connection sites of shape `id` anywhere in `shapes`, in slide coordinates; `None` when there is
-/// no such shape.
-pub fn sites_of(doc: &Presentation, sel: &Selection, shapes: &[Shape], id: ShapeId) -> Option<Vec<Point>> {
-    locate(doc, sel, shapes, id).map(|(s, a)| sites_in(doc, sel, s, a))
-}
-
 /// The nearest connection site within `radius` of `p` on any visible shape except `exclude`.
 pub fn nearest_site(
    doc: &Presentation,
@@ -107,8 +68,8 @@ pub fn reroute(doc: &mut Presentation, sel: &Selection) {
    let snapshot: Vec<Shape> = list.clone();
    let view = doc.clone();
    let site = |id: ShapeId, idx: u32| -> Option<Point> {
-        // Anywhere in the tree: a connector glued to a shape that is then grouped keeps following it.
-        let v = sites_of(&view, sel, &snapshot, id)?;
+        let s = snapshot.iter().find(|s| s.id == id)?;
+        let v = sites(&view, sel, s);
        v.get(idx as usize).or(v.first()).copied()
    };
    let mut updates: Vec<(usize, Xfrm, bool, bool)> = vec![];
@@ -85,20 +85,14 @@ impl AutomationRoots {

    /// May the file or folder at `path` be read (or written)? `Err` says why not.
    pub fn check(&self, path: &str, access: Access) -> Result<(), String> {
-        self.check_path(Path::new(path), access)
-    }
-
-    /// [`Self::check`] for a path that may not be UTF-8: the checked path is the one opened.
-    pub fn check_path(&self, path: &Path, access: Access) -> Result<(), String> {
-        let path_text = path.display();
        let roots = match access {
            Access::Read => &self.read,
            Access::Write => &self.write,
        };
        if roots.is_empty() {
            return match access {
-                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path_text}")),
-                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path_text}")),
+                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path}")),
+                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path}")),
            };
        }
        let resolved = resolve(path)?;
@@ -107,8 +101,8 @@ impl AutomationRoots {
        }
        let roots = roots.iter().map(|root| root.shown.display().to_string()).collect::<Vec<_>>().join(", ");
        match access {
-            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path_text}")),
-            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path_text}")),
+            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path}")),
+            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path}")),
        }
    }
 }
@@ -197,23 +191,17 @@ pub fn check_write(path: &str) -> Result<(), String> {
    current().map_or(Ok(()), |r| r.check(path, Access::Write))
 }

-/// May `path` be written here? Always, without roots in force. For a path that may not be UTF-8.
-pub fn check_write_path(path: &Path) -> Result<(), String> {
-    current().map_or(Ok(()), |r| r.check_path(path, Access::Write))
-}
-
 /// `path` made absolute with its links followed; for a path that doesn't exist (yet), its nearest
 /// existing folder's links followed and the rest appended.
-fn resolve(path: &Path) -> Result<PathBuf, String> {
-    if path.as_os_str().is_empty() {
+fn resolve(path: &str) -> Result<PathBuf, String> {
+    if path.is_empty() {
        return Err("automation path rejected: path is empty".into());
    }
-    let shown = path.display();
    // Checked as given: making `…\NUL` absolute gives the device path `\\.\NUL` on Windows.
-    if cfg!(windows) && path.components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
-        return Err(format!("automation path rejected: reserved device names are not allowed: {shown}"));
+    if cfg!(windows) && Path::new(path).components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
+        return Err(format!("automation path rejected: reserved device names are not allowed: {path}"));
    }
-    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {shown}: {e}"))?;
+    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {path}: {e}"))?;
    // The names below the nearest existing folder, last first.
    let mut missing: Vec<OsString> = vec![];
    let mut at = absolute.as_path();
@@ -224,11 +212,11 @@ fn resolve(path: &Path) -> Result<PathBuf, String> {
                return Ok(found);
            }
            Err(e) => match std::fs::symlink_metadata(at) {
-                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {shown}")),
+                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {path}")),
                // There, yet its real path can't be had (no permission): nothing to compare.
-                Ok(_) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
+                Ok(_) => return Err(format!("automation path rejected: cannot resolve {path}: {e}")),
                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-                Err(e) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
+                Err(e) => return Err(format!("automation path rejected: cannot resolve {path}: {e}")),
            },
        }
        let parent = at.parent();
@@ -238,12 +226,12 @@ fn resolve(path: &Path) -> Result<PathBuf, String> {
                at = parent;
            }
            (Some(Component::ParentDir), _) => {
-                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {shown}"));
+                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {path}"));
            }
            // Down to the root (or drive) and it doesn't exist either.
            _ => {
                let e = std::io::Error::from(std::io::ErrorKind::NotFound);
-                return Err(format!("automation path rejected: cannot resolve {shown}: {e}"));
+                return Err(format!("automation path rejected: cannot resolve {path}: {e}"));
            }
        }
    }
@@ -1,8 +1,6 @@
 //! Fonts a presentation uses that this machine doesn't have, so opening it can say so (its text
 //! draws in a stand-in; see `FontDb::document_face`).

-use std::collections::HashSet;
-
 use deckcraft_fonts::FontDb;
 use deckcraft_model::resolve::{self, Ctx};
 use deckcraft_model::text::{Bullet, TextBody};
@@ -14,13 +12,8 @@ use deckcraft_model::{Presentation, Shape, ShapeKind};
 /// font to load and are left for the round trip.
 pub fn install_embedded_fonts(p: &Presentation) {
    let db = FontDb::global();
-    // Faces can name one media item many times; each is copied and enumerated once.
-    let mut seen = HashSet::new();
    for font in &p.embedded_fonts {
        for id in font.faces().into_iter().flatten() {
-            if !seen.insert(id) {
-                continue;
-            }
            let Some(item) = p.media(id) else { continue };
            let Some(sfnt) = deckcraft_fonts::embedded_sfnt(&item.data) else { continue };
            db.add_font(sfnt.to_vec());
@@ -34,8 +27,12 @@ pub fn install_embedded_fonts(p: &Presentation) {
 /// and can't be installed, so they aren't reported.
 pub fn missing_fonts(p: &Presentation) -> Vec<String> {
    let db = FontDb::global();
-    // used_fonts is already free of case-insensitive duplicates.
-    let mut out: Vec<String> = used_fonts(p).into_iter().filter(|f| !f.starts_with('.') && !db.has_family(f)).collect();
+    let mut out: Vec<String> = Vec::new();
+    for family in used_fonts(p) {
+        if !family.starts_with('.') && !db.has_family(&family) && !out.iter().any(|f| f.eq_ignore_ascii_case(&family)) {
+            out.push(family);
+        }
+    }
    out.sort_by_key(|f| f.to_lowercase());
    out
 }
@@ -43,10 +40,9 @@ pub fn missing_fonts(p: &Presentation) -> Vec<String> {
 /// The families the slides' text runs and bullets are drawn in.
 pub fn used_fonts(p: &Presentation) -> Vec<String> {
    let mut out: Vec<String> = Vec::new();
-    let mut seen: HashSet<String> = HashSet::new();
    let mut add = |f: String| {
        let f = f.trim().to_string();
-        if !f.is_empty() && seen.insert(f.to_ascii_lowercase()) {
+        if !f.is_empty() && !out.iter().any(|o| o.eq_ignore_ascii_case(&f)) {
            out.push(f);
        }
    };
@@ -454,30 +454,17 @@ pub struct MediaStatus {
 }

 /// Clipboard contents copied within the app.
-/// The theme a copy drew with. The colours and the map stay apart, as in
-/// `deckcraft_model::resolve::Ctx::color`: the map renames only `tx1`, `bg1`, `tx2` and `bg2`, and
-/// a direct `dk1` keeps the theme's colour.
-#[derive(Clone, Debug)]
-pub struct SourceTheme {
-    /// The theme's own colours, no colour map applied.
-    pub colors: deckcraft_color::ColorScheme,
-    pub color_map: Vec<(String, String)>,
-    pub fonts: deckcraft_model::theme::FontScheme,
-}
-
 #[derive(Clone, Debug, Default)]
 pub struct Clipboard {
    pub shapes: Vec<Shape>,
-    /// The copied placeholders as they were, by id. `shapes` holds a slide's placeholders as
-    /// regular shapes; a paste in Slide Master view takes these, which stay placeholders.
-    pub placeholders: Vec<Shape>,
    pub slides: Vec<Slide>,
    /// Media the copied shapes/slides reference.
    pub media: Vec<deckcraft_model::MediaItem>,
    pub text: Option<deckcraft_model::TextBody>,
    pub plain: String,
-    /// The theme the shapes were copied under, for Paste Special › Keep Source Formatting.
-    pub source_theme: Option<SourceTheme>,
+    /// The copied shapes' theme colours (colour map applied) and fonts, for Paste Special ›
+    /// Keep Source Formatting.
+    pub source_theme: Option<(deckcraft_color::ColorScheme, deckcraft_model::theme::FontScheme)>,
    /// How many times the shapes were pasted (each paste offsets further).
    pub pastes: u32,
 }
@@ -824,32 +811,10 @@ fn clamp_selection(st: &mut DocState) {
 /// Default for [`History::byte_limit`].
 pub const UNDO_BYTE_BUDGET: usize = 256 << 20;

-/// A rough size of a text body in memory: its paragraphs and runs, at their inline struct sizes.
-fn text_cost(t: &deckcraft_model::text::TextBody) -> usize {
-    use deckcraft_model::text::{Paragraph, Run};
-    let (para, run) = (std::mem::size_of::<Paragraph>(), std::mem::size_of::<Run>());
-    t.paragraphs.iter().map(|p| para + p.runs.iter().map(|r| run + r.text.len()).sum::<usize>()).sum()
-}
-
-/// A rough size of comments in memory, replies included.
-fn comments_cost(cs: &[deckcraft_model::Comment], depth: usize) -> usize {
-    let kids = |c: &deckcraft_model::Comment| if depth < 64 { comments_cost(&c.replies, depth + 1) } else { 0 };
-    cs.iter().map(|c| 256 + c.author.len() + c.initials.len() + c.text.len() + c.date.len() + kids(c)).sum()
-}
-
-/// A rough size of a slide's own data besides its shapes: notes, comments, tags and kept XML,
-/// all copied with the slide when an edit changes it.
-fn slide_extra_cost(s: &deckcraft_model::Slide) -> usize {
-    text_cost(&s.notes)
-        + comments_cost(&s.comments, 0)
-        + s.name.len()
-        + s.tags.iter().map(|(k, v)| 48 + k.len() + v.len()).sum::<usize>()
-        + s.raw_ext.as_ref().map_or(0, String::len)
-}
-
 /// A rough size of a shape in memory: the struct, its text and kept XML, its children.
 fn shape_cost(sh: &deckcraft_model::Shape, depth: usize) -> usize {
-    let text: usize = sh.text.as_ref().map_or(0, text_cost);
+    let text: usize =
+        sh.text.as_ref().map_or(0, |t| t.paragraphs.iter().map(|p| 96 + p.runs.iter().map(|r| 128 + r.text.len()).sum::<usize>()).sum());
    let kids: usize = if depth < 64 { sh.children().iter().map(|c| shape_cost(c, depth + 1)).sum() } else { 0 };
    768 + text + sh.raw_ext.as_ref().map_or(0, String::len) + kids
 }
@@ -867,7 +832,7 @@ pub fn undo_cost(doc: &Presentation, newer: &Presentation) -> usize {
    let media: HashSet<*const Vec<u8>> = newer.media.iter().map(|m| Arc::as_ptr(&m.data)).collect();
    let mut n = 64 * doc.slides.len();
    for s in doc.slides.iter().filter(|s| !slides.contains(&Arc::as_ptr(s))) {
-        n += 512 + shapes_cost(&s.shapes) + slide_extra_cost(s);
+        n += 512 + shapes_cost(&s.shapes);
    }
    for m in doc.masters.iter().filter(|m| !masters.contains(&Arc::as_ptr(m))) {
        n += 4096 + shapes_cost(&m.shapes) + m.layouts.iter().map(|l| 512 + shapes_cost(&l.shapes)).sum::<usize>();
@@ -171,9 +171,7 @@ impl Dictionary {
                ["COMPOUNDWORDMAX", n, ..] => d.compound_max = n.parse().unwrap_or(0),
                ["REP", n] => {
                    for _ in 0..n.parse::<usize>().unwrap_or(0) {
-                        // The count is the file's claim: stop when the records run out.
-                        let Some(line) = lines.next() else { break };
-                        let r: Vec<&str> = line.split_whitespace().collect();
+                        let r: Vec<&str> = lines.next().unwrap_or("").split_whitespace().collect();
                        if let [_, a, b, ..] = r.as_slice() {
                            d.rep.push((a.replace('_', " "), b.replace('_', " ")));
                        }
@@ -184,8 +182,7 @@ impl Dictionary {
                    let Some(flag) = one_flag(Some(flag), mode) else { continue };
                    let cross = cross.eq_ignore_ascii_case("y");
                    for _ in 0..n.parse::<usize>().unwrap_or(0) {
-                        let Some(line) = lines.next() else { break };
-                        let r: Vec<&str> = line.split_whitespace().collect();
+                        let r: Vec<&str> = lines.next().unwrap_or("").split_whitespace().collect();
                        let [_, _, strip, add, rest @ ..] = r.as_slice() else { continue };
                        let (add, cont) = match add.split_once('/') {
                            Some((a, c)) => (a, parse_flags(c, mode)),
@@ -307,12 +304,7 @@ impl Dictionary {

    /// `w` made of dictionary parts allowed in compounds (`COMPOUNDFLAG`, or the begin, middle and
    /// end flags), each at least `COMPOUNDMIN` characters long.
-    fn compounded(&self, w: &[char], index: usize, failed: &mut HashSet<(usize, usize)>) -> bool {
-        // `w` is always a tail of the checked word, so its length names it: a (tail, part index)
-        // that failed once fails again however the earlier parts were split.
-        if failed.contains(&(w.len(), index)) {
-            return false;
-        }
+    fn compounded(&self, w: &[char], index: usize) -> bool {
        if self.compound.is_none() && self.compound_end.is_none() {
            return false;
        }
@@ -330,11 +322,10 @@ impl Dictionary {
            if [self.compound, self.compound_end].into_iter().flatten().any(|f| self.compound_part(rest, f, true)) {
                return true;
            }
-            if self.compounded(rest, index + 1, failed) {
+            if self.compounded(rest, index + 1) {
                return true;
            }
        }
-        failed.insert((w.len(), index));
        false
    }

@@ -361,7 +352,7 @@ impl Dictionary {
                return true;
            }
        }
-        self.compounded(&w, 0, &mut HashSet::new())
+        self.compounded(&w, 0)
    }

    /// Is `word` spelt correctly? Capitalised and upper-case forms of a lower-case word pass.
@@ -585,15 +576,6 @@ fn cache() -> &'static Cache {
    CACHE.get_or_init(Default::default)
 }

-/// Language strings remembered by [`dictionary`]; a string past it is resolved again on each call.
-const MAX_CACHED_LANGS: usize = 256;
-
-/// Parsed dictionaries by their affix file, so aliases of one language share it.
-fn by_files() -> &'static Mutex<HashMap<PathBuf, Arc<Dictionary>>> {
-    static M: OnceLock<Mutex<HashMap<PathBuf, Arc<Dictionary>>>> = OnceLock::new();
-    M.get_or_init(Default::default)
-}
-
 /// The dictionary for `lang` (a BCP-47 tag such as `en-US`), loaded once per process.
 pub fn dictionary(lang: &str) -> Option<Arc<Dictionary>> {
    let cache = cache();
@@ -604,23 +586,10 @@ pub fn dictionary(lang: &str) -> Option<Arc<Dictionary>> {
        return d.clone();
    }
    let loaded = find_in(&search_dirs(), lang).and_then(|(a, d)| {
-        // Tags that resolve to the same files share one parsed dictionary.
-        if let Ok(m) = by_files().lock()
-            && let Some(dict) = m.get(&a)
-        {
-            return Some(dict.clone());
-        }
-        let (bytes_a, bytes_d) = (std::fs::read(&a).ok()?, std::fs::read(d).ok()?);
-        let dict = Arc::new(Dictionary::parse(&bytes_a, &bytes_d));
-        // A concurrent loader of the same files may have inserted first: share its copy.
-        if let Ok(mut m) = by_files().lock() {
-            return Some(m.entry(a).or_insert(dict).clone());
-        }
-        Some(dict)
+        let (a, d) = (std::fs::read(a).ok()?, std::fs::read(d).ok()?);
+        Some(Arc::new(Dictionary::parse(&a, &d)))
    });
-    if let Ok(mut c) = cache.lock()
-        && c.len() < MAX_CACHED_LANGS
-    {
+    if let Ok(mut c) = cache.lock() {
        c.insert(key, loaded.clone());
    }
    loaded
@@ -699,8 +668,6 @@ pub fn add_user_word(word: &str) -> std::io::Result<()> {
        return Ok(());
    }
    let path = user_dictionary_path().ok_or_else(|| std::io::Error::new(std::io::ErrorKind::NotFound, "no folder for the user dictionary"))?;
-    // A confined automation client may write only inside its write roots, this file included.
-    crate::file_access::check_write_path(&path).map_err(|e| std::io::Error::new(std::io::ErrorKind::PermissionDenied, e))?;
    if let Some(d) = path.parent() {
        std::fs::create_dir_all(d)?;
    }
@@ -930,14 +897,6 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
        assert!(d.suggest("workingslides", 5).contains(&"working slides".to_string()));
    }

-    /// An affix header can claim billions of records; parsing stops where the file does.
-    #[test]
-    fn a_header_count_past_the_records_ends_with_them() {
-        let aff = b"SFX S Y 4000000000\nSFX S 0 s .\nREP 4000000000\nREP a b\n";
-        let d = Dictionary::parse(aff, b"1\ncat/S\n".as_slice());
-        assert!(d.check("cats"));
-    }
-
    /// #1175: compound splitting is quadratic in the word's length, so a word longer than
    /// `MAX_CHECK_CHARS` is not checked; shorter ones still are.
    #[test]
@@ -972,17 +931,6 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
        }
    }

-    #[test]
-    fn overlapping_compound_roots_with_a_failing_ending_stay_cheap() {
-        // Roots a..aaaaaaaa overlap, so many splits of "aaa…ab" reach the same (tail, part) state; unmemoized that is millions of searches.
-        let d = Dictionary::parse(
-            b"COMPOUNDFLAG X\nCOMPOUNDMIN 1\n".as_slice(),
-            b"8\na/X\naa/X\naaa/X\naaaa/X\naaaaa/X\naaaaaa/X\naaaaaaa/X\naaaaaaaa/X\n".as_slice(),
-        );
-        assert!(!d.check(&format!("{}b", "a".repeat(99))));
-        assert!(d.check(&"a".repeat(20)));
-    }
-
    #[test]
    fn runs_give_words_their_language() {
        use deckcraft_model::{Paragraph, Run, RunProps};
@@ -1022,20 +970,6 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
        assert_eq!(w, vec!["check", "done"]);
    }

-    #[test]
-    fn a_confined_client_cannot_write_the_user_dictionary_outside_its_roots() {
-        let root = std::env::temp_dir().join(format!("deckcraft-dict-root-{}", std::process::id()));
-        std::fs::create_dir_all(&root).unwrap();
-        let roots = crate::file_access::AutomationRoots::new(std::slice::from_ref(&root), std::slice::from_ref(&root)).unwrap();
-        // The user dictionary is a file of its own outside `root`, not whatever HOME points at.
-        let outside = std::env::temp_dir().join(format!("deckcraft-dict-outside-{}", std::process::id()));
-        set_user_dictionary_path(outside.join("user.dic"));
-        let r = crate::file_access::confine(roots.as_ref(), || add_user_word("zqxconfinedword"));
-        assert_eq!(r.map_err(|e| e.kind()), Err(std::io::ErrorKind::PermissionDenied));
-        assert!(!outside.exists(), "the refused write created nothing");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
    #[test]
    fn a_long_paragraph_with_a_huge_language_is_checked_in_linear_work() {
        use deckcraft_model::{Paragraph, Run, RunProps};
@@ -214,368 +214,6 @@ fn clipboard_copy_paste_shapes_and_slides() {
    assert!(s.doc().unwrap().doc.validate().is_empty());
 }

-/// The resolved look of every paragraph and run of shape `id` on the current slide: size, font,
-/// colour, bold, bullet, indent, alignment, and the box's insets and anchor.
-fn resolved_look(s: &Session, id: ShapeId) -> String {
-    use deckcraft_model::resolve;
-    let st = s.doc().unwrap();
-    let slide = st.current_slide().unwrap();
-    let ctx = resolve::Ctx::for_slide(&st.doc, slide).unwrap();
-    let sh = st.shape(id).unwrap();
-    let t = sh.text.as_ref().unwrap();
-    let b = resolve::body(&ctx, sh);
-    let mut out = format!("body {:?} {:?} {:?}\n", b.anchor, b.inset_l, b.autofit);
-    for p in &t.paragraphs {
-        let pp = resolve::para(&ctx, sh, p);
-        out += &format!("para {:?} {:?} {:?} {:?}\n", pp.align, pp.margin_left, pp.indent, pp.bullet);
-        for r in &p.runs {
-            let rp = resolve::run(&ctx, sh, p, &r.props);
-            out += &format!("  run {:?} {:?} {:?} {:?}\n", rp.size, rp.font, rp.bold, rp.fill);
-        }
-    }
-    out
-}
-
-/// A placeholder pasted or duplicated on a slide becomes a regular shape, and keeps the look its
-/// layout and master gave it: the title's size and font, the body's bullets and indents. Before,
-/// the copy fell back to the master's other-text style (18 pt, no bullets).
-#[test]
-fn a_pasted_or_duplicated_placeholder_keeps_its_inherited_look() {
-    let mut s = session();
-    s.execute("slide.new", &json!({})).unwrap();
-    let phs: Vec<ShapeId> = s.doc().unwrap().current_slide().unwrap().shapes.iter().filter(|x| x.ph.is_some()).map(|x| x.id).collect();
-    assert!(phs.len() >= 2, "a title and a body placeholder");
-    for (k, id) in phs.iter().enumerate() {
-        s.execute("text.set", &json!({"id": id.0, "text": format!("Placeholder {k}\nSecond line")})).unwrap();
-    }
-    for id in phs {
-        let want = resolved_look(&s, id);
-        for cmd in ["paste", "duplicate"] {
-            s.execute("selection.select", &json!({"id": id.0})).unwrap();
-            if cmd == "paste" {
-                s.execute("edit.copy", &json!({})).unwrap();
-                s.execute("edit.paste", &json!({})).unwrap();
-            } else {
-                s.execute("edit.duplicate", &json!({})).unwrap();
-            }
-            let copy = s.doc().unwrap().selection.shapes[0];
-            assert_ne!(copy, id);
-            assert!(s.doc().unwrap().shape(copy).unwrap().ph.is_none(), "{cmd}: the copy is a regular shape");
-            assert_eq!(resolved_look(&s, copy), want, "{cmd} of placeholder {}", id.0);
-        }
-    }
-    assert!(s.doc().unwrap().doc.validate().is_empty());
-}
-
-/// Dragging a copy of a placeholder off it keeps the look too: the title's size and font, the
-/// body's bullets. `edit.duplicate` is not the only way to duplicate.
-#[test]
-fn a_placeholder_duplicated_by_dragging_keeps_its_look() {
-    let mut s = session();
-    s.execute("slide.new", &json!({})).unwrap();
-    let phs: Vec<ShapeId> = s.doc().unwrap().current_slide().unwrap().shapes.iter().filter(|x| x.ph.is_some()).map(|x| x.id).collect();
-    assert!(phs.len() >= 2, "a title and a body placeholder");
-    for id in phs {
-        s.execute("text.set", &json!({"id": id.0, "text": "First\nSecond"})).unwrap();
-        let want = resolved_look(&s, id);
-        s.execute("selection.select", &json!({"id": id.0})).unwrap();
-        let st = s.doc().unwrap();
-        let x = crate::cmd::xfrm_of(&st.doc, &st.selection, st.shape(id).unwrap());
-        let (cx, cy) = (x.x + x.w / 2.0, x.y + x.h / 2.0);
-        let alt = |kind, x, y| PointerEvent { mods: Mods { alt: true, ..Default::default() }, ..tev(kind, x, y) };
-        s.pointer(alt(PointerKind::Down, cx, cy)).unwrap();
-        s.pointer(alt(PointerKind::Drag, cx + 30.0, cy + 30.0)).unwrap();
-        s.pointer(alt(PointerKind::Up, cx + 30.0, cy + 30.0)).unwrap();
-        let copy = s.doc().unwrap().selection.shapes[0];
-        assert_ne!(copy, id, "the drag made a copy");
-        assert!(s.doc().unwrap().shape(id).unwrap().ph.is_some(), "the original stays a placeholder");
-        assert!(s.doc().unwrap().shape(copy).unwrap().ph.is_none(), "the copy is a regular shape");
-        assert_eq!(resolved_look(&s, copy), want, "placeholder {}", id.0);
-    }
-}
-
-/// Keep Source Formatting fixes a copy's theme colours as the source drew them: through the colour
-/// map of its slide or layout, not the master's. A title's inherited `tx1` stays the light colour
-/// an override gave it.
-#[test]
-fn keep_source_formatting_uses_the_slides_colour_map() {
-    use deckcraft_model::resolve;
-    let first_run_colour = |s: &Session, id: ShapeId| {
-        let st = s.doc().unwrap();
-        let ctx = resolve::Ctx::for_slide(&st.doc, st.current_slide().unwrap()).unwrap();
-        let sh = st.shape(id).unwrap();
-        let p = &sh.text.as_ref().unwrap().paragraphs[0];
-        resolve::text_color(&ctx, &resolve::run(&ctx, sh, p, &p.runs[0].props))
-    };
-    for on_layout in [false, true] {
-        let mut s = session();
-        s.execute("slide.new", &json!({})).unwrap();
-        let title = s.doc().unwrap().current_slide().unwrap().shapes.iter().find(|x| x.ph.is_some()).unwrap().id;
-        s.execute("text.set", &json!({"id": title.0, "text": "Title"})).unwrap();
-        let plain = first_run_colour(&s, title);
-        let st = s.doc_mut().unwrap();
-        let at = st.selection.slide;
-        let doc = std::sync::Arc::make_mut(&mut st.doc);
-        if on_layout {
-            let layout = doc.slides[at].layout;
-            let m = std::sync::Arc::make_mut(&mut doc.masters[0]);
-            m.layouts.iter_mut().find(|l| l.id == layout).unwrap().color_map = swapped_colour_map();
-        } else {
-            std::sync::Arc::make_mut(&mut doc.slides[at]).color_map = swapped_colour_map();
-        }
-        let want = first_run_colour(&s, title);
-        assert_ne!(want, plain, "the override changes how the title draws");
-
-        s.execute("selection.select", &json!({"id": title.0})).unwrap();
-        s.execute("edit.copy", &json!({})).unwrap();
-        s.execute("edit.pasteSpecial", &json!({"as": "keepSource"})).unwrap();
-        let copy = s.doc().unwrap().selection.shapes[0];
-        assert_ne!(copy, title);
-        assert_eq!(first_run_colour(&s, copy), want, "override on the layout: {on_layout}");
-    }
-}
-
-/// A colour map that swaps text and background, as a dark slide or layout has.
-fn swapped_colour_map() -> Option<Vec<(String, String)>> {
-    Some([("bg1", "dk1"), ("tx1", "lt1"), ("bg2", "dk2"), ("tx2", "lt2")].map(|(a, b)| (a.to_string(), b.to_string())).to_vec())
-}
-
-/// A new rectangle in the edited tree, filled with theme colour `slot`.
-fn rect_filled_with(s: &mut Session, slot: deckcraft_color::SchemeSlot) -> ShapeId {
-    use deckcraft_model::{ColorRef, Fill};
-    let id = s.execute("shape.insert", &json!({"preset": "rect", "rect": [10, 10, 50, 50]})).unwrap()["id"].as_u64().unwrap();
-    let id = ShapeId(u32::try_from(id).unwrap());
-    s.edit(|doc, sel| {
-        let list = crate::shapes_mut(doc, sel).unwrap();
-        list.iter_mut().find(|x| x.id == id).unwrap().fill = Some(Fill::solid(ColorRef::scheme(slot)));
-        Ok(())
-    })
-    .unwrap();
-    id
-}
-
-/// How shape `id`'s fill draws in the edited tree.
-fn drawn_fill(s: &Session, id: ShapeId) -> deckcraft_color::Rgba {
-    use deckcraft_model::{Fill, resolve};
-    let st = s.doc().unwrap();
-    let ctx = crate::cmd::text::ctx_for(&st.doc, &st.selection).unwrap();
-    match resolve::fill(&ctx, st.shape(id).unwrap()).0 {
-        Some(Fill::Solid { color }) => ctx.color(&color, None),
-        other => panic!("not a solid fill: {other:?}"),
-    }
-}
-
-/// Copy the selected shape and paste it with Keep Source Formatting; the copy's id.
-fn keep_source_copy(s: &mut Session, id: ShapeId) -> ShapeId {
-    s.execute("selection.select", &json!({"id": id.0})).unwrap();
-    s.execute("edit.copy", &json!({})).unwrap();
-    s.execute("edit.pasteSpecial", &json!({"as": "keepSource"})).unwrap();
-    let copy = s.doc().unwrap().selection.shapes[0];
-    assert_ne!(copy, id);
-    copy
-}
-
-/// A colour map renames only `tx1`, `bg1`, `tx2` and `bg2`. Keep Source Formatting fixes every slot
-/// as it draws: `tx1` follows the map, while a direct `dk1` stays the theme's dark colour.
-#[test]
-fn keep_source_formatting_maps_only_the_alias_colours() {
-    use deckcraft_color::SchemeSlot::{self, *};
-    let mut s = session();
-    let st = s.doc_mut().unwrap();
-    let at = st.selection.slide;
-    std::sync::Arc::make_mut(&mut std::sync::Arc::make_mut(&mut st.doc).slides[at]).color_map = swapped_colour_map();
-    let slots: [SchemeSlot; 9] = [Dk1, Lt1, Dk2, Lt2, Tx1, Bg1, Tx2, Bg2, Accent1];
-    let mut drawn = vec![];
-    for slot in slots {
-        let id = rect_filled_with(&mut s, slot);
-        let want = drawn_fill(&s, id);
-        let copy = keep_source_copy(&mut s, id);
-        assert_eq!(drawn_fill(&s, copy), want, "{slot:?}");
-        drawn.push(want);
-    }
-    assert_ne!(drawn[0], drawn[4], "the map sets `tx1` apart from `dk1`");
-}
-
-/// In Slide Master view a copy draws through the edited master's map, not an override on the slide
-/// that happens to be current.
-#[test]
-fn keep_source_formatting_in_slide_master_view_ignores_the_slides_colour_map() {
-    use deckcraft_color::SchemeSlot::Tx1;
-    for master in [false, true] {
-        let mut s = session();
-        let st = s.doc_mut().unwrap();
-        let at = st.selection.slide;
-        std::sync::Arc::make_mut(&mut std::sync::Arc::make_mut(&mut st.doc).slides[at]).color_map = swapped_colour_map();
-        s.execute("view.slideMaster", &if master { json!({"master": 0}) } else { json!({}) }).unwrap();
-        let id = rect_filled_with(&mut s, Tx1);
-        let want = drawn_fill(&s, id);
-        let copy = keep_source_copy(&mut s, id);
-        assert_eq!(drawn_fill(&s, copy), want, "editing the master: {master}");
-    }
-}
-
-/// A slide's placeholder pasted in Slide Master view stays a placeholder that inherits from where
-/// it lands; only a paste on a slide turns it into a regular shape with the look it had.
-#[test]
-fn a_slide_placeholder_pasted_in_slide_master_view_stays_a_placeholder() {
-    let mut s = session();
-    s.execute("slide.new", &json!({})).unwrap();
-    let title = s.doc().unwrap().current_slide().unwrap().shapes.iter().find(|x| x.ph.is_some()).unwrap().id;
-    s.execute("text.set", &json!({"id": title.0, "text": "Title"})).unwrap();
-    let want = resolved_look(&s, title);
-    let source = s.doc().unwrap().shape(title).unwrap().clone();
-    s.execute("selection.select", &json!({"id": title.0})).unwrap();
-    s.execute("edit.copy", &json!({})).unwrap();
-
-    s.execute("view.slideMaster", &json!({})).unwrap();
-    for paste in ["edit.paste", "edit.pasteSpecial"] {
-        s.execute(paste, &json!({"as": "keepSource"})).unwrap();
-        let st = s.doc().unwrap();
-        let copy = st.shape(st.selection.shapes[0]).unwrap();
-        assert_eq!(copy.ph.as_ref().map(|p| p.kind), source.ph.as_ref().map(|p| p.kind), "{paste} keeps the placeholder");
-        let list = copy.text.as_ref().map(|t| t.list_style.clone());
-        assert_eq!(list, source.text.as_ref().map(|t| t.list_style.clone()), "{paste} adds no baked styles");
-    }
-    s.execute("view.closeMaster", &json!({})).unwrap();
-
-    s.execute("edit.paste", &json!({})).unwrap();
-    let copy = s.doc().unwrap().selection.shapes[0];
-    assert!(s.doc().unwrap().shape(copy).unwrap().ph.is_none(), "on a slide the copy is a regular shape");
-    assert_eq!(resolved_look(&s, copy), want);
-}
-
-/// The resolved fill, line and effects of shape `id` on the current slide, with their style colours.
-fn resolved_box(s: &Session, id: ShapeId) -> String {
-    use deckcraft_model::resolve;
-    let st = s.doc().unwrap();
-    let ctx = resolve::Ctx::for_slide(&st.doc, st.current_slide().unwrap()).unwrap();
-    let sh = st.shape(id).unwrap();
-    format!("{:?}\n{:?}\n{:?}", resolve::fill(&ctx, sh), resolve::line(&ctx, sh), resolve::effects(&ctx, sh))
-}
-
-/// Edit the title placeholders the current slide's title inherits from: its layout's and its
-/// master's. Returns the slide title's id.
-fn edit_title_parents(
-    s: &mut Session,
-    layout: impl FnOnce(&mut deckcraft_model::Shape),
-    master: impl FnOnce(&mut deckcraft_model::Shape),
-) -> ShapeId {
-    let st = s.doc_mut().unwrap();
-    let slide = st.current_slide().unwrap().clone();
-    let title = slide.shapes.iter().find(|x| x.ph_type().is_some_and(|k| k.is_title())).unwrap().id;
-    let doc = std::sync::Arc::make_mut(&mut st.doc);
-    let m = std::sync::Arc::make_mut(&mut doc.masters[0]);
-    let lay = m.layouts.iter_mut().find(|l| l.id == slide.layout).unwrap();
-    layout(lay.shapes.iter_mut().find(|x| x.ph_type().is_some_and(|k| k.is_title())).unwrap());
-    master(m.shapes.iter_mut().find(|x| x.ph_type().is_some_and(|k| k.is_title())).unwrap());
-    title
-}
-
-/// A copied placeholder takes each of fill, line and effects from where the original does: a
-/// style on the layout's placeholder (or on the slide's own) wins over an explicit value on the
-/// master's, as `resolve::fill`, `resolve::line` and `resolve::effects` decide.
-#[test]
-fn a_pasted_placeholder_keeps_the_style_precedence_of_its_box() {
-    use deckcraft_color::SchemeSlot;
-    use deckcraft_model::{ColorRef, Effects, Fill, Line, ShapeStyle};
-    for style_on_slide in [false, true] {
-        let mut s = session();
-        s.execute("slide.new", &json!({})).unwrap();
-        let style = ShapeStyle {
-            line_ref: (1, ColorRef::scheme(SchemeSlot::Accent2)),
-            fill_ref: (1, ColorRef::scheme(SchemeSlot::Accent1)),
-            effect_ref: (0, ColorRef::scheme(SchemeSlot::Accent3)),
-            font_ref: ("minor".into(), None),
-        };
-        let layout_style = (!style_on_slide).then(|| style.clone());
-        let title = edit_title_parents(
-            &mut s,
-            |l| l.style = layout_style,
-            |m| {
-                m.fill = Some(Fill::solid(ColorRef::scheme(SchemeSlot::Accent4)));
-                m.line = Some(Line::solid(ColorRef::scheme(SchemeSlot::Accent5), 20.0));
-                m.effects = Some(Effects { soft_edge: Some(5.0), ..Default::default() });
-            },
-        );
-        if style_on_slide {
-            s.edit(|doc, sel| {
-                let list = crate::shapes_mut(doc, sel).unwrap();
-                list.iter_mut().find(|x| x.id == title).unwrap().style = Some(style.clone());
-                Ok(())
-            })
-            .unwrap();
-        }
-        s.execute("text.set", &json!({"id": title.0, "text": "Styled title"})).unwrap();
-        let want = (resolved_box(&s, title), resolved_look(&s, title));
-        s.execute("selection.select", &json!({"id": title.0})).unwrap();
-        s.execute("edit.copy", &json!({})).unwrap();
-        s.execute("edit.paste", &json!({})).unwrap();
-        let copy = s.doc().unwrap().selection.shapes[0];
-        assert_eq!((resolved_box(&s, copy), resolved_look(&s, copy)), want, "style on the slide: {style_on_slide}");
-    }
-}
-
-/// The master's placeholder style never reaches the copy's text: the original's text ignores it
-/// (only the shape's or the layout's font reference counts), so the copy must too.
-#[test]
-fn a_pasted_placeholder_ignores_the_masters_font_reference() {
-    use deckcraft_color::SchemeSlot;
-    use deckcraft_model::{ColorRef, ShapeStyle};
-    let mut s = session();
-    s.execute("slide.new", &json!({})).unwrap();
-    let title = edit_title_parents(
-        &mut s,
-        |l| l.style = None,
-        |m| {
-            m.style = Some(ShapeStyle {
-                line_ref: (0, ColorRef::scheme(SchemeSlot::Accent2)),
-                fill_ref: (0, ColorRef::scheme(SchemeSlot::Accent1)),
-                effect_ref: (0, ColorRef::scheme(SchemeSlot::Accent3)),
-                font_ref: ("minor".into(), Some(ColorRef::scheme(SchemeSlot::Accent6))),
-            })
-        },
-    );
-    s.execute("text.set", &json!({"id": title.0, "text": "Title"})).unwrap();
-    let want = (resolved_box(&s, title), resolved_look(&s, title));
-    assert!(want.1.contains("+mj-lt"), "the title draws in the heading font: {}", want.1);
-    s.execute("selection.select", &json!({"id": title.0})).unwrap();
-    s.execute("edit.duplicate", &json!({})).unwrap();
-    let copy = s.doc().unwrap().selection.shapes[0];
-    assert_eq!((resolved_box(&s, copy), resolved_look(&s, copy)), want);
-}
-
-/// The same on every text placeholder of the sample deck (titles, bulleted bodies, subtitles).
-#[test]
-fn sample_placeholders_paste_with_their_look() {
-    let mut s = Session::new();
-    crate::sample::open_sample(&mut s).unwrap();
-    let slides = s.doc().unwrap().doc.slides.len();
-    let mut checked = 0;
-    for i in 0..slides {
-        s.execute("slide.go", &json!({"index": i})).unwrap();
-        let phs: Vec<ShapeId> = s
-            .doc()
-            .unwrap()
-            .current_slide()
-            .unwrap()
-            .shapes
-            .iter()
-            .filter(|x| x.ph.is_some() && x.text.as_ref().is_some_and(|t| !t.is_empty()))
-            .map(|x| x.id)
-            .collect();
-        for id in phs {
-            let want = resolved_look(&s, id);
-            s.execute("selection.select", &json!({"id": id.0})).unwrap();
-            s.execute("edit.copy", &json!({})).unwrap();
-            s.execute("edit.paste", &json!({})).unwrap();
-            let copy = s.doc().unwrap().selection.shapes[0];
-            assert_eq!(resolved_look(&s, copy), want, "slide {i}, placeholder {}", id.0);
-            checked += 1;
-        }
-    }
-    assert!(checked >= 3, "the sample has text placeholders ({checked})");
-}
-
 #[test]
 fn pasted_shapes_get_the_next_automatic_name() {
    let mut s = session();
@@ -1713,31 +1351,6 @@ fn tab_moves_between_cells_skipping_merged_ones() {
    assert_eq!((cell(&s), table_of(&s, id).n_rows()), (Some((2, 0)), 3), "Tab in the last cell adds a row");
 }

-#[test]
-fn format_paragraph_align_names_match_format_align() {
-    use deckcraft_model::text::Align;
-    let mut s = session();
-    let title = s.doc().unwrap().current_slide().unwrap().shapes[0].id.0;
-    s.execute("text.edit", &json!({"id": title})).unwrap();
-    let para = |s: &Session| s.doc().unwrap().current_slide().unwrap().shapes[0].text.as_ref().unwrap().paragraphs[0].props.align;
-    for (name, want) in [
-        ("justLow", Align::JustLow),
-        ("justifyLow", Align::JustLow),
-        ("thaiDist", Align::ThaiDistributed),
-        ("ctr", Align::Center),
-        ("centre", Align::Center),
-        ("r", Align::Right),
-        ("just", Align::Justify),
-        ("dist", Align::Distributed),
-        ("distributed", Align::Distributed),
-        ("left", Align::Left),
-    ] {
-        s.execute("format.paragraph", &json!({"align": name})).unwrap();
-        assert_eq!(para(&s), Some(want), "{name}");
-    }
-    assert!(s.execute("format.paragraph", &json!({"align": "bogus"})).is_err());
-}
-
 #[test]
 fn right_to_left_paragraphs() {
    let mut s = session();
@@ -3745,25 +3358,6 @@ fn undo_history_is_capped_by_memory_as_well_as_steps() {
    assert_eq!(s.doc().unwrap().history.undo.len(), 120);
 }

-/// A slide's notes count toward the undo budget: small edits to a slide with large notes keep a
-/// copy of those notes per step, and must not slip past the budget as if the slide were empty.
-#[test]
-fn undo_history_counts_slide_notes() {
-    let mut s = Session::with_new();
-    let notes = "n".repeat(1 << 20);
-    s.edit(|doc, _| {
-        std::sync::Arc::make_mut(&mut doc.slides[0]).notes = deckcraft_model::text::TextBody::from_text(&notes);
-        Ok(())
-    })
-    .unwrap();
-    s.doc_mut().unwrap().history = History { limit: 500, byte_limit: 8 << 20, ..Default::default() };
-    for i in 0..40 {
-        s.execute("slide.rename", &json!({"name": format!("v{i}"), "index": 0})).unwrap();
-    }
-    let n = s.doc().unwrap().history.undo.len();
-    assert!((1..=8).contains(&n), "{n} steps of 1 MB notes kept under an 8 MB budget");
-}
-
 #[test]
 fn picture_styles_replace_each_other_in_one_step() {
    const PNG: &[u8] = &[
@@ -4727,9 +4321,6 @@ fn shape_fill_documents_each_gradient_key_and_kind() {
    let params = cmd::parse_params(find_command("shape.fill").unwrap().params).unwrap();
    let about = params.iter().find(|p| p.name == "gradient").unwrap().about;
    assert_eq!(cmd::param_keys(about).unwrap(), ["stops", "kind", "angle", "focus", "rotateWithShape"]);
-    // The renderer keeps only linear and radial gradients upright (`paint::fill_path`).
-    let rotate = cmd::parse_params(about).unwrap().into_iter().find(|p| p.name == "rotateWithShape").unwrap().about;
-    assert!(rotate.contains("rectangular and path gradients turn with the shape"), "{rotate}");
    for kind in ["linear", "radial", "rectangular", "path"] {
        assert!(about.contains(kind), "{kind}: {about}");
        let g = cmd::shape::gradient_param(&json!({
@@ -5452,38 +5043,6 @@ fn pen_pressure_is_kept_and_a_mouse_draws_at_full_width() {
    assert_eq!(got, vec![vec![0.2, 1.0, 0.4], vec![1.0, 1.0]]);
 }

-#[test]
-fn a_long_ink_stroke_is_extended_in_place_and_capped() {
-    let mut s = session();
-    s.set_tool(tools::ToolKind::Ink { mode: "pen".into(), color: deckcraft_model::Rgba::rgb(20, 20, 20), width: 4.0 });
-    let ev = |kind, x: f64| tools::PointerEvent { kind, x, y: 80.0, mods: Mods::default(), tol: 3.0, pressure: Some(0.5) };
-    s.pointer(ev(PointerKind::Down, 0.0)).unwrap();
-    let n = tools::MAX_GESTURE_POINTS + 5_000;
-    for i in 1..n {
-        s.pointer(ev(PointerKind::Drag, (i % 500) as f64)).unwrap();
-    }
-    assert_eq!(s.tool.ink_preview.len(), tools::MAX_GESTURE_POINTS);
-    s.pointer(ev(PointerKind::Up, 0.0)).unwrap();
-    let kept: usize = ink_pressures(&s).iter().map(Vec::len).sum();
-    assert!((2..=tools::MAX_GESTURE_POINTS).contains(&kept), "{kept}");
-}
-
-#[test]
-fn double_clicking_a_capped_freeform_keeps_its_vertices() {
-    let mut s = session();
-    let ev = |kind, x: f64, y: f64| tools::PointerEvent { kind, x, y, mods: Default::default(), tol: 3.0, pressure: None };
-    s.set_tool(tools::ToolKind::Shape { preset: "freeform".into() });
-    s.pointer(ev(tools::PointerKind::Down, 100.0, 100.0)).unwrap();
-    // Densely clicked vertices, each within the double-click tolerance of the last.
-    for i in 0..tools::MAX_GESTURE_POINTS + 10 {
-        s.pointer(ev(tools::PointerKind::Down, 300.0 + i as f64 * 0.001, 100.0)).unwrap();
-    }
-    s.pointer(ev(tools::PointerKind::DoubleClick, 300.0, 100.0)).unwrap();
-    let st = s.doc().unwrap();
-    let deckcraft_model::Geom::Custom { paths } = &st.shapes().last().unwrap().geom else { panic!("no freeform") };
-    assert_eq!(paths[0].d.matches(" L ").count(), tools::MAX_GESTURE_POINTS - 1);
-}
-
 fn ink_pressures(s: &Session) -> Vec<Vec<f32>> {
    let st = s.doc().unwrap();
    let Some(sh) = st.shapes().iter().rev().find(|sh| matches!(sh.kind, deckcraft_model::ShapeKind::Ink { .. })) else {
@@ -6921,39 +6480,6 @@ fn master_body_placeholder_format_keeps_per_level_formatting() {
    assert_eq!(shown(&s), vec![Some(28.0), Some(24.0)]);
 }

-/// A shape named many times in one edit is edited once and not copied per mention.
-#[test]
-fn repeated_target_ids_edit_the_shape_once() {
-    let mut s = session();
-    let r = s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 300, 100], "text": "x".repeat(100_000)})).unwrap();
-    let id = r["id"].as_u64().unwrap();
-    let edited = s.execute("shape.fill", &json!({"ids": vec![id; 50_000], "color": "#ff0000"})).unwrap();
-    assert_eq!(edited, json!(1));
-    let v = s.execute("shape.inspect", &json!({"id": id})).unwrap();
-    assert_eq!(v["shape"]["fill"]["color"]["base"]["rgb"], json!({"a": 255, "b": 0, "g": 0, "r": 255}));
-}
-
-#[test]
-fn many_distinct_fonts_are_listed_once_each_without_a_quadratic_scan() {
-    // 30,000 runs in 15,000 families, each written twice in different case.
-    let mut p = deckcraft_model::Presentation::default();
-    let slide = std::sync::Arc::make_mut(&mut p.slides[0]);
-    let mut body = deckcraft_model::text::TextBody::from_text("x");
-    let run = body.paragraphs[0].runs[0].clone();
-    body.paragraphs[0].runs = (0..30_000)
-        .map(|i| {
-            let mut r = run.clone();
-            let name = format!("Qqq Font {}", i / 2);
-            r.props.font = Some(if i % 2 == 0 { name } else { name.to_uppercase() });
-            r
-        })
-        .collect();
-    slide.shapes[0].text = Some(body);
-    let used = crate::fonts::used_fonts(&p);
-    assert_eq!(used.iter().filter(|f| f.starts_with("Qqq Font ")).count(), 15_000);
-    assert_eq!(crate::fonts::missing_fonts(&p).iter().filter(|f| f.to_ascii_lowercase().starts_with("qqq font ")).count(), 15_000);
-}
-
 #[test]
 fn slide_master_view_rejects_invalid_indices() {
    let mut s = Session::with_new();
@@ -6980,176 +6506,3 @@ fn save_to_image_path_is_an_error_not_zip_bytes() {
    }
    let _ = std::fs::remove_dir_all(&dir);
 }
-
-/// `shape.connect` glues to a shape inside a group, as PowerPoint does: the connector's
-/// end is set to the grouped shape and follows it when the group moves. The glue was dropped at
-/// once (the end stayed `None`) because rerouting only looked at the slide's top-level shapes,
-/// and the sites of a grouped shape were computed in the group's child space.
-#[test]
-fn shape_connect_glues_to_a_shape_inside_a_group() {
-    use deckcraft_model::{ShapeId, ShapeKind};
-    let mut s = session();
-    s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
-    let a = s.execute("shape.insert", &json!({"preset": "rect", "rect": [10, 10, 100, 50]})).unwrap()["id"].as_u64().unwrap();
-    let b = s.execute("shape.insert", &json!({"preset": "rect", "rect": [10, 200, 100, 50]})).unwrap()["id"].as_u64().unwrap();
-    let g = s.execute("arrange.group", &json!({"ids": [a, b]})).unwrap()["id"].as_u64().unwrap();
-    let c = s.execute("shape.insert", &json!({"preset": "rect", "rect": [400, 10, 100, 50]})).unwrap()["id"].as_u64().unwrap();
-    let glue = |s: &Session, id: u64| {
-        let st = s.doc().unwrap();
-        match st.shape(ShapeId(id as u32)).unwrap().kind {
-            ShapeKind::Connector { start, end } => (start.map(|(i, _)| i.0 as u64), end.map(|(i, _)| i.0 as u64)),
-            _ => (None, None),
-        }
-    };
-    let near = |p: deckcraft_geom::Point, x: f64, y: f64| (p.x - x).abs() < 1e-6 && (p.y - y).abs() < 1e-6;
-    // A new connector into the group.
-    let r = s.execute("shape.connect", &json!({"from": c, "to": a})).unwrap();
-    let k = r["id"].as_u64().unwrap();
-    assert_eq!(glue(&s, k), (Some(c), Some(a)), "{r}");
-    let (p0, p1) = line_ends(&s, k);
-    assert!(near(p0, 400.0, 35.0), "from C's left site: {p0:?}");
-    assert!(near(p1, 110.0, 35.0), "to A's right site in slide space: {p1:?}");
-    s.execute("shape.move", &json!({"ids": [g], "dy": 100})).unwrap();
-    assert_eq!(glue(&s, k), (Some(c), Some(a)), "the glue survives the move");
-    let (_, p1) = line_ends(&s, k);
-    assert!(near(p1, 110.0, 135.0), "the connector follows the grouped shape: {p1:?}");
-    // Re-gluing an existing line with `id`.
-    let l = s.execute("shape.insert", &json!({"preset": "straightConnector1", "rect": [600, 400, 50, 50]})).unwrap()["id"].as_u64().unwrap();
-    let r = s.execute("shape.connect", &json!({"id": l, "from": c, "to": b})).unwrap();
-    assert_eq!(r["id"], l, "{r}");
-    assert_eq!(glue(&s, l), (Some(c), Some(b)), "{r}");
-    let (_, p1) = line_ends(&s, l);
-    assert!(near(p1, 110.0, 325.0), "to B's right site (C is mostly to its right) in slide space, B moved with the group: {p1:?}");
-    s.execute("shape.move", &json!({"ids": [g], "dx": 50})).unwrap();
-    assert_eq!(glue(&s, l), (Some(c), Some(b)));
-    let (_, p1) = line_ends(&s, l);
-    assert!(near(p1, 160.0, 325.0), "{p1:?}");
-    // shape.sites answers in slide space, as shape.connect uses them: A's right site, A moved
-    // with the group.
-    let v = s.execute("shape.sites", &json!({"id": a})).unwrap();
-    assert!(
-        v.as_array().unwrap().iter().any(|q| near(deckcraft_geom::Point::new(q[0].as_f64().unwrap(), q[1].as_f64().unwrap()), 160.0, 135.0)),
-        "{v}"
-    );
-    // A line inside a group is refused as `id`: its ends would be written in slide space into
-    // the group's space, and rerouting does not follow grouped connectors.
-    let m = s.execute("shape.insert", &json!({"preset": "line", "rect": [600, 300, 50, 0]})).unwrap()["id"].as_u64().unwrap();
-    let n = s.execute("shape.insert", &json!({"preset": "rect", "rect": [600, 450, 50, 50]})).unwrap()["id"].as_u64().unwrap();
-    s.execute("arrange.group", &json!({"ids": [m, n]})).unwrap();
-    let before = s.doc().unwrap().doc.clone();
-    let e = s.execute("shape.connect", &json!({"id": m, "from": c, "to": b})).unwrap_err().to_string();
-    assert!(e.contains("inside a group"), "{e}");
-    assert_eq!(s.doc().unwrap().doc, before, "nothing changed");
-    // A grouped shape that is not a line is refused as not a line, not as a grouped line.
-    let e = s.execute("shape.connect", &json!({"id": n, "from": c, "to": b})).unwrap_err().to_string();
-    assert!(e.contains("not a line"), "{e}");
-    assert_eq!(s.doc().unwrap().doc, before, "nothing changed");
-}
-
-#[test]
-fn flip_is_refused_on_a_smartart_graphic_and_leaves_it_a_graphic() {
-    let mut s = session();
-    s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
-    s.execute("insert.textBox", &json!({"text": "Goals\nRevenue"})).unwrap();
-    let gid = s.execute("smartArt.fromText", &json!({"kind": "blockList"})).unwrap()["id"].as_u64().unwrap();
-    for cmd in ["arrange.flipHorizontal", "arrange.flipVertical", "shape.flip"] {
-        let e = s.execute(cmd, &json!({"ids": [gid]})).unwrap_err().to_string();
-        assert!(e.contains("SmartArt") && e.contains("smartArt.layout"), "{cmd}: {e}");
-    }
-    // Grouped with another shape it cannot be flipped either: ungrouping would hand it the flip.
-    let other = s.execute("insert.textBox", &json!({"text": "x"})).unwrap()["id"].as_u64().unwrap();
-    let group = s.execute("arrange.group", &json!({"ids": [gid, other]})).unwrap()["id"].as_u64().unwrap();
-    let e = s.execute("shape.flip", &json!({"ids": [group]})).unwrap_err().to_string();
-    assert!(e.contains("SmartArt"), "{e}");
-    s.execute("arrange.ungroup", &json!({"ids": [group]})).unwrap();
-    // Still a SmartArt graphic: smartArt commands keep working.
-    s.execute("smartArt.layout", &json!({"id": gid, "kind": "cycle"})).unwrap();
-    // Ordinary shapes still flip.
-    let b = s.execute("insert.textBox", &json!({"text": "x"})).unwrap();
-    let id = b["id"].as_u64().unwrap();
-    assert_eq!(s.execute("arrange.flipHorizontal", &json!({"ids": [id]})).unwrap(), json!(1));
-}
-
-/// Table cell commands refuse a `cells` that is not a list of [row, col] cells in the table,
-/// instead of dropping the entry or reading the list as absent (which acts on the selection).
-#[test]
-fn table_cell_commands_refuse_a_malformed_cells_list() {
-    let mut s = session();
-    let t = table_at(&mut s, &[100.0, 100.0], json!([["a", "b"], ["c", "d"]]));
-    let rev = s.doc().unwrap().revision;
-    for cells in [
-        json!([[-1, 0]]),
-        json!([[0]]),
-        json!([[0, 0], "x"]),
-        json!([[0, 0, "x"]]),
-        json!([[0, 2]]),
-        json!([[0, u64::MAX]]),
-        json!("0,0"),
-        json!({"0": 0}),
-    ] {
-        for (cmd, extra) in [
-            ("table.cellFill", json!({"color": "#FF0000"})),
-            ("table.cellMargins", json!({"left": 4})),
-            ("table.cellAlign", json!({"align": "center"})),
-            ("table.borders", json!({"which": "right"})),
-        ] {
-            let mut p = extra.clone();
-            p["id"] = json!(t);
-            p["cells"] = cells.clone();
-            let e = s.execute(cmd, &p).unwrap_err().to_string();
-            assert!(e.contains(cmd) && e.contains("cell"), "{cmd} {cells}: {e}");
-        }
-    }
-    assert_eq!(s.doc().unwrap().revision, rev, "nothing changed");
-    let many = json!(vec![[0, 0]; 100_001]);
-    assert!(s.execute("table.cellFill", &json!({"id": t, "color": "#FF0000", "cells": many})).unwrap_err().to_string().contains("at most"));
-    s.execute("table.cellFill", &json!({"id": t, "color": "#FF0000", "cells": [[1, 1]]})).unwrap();
-    assert!(table_of(&s, t).cell(1, 1).unwrap().fill.is_some() && table_of(&s, t).cell(0, 0).unwrap().fill.is_none());
-}
-
-/// The outline exports (PowerPoint's outline view) holds titles and body text only: footer,
-/// date and slide-number placeholders are not body lines.
-#[test]
-fn outline_export_skips_footer_date_and_slide_number() {
-    let mut s = session();
-    s.execute("slide.new", &json!({"layout": "titleAndContent", "title": "Agenda", "body": "First point\nSecond point"})).unwrap();
-    s.execute(
-        "design.headerFooter",
-        &json!({"footer": true, "footerText": "Company Confidential", "slideNumber": true, "date": true, "dateText": "1 May 2026"}),
-    )
-    .unwrap();
-    let dir = std::env::temp_dir().join(format!("deckcraft-outline-{}", std::process::id()));
-    let _ = std::fs::remove_dir_all(&dir);
-    std::fs::create_dir_all(&dir).unwrap();
-    let path = dir.join("deck.md");
-    s.execute("file.export", &json!({"path": path.to_string_lossy(), "format": "outline"})).unwrap();
-    let text = std::fs::read_to_string(&path).unwrap();
-    let _ = std::fs::remove_dir_all(&dir);
-    assert!(text.contains("Agenda") && text.contains("First point") && text.contains("Second point"), "{text:?}");
-    assert!(!text.contains("Company Confidential"), "footer text is not a body line: {text:?}");
-    assert!(!text.contains("‹#›"), "the slide-number field is not a body line: {text:?}");
-    assert!(!text.contains("1 May 2026"), "the date is not a body line: {text:?}");
-    // The RTF outline (Save As ▸ Outline/RTF) too.
-    std::fs::create_dir_all(&dir).unwrap();
-    let path = dir.join("deck.rtf");
-    s.execute("file.export", &json!({"path": path.to_string_lossy(), "format": "rtf"})).unwrap();
-    let rtf = std::fs::read_to_string(&path).unwrap();
-    let _ = std::fs::remove_dir_all(&dir);
-    assert!(rtf.contains("Agenda") && rtf.contains("First point"), "{rtf:?}");
-    assert!(!rtf.contains("Company Confidential") && !rtf.contains("1 May 2026"), "{rtf:?}");
-}
-
-#[test]
-fn shape_adjust_and_quick_style_reject_invalid_index() {
-    let mut s = session();
-    let r = s.execute("shape.insert", &json!({"preset": "roundRect", "rect": [100, 100, 200, 100]})).unwrap();
-    let id = deckcraft_model::ShapeId(r["id"].as_u64().unwrap() as u32);
-    let before = s.doc().unwrap().shape(id).unwrap().clone();
-    for bad in [json!(-1), json!(1.5)] {
-        assert!(s.execute("shape.adjust", &json!({"index": bad, "value": 0.4})).is_err(), "adjust accepted {bad}");
-        assert!(s.execute("shape.quickStyle", &json!({"index": bad})).is_err(), "quickStyle accepted {bad}");
-    }
-    assert_eq!(s.doc().unwrap().shape(id).unwrap().geom, before.geom);
-    assert_eq!(s.doc().unwrap().shape(id).unwrap().style, before.style);
-    s.execute("shape.adjust", &json!({"value": 0.4})).unwrap();
-}
@@ -17,7 +17,6 @@ mod geometry;
 mod hit;
 mod pointer;

-pub(crate) use drag::MAX_GESTURE_POINTS;
 pub use hit::{line_xfrm, resize_box, table_rows, text_pos};

 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
@@ -276,8 +275,6 @@ pub struct ToolState {
    pub path_preview: Vec<Point>,
    pub path_smooth: bool,
    pub path_closing: bool,
-    /// Whether the last freeform press added a vertex (it adds none at the point cap).
-    pub press_added_vertex: bool,
    /// The shape in Edit Points: its vertices are handles instead of the box's.
    pub edit_points: Option<ShapeId>,
    /// The vertex (path, index) whose control handles show in Edit Points.
@@ -4,12 +4,8 @@ use super::{Drag, Hit, Point, Result, Session, ShapeId, ShapeKind, TextSel, Tool
 impl Session {
    pub(super) fn double_click(&mut self, p: Point, tol: f64) -> Result<Value> {
        if let Some(Drag::Freeform { mode, mut points, .. }) = self.tool.drag.clone() {
-            // The double-click's own click added a duplicate vertex (none at the point cap, where
-            // the existing vertices are all kept).
-            while self.tool.press_added_vertex
-                && points.len() > 2
-                && points.last().zip(points.get(points.len() - 2)).is_some_and(|(a, b)| (*a - *b).hypot() <= tol)
-            {
+            // The double-click's own click added a duplicate vertex.
+            while points.len() > 2 && points.last().zip(points.get(points.len() - 2)).is_some_and(|(a, b)| (*a - *b).hypot() <= tol) {
                points.pop();
            }
            self.tool.drag = Some(Drag::Freeform { mode, points, pressed: false });
@@ -12,16 +12,9 @@ struct MoveDrag {
    enter_text: Option<(ShapeId, Point)>,
 }

-/// Samples one ink or freeform gesture keeps; later pointer moves extend it no further.
-pub(crate) const MAX_GESTURE_POINTS: usize = 100_000;
-
 impl Session {
    /// Update the active drag interaction using the pointer position and modifiers.
    pub(super) fn drag(&mut self, p: Point, mods: Mods, tol: f64) -> Result<Value> {
-        if matches!(self.tool.drag, Some(Drag::Ink { .. })) {
-            self.extend_ink(p);
-            return Ok(Value::Null);
-        }
        let Some(drag) = self.tool.drag.clone() else { return Ok(Value::Null) };
        match drag {
            Drag::Guide { index } => {
@@ -188,7 +181,7 @@ impl Session {
            }
            Drag::Freeform { mode, mut points, pressed } => {
                // Dragging scribbles (except for curves, which only take clicked points).
-                if pressed && mode != "curve" && points.len() < MAX_GESTURE_POINTS && points.last().is_none_or(|l| (*l - p).hypot() >= 1.5) {
+                if pressed && mode != "curve" && points.last().is_none_or(|l| (*l - p).hypot() >= 1.5) {
                    points.push(p);
                }
                let mut v = points.clone();
@@ -198,24 +191,15 @@ impl Session {
                self.tool.path_preview = v;
                self.tool.drag = Some(Drag::Freeform { mode, points, pressed });
            }
-            // Handled above.
-            Drag::Ink { .. } => {}
+            Drag::Ink { mut points } => {
+                points.push(self.ink_sample(p));
+                self.tool.ink_preview = points.clone();
+                self.tool.drag = Some(Drag::Ink { points });
+            }
        }
        Ok(Value::Null)
    }

-    /// Ink grows by one sample per move: extend it (and its preview) in place rather than
-    /// copying the whole stroke twice per event, up to [`MAX_GESTURE_POINTS`].
-    fn extend_ink(&mut self, p: Point) {
-        let sample = self.ink_sample(p);
-        if let Some(Drag::Ink { points }) = self.tool.drag.as_mut()
-            && points.len() < MAX_GESTURE_POINTS
-        {
-            points.push(sample);
-            self.tool.ink_preview.push(sample);
-        }
-    }
-
    fn drag_move(&mut self, drag: MoveDrag, p: Point, mods: Mods, tol: f64) -> Result<Value> {
        let MoveDrag { ids, start, origs, moved, duplicate, enter_text } = drag;
        let mut d = p - start;
@@ -252,12 +236,7 @@ impl Session {
                }
            }
            // A connector dragged away from shapes that stay put comes unglued at those ends.
-            let mut moved: Vec<ShapeId> = vec![];
-            for (id, _) in &origs2 {
-                if let Some(sh) = deckcraft_model::find_shape(list, *id) {
-                    deckcraft_model::walk(std::slice::from_ref(sh), &mut |s, _| moved.push(s.id));
-                }
-            }
+            let moved: Vec<ShapeId> = origs2.iter().map(|o| o.0).collect();
            for sh in list.iter_mut().filter(|s| moved.contains(&s.id)) {
                if let ShapeKind::Connector { start, end } = &mut sh.kind {
                    for c in [start, end] {
@@ -101,7 +101,6 @@ impl Session {
            let list = cmd::current_shapes(doc, sel).cloned().unwrap_or_default();
            let mut copies: Vec<Shape> = list.iter().filter(|x| ids.contains(&x.id)).cloned().collect();
            let boxes: Vec<Xfrm> = copies.iter().map(|c| xfrm_of(doc, sel, c)).collect();
-            cmd::edit::detach_on_slide(doc, sel, &mut copies);
            cmd::edit::reid("edit.duplicate", doc, &mut copies)?;
            for (c, b) in copies.iter_mut().zip(boxes) {
                c.xfrm = Some(b);
@@ -228,10 +228,7 @@ impl Session {
                self.tool.drag = Some(Drag::Freeform { mode, points, pressed: false });
                return self.finish_freeform(true);
            }
-            self.tool.press_added_vertex = points.len() < super::MAX_GESTURE_POINTS;
-            if self.tool.press_added_vertex {
-                points.push(p);
-            }
+            points.push(p);
            self.tool.path_preview = points.clone();
            self.tool.drag = Some(Drag::Freeform { mode, points, pressed: true });
            return Ok(Value::Null);
@@ -169,14 +169,8 @@ impl FontDb {
                if bundled.contains(fam) {
                    continue;
                }
-                if self.is_loaded(fam) || (self.system_fallback_enabled() && self.has_family(fam)) {
-                    // With system fallback off, only a face that is already loaded: `face` could load more catalog files.
-                    let f = if self.system_fallback_enabled() {
-                        self.face(fam, style)
-                    } else {
-                        let Some(f) = self.find(fam, style) else { continue };
-                        f
-                    };
+                if self.is_loaded(fam) || self.has_family(fam) {
+                    let f = self.face(fam, style);
                    if f.family.eq_ignore_ascii_case(fam) && covers_cluster(&f, cluster) {
                        return f;
                    }
@@ -317,21 +311,4 @@ mod tests {
            assert!(c.windows(2).all(|w| w[0] <= w[1]));
        }
    }
-
-    /// With system fallback off, the automatic cascades (script families and symbol faces) load no
-    /// installed family: the result comes from what is already loaded.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn cascades_load_no_installed_family_when_system_fallback_is_off() {
-        let db = FontDb::with_font_dirs(Vec::new());
-        db.set_system_fallback(false);
-        let base = db.face(crate::DEFAULT_FAMILY, "Regular");
-        let loaded = |db: &FontDb| [b"Arab", b"Hebr", b"Thai", b"Deva"].into_iter().flat_map(|s| os_families(*s)).filter(|f| db.is_loaded(f)).count();
-        let before = loaded(&db);
-        for c in ['\u{0628}', '\u{05D0}', '\u{0E01}', '\u{0905}', '\u{2211}', '\u{2603}'] {
-            let f = db.cascade(&[c], std::slice::from_ref(&base), "Regular");
-            assert!(!f.family.is_empty());
-        }
-        assert_eq!(loaded(&db), before, "no installed family was loaded");
-    }
 }
@@ -976,17 +976,6 @@ impl FontDb {
        let _ = on;
    }

-    /// Whether automatic system-font lookups (fallback by character, symbol and script families)
-    /// may touch installed fonts. Lookups of a family the document or host names are not gated.
-    pub(crate) fn system_fallback_enabled(&self) -> bool {
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).enabled
-        }
-        #[cfg(target_arch = "wasm32")]
-        false
-    }
-
    /// Process-wide database: the bundled fonts, then the installed system fonts, cataloged the
    /// first time a lookup by family name needs them (or ahead of time by
    /// [`FontDb::scan_in_background`]).
@@ -1271,8 +1260,9 @@ impl FontDb {
    fn instance(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
        let open = style.find('{')?;
        let base = self.find(family, style[..open].trim())?;
-        let Some(font) = base.skrifa().filter(|f| !f.axes().is_empty()) else { return Some(base) };
-        let axis_tags: Vec<[u8; 4]> = font.axes().iter().map(|a| a.tag().to_be_bytes()).collect();
+        if base.skrifa().is_none_or(|f| f.axes().is_empty()) {
+            return Some(base);
+        }
        let mut coords = base.coords.clone();
        for kv in style[open + 1..].trim_end_matches('}').split(',') {
            let (k, v) = kv.split_once(':')?;
@@ -1282,11 +1272,6 @@ impl FontDb {
                return None;
            }
            let tag = [k[0], k[1], k[2], k[3]];
-            // A tag the font has no axis for changes nothing; keeping it would grow the list with
-            // every distinct tag in the style text.
-            if !axis_tags.contains(&tag) {
-                continue;
-            }
            match coords.iter_mut().find(|(t, _)| *t == tag) {
                Some(c) => c.1 = v,
                None => coords.push((tag, v)),
@@ -1298,7 +1283,7 @@ impl FontDb {
        Some(f)
    }

-    pub(crate) fn find(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
+    fn find(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
        if style.contains('{') {
            {
                let faces = self.read_faces();
@@ -1484,8 +1469,7 @@ impl FontDb {
        };
        #[cfg(not(target_arch = "wasm32"))]
        {
-            let cataloged: Vec<String> =
-                if self.system_fallback_enabled() { self.read_catalog().iter().map(|e| e.family.clone()).collect() } else { Vec::new() };
+            let cataloged: Vec<String> = self.read_catalog().iter().map(|e| e.family.clone()).collect();
            for fam in SYSTEM_FALLBACKS.iter().filter(|f| f.contains("Symbol")) {
                if !self.is_loaded(fam) && cataloged.iter().any(|f| f.eq_ignore_ascii_case(fam)) {
                    self.load_cataloged(fam);
@@ -425,11 +425,3 @@ fn the_font_scan_skips_fifos_folders_and_link_loops() {
    assert!(fifo || n >= 1);
    let _ = std::fs::remove_dir_all(&dir);
 }
-
-#[test]
-fn disabling_system_fallback_gates_automatic_family_loads() {
-    let db = FontDb::with_font_dirs(Vec::new());
-    assert!(cfg!(target_arch = "wasm32") || db.system_fallback_enabled());
-    db.set_system_fallback(false);
-    assert!(!db.system_fallback_enabled());
-}
@@ -694,9 +694,7 @@ pub fn slides_to_outline(p: &Presentation) -> String {
        out.push_str(&s.title().replace('\n', " "));
        out.push('\n');
        for sh in &s.shapes {
-            // The title is the slide's line; footer, date and slide-number placeholders are not
-            // body text (PowerPoint's outline view shows title and body placeholders only).
-            if sh.ph_type().is_some_and(|k| k.is_title() || k.is_footer_kind()) {
+            if sh.ph_type().is_some_and(|k| k.is_title()) {
                continue;
            }
            if let Some(t) = &sh.text {
@@ -71,8 +71,7 @@ pub fn slides_to_rtf(p: &Presentation) -> String {
        }
        out.push_str("\\b0\\par\n");
        for sh in &s.shapes {
-            // As in the text outline: footer, date and slide-number placeholders are not body text.
-            if sh.ph_type().is_some_and(|k| k.is_title() || k.is_footer_kind()) {
+            if sh.ph_type().is_some_and(|k| k.is_title()) {
                continue;
            }
            let Some(t) = &sh.text else { continue };
@@ -300,8 +299,7 @@ impl Outline<'_> {

    /// A one-character control symbol (`\\`, `\{`, `\~`, ...).
    fn symbol(&mut self, n: u8) {
-        let c = self.rtf.get(self.i..).and_then(|r| r.chars().next());
-        self.i = advance(self.rtf, self.i, 1);
+        self.i += 1;
        if self.st.skip {
            return;
        }
@@ -310,7 +308,6 @@ impl Outline<'_> {
            b'~' => self.line.push('\u{a0}'),
            b'_' => self.line.push('\u{2011}'),
            b'\n' | b'\r' => self.flush(),
-            _ if !n.is_ascii() => self.line.extend(c),
            _ => {}
        }
    }
@@ -422,11 +419,6 @@ mod tests {
        assert_eq!(rtf_to_outline(r"{\rtf1 x\u-70000?y\par}"), "x\u{ee90}y\n");
    }

-    #[test]
-    fn multibyte_control_symbol_keeps_character_and_following_text() {
-        assert_eq!(rtf_to_outline("{\\rtf1 A\\éB\\par}"), "AéB\n");
-    }
-
    /// `\\_` is RTF's non-breaking hyphen: a visible character, not markup.
    #[test]
    fn non_breaking_hyphen_is_kept() {
@@ -48,7 +48,7 @@ impl SliceDecoder<'_> {
        let intra_slice = self.sh.slice_type.is_intra();
        loop {
            ensure!(addr < total, "macroblock address {addr} out of range");
-            self.start_mb(addr)?;
+            self.start_mb(addr);
            let skip = !intra_slice && self.decode_skip_flag(&mut c);
            if skip {
                self.decode_skip()?;
@@ -15,7 +15,7 @@ use crate::slicedec::{PicState, SliceDecoder};
 use crate::transform::LevelScale;
 use crate::{ColorInfo, Picture};
 use deckcraft_bitstream::{BitReader, annexb_nals, length_prefixed_nals, unescape_rbsp};
-use std::collections::{HashMap, VecDeque};
+use std::collections::VecDeque;
 use std::sync::{Arc, Mutex};

 /// One slice of a picture job.
@@ -90,10 +90,6 @@ pub struct Decoder {
    ls_cache: Vec<(Arc<Pps>, Arc<LevelScale>)>,
    /// Pictures leaving the DPB, converted once their decoding job has finished.
    out_queue: VecDeque<Output>,
-    /// Queued entries per frame id and their summed bytes, kept in step with `out_queue` so the
-    /// budget check does not rescan it.
-    queued_ids: HashMap<u32, u64>,
-    queued_bytes: u64,
    shared: Arc<Shared>,
    #[cfg(feature = "threads")]
    pool: Option<rayon::ThreadPool>,
@@ -179,8 +175,6 @@ impl Decoder {
            active_sps: None,
            ls_cache: Vec::new(),
            out_queue: VecDeque::new(),
-            queued_ids: HashMap::new(),
-            queued_bytes: 0,
            shared: Arc::new(Shared::default()),
            #[cfg(feature = "threads")]
            pool,
@@ -289,7 +283,7 @@ impl Decoder {
            if !o.frame.is_published(o.frame.mb_h() - 1) && self.out_queue.len() <= max_queue {
                break;
            }
-            let Some(o) = self.pop_out() else { break };
+            let Some(o) = self.out_queue.pop_front() else { break };
            pics.push(make_picture(&o));
        }
        Ok(pics)
@@ -301,7 +295,7 @@ impl Decoder {
        let mut outs = Vec::new();
        self.dpb.flush(&mut outs);
        self.emit(outs);
-        let pics = std::iter::from_fn(|| self.pop_out()).map(|o| make_picture(&o)).collect();
+        let pics = self.out_queue.drain(..).map(|o| make_picture(&o)).collect();
        while let Some(f) = self.in_flight.pop_front() {
            f.wait_complete();
        }
@@ -457,24 +451,13 @@ impl Decoder {
            chroma_planes: if chroma == 0 { 0 } else { 2 },
            bytes_per_sample: 1,
        };
-        // Pictures already held count at their own size, not the incoming SPS's: after a
-        // resolution change, larger pictures of the old size can still be in the DPB or waiting
-        // for output (one decode call may carry many access units). A buffer shared with a DPB
-        // entry is counted once.
-        let pic = shape.bytes().unwrap_or(u64::MAX);
-        let held = |frames: &mut dyn Iterator<Item = &Arc<Frame>>| frames.fold(0u64, |n, f| n.saturating_add(f.bytes()));
-        // Queued bytes minus the queue entries that share a DPB frame (each distinct DPB frame once).
-        let mut ids: Vec<(u32, u64)> = self.dpb.entries.iter().map(|e| (e.frame.id, e.frame.bytes())).collect();
-        ids.sort_unstable();
-        ids.dedup();
-        let shared = ids.iter().fold(0u64, |n, (id, b)| n.saturating_add(self.queued_ids.get(id).copied().unwrap_or(0).saturating_mul(*b)));
-        let queued = self.queued_bytes.saturating_sub(shared);
-        let in_dpb = held(&mut self.dpb.entries.iter().map(|e| &e.frame));
-        let dpb = sps.max_dpb_frames().max(self.dpb.entries.len()) as u64;
-        // The DPB (the larger of its new slots and what it holds now), the picture being decoded,
-        // and what is in flight or queued.
-        let bytes = pic.saturating_mul(dpb).max(in_dpb).saturating_add(pic).saturating_add(pic.saturating_mul(self.max_in_flight as u64).max(queued));
-        ensure!(bytes <= self.memory_budget, "{}x{} pictures with {bytes} bytes in the decoder exceed the memory budget", sps.width(), sps.height());
+        let pictures = (sps.max_dpb_frames() + 1 + self.max_in_flight) as u64;
+        ensure!(
+            shape.fits(pictures, self.memory_budget),
+            "{}x{} pictures with {pictures} in the decoder exceed the memory budget",
+            sps.width(),
+            sps.height()
+        );
        Ok(())
    }

@@ -579,24 +562,8 @@ impl Decoder {
    }

    fn emit(&mut self, outs: Vec<Output>) {
-        for o in &outs {
-            *self.queued_ids.entry(o.frame.id).or_insert(0) += 1;
-            self.queued_bytes = self.queued_bytes.saturating_add(o.frame.bytes());
-        }
        self.out_queue.extend(outs);
    }
-
-    fn pop_out(&mut self) -> Option<Output> {
-        let o = self.out_queue.pop_front()?;
-        if let Some(n) = self.queued_ids.get_mut(&o.frame.id) {
-            *n -= 1;
-            if *n == 0 {
-                self.queued_ids.remove(&o.frame.id);
-            }
-        }
-        self.queued_bytes = self.queued_bytes.saturating_sub(o.frame.bytes());
-        Some(o)
-    }
 }

 /// Decode all slices of one picture and publish its rows.
@@ -139,9 +139,8 @@ impl Dpb {
        let mut unused = (prev_ref_frame_num + 1) % max_frame_num;
        // Only the last `max_num_ref_frames` "non-existing" frames can survive the sliding window, and
        // inserting more than that evicts every earlier short-term reference. Skip straight to that tail
-        // (advancing the POC state across the skipped run in constant time) so a hostile gap of up to
-        // 65535 frames costs at most `max_num_ref_frames` frame allocations and POC updates instead of
-        // one per missing frame.
+        // (keeping the POC state walk for every missing frame_num) so a hostile gap of up to 65535
+        // frames costs at most `max_num_ref_frames` frame allocations instead of one per missing frame.
        let gap = frame_num.wrapping_add(max_frame_num).wrapping_sub(unused) % max_frame_num;
        let keep = u32::try_from(max_num_ref_frames.max(1)).unwrap_or(u32::MAX);
        let skip = gap.saturating_sub(keep);
@@ -150,17 +149,10 @@ impl Dpb {
                e.mark = RefMark::Unused;
            }
            self.prune();
-            // The POC state only advances FrameNumOffset where frame_num decreases, so walking the
-            // skipped run is the same as visiting its first value, the wrap (if the run crosses
-            // it) and its last value: constant work however long the gap.
-            let last = (unused + (skip - 1) % max_frame_num) % max_frame_num;
-            poc_state(unused);
-            if last < unused {
-                poc_state(max_frame_num - 1);
-                poc_state(0);
+            for _ in 0..skip {
+                poc_state(unused);
+                unused = (unused + 1) % max_frame_num;
            }
-            poc_state(last);
-            unused = (last + 1) % max_frame_num;
        }
        let mut guard = 0;
        while unused != frame_num && guard < max_frame_num {
@@ -446,15 +438,14 @@ impl Dpb {
                }
            }
        } else {
-            // Evict until there is room (frame_num gap concealment can leave the DPB over-full), so
-            // the store never holds more pictures than the memory budget was checked for.
-            while self.entries.len() >= self.capacity.max(1) {
+            while self.entries.len() >= self.capacity {
                if !self.bump(out) {
                    if let Some(pos) = self.entries.iter().position(|e| !e.needed_for_output) {
                        self.entries.remove(pos);
                    } else {
                        self.entries.remove(0);
                    }
+                    break;
                }
            }
        }
@@ -555,37 +546,6 @@ mod tests {
        (made, walk, left)
    }

-    /// (FrameNumOffset, prev frame_num) after `walk`, by the rule of `PocState::update_gap_frame`.
-    fn poc_after(walk: &[u32], prev: u32, max: u32) -> (u64, u32) {
-        walk.iter().fold((0, prev), |(off, prev), &f| (if prev > f { off + u64::from(max) } else { off }, f))
-    }
-
-    #[test]
-    fn gap_walk_matches_every_frame_num_for_any_skip() {
-        for (prev, cur) in [(1, 9), (10, 3), (14, 0), (15, 14), (0, 15), (7, 6)] {
-            for refs in 1..4 {
-                let mut dpb = Dpb::new();
-                let (_, walk, _) = fill(&mut dpb, prev, cur, 16, refs);
-                let every: Vec<u32> = (1..16).map(|i| (prev + i) % 16).take_while(|&f| f != cur).collect();
-                assert_eq!(poc_after(&walk, prev, 16), poc_after(&every, prev, 16), "{prev} -> {cur}, {refs} refs");
-                assert_eq!(walk.last(), every.last(), "{prev} -> {cur}, {refs} refs");
-            }
-        }
-    }
-
-    #[test]
-    fn reference_store_evicts_down_to_capacity() {
-        let mut dpb = Dpb::new();
-        dpb.capacity = 2;
-        // Gap concealment can leave more non-output references than the capacity.
-        for i in 0..5 {
-            short(&mut dpb, i, i);
-        }
-        let mut out = Vec::new();
-        assert!(!dpb.bump_for_space(RefMark::Short, 0, &mut out));
-        assert!(dpb.entries.len() < 2, "{} pictures left before storing into a 2-picture DPB", dpb.entries.len());
-    }
-
    #[test]
    fn huge_gap_makes_only_the_frames_that_stay_referenced() {
        let mut dpb = Dpb::new();
@@ -593,9 +553,8 @@ mod tests {
        short(&mut dpb, 2, 1);
        let (made, walk, left) = fill(&mut dpb, 1, 65535, 65536, 4);
        assert_eq!(made, 4);
-        // The POC state ends where walking every missing frame_num would leave it, in a few steps.
-        assert_eq!(poc_after(&walk, 1, 65536), poc_after(&(2..65535).collect::<Vec<_>>(), 1, 65536));
-        assert!(walk.len() <= 8, "{} POC updates", walk.len());
+        // The POC state still walks every missing frame_num, in order.
+        assert_eq!(walk.len(), 65533);
        assert_eq!(walk.first(), Some(&2));
        assert_eq!(walk.last(), Some(&65534));
        assert_eq!(left, vec![(65531, true), (65532, true), (65533, true), (65534, true)]);
@@ -607,9 +566,7 @@ mod tests {
        short(&mut dpb, 1, 65000);
        let (made, walk, left) = fill(&mut dpb, 65000, 3, 65536, 2);
        assert_eq!(made, 2);
-        let every: Vec<u32> = (65001..65536).chain(0..3).collect();
-        assert_eq!(poc_after(&walk, 65000, 65536), poc_after(&every, 65000, 65536));
-        assert!(walk.len() <= 6, "{} POC updates", walk.len());
+        assert_eq!(walk.len(), 538);
        assert_eq!(walk.first(), Some(&65001));
        assert_eq!(walk.last(), Some(&2));
        assert_eq!(left, vec![(1, true), (2, true)]);
@@ -160,14 +160,6 @@ impl Frame {
        self.rows.len()
    }

-    /// Sample bytes this picture holds (luma and both chroma planes), as the decoder's memory
-    /// budget counts a picture.
-    pub fn bytes(&self) -> u64 {
-        (self.width as u64)
-            .saturating_mul(self.height as u64)
-            .saturating_add((self.cwidth as u64).saturating_mul(self.cheight as u64).saturating_mul(2))
-    }
-
    /// Publish MB row `r` (ignored if already published).
    pub fn publish(&self, r: usize, row: FrameRow) {
        let _ = self.rows[r].set(row);
@@ -346,11 +346,8 @@ impl<'a> SliceDecoder<'a> {
    // Neighbour helpers
    // ------------------------------------------------------------------------------------------

-    /// Set up the current macroblock address and neighbour availability. A macroblock an earlier
-    /// slice of this picture already decoded is refused: overlapping slices would otherwise redo
-    /// the picture's reconstruction once per slice.
-    pub fn start_mb(&mut self, addr: usize) -> Result<()> {
-        ensure!(self.pic.mbs[addr].slice_num == u32::MAX, "macroblock {addr} overlaps an earlier slice");
+    /// Set up the current macroblock address and neighbour availability.
+    pub fn start_mb(&mut self, addr: usize) {
        self.mb_addr = addr;
        self.mb_x = addr % self.mb_w;
        self.mb_y = addr / self.mb_w;
@@ -367,7 +364,6 @@ impl<'a> SliceDecoder<'a> {
        ];
        self.mv_done = 0;
        self.pic.mbs[addr] = MbState { slice_num: sn, ..MbState::default() };
-        Ok(())
    }

    #[inline]
@@ -1471,7 +1467,7 @@ impl<'a> SliceDecoder<'a> {
                let run = r.read_ue()? as usize;
                ensure!(addr + run <= total, "mb_skip_run out of range");
                for _ in 0..run {
-                    self.start_mb(addr)?;
+                    self.start_mb(addr);
                    self.decode_skip()?;
                    self.pic.mb_done(addr);
                    addr += 1;
@@ -1481,7 +1477,7 @@ impl<'a> SliceDecoder<'a> {
                }
                ensure!(addr < total, "macroblock address {addr} out of range");
            }
-            self.start_mb(addr)?;
+            self.start_mb(addr);
            self.decode_mb_cavlc(r)?;
            self.pic.mb_done(addr);
            addr += 1;
@@ -113,7 +113,6 @@ fn avcc_rejects_a_valid_picture_slice_without_starting_a_picture() {
            poc_lsb: Some(0),
            poc_delta: None,
            wt: None,
-            first_mb: 0,
        },
        false,
    );
@@ -154,8 +153,6 @@ struct Pic {
    /// Explicit weights (luma, cb, cr) as (weight, offset) for refIdx 0 of list 0 and list 1;
    /// log2 denominators are 5 (luma) and 3 (chroma).
    wt: Option<[[(i32, i32); 3]; 2]>,
-    /// first_mb_in_slice (`mbs` then lists the slice's macroblocks from there).
-    first_mb: u32,
 }

 impl Pic {
@@ -168,7 +165,7 @@ impl Pic {
 }

 fn slice_header(w: &mut BitWriter, p: &Pic, cabac: bool) {
-    w.write_ue(p.first_mb);
+    w.write_ue(0); // first_mb
    w.write_ue(if p.b {
        6
    } else if p.is_p() {
@@ -663,63 +660,3 @@ fn frame_num_gap_is_filled_when_the_sps_allows_gaps() {
    assert_eq!(out.len(), 2);
    assert_eq!(dec.stats().frame_num_gaps, 1);
 }
-
-/// An IDR picture followed by `pictures` reference P pictures of P_Skip macroblocks.
-fn skip_stream(pictures: u32) -> (Vec<u8>, Vec<Vec<u8>>) {
-    let mut seed = 11u32;
-    let a: Vec<Option<Vec<u8>>> = (0..NMB).map(|_| Some(random_mb(&mut seed))).collect();
-    let mut head = sps(66, 2, false, PocType::T2);
-    head.extend(pps(false, false));
-    head.extend(slice_nal(&Pic { idr: true, frame_num: 0, ref_idc: 3, mbs: a, ..Default::default() }, false));
-    let ps = (1..=pictures).map(|k| slice_nal(&Pic { frame_num: k % 16, ref_idc: 2, mbs: vec![None; NMB], ..Default::default() }, false)).collect();
-    (head, ps)
-}
-
-#[test]
-fn overlapping_slices_are_not_reconstructed_twice() {
-    let (head, ps) = skip_stream(1);
-    let mut once = Decoder::with_threads(1);
-    let mut out = once.decode(&[head.clone(), ps[0].clone()].concat(), 0).unwrap();
-    out.extend(once.flush());
-    assert!(once.take_error().is_none());
-    assert_eq!(out.len(), 2);
-    // A second slice of the same picture starting at macroblock 1 covers those macroblocks again.
-    let again = slice_nal(&Pic { frame_num: 1, ref_idc: 2, mbs: vec![None; NMB - 1], first_mb: 1, ..Default::default() }, false);
-    let mut twice = Decoder::with_threads(1);
-    let result = twice.decode(&[head, ps[0].clone(), again].concat(), 0);
-    twice.flush();
-    let err = result.err().or_else(|| twice.take_error()).expect("overlapping slice refused");
-    assert!(err.to_string().contains("overlaps"), "{err}");
-}
-
-#[test]
-fn output_queue_counts_against_the_memory_budget() {
-    let (head, ps) = skip_stream(40);
-    let sps_nal = sps(66, 2, false, PocType::T2);
-    let parsed = crate::params::Sps::parse(&deckcraft_bitstream::unescape_rbsp(&sps_nal[5..])).unwrap();
-    let one = (NMB * 256 + 2 * NMB * 64) as u64;
-    let budget = (parsed.max_dpb_frames() + 1 + 3) as u64 * one;
-    // One access unit per call: output drains as it goes, and the stream fits.
-    let mut dec = Decoder::with_threads(1);
-    dec.set_memory_budget(budget);
-    let mut out = dec.decode(&head, 0).unwrap();
-    for (i, p) in ps.iter().enumerate() {
-        out.extend(dec.decode(p, i as i64 + 1).unwrap());
-    }
-    out.extend(dec.flush());
-    assert!(dec.take_error().is_none());
-    assert_eq!(out.len(), 41);
-    // Every access unit in one call: the pictures held for output stop fitting the budget.
-    let mut dec = Decoder::with_threads(1);
-    dec.set_memory_budget(budget);
-    let err = dec.decode(&[head, ps.concat()].concat(), 0).expect_err("output queue is over budget");
-    assert!(err.to_string().contains("memory budget"), "{err}");
-}
-
-/// A held picture is charged at its own size (luma and both 4:2:0 chroma planes), the same
-/// count the budget uses for the incoming SPS's pictures.
-#[test]
-fn a_held_frame_is_charged_at_its_own_size() {
-    let f = crate::picture::Frame::new(0, 0, 2, 3);
-    assert_eq!(f.bytes(), (2 * 3 * 256 + 2 * 2 * 3 * 64) as u64);
-}
@@ -404,36 +404,10 @@ impl Decoder {
            chroma_planes: if chroma == 0 { 0 } else { 2 },
            bytes_per_sample: 2,
        };
-        let frame_bytes = |f: &crate::picture::Frame| {
-            (f.width as u64)
-                .saturating_mul(f.height as u64)
-                .saturating_add((f.cwidth as u64).saturating_mul(f.cheight as u64).saturating_mul(2))
-                .saturating_mul(2)
-        };
-        // Output frames waiting to be returned stay allocated after they leave the DPB, at their
-        // own size: a resolution change in this call can leave pictures of the previous SPS.
-        let queued: u64 = self
-            .out_queue
-            .iter()
-            .filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame)) && !self.in_flight.iter().any(|f| Arc::ptr_eq(f, &o.frame)))
-            .map(|o| frame_bytes(&o.frame))
-            .fold(0, u64::saturating_add);
-        // Frames the DPB holds now count at their own size too (an SPS change flushes them into the
-        // queue before the new pictures are made): the DPB part is the larger of its new slots and that.
-        let held: u64 = self.dpb.entries.iter().map(|e| frame_bytes(&e.frame)).fold(0, u64::saturating_add);
-        // A queued frame still being decoded is one of the in-flight pictures already reserved, so the
-        // queue and the in-flight reservation overlap: charge the larger, not both.
        let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64;
-        let slots = shape.store_bytes(u64::from(sps.max_dec_pic_buffering));
-        let flight = shape.store_bytes(self.max_in_flight as u64);
-        let total = shape
-            .store_bytes(1)
-            .zip(slots)
-            .zip(flight)
-            .map(|((one, slots), flight)| slots.max(held).saturating_add(one).saturating_add(flight).saturating_add(queued));
        ensure!(
-            total.is_some_and(|b| b <= self.memory_budget),
-            "{}x{} pictures with {pictures} in the decoder and {queued} bytes queued exceed the memory budget",
+            shape.fits(pictures, self.memory_budget),
+            "{}x{} pictures with {pictures} in the decoder exceed the memory budget",
            sps.width,
            sps.height
        );
@@ -0,0 +1,13 @@
+[package]
+name = "deckcraft-isobmff"
+description = "Clean-room ISO BMFF (MP4) and QuickTime (MOV) demuxer and muxer"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+craft-media = { workspace = true, features = ["isobmff"] }
@@ -0,0 +1,6 @@
+//! ISO BMFF (MP4) and QuickTime (MOV) demuxer and muxer: a re-export of [`craft_media::isobmff`]
+//! from craft-libs. Supported boxes and limitations are in the craft-media README.
+
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
+pub use craft_media::isobmff::*;
@@ -0,0 +1,13 @@
+[package]
+name = "deckcraft-matroska"
+description = "Clean-room Matroska (MKV) and WebM demuxer and muxer"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+craft-media = { workspace = true, features = ["matroska"] }
@@ -0,0 +1,6 @@
+//! Matroska (MKV) and WebM demuxer and muxer: a re-export of [`craft_media::matroska`] from
+//! craft-libs. Supported elements and limitations are in the craft-media README.
+
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
+pub use craft_media::matroska::*;
@@ -16,12 +16,6 @@ const INVALID_REQUEST: i64 = -32600;
 const METHOD_NOT_FOUND: i64 = -32601;
 const INVALID_PARAMS: i64 = -32602;
 const INTERNAL_ERROR: i64 = -32603;
-
-/// Entries one batch (a JSON-RPC batch, or the `batch` tool's commands) may hold.
-pub(crate) const MAX_BATCH_ITEMS: usize = 1000;
-/// Bytes of results one batch may gather before the rest of it is refused: each result can copy
-/// much of the document (an inspection holds every note), so a batch holds at most this much.
-pub(crate) const MAX_BATCH_BYTES: usize = 64 << 20;
 const RESOURCE_NOT_FOUND: i64 = -32002;
 /// Keep request frames in step with the connected backend's reply limit.
 const MAX_FRAME_BYTES: usize = 16 * 1024 * 1024;
@@ -99,28 +93,8 @@ impl Server {
                // Batches were removed in 2025-06-18; still answer older clients sensibly.
                if batch.is_empty() {
                    Some(error(Value::Null, INVALID_REQUEST, "empty batch"))
-                } else if batch.len() > MAX_BATCH_ITEMS {
-                    Some(error(Value::Null, INVALID_REQUEST, format!("a batch holds at most {MAX_BATCH_ITEMS} messages")))
                } else {
-                    let mut used = 0usize;
-                    let mut replies: Vec<Value> = Vec::new();
-                    for m in batch {
-                        if used > MAX_BATCH_BYTES {
-                            // Not run: answer each remaining request with a short error.
-                            if let Some(id) = m.get("id").filter(|id| id.is_string() || id.is_number()) {
-                                replies.push(error(id.clone(), INTERNAL_ERROR, "the batch's replies passed 64 MiB; not run"));
-                            }
-                            continue;
-                        }
-                        if let Some(r) = self.handle(m) {
-                            used = used.saturating_add(r.to_string().len());
-                            replies.push(if used > MAX_BATCH_BYTES {
-                                error(r.get("id").cloned().unwrap_or(Value::Null), INTERNAL_ERROR, "the batch's replies passed 64 MiB; reply dropped")
-                            } else {
-                                r
-                            });
-                        }
-                    }
+                    let replies: Vec<Value> = batch.into_iter().filter_map(|m| self.handle(m)).collect();
                    (!replies.is_empty()).then_some(Value::Array(replies))
                }
            }
@@ -357,40 +357,21 @@ pub fn call_tool(b: &mut dyn Backend, name: &str, a: &Value) -> ToolResult {
            wrap(exec(b, c, a.get("params").cloned().unwrap_or(json!({}))))
        }
        "batch" => {
-            use crate::server::{MAX_BATCH_BYTES, MAX_BATCH_ITEMS};
            let keep = a.get("keepGoing").and_then(Value::as_bool).unwrap_or(false);
-            let commands = a.get("commands").and_then(Value::as_array).map(Vec::as_slice).unwrap_or_default();
-            if commands.len() > MAX_BATCH_ITEMS {
-                return ToolResult::error(format!("a batch holds at most {MAX_BATCH_ITEMS} commands"));
-            }
            let mut out = vec![];
-            let mut used = 0usize;
-            for c in commands {
+            for c in a.get("commands").and_then(Value::as_array).cloned().unwrap_or_default() {
                let id = c.get("command").and_then(Value::as_str).unwrap_or("");
-                let (entry, failed) = match exec(b, id, c.get("params").cloned().unwrap_or(json!({}))) {
-                    Ok(v) => (json!({"command": id, "ok": true, "result": v}), false),
-                    Err(e) => (json!({"command": id, "ok": false, "error": e}), true),
-                };
-                // What the reply carries: the entry as text, escaped again inside the JSON-RPC reply.
-                // Failures count too: with keepGoing, a remote backend's large errors add up.
-                used = used.saturating_add(json!(entry.to_string()).to_string().len());
-                if used > MAX_BATCH_BYTES {
-                    let shown: String = id.chars().take(128).collect();
-                    out.push(json!({"command": shown, "ok": false, "error": "the batch's results passed 64 MiB; stopped here"}));
-                    return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
-                }
-                out.push(entry);
-                if failed && !keep {
-                    return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
+                match exec(b, id, c.get("params").cloned().unwrap_or(json!({}))) {
+                    Ok(v) => out.push(json!({"command": id, "ok": true, "result": v})),
+                    Err(e) => {
+                        out.push(json!({"command": id, "ok": false, "error": e}));
+                        if !keep {
+                            return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
+                        }
+                    }
                }
            }
-            // The reply is pretty-printed, which is longer than the compact entries counted above.
-            let reply = ToolResult::json(&Value::Array(out));
-            let text = reply.content[0]["text"].as_str().unwrap_or_default();
-            if json!(text).to_string().len() > MAX_BATCH_BYTES {
-                return ToolResult::error("the batch's results passed 64 MiB; nothing is returned");
-            }
-            reply
+            ToolResult::json(&Value::Array(out))
        }
        "new_presentation" => wrap(exec(b, "file.new", a)),
        "open_presentation" => wrap(exec(b, "file.open", a)),
@@ -1,70 +0,0 @@
-//! A batch (JSON-RPC or the `batch` tool) is bounded in entries and in the bytes of results it
-//! gathers, so a short request cannot copy a large document into memory hundreds of times.
-
-use deckcraft_mcp::{Headless, Server};
-use serde_json::{Value, json};
-
-fn server_with_notes(bytes: usize) -> Server {
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let line = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "run_command", "arguments": {"command": "slide.notes", "params": {"text": "n".repeat(bytes)}}}});
-    let reply: Value = serde_json::from_str(&server.handle_line(&line.to_string()).unwrap()).unwrap();
-    assert_ne!(reply["result"]["isError"], true, "{reply}");
-    server
-}
-
-#[test]
-fn json_rpc_batches_are_bounded_in_entries_and_reply_bytes() {
-    let mut server = server_with_notes(1 << 20);
-    let ping = |i: usize| json!({"jsonrpc": "2.0", "id": i, "method": "ping"});
-    let too_many: Vec<Value> = (0..1001).map(ping).collect();
-    let reply: Value = serde_json::from_str(&server.handle_line(&Value::Array(too_many).to_string()).unwrap()).unwrap();
-    assert_eq!(reply["error"]["code"], -32600, "{reply}");
-    // 100 inspections of a slide with 1 MB of notes: about 64 are answered, the rest refused.
-    let inspect = |i: usize| json!({"jsonrpc": "2.0", "id": i, "method": "tools/call", "params": {"name": "inspect_slide", "arguments": {}}});
-    let line = Value::Array((0..100).map(inspect).collect()).to_string();
-    let reply = server.handle_line(&line).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    let replies: Vec<Value> = serde_json::from_str(&reply).unwrap();
-    assert_eq!(replies.len(), 100, "every request is answered");
-    assert!(replies.last().unwrap()["error"]["message"].as_str().unwrap().contains("64 MiB"));
-}
-
-#[test]
-fn the_batch_tool_is_bounded_in_commands_and_result_bytes() {
-    let mut server = server_with_notes(1 << 20);
-    let call = |server: &mut Server, commands: Vec<Value>| {
-        let line = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-        let reply: Value = serde_json::from_str(&server.handle_line(&line.to_string()).unwrap()).unwrap();
-        (reply["result"]["isError"] == true, reply["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string())
-    };
-    let (err, text) = call(&mut server, vec![json!({"command": "document.inspect"}); 1001]);
-    assert!(err && text.contains("at most 1000"), "{text}");
-    let (err, text) = call(&mut server, vec![json!({"command": "slide.inspect"}); 100]);
-    assert!(err && text.contains("64 MiB"), "{}", &text[text.len().saturating_sub(200)..]);
-    assert!(text.len() < (64 << 20) + (4 << 20));
-}
-
-#[test]
-fn the_batch_tool_charges_the_escaped_reply() {
-    // Quotes escape twice on the way out (`\\\"`), so 30 results of ~2 MiB serialize to ~120 MiB.
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let notes = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "run_command", "arguments": {"command": "slide.notes", "params": {"text": "\"".repeat(1 << 20)}}}});
-    server.handle_line(&notes.to_string()).unwrap();
-    let commands = vec![json!({"command": "slide.inspect"}); 30];
-    let line = json!({"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-    let reply = server.handle_line(&line.to_string()).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    assert!(reply.contains("64 MiB"));
-}
-
-#[test]
-fn the_batch_tool_charges_failures_too() {
-    // Each unknown command's error echoes its ~1 MiB id; with keepGoing none of them is a result.
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let id = "x".repeat(1 << 20);
-    let commands = vec![json!({"command": id}); 70];
-    let line = json!({"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-    let reply = server.handle_line(&line.to_string()).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    assert!(reply.contains("64 MiB"));
-}
@@ -1,5 +1,3 @@
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md).
 #[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 mod automation_roots;
-#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-mod batch_budget;
@@ -9,9 +9,10 @@ description = "DeckCraft media: probing, audio decoding (MP3, AAC/M4A, WAV, AIFF
 workspace = true

 [dependencies]
-# Containers (MP4/MOV, Matroska/WebM, Ogg) and the Opus decoder, shared with the other Craft apps.
-craft-media = { workspace = true, features = ["isobmff", "matroska", "ogg"] }
-craft-audio = { workspace = true }
+deckcraft-isobmff = { workspace = true }
+deckcraft-matroska = { workspace = true }
+deckcraft-ogg = { workspace = true }
+deckcraft-opus = { workspace = true }
 deckcraft-h264 = { workspace = true }
 deckcraft-hevc = { workspace = true }
 deckcraft-vp9 = { workspace = true }
@@ -81,9 +81,7 @@ pub fn decode(bytes: &Bytes) -> Result<Pcm> {
            Some(r) => r,
            None => contained(|| decode_symphonia(bytes, "mkv")),
        },
-        Container::Mp4 | Container::Unknown | Container::Mp3 if !crate::mp4guard::probe_fits(bytes) => {
-            Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into()))
-        }
+        Container::Mp4 if !crate::mp4guard::tables_fit(bytes) => Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into())),
        c => contained(|| decode_symphonia(bytes, c.name())),
    }
 }
@@ -91,15 +89,15 @@ pub fn decode(bytes: &Bytes) -> Result<Pcm> {
 /// Ogg Opus with our decoder; `None` when the file holds no Opus stream.
 fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
    let src: &[u8] = bytes;
-    let file = craft_media::ogg::open(src).ok()?;
-    let s = file.stream_of(craft_media::ogg::Codec::Opus)?;
+    let file = deckcraft_ogg::open(src).ok()?;
+    let s = file.stream_of(deckcraft_ogg::Codec::Opus)?;
    let stream = file.streams.get(s)?;
    Some((|| {
        let head = stream.headers.first().ok_or(MediaError::Corrupt("Opus header missing".into()))?;
-        let mut dec = craft_audio::opus::Decoder::new(head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+        let mut dec = deckcraft_opus::Decoder::new(head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
        dec.set_trim_pre_skip(true);
        let channels = dec.channels() as u16;
-        let timing = craft_media::ogg::OpusTiming::of(stream, dec.pre_skip() as u32);
+        let timing = deckcraft_ogg::OpusTiming::of(stream, dec.pre_skip() as u32).map_err(|e| MediaError::Corrupt(e.to_string()))?;
        let mut out = Vec::new();
        for i in 0..stream.packets.len() {
            if MAX_PCM_SAMPLES.saturating_sub(out.len()) < channels.max(1) as usize {
@@ -115,8 +113,7 @@ fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
            }
        }
        // End trimming (RFC 7845 §4.5).
-        // the timing saturates on a hostile granule, so this product must too
-        let total = usize::try_from(timing.total).unwrap_or(0).saturating_mul(channels.max(1) as usize);
+        let total = timing.total.max(0) as usize * channels.max(1) as usize;
        if total > 0 && total < out.len() {
            out.truncate(total);
        }
@@ -127,13 +124,13 @@ fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
 /// WebM / Matroska Opus with our decoder; `None` when there is no Opus track.
 fn decode_mkv_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
    let src: &[u8] = bytes;
-    let file = craft_media::matroska::open(src).ok()?;
+    let file = deckcraft_matroska::open(src).ok()?;
    let (ti, head) = file.tracks.iter().enumerate().find_map(|(i, t)| match &t.codec {
-        craft_media::matroska::Codec::Opus { head } => Some((i, head.clone())),
+        deckcraft_matroska::Codec::Opus { head } => Some((i, head.clone())),
        _ => None,
    })?;
    Some((|| {
-        let mut dec = craft_audio::opus::Decoder::new(&head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+        let mut dec = deckcraft_opus::Decoder::new(&head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
        dec.set_trim_pre_skip(true);
        let channels = dec.channels() as u16;
        let mut out = Vec::new();
@@ -12,29 +12,6 @@ pub(crate) fn tables_fit(b: &[u8]) -> bool {
    boxes_fit(b, b.len() as u64, 0)
 }

-/// Bytes symphonia's probe scans for a format marker before giving up.
-const PROBE_SEARCH_LIMIT: usize = 1024 * 1024;
-
-/// Whether symphonia can be given `b`, whatever the sniffer made of it: its probe takes the first
-/// `ftyp` within its search window as the start of an MP4 (the size field 4 bytes before it), so
-/// the table check must start where that parser will, not at offset 0.
-pub(crate) fn probe_fits(b: &[u8]) -> bool {
-    if crate::Container::sniff(b) == crate::Container::Mp4 && !tables_fit(b) {
-        return false;
-    }
-    // The probe reads leading ID3v2 tags as metadata and searches again after the last one.
-    let mut rest = b;
-    while rest.starts_with(b"ID3") {
-        let size = rest.get(6..10).map(|s| s.iter().fold(0usize, |a, &x| (a << 7) | (x & 0x7f) as usize)).unwrap_or(0);
-        rest = rest.get(10 + size..).unwrap_or(&[]);
-    }
-    let head = &rest[..rest.len().min(PROBE_SEARCH_LIMIT + 16)];
-    match head.windows(4).position(|w| w == b"ftyp") {
-        Some(p) => tables_fit(&rest[p.saturating_sub(4)..]),
-        None => true,
-    }
-}
-
 fn be32(b: &[u8], at: usize) -> Option<u64> {
    b.get(at..at.checked_add(4)?).map(|s| u32::from_be_bytes([s[0], s[1], s[2], s[3]]) as u64)
 }
@@ -97,29 +74,3 @@ fn table_fits(kind: &[u8], body: &[u8], file_len: u64) -> bool {
    };
    be32(body, 4).is_some_and(|count| count <= body.len().saturating_sub(8) as u64 / entry)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// An MP4 whose `stsc` count asks for far more entries than the file holds.
-    fn mp4_with_huge_stsc() -> Vec<u8> {
-        let stsc = [&24u32.to_be_bytes()[..], b"stsc", &[0, 0, 0, 0], &u32::MAX.to_be_bytes(), &[0; 8]].concat();
-        let stbl = [&(stsc.len() as u32 + 8).to_be_bytes()[..], b"stbl", &stsc].concat();
-        let moov = [&(stbl.len() as u32 + 8).to_be_bytes()[..], b"moov", &stbl].concat();
-        [&16u32.to_be_bytes()[..], b"ftyp", b"isom", &[0; 4], &moov].concat()
-    }
-
-    #[test]
-    fn a_prefixed_mp4_is_checked_where_symphonia_starts_it() {
-        let mp4 = mp4_with_huge_stsc();
-        assert!(!tables_fit(&mp4));
-        assert!(!probe_fits(&mp4));
-        let prefixed = [&b"junk before the file "[..], &mp4].concat();
-        assert_eq!(crate::Container::sniff(&prefixed), crate::Container::Unknown);
-        assert!(tables_fit(&prefixed), "offset 0 sees no MP4 boxes");
-        assert!(!probe_fits(&prefixed));
-        let far = [&vec![0u8; PROBE_SEARCH_LIMIT + 16][..], &mp4].concat();
-        assert!(probe_fits(&far), "past the probe window symphonia never reads it as an MP4");
-    }
-}
@@ -71,8 +71,7 @@ pub fn probe_headers(bytes: &Bytes) -> Result<MediaInfo> {
    };
    if info.audio.is_none() && info.video.is_none() || info.audio.as_ref().is_some_and(|a| a.sample_rate == 0) {
        // Plain audio files (and anything our demuxers didn't describe): symphonia's probe.
-        // Symphonia opens an MP4 wherever its probe finds an `ftyp` (after leading ID3v2 tags too); other known containers (a WAV's audio bytes can spell an `ftyp`) skip the check.
-        if matches!(c, Container::Mp4 | Container::Unknown | Container::Mp3) && !crate::mp4guard::probe_fits(bytes) {
+        if c == Container::Mp4 && !crate::mp4guard::tables_fit(bytes) {
            return Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into()));
        }
        let (codec, rate, channels, frames) = std::panic::catch_unwind(|| crate::audio::probe_symphonia(bytes, c.name()))
@@ -106,9 +105,9 @@ fn codec_label(short: &str) -> String {
 }

 fn probe_mp4(bytes: &Bytes) -> Result<MediaInfo> {
-    use craft_media::isobmff::{CodecConfig, TrackKind};
+    use deckcraft_isobmff::{CodecConfig, TrackKind};
    let src: &[u8] = bytes;
-    let f = craft_media::isobmff::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+    let f = deckcraft_isobmff::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
    let mut info = MediaInfo { container: if f.is_quicktime { "mov" } else { "mp4" }, ..Default::default() };
    let mut dur = if f.timescale > 0 { f.duration as f64 / f.timescale as f64 } else { 0.0 };
    if let Some(ti) = f.track_of_kind(TrackKind::Video) {
@@ -146,9 +145,9 @@ fn probe_mp4(bytes: &Bytes) -> Result<MediaInfo> {
 }

 fn probe_mkv(bytes: &Bytes) -> Result<MediaInfo> {
-    use craft_media::matroska::{Codec, TrackKind};
+    use deckcraft_matroska::{Codec, TrackKind};
    let src: &[u8] = bytes;
-    let f = craft_media::matroska::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+    let f = deckcraft_matroska::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
    let mut info = MediaInfo { container: if f.is_webm() { "webm" } else { "matroska" }, ..Default::default() };
    let dur = f.duration_ns().map(|n| n as f64 / 1e9).unwrap_or(0.0);
    info.duration_ms = ms(dur);
@@ -179,11 +178,11 @@ fn probe_mkv(bytes: &Bytes) -> Result<MediaInfo> {

 fn probe_ogg(bytes: &Bytes) -> Option<MediaInfo> {
    let src: &[u8] = bytes;
-    let f = craft_media::ogg::open(src).ok()?;
-    let s = f.stream_of(craft_media::ogg::Codec::Opus)?;
+    let f = deckcraft_ogg::open(src).ok()?;
+    let s = f.stream_of(deckcraft_ogg::Codec::Opus)?;
    let st = f.streams.get(s)?;
-    let head = craft_audio::opus::OpusHead::parse(st.headers.first()?).ok()?;
-    let timing = craft_media::ogg::OpusTiming::of(st, head.pre_skip as u32);
+    let head = deckcraft_opus::OpusHead::parse(st.headers.first()?).ok()?;
+    let timing = deckcraft_ogg::OpusTiming::of(st, head.pre_skip as u32).ok()?;
    Some(MediaInfo {
        container: "ogg",
        duration_ms: ms(timing.total as f64 / 48_000.0),
@@ -3,8 +3,8 @@

 use std::collections::VecDeque;

-use craft_media::isobmff::CodecConfig;
-use craft_media::matroska::Codec as MkvCodec;
+use deckcraft_isobmff::CodecConfig;
+use deckcraft_matroska::Codec as MkvCodec;

 use crate::yuv::{self, Matrix, Planes};
 use crate::{Bytes, Container, MediaError, Result};
@@ -257,8 +257,8 @@ struct Track {
 }

 enum Demux {
-    Mp4(Box<craft_media::isobmff::Mp4File>, usize),
-    Mkv(Box<craft_media::matroska::MkvFile>, usize),
+    Mp4(Box<deckcraft_isobmff::Mp4File>, usize),
+    Mkv(Box<deckcraft_matroska::MkvFile>, usize),
 }

 impl Demux {
@@ -273,8 +273,8 @@ impl Demux {
 fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
    match Container::sniff(bytes) {
        Container::Mp4 => {
-            let f = craft_media::isobmff::open(bytes).map_err(dec_err)?;
-            let ti = f.track_of_kind(craft_media::isobmff::TrackKind::Video).ok_or(MediaError::Missing("video track"))?;
+            let f = deckcraft_isobmff::open(bytes).map_err(dec_err)?;
+            let ti = f.track_of_kind(deckcraft_isobmff::TrackKind::Video).ok_or(MediaError::Missing("video track"))?;
            let t = &f.tracks[ti];
            let entry = t.entries.first().ok_or(MediaError::Missing("video track"))?;
            let codec: Box<dyn Codec> = match &entry.codec {
@@ -290,11 +290,11 @@ fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
            Ok((Demux::Mp4(Box::new(f), ti), track, codec))
        }
        Container::Matroska => {
-            let f = craft_media::matroska::open(bytes).map_err(dec_err)?;
+            let f = deckcraft_matroska::open(bytes).map_err(dec_err)?;
            let ti = f
                .tracks
                .iter()
-                .position(|t| t.kind == craft_media::matroska::TrackKind::Video && !t.samples.is_empty())
+                .position(|t| t.kind == deckcraft_matroska::TrackKind::Video && !t.samples.is_empty())
                .ok_or(MediaError::Missing("video track"))?;
            let t = &f.tracks[ti];
            let codec: Box<dyn Codec> = match &t.codec {
@@ -303,7 +303,7 @@ fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
                MkvCodec::Vp9 { .. } => Box::new(Vp9 { dec: deckcraft_vp9::Decoder::new() }),
                MkvCodec::Av1 { av1c } => Box::new(Av1 {
                    dec: deckcraft_av1::Decoder::new(),
-                    config_obus: craft_media::isobmff::Av1Config::parse(av1c).map(|c| c.config_obus).unwrap_or_default(),
+                    config_obus: deckcraft_isobmff::Av1Config::parse(av1c).map(|c| c.config_obus).unwrap_or_default(),
                    primed: false,
                }),
                other => return Err(MediaError::Unsupported(format!("{} video", mkv_codec_name(other)))),
@@ -166,52 +166,6 @@ fn ogg_opus() {
    check_tone("opus", &fixture("tone.opus"), 48_000, 1);
 }

-/// Ogg Opus timing saturates on a hostile granule position instead of failing, so the end-trim
-/// arithmetic on its total must not overflow either: a three-channel file that ends with a page
-/// carrying the largest granule still probes and decodes.
-#[test]
-fn ogg_opus_with_a_huge_granule_does_not_overflow() {
-    fn seal(mut page: Vec<u8>) -> Vec<u8> {
-        page[22..26].fill(0);
-        let crc = craft_media::ogg::crc32(&page);
-        page[22..26].copy_from_slice(&crc.to_le_bytes());
-        page
-    }
-    let f = fixture("tone.opus");
-    let mut pages: Vec<Vec<u8>> = Vec::new();
-    let mut at = 0;
-    while at + 27 <= f.len() && &f[at..at + 4] == b"OggS" {
-        let nseg = f[at + 26] as usize;
-        let end = at + 27 + nseg + f[at + 27..at + 27 + nseg].iter().map(|&b| b as usize).sum::<usize>();
-        pages.push(f[at..end].to_vec());
-        at = end;
-    }
-    assert_eq!(at, f.len(), "the fixture is whole pages");
-    // an OpusHead for three channels (mapping family 1), each playing the one mono stream
-    let head = pages[0][28..].to_vec();
-    let mut first = pages[0][..26].to_vec();
-    first.extend_from_slice(&[1, 24]);
-    first.extend_from_slice(&head[..9]);
-    first.push(3);
-    first.extend_from_slice(&head[10..18]);
-    first.extend_from_slice(&[1, 1, 0, 0, 0, 0]);
-    pages[0] = seal(first);
-    // the last page once more, as the next page of the stream, with the largest granule
-    let last = pages.len() - 1;
-    let mut extra = pages[last].clone();
-    pages[last][5] &= !0x04;
-    pages[last] = seal(pages[last].clone());
-    extra[6..14].copy_from_slice(&i64::MAX.to_le_bytes());
-    let seq = u32::from_le_bytes([extra[18], extra[19], extra[20], extra[21]]) + 1;
-    extra[18..22].copy_from_slice(&seq.to_le_bytes());
-    pages.push(seal(extra));
-    let b: Bytes = Arc::new(pages.concat());
-    assert!(probe(&b).is_ok_and(|i| i.duration_ms > 1 << 40), "the granule is taken at its word");
-    let p = audio::decode(&b).expect("decode");
-    assert_eq!(p.channels, 3);
-    assert!(!p.samples.is_empty());
-}
-
 #[test]
 fn wma_is_probed_but_not_decoded() {
    let b = fixture("tone.wma");
@@ -313,8 +313,6 @@ pub(crate) struct Canvas {
    saved: Vec<Saved>,
    /// Bytes held by the items so far (path ops and pixels), capped at [`MAX_BYTES`].
    used: usize,
-    /// Bytes retained outside the canvas (EMF+ objects) that count against the same cap.
-    held: usize,
    objects: Vec<Option<Obj>>,
    pen: Pen,
    brush: Brush,
@@ -347,7 +345,6 @@ impl Canvas {
            viewport_set: false,
            saved: Vec::new(),
            used: 0,
-            held: 0,
            objects: Vec::new(),
            pen: Pen { style: 0, width: 0.0, color: [0, 0, 0, 255] },
            brush: Brush::new(BS_SOLID, [255, 255, 255, 255]),
@@ -371,17 +368,6 @@ impl Canvas {
        self.surface = clip::normalize(rect);
    }

-    /// Bytes retained outside the canvas that share its budget (see [`Canvas::hold`]).
-    #[cfg(test)]
-    pub(crate) fn held(&self) -> usize {
-        self.held
-    }
-
-    /// Bytes the canvas has retained so far.
-    pub fn used(&self) -> usize {
-        self.used
-    }
-
    /// True once the item cap is hit; the readers stop there and keep what they have.
    pub fn full(&self) -> bool {
        self.full
@@ -399,12 +385,6 @@ impl Canvas {
        }
    }

-    /// Records the bytes another part of the player retains, so the items and they stay within
-    /// [`MAX_BYTES`] together.
-    pub fn hold(&mut self, bytes: usize) {
-        self.held = bytes;
-    }
-
    fn push_raw(&mut self, mut raw: Raw) {
        if self.clip.as_ref().is_some_and(Vec::is_empty) {
            return;
@@ -422,7 +402,7 @@ impl Canvas {
            Raw::Bitmap { img, .. } => img.px.len(),
            Raw::Text { text: t, .. } => t.text.len() + t.dx.len() * 4 + t.font.family.len() + 128,
        } + region_cost;
-        if self.items.len() >= MAX_ITEMS || self.used.saturating_add(self.held).saturating_add(cost) > MAX_BYTES {
+        if self.items.len() >= MAX_ITEMS || self.used.saturating_add(cost) > MAX_BYTES {
            self.full = true;
        } else {
            self.used += cost;
@@ -571,10 +551,6 @@ impl Canvas {
    /// of at most [`SHADE_RES`] cells on the longer side, laid out so that its one repeat covers
    /// the shape.
    pub fn shade_shape(&mut self, ops: &[Op], shade: &dyn Fn(P) -> [u8; 4]) {
-        // A full canvas or an empty clip keeps nothing more, so do not sample a tile for it.
-        if self.full || self.clip.as_ref().is_some_and(Vec::is_empty) {
-            return;
-        }
        let dev: Vec<Op> = ops.iter().map(|o| self.map_op(*o)).collect();
        let Some([l, t, r, b]) = crate::cliprect::ops_bbox(&dev) else { return };
        let side = (r - l).max(b - t);
@@ -690,7 +666,7 @@ impl Canvas {
        // A pattern brush's pixels count against the byte budget like drawn items.
        if let Obj::Brush(Brush { pattern: Some(p), .. }) = &obj {
            let cost = p.px.len();
-            if self.used.saturating_add(self.held).saturating_add(cost) > MAX_BYTES {
+            if self.used.saturating_add(cost) > MAX_BYTES {
                self.full = true;
                return;
            }
@@ -11,14 +11,6 @@ use crate::geom::{Op, P};
 /// Line segments per Bézier when a crossing shape is flattened.
 const CURVE_STEPS: usize = 16;

-/// Point-against-edge tests one clipped item may cost (all its subpaths together); an item over
-/// it is dropped, as a single polygon over it already was.
-const MAX_CLIP_WORK: usize = 1_000_000;
-
-/// The same allowance for intersecting two clip regions, a budget of its own: two convex
-/// 1,000-gons cost about 1.5 million tests once the cut polygon has grown.
-pub(crate) const MAX_AREA_CLIP_WORK: usize = 4 * MAX_CLIP_WORK;
-
 /// The bounding box `[l, t, r, b]` of the points in `ops` (control points included).
 pub(crate) fn ops_bbox(ops: &[Op]) -> Option<[f64; 4]> {
    let mut b: Option<[f64; 4]> = None;
@@ -106,18 +98,16 @@ fn is_rect(clip: &[P]) -> bool {
    pts_bbox(clip).is_some_and(|b| clip.len() == 4 && clip.iter().all(|p| (p.0 == b[0] || p.0 == b[2]) && (p.1 == b[1] || p.1 == b[3])))
 }

-/// Sutherland–Hodgman: `poly` cut by convex `clip`, charging each point visited against each clip
-/// edge to `budget`: the polygon
-/// can gain a vertex at every edge, so its cost isn't known from its input size alone. `None`
-/// once the budget is spent.
-pub(crate) fn clip_polygon_within(poly: &[P], clip: &[P], budget: &mut usize) -> Option<Vec<P>> {
+/// Sutherland–Hodgman: `poly` cut by convex `clip`.
+pub(crate) fn clip_polygon(poly: &[P], clip: &[P]) -> Vec<P> {
+    if poly.len().saturating_mul(clip.len()) > 1_000_000 {
+        return Vec::new();
+    }
    let mut poly = poly.to_vec();
    for i in 0..clip.len() {
-        // The work actually done: this edge visits the polygon as it now stands.
-        if poly.len() > *budget {
-            return None;
+        if poly.len().saturating_mul(clip.len() - i) > 1_000_000 {
+            return Vec::new();
        }
-        *budget -= poly.len();
        let (a, b) = (clip[i], clip[(i + 1) % clip.len()]);
        let keep = |p: P| cross(a, b, p) >= 0.0;
        let cut = |p: P, q: P| {
@@ -143,7 +133,7 @@ pub(crate) fn clip_polygon_within(poly: &[P], clip: &[P], budget: &mut usize) ->
            break;
        }
    }
-    Some(poly)
+    poly
 }

 fn disjoint(b: [f64; 4], c: [f64; 4]) -> bool {
@@ -168,17 +158,15 @@ pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
                return Vec::new();
            }
            let subs = flatten(&ops);
-            // One allowance for the fill and the stroke together; the item goes once it is spent.
-            let mut budget = MAX_CLIP_WORK;
            let mut out = Vec::new();
            if fill.is_some() {
-                let Some(f) = clip_fill(&subs, clip, &mut budget) else { return Vec::new() };
+                let f = clip_fill(&subs, clip);
                if !f.is_empty() {
                    out.push(Raw::Path { ops: f, fill, stroke: None, even_odd, region: region.clone() });
                }
            }
            if stroke.is_some() {
-                let Some(s) = clip_stroke(&subs, clip, &mut budget) else { return Vec::new() };
+                let s = clip_stroke(&subs, clip);
                if !s.is_empty() {
                    out.push(Raw::Path { ops: s, fill: None, stroke, even_odd, region });
                }
@@ -193,8 +181,7 @@ pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
            if disjoint(b, cb) {
                return Vec::new();
            }
-            let subs = flatten(&ops);
-            let f = clip_fill(&subs, clip, &mut { MAX_CLIP_WORK }).unwrap_or_default();
+            let f = clip_fill(&flatten(&ops), clip);
            if f.is_empty() { Vec::new() } else { vec![Raw::Pattern { ops: f, even_odd, tile, region }] }
        }
        Raw::Bitmap { rect, img, region } => crop(rect, img, clip).map(|(rect, img)| vec![Raw::Bitmap { rect, img, region }]).unwrap_or_default(),
@@ -243,23 +230,20 @@ pub(crate) fn flatten(ops: &[Op]) -> Vec<(Vec<P>, bool)> {
    subs
 }

-/// The clipped fill of every subpath, its clipping work charged to `budget` with that of the
-/// stroke: `None` (the whole item goes) once it is spent.
-fn clip_fill(subs: &[(Vec<P>, bool)], clip: &[P], budget: &mut usize) -> Option<Vec<Op>> {
+fn clip_fill(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {
    let mut ops = Vec::new();
    for (pts, _) in subs {
-        let poly = clip_polygon_within(pts, clip, budget)?;
+        let poly = clip_polygon(pts, clip);
        if poly.len() >= 3 {
            ops.push(Op::M(poly[0]));
            ops.extend(poly[1..].iter().map(|p| Op::L(*p)));
            ops.push(Op::Z);
        }
    }
-    Some(ops)
+    ops
 }

-/// The clipped outline of every subpath; `None` once `budget` is spent.
-fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P], budget: &mut usize) -> Option<Vec<Op>> {
+fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {
    let mut ops = Vec::new();
    for (pts, closed) in subs {
        let mut pts = pts.clone();
@@ -268,7 +252,7 @@ fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P], budget: &mut usize) -> Optio
        }
        let mut last: Option<P> = None;
        for w in pts.windows(2) {
-            let Some((a, b)) = segment(w[0], w[1], clip, budget)? else {
+            let Some((a, b)) = segment(w[0], w[1], clip) else {
                last = None;
                continue;
            };
@@ -279,23 +263,21 @@ fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P], budget: &mut usize) -> Optio
            last = Some(b);
        }
    }
-    Some(ops)
+    ops
 }

-/// Cyrus–Beck: the part of segment `a`–`b` inside convex `clip`, one unit of `budget` per clip edge
-/// visited; the outer `None` is a spent budget.
-fn segment(a: P, b: P, clip: &[P], budget: &mut usize) -> Option<Option<(P, P)>> {
+/// Cyrus–Beck: the part of segment `a`–`b` inside convex `clip`.
+fn segment(a: P, b: P, clip: &[P]) -> Option<(P, P)> {
    let d = (b.0 - a.0, b.1 - a.1);
    let (mut t0, mut t1) = (0.0f64, 1.0f64);
    for i in 0..clip.len() {
-        *budget = budget.checked_sub(1)?;
        let (e0, e1) = (clip[i], clip[(i + 1) % clip.len()]);
        // Inside is cross(e0, e1, p) >= 0, linear in t along the segment.
        let f0 = cross(e0, e1, a);
        let df = (e1.0 - e0.0) * d.1 - (e1.1 - e0.1) * d.0;
        if df == 0.0 {
            if f0 < 0.0 {
-                return Some(None);
+                return None;
            }
        } else {
            let t = -f0 / df;
@@ -306,7 +288,7 @@ fn segment(a: P, b: P, clip: &[P], budget: &mut usize) -> Option<Option<(P, P)>>
            }
        }
    }
-    Some((t0 <= t1).then_some(((a.0 + d.0 * t0, a.1 + d.1 * t0), (a.0 + d.0 * t1, a.1 + d.1 * t1))))
+    (t0 <= t1).then_some(((a.0 + d.0 * t0, a.1 + d.1 * t0), (a.0 + d.0 * t1, a.1 + d.1 * t1)))
 }

 /// Crops a bitmap drawn into `rect` = `[x, y, w, h]` (device, positive extents) to the clip
@@ -28,7 +28,7 @@ use std::sync::Arc;
 use crate::bytes::Bytes;
 use crate::canvas::Raw;
 use crate::canvas::{BS_NULL, BS_SOLID, Brush, Canvas, LogFont, PS_NULL, Pen, RawTile, Xform, hatch_tile, mul};
-use crate::cliprect::{MAX_AREA_CLIP_WORK, clip_polygon_within, convex, flatten, ops_bbox, pts_bbox, rect_poly};
+use crate::cliprect::{clip_polygon, convex, flatten, ops_bbox, pts_bbox, rect_poly};
 use crate::dib::Rgba;
 use crate::geom::{Op, P};
 use crate::text::{ETO_CLIPPED, Font};
@@ -288,23 +288,13 @@ impl Plus {
        if !self.active {
            return None;
        }
-        let done = match typ {
-            0x4008 => self.object(flags, r, cv.used().saturating_add(self.clip_bytes())),
+        match typ {
+            0x4008 => self.object(flags, r),
            0x4009 | 0x4013 | 0x401A..=0x401C | 0x4036 => self.record_image_text_region(cv, typ, flags, r),
            0x4025..=0x4035 => self.record_state(cv, typ, flags, r),
            0x4010..=0x4012 | 0x4016..=0x4019 => self.record_curve(cv, typ, flags, r),
            _ => self.record_shape(cv, typ, flags, r),
-        };
-        // What this player retains (objects, a continued object's pieces, the current and saved
-        // clips) shares the canvas's byte budget; clip changes are charged as they happen.
-        cv.hold(self.object_bytes.saturating_add(self.partial.as_ref().map_or(0, |p| p.data.len())).saturating_add(self.clip_bytes()));
-        done
-    }
-
-    /// Bytes of the current clip and of every saved one.
-    fn clip_bytes(&self) -> usize {
-        let area = |a: &Area| a.as_ref().map_or(0, |v| v.len().saturating_mul(std::mem::size_of::<P>()));
-        self.stack.iter().map(|s| area(&s.clip)).fold(area(&self.clip), usize::saturating_add)
+        }
    }

    /// Rectangle, polygon, ellipse and path records.
@@ -569,7 +559,7 @@ impl Plus {
        Some(())
    }

-    fn object(&mut self, flags: u16, r: Bytes, canvas_used: usize) -> Option<()> {
+    fn object(&mut self, flags: u16, r: Bytes) -> Option<()> {
        let id = usize::from(flags & 0xFF);
        let kind = (flags >> 8) & 0x7F;
        if flags & 0x8000 != 0 {
@@ -585,7 +575,7 @@ impl Plus {
            p.data.extend_from_slice(&chunk[..chunk.len().min(room)]);
            if p.data.len() >= p.total {
                let obj = parse_object(p.kind, Bytes(&p.data));
-                self.store(p.id, obj, canvas_used);
+                self.store(p.id, obj);
            } else {
                self.partial = Some(p);
            }
@@ -599,23 +589,22 @@ impl Plus {
            let room = p.total.saturating_sub(p.data.len());
            p.data.extend_from_slice(&r.0[..r.0.len().min(room)]);
            let obj = parse_object(kind, Bytes(&p.data));
-            self.store(id, obj, canvas_used);
+            self.store(id, obj);
            return Some(());
        }
        let obj = parse_object(kind, r);
-        self.store(id, obj, canvas_used);
+        self.store(id, obj);
        Some(())
    }

-    /// `canvas_used` is what the canvas already retains: objects and items share one budget.
-    fn store(&mut self, id: usize, obj: Option<Obj>, canvas_used: usize) {
+    fn store(&mut self, id: usize, obj: Option<Obj>) {
        let Some(slot) = self.objects.get_mut(id) else { return };
        if let Some(old) = slot.take() {
            self.object_bytes = self.object_bytes.saturating_sub(Self::obj_cost(&old));
        }
        if let Some(new_obj) = obj {
            let cost = Self::obj_cost(&new_obj);
-            if self.object_bytes.saturating_add(cost).saturating_add(canvas_used) <= crate::MAX_BYTES {
+            if self.object_bytes.saturating_add(cost) <= crate::MAX_BYTES {
                self.object_bytes += cost;
                *slot = Some(new_obj);
            }
@@ -626,7 +615,7 @@ impl Plus {
        match obj {
            Obj::Image(img) => match img.as_ref() {
                ImageData::Bitmap(rgba) => rgba.px.len(),
-                ImageData::Meta(pic) => picture_cost(&pic.items),
+                ImageData::Meta(pic) => pic.items.len().saturating_mul(128),
            },
            Obj::Brush(Fill::Texture { img, .. }) => img.px.len(),
            Obj::Path(ops) => ops.len().saturating_mul(std::mem::size_of::<Op>()),
@@ -1181,13 +1170,7 @@ fn area_of_ops(ops: &[Op]) -> Vec<P> {
 fn area_intersect(a: Area, b: Area) -> Area {
    match (a, b) {
        (None, x) | (x, None) => x,
-        (Some(a), Some(b)) if a.len() >= 3 && b.len() >= 3 => {
-            // Out of work: keep the area so far rather than call the region empty.
-            match clip_polygon_within(&a, &b, &mut { MAX_AREA_CLIP_WORK }) {
-                Some(p) => Some(convex(&p).unwrap_or_default()),
-                None => Some(a),
-            }
-        }
+        (Some(a), Some(b)) if a.len() >= 3 && b.len() >= 3 => Some(convex(&clip_polygon(&a, &b)).unwrap_or_default()),
        _ => Some(Vec::new()),
    }
 }
@@ -1293,33 +1276,6 @@ fn metafile(r: Bytes) -> Option<Picture> {
    pic.filter(|p| p.width > 0.0 && p.height > 0.0)
 }

-/// Bytes the items of a nested picture own: path segments, clip rectangles, pixels and text, with
-/// each shared pattern tile counted once.
-fn picture_cost(items: &[crate::Item]) -> usize {
-    use crate::Item;
-    let region = |r: &Option<Vec<[f32; 4]>>| r.as_ref().map_or(0, |v| v.len().saturating_mul(16));
-    let mut tiles = std::collections::HashSet::new();
-    let mut total = 0usize;
-    for item in items {
-        let own = match item {
-            Item::Path { segs, region: r, .. } => segs.len().saturating_mul(std::mem::size_of::<crate::Seg>()).saturating_add(region(r)),
-            Item::Bitmap { rgba, region: r, .. } => rgba.len().saturating_add(region(r)),
-            Item::Pattern { segs, tile, region: r, .. } => {
-                let tile_bytes = if tiles.insert(Arc::as_ptr(tile)) { tile.rgba.len() } else { 0 };
-                segs.len().saturating_mul(std::mem::size_of::<crate::Seg>()).saturating_add(tile_bytes).saturating_add(region(r))
-            }
-            Item::Text(t) => t
-                .text
-                .len()
-                .saturating_add(t.dx.len().saturating_mul(std::mem::size_of::<f32>()))
-                .saturating_add(t.font.family.len())
-                .saturating_add(region(&t.region)),
-        };
-        total = total.saturating_add(128).saturating_add(own);
-    }
-    total
-}
-
 fn bitmap(r: Bytes) -> Option<Rgba> {
    let (w, h, stride) = (r.u32(8)? as i32, r.u32(12)? as i32, r.u32(16)? as i32);
    let format = r.u32(20)?;
@@ -1597,45 +1553,3 @@ fn wrap_line(line: &[u16], width: f64, em: f64) -> Vec<Vec<u16>> {
    out.push(cur);
    out
 }
-
-#[cfg(test)]
-mod cost_tests {
-    use super::*;
-    use crate::{Item, Seg, Tile};
-
-    #[test]
-    fn a_shared_pattern_tile_is_charged_once() {
-        let tile = Arc::new(Tile { width: 512, height: 512, rgba: vec![0; 1 << 20], cell: [1.0, 1.0], origin: [0.0, 0.0] });
-        let item = || Item::Pattern { segs: vec![Seg::Move(0.0, 0.0), Seg::Line(1.0, 1.0)], even_odd: false, tile: tile.clone(), region: None };
-        let items: Vec<Item> = (0..257).map(|_| item()).collect();
-        assert!(picture_cost(&items) < 2 << 20, "{}", picture_cost(&items));
-    }
-
-    #[test]
-    fn pieces_of_a_continued_object_count_against_the_shared_budget() {
-        let (mut plus, mut cv) = (Plus::new(), Canvas::new());
-        plus.active = true;
-        // Image object (kind 5), id 0, continued: 1000 bytes announced, 100 delivered.
-        let mut rec = 1000u32.to_le_bytes().to_vec();
-        rec.extend([0u8; 100]);
-        plus.record(&mut cv, 0x4008, 0x8000 | (5 << 8), Bytes(&rec));
-        assert_eq!(cv.held(), 100);
-    }
-
-    #[test]
-    fn current_and_saved_clips_count_against_the_shared_budget() {
-        let (mut plus, mut cv) = (Plus::new(), Canvas::new());
-        plus.active = true;
-        let pts = vec![(0.0, 0.0); 1000];
-        plus.clip = Some(pts.clone());
-        plus.stack.push(Saved { id: 1, world: IDENTITY, page: 1.0, clip: Some(pts) });
-        // Any record refreshes the held count (an unknown record draws nothing).
-        plus.record(&mut cv, 0x40FF, 0, Bytes(&[]));
-        assert_eq!(cv.held(), 2 * 1000 * std::mem::size_of::<P>());
-        // Restoring the saved state releases the charge of what it dropped.
-        plus.stack.clear();
-        plus.clip = None;
-        plus.record(&mut cv, 0x40FF, 0, Bytes(&[]));
-        assert_eq!(cv.held(), 0);
-    }
-}
@@ -58,7 +58,6 @@ impl Picture {
        let k = (c[0].abs() + c[3].abs()) / 2.0;
        let mut out = Vec::with_capacity(self.items.len());
        let mut total_elements = 0usize;
-        let region_elements = std::cell::Cell::new(0usize);
        let mut cached_region: Option<(*const [f32; 4], usize, Option<Option<Arc<BezPath>>>)> = None;
        let mut get_region = |reg: &Option<Vec<[f32; 4]>>| -> Option<Option<Arc<BezPath>>> {
            let (ptr, len) = match reg {
@@ -72,15 +71,12 @@ impl Picture {
                return res.clone();
            }
            let res = placed_region(&tf, reg);
-            // Each distinct clip region is expanded once; its elements count against the placement budget.
-            let n = res.as_ref().and_then(Option::as_ref).map_or(0, |p| p.elements().len());
-            region_elements.set(region_elements.get().saturating_add(n));
            cached_region = Some((ptr, len, res.clone()));
            res
        };

        for (index, item) in self.items.iter().enumerate() {
-            if total_elements.saturating_add(region_elements.get()) >= MAX_PLACED_ELEMENTS {
+            if total_elements >= MAX_PLACED_ELEMENTS {
                break;
            }
            match item {
@@ -88,10 +84,6 @@ impl Picture {
                    let path = tf * bez(segs);
                    let Some(region) = get_region(region) else { continue };
                    if in_range(path.bounding_box()) {
-                        // This item's own region is expanded by now: it counts before it is kept.
-                        if total_elements.saturating_add(path.elements().len()).saturating_add(region_elements.get()) > MAX_PLACED_ELEMENTS {
-                            break;
-                        }
                        total_elements = total_elements.saturating_add(path.elements().len());
                        let stroke = stroke.map(|(c, w)| (c, f64::from(w) * k));
                        out.push(PlacedItem::Path { path, fill: *fill, stroke, even_odd: *even_odd, region });
@@ -105,9 +97,6 @@ impl Picture {
                        * Affine::scale_non_uniform(f64::from(t.cell[0]), f64::from(t.cell[1]));
                    let det = tile.determinant();
                    if in_range(path.bounding_box()) && det.is_finite() && det.abs() > 1e-12 {
-                        if total_elements.saturating_add(path.elements().len()).saturating_add(region_elements.get()) > MAX_PLACED_ELEMENTS {
-                            break;
-                        }
                        total_elements = total_elements.saturating_add(path.elements().len());
                        out.push(PlacedItem::Pattern { index, path, even_odd: *even_odd, tile, region });
                    }
@@ -897,24 +897,6 @@ fn place_fits_the_frame_scales_strokes_and_drops_far_paths() {
    assert_eq!(stroke.map(|s| s.1), Some(8.0));
 }

-#[test]
-fn place_counts_the_items_own_clip_region_before_keeping_it() {
-    // A path of 499,998 elements nearly fills the 500,000 budget; a second one whose new clip
-    // region adds elements goes past it and is left out.
-    let mut segs = vec![Seg::Move(0.0, 0.0)];
-    segs.extend((0..499_997).map(|i| Seg::Line(1.0 + (i % 50) as f32, 1.0)));
-    let big = Item::Path { segs, fill: None, stroke: None, even_odd: false, region: None };
-    let small = Item::Path {
-        segs: vec![Seg::Move(0.0, 0.0), Seg::Line(1.0, 1.0)],
-        fill: None,
-        stroke: None,
-        even_odd: false,
-        region: Some(vec![[0.0, 0.0, 50.0, 25.0], [10.0, 10.0, 20.0, 20.0]]),
-    };
-    let pic = crate::Picture { width: 100.0, height: 50.0, items: vec![big, small] };
-    assert_eq!(pic.place(kurbo::Rect::new(0.0, 0.0, 100.0, 50.0), [0.0; 4]).len(), 1);
-}
-
 #[test]
 fn place_keeps_only_finite_bounded_bitmaps_with_area() {
    let bitmap = |rect: [f32; 4]| Item::Bitmap { rect, width: 1, height: 1, rgba: vec![0; 4], region: None };
@@ -2089,108 +2071,6 @@ fn emfplus_wrap_line_linear_performance() {
 fn clip_polygon_work_bound() {
    let poly: Vec<(f64, f64)> = (0..2000).map(|i| (i as f64, i as f64)).collect();
    let clip: Vec<(f64, f64)> = (0..2000).map(|i| (i as f64, i as f64)).collect();
-    assert!(crate::cliprect::clip_polygon_within(&poly, &clip, &mut 1_000_000).is_none(), "excessive polygon clip product rejected");
-}
-
-#[test]
-fn clip_polygon_charges_actual_work_not_projected_growth() {
-    // Two convex 1,000-gons: the product is exactly the budget, and a cut that adds a vertex must
-    // not make a later step look over budget.
-    let gon = |cx: f64| -> Vec<(f64, f64)> {
-        (0..1000).map(|i| (i as f64 / 1000.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (cx + 100.0 * c, 100.0 * s)).collect()
-    };
-    let clipped = crate::cliprect::clip_polygon_within(&gon(0.0), &gon(30.0), &mut 4_000_000).unwrap();
-    assert!(clipped.len() > 100, "the intersection is kept: {}", clipped.len());
-}
-
-#[test]
-fn clip_work_is_shared_by_fill_and_stroke() {
-    use crate::canvas::Raw;
-    use crate::geom::Op;
-    // One zigzag subpath crossing a 512-gon's edge: about 510k point-edge tests per pass, so a
-    // fill alone fits the allowance but a fill plus a stroke would spend it twice.
-    let clip: Vec<(f64, f64)> =
-        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
-    let mut ops = vec![Op::M((0.0, 95.0))];
-    ops.extend((1..1000).map(|i| Op::L((i as f64 * 0.19, if i % 2 == 0 { 95.0 } else { 300.0 }))));
-    ops.push(Op::Z);
-    let raw = |fill, stroke| Raw::Path { ops: ops.clone(), fill, stroke, even_odd: false, region: None };
-    let black = [0, 0, 0, 255];
-    assert!(!crate::cliprect::clip_raw(raw(Some(black), None), &clip).is_empty(), "a fill alone is within the allowance");
-    assert!(crate::cliprect::clip_raw(raw(Some(black), Some((black, 1.0))), &clip).is_empty(), "fill and stroke share one allowance");
-}
-
-#[test]
-fn clip_work_is_bounded_across_subpaths() {
-    use crate::canvas::Raw;
-    use crate::geom::Op;
-    // 512-gon clip; 4,000 small triangles crossing its edge: each under the per-polygon cap, together
-    // far over it, for both the fill and the stroke.
-    let clip: Vec<(f64, f64)> =
-        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
-    let tri = |x: f64| [Op::M((x, 95.0)), Op::L((x + 1.0, 95.0)), Op::L((x, 300.0)), Op::Z];
-    let many: Vec<Op> = (0..4000).flat_map(|i| tri(i as f64 % 200.0)).collect();
-    let raw = |ops| Raw::Path { ops, fill: Some([0, 0, 0, 255]), stroke: Some(([0, 0, 0, 255], 1.0)), even_odd: false, region: None };
-    assert!(crate::cliprect::clip_raw(raw(many), &clip).is_empty(), "the whole item's clipping work is bounded");
-    assert_eq!(crate::cliprect::clip_raw(raw(tri(100.0).to_vec()), &clip).len(), 2, "a small crossing shape is still clipped");
-}
-
-/// Clipping a fill can add a vertex at every clip edge, so a polygon's work isn't its input size:
-/// shapes that pass the up-front estimate but grow while clipped are charged as they grow, against
-/// one budget for the whole item.
-#[test]
-fn growing_fill_clips_share_one_budget() {
-    use crate::canvas::Raw;
-    use crate::geom::Op;
-    let clip: Vec<(f64, f64)> =
-        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
-    // A triangle around the whole circle: clipped, it becomes the 512-gon, about 130,000 steps.
-    let tri = [Op::M((-1000.0, -1000.0)), Op::L((1000.0, -1000.0)), Op::L((100.0, 1000.0)), Op::Z];
-    let raw = |n: usize| Raw::Path { ops: tri.repeat(n), fill: Some([0, 0, 0, 255]), stroke: None, even_odd: false, region: None };
-    // 400 of them pass the estimate (400 x 4 x 512 is under a million) but cost about 52 million.
-    assert!(crate::cliprect::clip_raw(raw(400), &clip).is_empty(), "the growing work is charged");
-    assert_eq!(crate::cliprect::clip_raw(raw(2), &clip).len(), 1, "a couple of them are still clipped");
-}
-
-#[test]
-fn stroke_work_is_charged_and_outside_items_are_cheap() {
-    use crate::canvas::Raw;
-    use crate::geom::Op;
-    let clip: Vec<(f64, f64)> =
-        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
-    // A stroke-only zigzag of 4,000 segments across the edge: 4,000 x 512 tests, over the allowance.
-    let mut ops = vec![Op::M((0.0, 95.0))];
-    ops.extend((1..4000).map(|i| Op::L((i as f64 * 0.05, if i % 2 == 0 { 95.0 } else { 300.0 }))));
-    let raw = Raw::Path { ops, fill: None, stroke: Some(([0, 0, 0, 255], 1.0)), even_odd: false, region: None };
-    assert!(crate::cliprect::clip_raw(raw, &clip).is_empty(), "stroke work is bounded");
-}
-
-#[test]
-fn region_intersection_over_budget_keeps_the_previous_area() {
-    let gon = |cx: f64| -> Vec<(f64, f64)> {
-        (0..1000).map(|i| (i as f64 / 1000.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (cx + 100.0 * c, 100.0 * s)).collect()
-    };
-    assert!(crate::cliprect::clip_polygon_within(&gon(0.0), &gon(30.0), &mut 10).is_none());
-    assert!(crate::cliprect::clip_polygon_within(&gon(0.0), &gon(30.0), &mut crate::cliprect::MAX_AREA_CLIP_WORK.clone()).is_some());
-}
-
-#[test]
-fn full_canvas_does_not_sample_gradient_tiles() {
-    let mut cv = Canvas::new();
-    let big = || Rgba { w: 1, h: 1, bottom_up: false, px: vec![0u8; MAX_BYTES / 2] };
-    for _ in 0..3 {
-        cv.bitmap([0.0, 0.0, 1.0, 1.0], big());
-    }
-    assert!(cv.full());
-    cv.shade_shape(&crate::geom::rect(0.0, 0.0, 10.0, 10.0), &|_| panic!("sampled a full canvas"));
-    assert_eq!(cv.items.len(), 2);
-}
-
-#[test]
-fn canvas_budget_counts_bytes_held_elsewhere() {
-    let mut cv = Canvas::new();
-    cv.hold(MAX_BYTES - 100);
-    cv.bitmap([0.0, 0.0, 1.0, 1.0], Rgba { w: 1, h: 1, bottom_up: false, px: vec![0u8; 200] });
-    assert!(cv.full());
-    assert!(cv.items.is_empty());
+    let clipped = crate::cliprect::clip_polygon(&poly, &clip);
+    assert!(clipped.is_empty(), "excessive polygon clip product rejected");
 }
@@ -392,9 +392,6 @@ pub struct Chart {
    /// Original chart XML part kept for round-trip of unmodelled options.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub raw: Option<String>,
-    /// The chart was too large to model: `raw` and `kept` are written back unchanged on save.
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub verbatim: bool,
    /// Package parts the original chart still points at (embedded workbook, styles, drawings).
    /// The PPTX writer clears this before comparing modelled state. Native saves keep it too.
    #[serde(skip_serializing_if = "ChartKept::is_empty")]
@@ -488,7 +485,6 @@ impl Default for Chart {
            bin_count: None,
            bin_size: None,
            raw: None,
-            verbatim: false,
            kept: ChartKept::default(),
        }
    }
@@ -1315,7 +1311,6 @@ impl Chart {
            series: vec![],
            gap_width: 0.0,
            raw: None,
-            verbatim: false,
            subtotals: vec![],
            ..self.clone()
        };
@@ -498,11 +498,6 @@ pub fn next_case(s: &str) -> &'static str {
    }
 }

-/// Whether the `.` at `i` sits between two ASCII digits (a decimal point or version number).
-fn is_decimal_point(all: &[char], i: usize) -> bool {
-    i > 0 && all[i - 1].is_ascii_digit() && all.get(i + 1).is_some_and(|n| n.is_ascii_digit())
-}
-
 /// Change case: `upper`, `lower`, `sentence`, `title`, `toggle`.
 pub fn change_case(s: &str, mode: &str) -> String {
    change_case_parts(&[s], mode).concat()
@@ -537,7 +532,7 @@ pub fn change_case_parts(parts: &[&str], mode: &str) -> Vec<String> {
                    } else {
                        out.extend(c.to_lowercase());
                    }
-                    if (title && c.is_whitespace()) || (!title && matches!(c, '.' | '!' | '?') && !(c == '.' && is_decimal_point(&all, i))) {
+                    if (title && c.is_whitespace()) || (!title && matches!(c, '.' | '!' | '?')) {
                        start = true;
                    }
                }
@@ -563,13 +558,6 @@ mod tests {
        assert_eq!(change_case("ΟΔΟΣ", "lower"), "οδος");
    }

-    #[test]
-    fn sentence_case_decimal_point_is_not_a_boundary() {
-        assert_eq!(change_case("I HAVE 3.5 APPLES", "sentence"), "I have 3.5 apples");
-        assert_eq!(change_case_parts(&["V 1.", "2 BETA"], "sentence").concat(), "V 1.2 beta");
-        assert_eq!(change_case("HELLO. WORLD", "sentence"), "Hello. World");
-    }
-
    #[test]
    fn title_sigma_across_runs_is_not_final() {
        assert_eq!(change_case_parts(&["ΟΔΟΣ", "ΑΣ"], "title"), ["Οδοσ", "ας"]);
@@ -4,7 +4,7 @@
 use deckcraft_color::{ColorScheme, Rgba, SchemeSlot};
 use deckcraft_geom::Xfrm;

-use crate::style::{ColorRef, Effects, Fill, Line, ShapeStyle};
+use crate::style::{ColorRef, Effects, Fill, Line};
 use crate::text::{Anchor, AutoFit, BodyProps, LevelStyle, ListStyle, ParaProps, RunProps};
 use crate::{Background, Layout, Master, PhType, Presentation, Shape, Slide};

@@ -218,68 +218,6 @@ pub fn effects(ctx: &Ctx, shape: &Shape) -> (Option<Effects>, Option<Rgba>) {
    (None, None)
 }

-/// Turn a placeholder into a regular shape that looks the same: what it inherited from its layout
-/// and master placeholders (position, fill, line, effects, style, body properties and the text
-/// style of every outline level, the master's title or body style included) becomes its own, and
-/// `ph` is cleared. A shape that is not a placeholder is left as it is.
-///
-/// Theme references (`+mj-lt`, scheme colours) stay references, so the copy still follows the
-/// destination theme, as PowerPoint's default paste does.
-pub fn detach_placeholder(ctx: &Ctx, shape: &mut Shape) {
-    if shape.ph.is_none() {
-        return;
-    }
-    // The text first: `level_style` reads the shape's own style, which changes below.
-    let text = shape.text.as_ref().map(|_| (body(ctx, shape), (0..9).map(|l| Some(level_style(ctx, shape, l))).collect::<Vec<_>>()));
-    let own = shape.clone();
-    let (lp, mp) = parents(ctx, &own);
-    let chain = [Some(&own), lp, mp].into_iter().flatten();
-
-    // Each property comes from where `fill`, `line` and `effects` take it: the first shape in the
-    // chain with an explicit value or a style. Lines merge explicit values up to the first styled
-    // shape, whose style line fills the rest.
-    let fill_src = chain.clone().find(|s| s.fill.is_some() || s.style.is_some());
-    let effects_src = chain.clone().find(|s| s.effects.is_some() || s.style.is_some());
-    let mut line = None;
-    let mut line_src = None;
-    for s in chain.clone() {
-        if let Some(l) = &s.line {
-            line.get_or_insert_with(Line::default).inherit(l);
-        }
-        if s.style.is_some() {
-            line_src = Some(s);
-            break;
-        }
-    }
-    // Text takes its font reference from the shape's style or its layout placeholder's (a table's
-    // from its own only), never the master's.
-    let table = matches!(own.kind, crate::ShapeKind::Table(_));
-    let font_src = own.style.as_ref().or(lp.filter(|_| !table).and_then(|s| s.style.as_ref()));
-
-    // One style for the copy, each reference taken from the shape that supplied that property. A
-    // property with an explicit value ignores its reference, except a gradient without stops,
-    // which takes them from its own shape's style; a neutral reference (index 0) adds nothing.
-    let style_of = |s: Option<&Shape>| s.and_then(|s| s.style.clone());
-    let neutral = (0, ColorRef::scheme(SchemeSlot::Tx1));
-    let style = chain.clone().any(|s| s.style.is_some()).then(|| ShapeStyle {
-        fill_ref: style_of(fill_src).map_or_else(|| neutral.clone(), |st| st.fill_ref),
-        line_ref: style_of(line_src).map_or_else(|| neutral.clone(), |st| st.line_ref),
-        effect_ref: style_of(effects_src).map_or_else(|| neutral.clone(), |st| st.effect_ref),
-        font_ref: font_src.map_or_else(|| ("none".into(), None), |st| st.font_ref.clone()),
-    });
-
-    shape.xfrm = Some(xfrm(ctx, &own));
-    shape.fill = fill_src.and_then(|s| s.fill.clone());
-    shape.effects = effects_src.and_then(|s| s.effects.clone());
-    shape.line = line;
-    shape.style = style;
-    if let (Some(t), Some((body, levels))) = (shape.text.as_mut(), text) {
-        t.body = body;
-        t.list_style = ListStyle { levels };
-    }
-    shape.ph = None;
-}
-
 /// Body properties with defaults filled in.
 pub fn body(ctx: &Ctx, shape: &Shape) -> BodyProps {
    let (lp, mp) = parents(ctx, shape);
@@ -314,7 +252,6 @@ pub fn body(ctx: &Ctx, shape: &Shape) -> BodyProps {
        compat_ln_spc: None,
        vert_overflow: None,
        horz_overflow: None,
-        raw3d: None,
    });
    b
 }
@@ -124,9 +124,6 @@ pub struct BodyProps {
    pub compat_ln_spc: Option<bool>,
    pub vert_overflow: Option<TextOverflow>,
    pub horz_overflow: Option<TextOverflow>,
-    /// Unmodelled 3-D XML on the text body (`a:scene3d`, `a:sp3d`, `a:flatTx`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub raw3d: Option<String>,
 }

 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -190,9 +187,6 @@ impl BodyProps {
        self.compat_ln_spc = self.compat_ln_spc.or(p.compat_ln_spc);
        self.vert_overflow = self.vert_overflow.or(p.vert_overflow);
        self.horz_overflow = self.horz_overflow.or(p.horz_overflow);
-        if self.raw3d.is_none() {
-            self.raw3d.clone_from(&p.raw3d);
-        }
    }
 }

@@ -337,31 +337,16 @@ fn fit_moving_avg(pairs: &[(f64, f64)], period: usize) -> Option<(Model, Vec<f64

 #[allow(clippy::needless_range_loop)]
 fn polyfit_with_intercept(xs: &[f64], ys: &[f64], order: usize, b0: f64) -> Option<Vec<f64>> {
-    // Fit `y - b0 = (x / sx) * q(u)` with `u = (x - xm) / su` and `q` of degree `order - 1`. The
-    // basis `(x / sx) * u^j` spans the same polynomials as `x^(j + 1)`, but keeps the pivots in
-    // `solve` independent of the units and the offset of x.
-    let n = xs.len() as f64;
-    let sx = xs.iter().fold(0.0_f64, |acc, x| acc.max(x.abs()));
-    if sx <= 0.0 || !sx.is_finite() {
-        return None;
-    }
-    let xm = xs.iter().sum::<f64>() / n;
-    let su = match xs.iter().fold(0.0_f64, |acc, x| acc.max((x - xm).abs())) {
-        s if s > 0.0 && s.is_finite() => s,
-        _ => 1.0,
-    };
    let m = order;
    let mut ata = vec![vec![0.0; m]; m];
    let mut atb = vec![0.0; m];
    for (x, y) in xs.iter().zip(ys) {
-        let v = x / sx;
-        let u = (x - xm) / su;
        let dy = y - b0;
        for i in 0..m {
-            let xi = v * u.powi(i as i32);
+            let xi = x.powi((i + 1) as i32);
            atb[i] += dy * xi;
            for j in i..m {
-                ata[i][j] += xi * v * u.powi(j as i32);
+                ata[i][j] += xi * x.powi((j + 1) as i32);
            }
        }
    }
@@ -370,11 +355,10 @@ fn polyfit_with_intercept(xs: &[f64], ys: &[f64], order: usize, b0: f64) -> Opti
            ata[i][j] = ata[j][i];
        }
    }
-    let centred: Vec<f64> = solve(ata, atb)?.iter().enumerate().map(|(k, c)| c / su.powi(k as i32)).collect();
-    let q = expand_shift(&centred, xm);
+    let solved = solve(ata, atb)?;
    let mut coeff = Vec::with_capacity(order + 1);
    coeff.push(b0);
-    coeff.extend(q.iter().map(|c| c / sx));
+    coeff.extend(solved);
    coeff.iter().all(|v| v.is_finite()).then_some(coeff)
 }

@@ -390,13 +374,7 @@ fn polyfit(xs: &[f64], ys: &[f64], order: usize, intercept: Option<f64>) -> Opti
        return polyfit_with_intercept(xs, ys, order, b0);
    }
    let xm = xs.iter().sum::<f64>() / n as f64;
-    // Scale the centred x to unit range so the pivot threshold in `solve` does not depend on the
-    // units of x.
-    let s = xs.iter().fold(0.0_f64, |acc, x| acc.max((x - xm).abs()));
-    if s <= 0.0 || !s.is_finite() {
-        return None;
-    }
-    let us: Vec<f64> = xs.iter().map(|x| (x - xm) / s).collect();
+    let us: Vec<f64> = xs.iter().map(|x| x - xm).collect();
    let m = order + 1;
    let mut ata = vec![vec![0.0; m]; m];
    let mut atb = vec![0.0; m];
@@ -415,7 +393,7 @@ fn polyfit(xs: &[f64], ys: &[f64], order: usize, intercept: Option<f64>) -> Opti
            ata[i][j] = ata[j][i];
        }
    }
-    let centred: Vec<f64> = solve(ata, atb)?.iter().enumerate().map(|(k, c)| c / s.powi(k as i32)).collect();
+    let centred = solve(ata, atb)?;
    let coeff = expand_shift(&centred, xm);
    coeff.iter().all(|v| v.is_finite()).then_some(coeff)
 }
@@ -593,49 +571,6 @@ mod tests {
        assert!((fit.y(3e-10).unwrap() - 3.0).abs() < 1e-6);
    }

-    #[test]
-    fn poly_fits_tiny_x_values() {
-        let xs = [1e-5, 2e-5, 3e-5, 4e-5, 5e-5];
-        let f = |x: f64| 1.0 + 2.0 * x + 3.0 * x * x;
-        let ys: Vec<f64> = xs.iter().map(|x| f(*x)).collect();
-        let fit = line(TrendlineType::Poly).fit(&xs, &ys).expect("poly fit of tiny x values");
-        assert!((fit.y(3e-5).unwrap() - f(3e-5)).abs() < 1e-9);
-        let big: Vec<f64> = xs.iter().map(|x| x * 1e5).collect();
-        let scaled = line(TrendlineType::Poly).fit(&big, &ys).expect("poly fit of scaled x values");
-        for x in xs {
-            assert!((fit.y(x).unwrap() - scaled.y(x * 1e5).unwrap()).abs() < 1e-9, "{x}");
-        }
-    }
-
-    #[test]
-    fn poly_with_intercept_fits_tiny_x_values() {
-        let xs = [1e-5, 2e-5, 3e-5, 4e-5, 5e-5];
-        let f = |x: f64| 1.0 + 2.0 * x + 3.0 * x * x;
-        let ys: Vec<f64> = xs.iter().map(|x| f(*x)).collect();
-        let mut poly = line(TrendlineType::Poly);
-        poly.intercept = Some(1.0);
-        let fit = poly.fit(&xs, &ys).expect("poly fit with intercept of tiny x values");
-        assert!((fit.y(3e-5).unwrap() - f(3e-5)).abs() < 1e-9);
-        let big: Vec<f64> = xs.iter().map(|x| x * 1e5).collect();
-        let scaled = poly.fit(&big, &ys).expect("poly fit with intercept of scaled x values");
-        for x in xs {
-            assert!((fit.y(x).unwrap() - scaled.y(x * 1e5).unwrap()).abs() < 1e-9, "{x}");
-        }
-    }
-
-    #[test]
-    fn poly_with_intercept_fits_offset_but_narrow_x_range() {
-        let xs = [45000.00, 45000.01, 45000.02, 45000.03, 45000.04];
-        let f = |x: f64| 1.0 + x * (1.0 + 100.0 * (x - 45000.02));
-        let ys: Vec<f64> = xs.iter().map(|x| f(*x)).collect();
-        let mut poly = line(TrendlineType::Poly);
-        poly.intercept = Some(1.0);
-        let fit = poly.fit(&xs, &ys).expect("poly fit with intercept of offset x values");
-        for x in xs {
-            assert!((fit.y(x).unwrap() - f(x)).abs() < 1e-2, "{x}");
-        }
-    }
-
    #[test]
    fn linear_fits_offset_but_narrow_x_range() {
        let xs = [45000.00, 45000.01, 45000.02, 45000.03, 45000.04];
@@ -0,0 +1,12 @@
+[package]
+name = "deckcraft-ogg"
+description = "Clean-room Ogg (RFC 3533) demuxer with Ogg Opus (RFC 7845) and Ogg Vorbis stream mapping"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
@@ -0,0 +1,575 @@
+//! Clean-room Ogg demuxer, written from RFC 3533 (the Ogg encapsulation format), RFC 7845 (Ogg
+//! Opus) and the Vorbis I specification's Ogg mapping (section A).
+//!
+//! [`open`] reads every page (capture pattern, header, lacing values, CRC-32 checked; damaged
+//! regions are skipped by searching for the next `OggS`), groups them by logical bitstream and
+//! assembles packets — including packets that continue across pages — as lists of byte ranges,
+//! with the granule position of the page each packet completes on. Codec headers (Opus:
+//! `OpusHead` + `OpusTags`; Vorbis: identification, comment, setup) are collected separately from
+//! the audio packets.
+//!
+//! [`OpusTiming`] implements RFC 7845 §4: packet start positions from granule positions and
+//! TOC-derived durations, the pre-skip, and end trimming of the final page, so a player can seek
+//! to any 48 kHz sample.
+//!
+//! Layer L0: no dependencies beyond `std`, no `unsafe`, builds for `wasm32-unknown-unknown`.
+
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
+use std::collections::HashMap;
+use std::fmt;
+use std::io;
+
+/// Random-access, read-only byte source (same shape as the other FilmCraft demuxers').
+pub trait ByteSource {
+    fn len(&self) -> u64;
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()>;
+    fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+impl ByteSource for [u8] {
+    fn len(&self) -> u64 {
+        <[u8]>::len(self) as u64
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        let eof = || io::Error::new(io::ErrorKind::UnexpectedEof, "read past end");
+        let a = usize::try_from(offset).map_err(|_| eof())?;
+        buf.copy_from_slice(self.get(a..a.checked_add(buf.len()).ok_or_else(eof)?).ok_or_else(eof)?);
+        Ok(())
+    }
+}
+
+impl ByteSource for Vec<u8> {
+    fn len(&self) -> u64 {
+        self.as_slice().len() as u64
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        self.as_slice().read_at(offset, buf)
+    }
+}
+
+impl<T: ByteSource + ?Sized> ByteSource for &T {
+    fn len(&self) -> u64 {
+        (**self).len()
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        (**self).read_at(offset, buf)
+    }
+}
+
+#[derive(Debug)]
+pub enum Error {
+    Io(io::Error),
+    /// No Ogg page found.
+    NotOgg,
+    Invalid(String),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Error::Io(e) => write!(f, "I/O error: {e}"),
+            Error::NotOgg => write!(f, "not an Ogg file"),
+            Error::Invalid(s) => write!(f, "invalid Ogg: {s}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+impl From<io::Error> for Error {
+    fn from(e: io::Error) -> Self {
+        Error::Io(e)
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+/// The capture pattern at the start of a file.
+pub fn sniff(head: &[u8]) -> bool {
+    head.len() >= 27 && &head[..4] == b"OggS" && head[4] == 0
+}
+
+/// CRC-32 of RFC 3533 §6: polynomial 0x04C11DB7, initial value 0, no reflection, no final XOR.
+pub fn crc32(data: &[u8]) -> u32 {
+    static TABLE: std::sync::OnceLock<[u32; 256]> = std::sync::OnceLock::new();
+    let t = TABLE.get_or_init(|| {
+        let mut t = [0u32; 256];
+        for (i, e) in t.iter_mut().enumerate() {
+            let mut r = (i as u32) << 24;
+            for _ in 0..8 {
+                r = if r & 0x8000_0000 != 0 { (r << 1) ^ 0x04C1_1DB7 } else { r << 1 };
+            }
+            *e = r;
+        }
+        t
+    });
+    data.iter().fold(0u32, |c, &b| (c << 8) ^ t[((c >> 24) as u8 ^ b) as usize])
+}
+
+/// The codec of a logical bitstream (from its first packet).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Codec {
+    Opus,
+    Vorbis,
+    Flac,
+    Theora,
+    Speex,
+    Unknown,
+}
+
+impl Codec {
+    fn of(first: &[u8]) -> Codec {
+        if first.starts_with(b"OpusHead") {
+            Codec::Opus
+        } else if first.starts_with(b"\x01vorbis") {
+            Codec::Vorbis
+        } else if first.starts_with(b"\x7fFLAC") {
+            Codec::Flac
+        } else if first.starts_with(b"\x80theora") {
+            Codec::Theora
+        } else if first.starts_with(b"Speex   ") {
+            Codec::Speex
+        } else {
+            Codec::Unknown
+        }
+    }
+    /// Header packets before the audio packets.
+    fn header_count(self) -> usize {
+        match self {
+            Codec::Opus => 2,
+            Codec::Vorbis | Codec::Theora => 3,
+            Codec::Speex => 2,
+            Codec::Flac | Codec::Unknown => 1,
+        }
+    }
+    pub fn name(self) -> &'static str {
+        match self {
+            Codec::Opus => "Opus",
+            Codec::Vorbis => "Vorbis",
+            Codec::Flac => "FLAC",
+            Codec::Theora => "Theora",
+            Codec::Speex => "Speex",
+            Codec::Unknown => "unknown",
+        }
+    }
+}
+
+/// A packet: its byte ranges (a packet may span pages) and the granule position of the page it
+/// completes on when it is that page's last completed packet.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Packet {
+    pub parts: Vec<(u64, u32)>,
+    pub size: u32,
+    /// Granule position of the completing page if this is the last packet completed on it.
+    pub granule: Option<i64>,
+    /// Index of the page (within the stream) the packet completes on.
+    pub page: u32,
+    /// The packet completes on the stream's end-of-stream page.
+    pub eos: bool,
+    /// The first bytes of the packet (TOC for Opus, packet type for Vorbis).
+    pub prefix: [u8; 2],
+}
+
+/// A logical bitstream.
+#[derive(Clone, Debug)]
+pub struct Stream {
+    pub serial: u32,
+    pub codec: Codec,
+    /// Codec header packets (contents).
+    pub headers: Vec<Vec<u8>>,
+    /// Data packets after the headers.
+    pub packets: Vec<Packet>,
+    pub pages: u32,
+    /// Granule position of the last page with one.
+    pub last_granule: Option<i64>,
+    pub saw_eos: bool,
+}
+
+/// An opened Ogg file.
+#[derive(Clone, Debug)]
+pub struct OggFile {
+    pub streams: Vec<Stream>,
+    /// Pages dropped for a bad CRC, lost sync, truncation…
+    pub warnings: Vec<String>,
+}
+
+/// Source bytes damage recovery may read per file: the windows the scan for the next capture
+/// pattern fills and the pages read only to find their CRC wrong.
+const RECOVERY_BUDGET: u64 = 32 << 20;
+/// Warnings kept per file (not counting the one about the budget); the rest are counted in one last entry.
+const MAX_WARNINGS: usize = 256;
+
+/// Record a warning, keeping at most `MAX_WARNINGS` and one entry saying the rest were dropped.
+fn warn(warnings: &mut Vec<String>, msg: String) {
+    match warnings.len().cmp(&MAX_WARNINGS) {
+        std::cmp::Ordering::Less => warnings.push(msg),
+        std::cmp::Ordering::Equal => warnings.push("further warnings omitted".into()),
+        std::cmp::Ordering::Greater => {}
+    }
+}
+
+struct Partial {
+    parts: Vec<(u64, u32)>,
+    size: u32,
+    prefix: Vec<u8>,
+}
+
+/// Read every page and assemble the packets of every logical bitstream.
+pub fn open(src: &(impl ByteSource + ?Sized)) -> Result<OggFile> {
+    let len = src.len();
+    let mut streams: Vec<Stream> = Vec::new();
+    let mut by_serial: HashMap<u32, usize> = HashMap::new();
+    let mut partial: HashMap<u32, Partial> = HashMap::new();
+    let mut warnings = Vec::new();
+    let mut pos = 0u64;
+    let mut found_any = false;
+    let mut hdr = [0u8; 27 + 255];
+    let mut scanner = CaptureScanner::new();
+    while pos + 27 <= len {
+        src.read_at(pos, &mut hdr[..27])?;
+        if &hdr[..4] != b"OggS" || hdr[4] != 0 {
+            match scanner.find(src, pos + 1, len)? {
+                Some(p) => {
+                    if found_any {
+                        warn(&mut warnings, format!("lost sync at byte {pos}; resumed at {p}"));
+                    }
+                    pos = p;
+                    continue;
+                }
+                None => break,
+            }
+        }
+        let nseg = hdr[26] as usize;
+        if pos + 27 + nseg as u64 > len {
+            warn(&mut warnings, format!("truncated page header at byte {pos}"));
+            break;
+        }
+        src.read_at(pos + 27, &mut hdr[27..27 + nseg])?;
+        let body_len: u64 = hdr[27..27 + nseg].iter().map(|&b| b as u64).sum();
+        let page_len = 27 + nseg as u64 + body_len;
+        if pos + page_len > len {
+            warn(&mut warnings, format!("truncated page at byte {pos}"));
+            break;
+        }
+        let mut page = vec![0u8; page_len as usize];
+        src.read_at(pos, &mut page)?;
+        let stored_crc = u32::from_le_bytes([page[22], page[23], page[24], page[25]]);
+        page[22..26].fill(0);
+        if crc32(&page) != stored_crc {
+            warn(&mut warnings, format!("bad CRC on page at byte {pos}"));
+            // a page read only to find it damaged is recovery work, charged like the scan's windows
+            if scanner.charge(page_len) {
+                break;
+            }
+            pos += 1;
+            continue;
+        }
+        found_any = true;
+        let flags = page[5];
+        let granule = i64::from_le_bytes(page[6..14].try_into().unwrap_or([0; 8]));
+        let serial = u32::from_le_bytes([page[14], page[15], page[16], page[17]]);
+        let lacing = page[27..27 + nseg].to_vec();
+        let body_off = pos + 27 + nseg as u64;
+        let si = *by_serial.entry(serial).or_insert_with(|| {
+            streams.push(Stream {
+                serial,
+                codec: Codec::Unknown,
+                headers: Vec::new(),
+                packets: Vec::new(),
+                pages: 0,
+                last_granule: None,
+                saw_eos: false,
+            });
+            streams.len() - 1
+        });
+        let st = &mut streams[si];
+        let page_index = st.pages;
+        st.pages += 1;
+        if flags & 0x04 != 0 {
+            st.saw_eos = true;
+        }
+        // a continued page without a pending packet (lost a page): drop the fragment
+        let continued = flags & 0x01 != 0;
+        if !continued && partial.remove(&serial).is_some() {
+            warn(&mut warnings, format!("incomplete packet before page at byte {pos}"));
+        }
+        let mut completed: Vec<Packet> = Vec::new();
+        let mut off = 0u64;
+        let mut seg_start = 0u64;
+        let mut skip_fragment = continued && !partial.contains_key(&serial);
+        for (k, &l) in lacing.iter().enumerate() {
+            off += l as u64;
+            if l < 255 || k + 1 == nseg {
+                let (a, n) = (seg_start, off - seg_start);
+                seg_start = off;
+                if skip_fragment {
+                    if l < 255 {
+                        skip_fragment = false;
+                    }
+                    continue;
+                }
+                let p = partial.entry(serial).or_insert_with(|| Partial { parts: Vec::new(), size: 0, prefix: Vec::new() });
+                if n > 0 {
+                    p.parts.push((body_off + a, n as u32));
+                    p.size += n as u32;
+                    let s = (body_off - pos + a) as usize;
+                    let need = 2usize.saturating_sub(p.prefix.len()).min(n as usize);
+                    p.prefix.extend_from_slice(&page[s..s + need]);
+                }
+                if l < 255
+                    && let Some(p) = partial.remove(&serial)
+                {
+                    let mut prefix = [0u8; 2];
+                    prefix[..p.prefix.len().min(2)].copy_from_slice(&p.prefix[..p.prefix.len().min(2)]);
+                    completed.push(Packet { parts: p.parts, size: p.size, granule: None, page: page_index, eos: flags & 0x04 != 0, prefix });
+                }
+            }
+        }
+        if granule != -1 {
+            st.last_granule = Some(granule);
+            if let Some(last) = completed.last_mut() {
+                last.granule = Some(granule);
+            }
+        }
+        for pk in completed {
+            if st.headers.is_empty() && st.packets.is_empty() {
+                let data = read_parts(src, &pk.parts)?;
+                st.codec = Codec::of(&data);
+            }
+            if st.headers.len() < st.codec.header_count() && st.packets.is_empty() {
+                st.headers.push(read_parts(src, &pk.parts)?);
+            } else {
+                st.packets.push(pk);
+            }
+        }
+        pos += page_len;
+    }
+    if !found_any {
+        return Err(Error::NotOgg);
+    }
+    if !partial.is_empty() {
+        warn(&mut warnings, "file ends inside a packet".into());
+    }
+    if scanner.spent() {
+        // once per file and last, so it is not subject to the cap on the others
+        warnings.push("recovery budget spent; the rest of the damaged data was not searched".into());
+    }
+    Ok(OggFile { streams, warnings })
+}
+
+struct CaptureScanner {
+    buf: Vec<u8>,
+    buf_start: u64,
+    budget: u64,
+}
+
+impl CaptureScanner {
+    fn new() -> Self {
+        Self { buf: Vec::new(), buf_start: 0, budget: RECOVERY_BUDGET }
+    }
+
+    /// Charge `bytes` of recovery work; true once the budget is spent.
+    fn charge(&mut self, bytes: u64) -> bool {
+        self.budget = self.budget.saturating_sub(bytes);
+        self.spent()
+    }
+
+    /// Nothing left to search with: fewer bytes than a capture pattern can still be charged for.
+    fn spent(&self) -> bool {
+        self.budget < 4
+    }
+
+    fn find(&mut self, src: &(impl ByteSource + ?Sized), from: u64, len: u64) -> Result<Option<u64>> {
+        let mut at = from;
+        while at + 4 <= len {
+            let buf_end = self.buf_start + self.buf.len() as u64;
+            if at >= self.buf_start && at + 4 <= buf_end {
+                let off = (at - self.buf_start) as usize;
+                if let Some(i) = self.buf[off..].windows(4).position(|w| w == b"OggS") {
+                    return Ok(Some(at + i as u64));
+                }
+                at = buf_end.saturating_sub(3);
+                continue;
+            }
+            if self.spent() {
+                return Ok(None);
+            }
+            let n = ((len - at) as usize).min(64 * 1024).min(usize::try_from(self.budget).unwrap_or(usize::MAX));
+            if n < 4 {
+                break;
+            }
+            self.buf.resize(n, 0);
+            src.read_at(at, &mut self.buf)?;
+            self.buf_start = at;
+            self.budget = self.budget.saturating_sub(n as u64);
+            if let Some(i) = self.buf.windows(4).position(|w| w == b"OggS") {
+                return Ok(Some(at + i as u64));
+            }
+            at += (n - 3) as u64;
+        }
+        Ok(None)
+    }
+}
+
+fn read_parts(src: &(impl ByteSource + ?Sized), parts: &[(u64, u32)]) -> Result<Vec<u8>> {
+    let mut v = Vec::with_capacity(parts.iter().map(|p| p.1 as usize).sum());
+    for &(o, n) in parts {
+        let a = v.len();
+        v.resize(a + n as usize, 0);
+        src.read_at(o, &mut v[a..])?;
+    }
+    Ok(v)
+}
+
+impl OggFile {
+    /// The first stream of `codec`.
+    pub fn stream_of(&self, codec: Codec) -> Option<usize> {
+        self.streams.iter().position(|s| s.codec == codec)
+    }
+    /// The bytes of packet `i` of stream `s`.
+    pub fn read_packet(&self, src: &(impl ByteSource + ?Sized), s: usize, i: usize) -> Result<Vec<u8>> {
+        let p = self.streams.get(s).and_then(|st| st.packets.get(i)).ok_or_else(|| Error::Invalid(format!("no packet {i} in stream {s}")))?;
+        read_parts(src, &p.parts)
+    }
+}
+
+/// Duration of an Opus packet in 48 kHz samples from its TOC (RFC 6716 §3.1); `None` if invalid.
+pub fn opus_packet_samples(prefix: [u8; 2], size: u32) -> Option<u32> {
+    if size == 0 {
+        return None;
+    }
+    let toc = prefix[0];
+    let config = toc >> 3;
+    let frame = match config {
+        0..=11 => [480, 960, 1920, 2880][(config & 3) as usize],
+        12..=15 => [480, 960][(config & 1) as usize],
+        _ => [120, 240, 480, 960][(config & 3) as usize],
+    };
+    let frames = match toc & 3 {
+        0 => 1,
+        1 | 2 => 2,
+        _ => {
+            if size < 2 {
+                return None;
+            }
+            (prefix[1] & 0x3F) as u32
+        }
+    };
+    let n = frame * frames;
+    (n > 0 && n <= 5760).then_some(n)
+}
+
+/// RFC 7845 §4 timing of an Opus stream.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct OpusTiming {
+    pub pre_skip: u32,
+    /// Start of each packet's decoded output in output samples (48 kHz): 0 is the first sample
+    /// after the pre-skip; the pre-skip samples have negative positions.
+    pub starts: Vec<i64>,
+    /// Decoded samples of each packet.
+    pub durations: Vec<u32>,
+    /// Playable samples (end trimming applied).
+    pub total: i64,
+}
+
+fn timing_add(a: i64, b: i64) -> Result<i64> {
+    a.checked_add(b).ok_or_else(|| Error::Invalid("opus timing overflow".into()))
+}
+
+fn timing_sub(a: i64, b: i64) -> Result<i64> {
+    a.checked_sub(b).ok_or_else(|| Error::Invalid("opus timing overflow".into()))
+}
+
+impl OpusTiming {
+    /// Timing of the Opus stream `s` (`pre_skip` from its `OpusHead`).
+    ///
+    /// A granule or a run of packet durations that does not fit in `i64` is an error. Ordinary
+    /// files, including a truncated tail and end trimming, are unchanged.
+    pub fn of(stream: &Stream, pre_skip: u32) -> Result<OpusTiming> {
+        let durations: Vec<u32> = stream.packets.iter().map(|p| opus_packet_samples(p.prefix, p.size).unwrap_or(0)).collect();
+        let n = durations.len();
+        let mut ends: Vec<Option<i64>> = vec![None; n];
+        let mut i = 0;
+        let mut cursor: Option<i64> = None;
+        let mut trimmed_end: Option<i64> = None;
+        while i < n {
+            // packets completing on the same page: i..j, the last carries the page granule
+            let mut j = i;
+            while j < n && stream.packets[j].granule.is_none() {
+                j += 1;
+            }
+            if j == n {
+                // trailing packets without a granule (truncated file): continue from the cursor
+                let mut c = cursor.unwrap_or(0);
+                for k in i..n {
+                    c = timing_add(c, i64::from(durations[k]))?;
+                    ends[k] = Some(c);
+                }
+                break;
+            }
+            let Some(g) = stream.packets[j].granule else { break };
+            let sum = durations[i..=j].iter().try_fold(0i64, |a, &d| timing_add(a, i64::from(d)))?;
+            let forward = match cursor {
+                Some(c) => Some(timing_add(c, sum)?),
+                None => None,
+            };
+            let end = match forward {
+                // end trimming on the last page (RFC 7845 §4.5): keep the forward positions
+                Some(f) if stream.packets[j].eos && g < f => {
+                    trimmed_end = Some(g);
+                    f
+                }
+                Some(f) if f == g => f,
+                // first page, or a discontinuity: trust the granule
+                _ => g,
+            };
+            let mut e = end;
+            for k in (i..=j).rev() {
+                ends[k] = Some(e);
+                e = timing_sub(e, i64::from(durations[k]))?;
+            }
+            cursor = Some(end);
+            i = j + 1;
+        }
+        let mut raw_starts = Vec::with_capacity(n);
+        for (e, &d) in ends.iter().zip(&durations) {
+            raw_starts.push(timing_sub(e.unwrap_or(0), i64::from(d))?);
+        }
+        let base = raw_starts.first().copied().unwrap_or(0).max(0);
+        let shift = timing_add(base, i64::from(pre_skip))?;
+        let mut starts = Vec::with_capacity(n);
+        for s in &raw_starts {
+            starts.push(timing_sub(*s, shift)?);
+        }
+        let end_all = trimmed_end.or(cursor).unwrap_or(0);
+        let total = timing_sub(end_all, shift)?.max(0);
+        Ok(OpusTiming { pre_skip, starts, durations, total })
+    }
+}
+
+/// Vorbis identification header fields (Vorbis I §4.2.2).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct VorbisInfo {
+    pub channels: u8,
+    pub sample_rate: u32,
+    pub bitrate_nominal: i32,
+}
+
+impl VorbisInfo {
+    pub fn parse(h: &[u8]) -> Option<VorbisInfo> {
+        if h.len() < 30 || !h.starts_with(b"\x01vorbis") {
+            return None;
+        }
+        Some(VorbisInfo {
+            channels: h[11],
+            sample_rate: u32::from_le_bytes([h[12], h[13], h[14], h[15]]),
+            bitrate_nominal: i32::from_le_bytes([h[20], h[21], h[22], h[23]]),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests;
@@ -0,0 +1,276 @@
+//! Synthetic Ogg streams: a small page writer (RFC 3533) and Opus-like packets.
+
+use std::cell::Cell;
+use std::io;
+
+use super::{ByteSource, CaptureScanner, Codec, Error, OpusTiming, Packet, Stream, crc32, open, opus_packet_samples, sniff};
+
+/// Write one page holding `segments` (lacing already computed by `lace`).
+fn page(out: &mut Vec<u8>, flags: u8, granule: i64, serial: u32, seq: u32, lacing: &[u8], body: &[u8]) {
+    let start = out.len();
+    out.extend_from_slice(b"OggS");
+    out.push(0);
+    out.push(flags);
+    out.extend_from_slice(&granule.to_le_bytes());
+    out.extend_from_slice(&serial.to_le_bytes());
+    out.extend_from_slice(&seq.to_le_bytes());
+    out.extend_from_slice(&[0; 4]);
+    out.push(lacing.len() as u8);
+    out.extend_from_slice(lacing);
+    out.extend_from_slice(body);
+    let crc = crc32(&out[start..]);
+    out[start + 22..start + 26].copy_from_slice(&crc.to_le_bytes());
+}
+
+fn lace(packets: &[&[u8]], last_continues: bool) -> (Vec<u8>, Vec<u8>) {
+    let mut l = Vec::new();
+    let mut b = Vec::new();
+    for (i, p) in packets.iter().enumerate() {
+        let mut n = p.len();
+        while n >= 255 {
+            l.push(255);
+            n -= 255;
+        }
+        if !(last_continues && i + 1 == packets.len()) {
+            l.push(n as u8);
+        }
+        b.extend_from_slice(p);
+    }
+    (l, b)
+}
+
+fn opus_head(pre_skip: u16) -> Vec<u8> {
+    let mut h = b"OpusHead".to_vec();
+    h.push(1);
+    h.push(2);
+    h.extend_from_slice(&pre_skip.to_le_bytes());
+    h.extend_from_slice(&48_000u32.to_le_bytes());
+    h.extend_from_slice(&0i16.to_le_bytes());
+    h.push(0);
+    h
+}
+
+/// A CELT 20 ms packet (960 samples): TOC config 31, code 0.
+fn pkt(i: usize, len: usize) -> Vec<u8> {
+    let mut p = vec![0xF8];
+    p.extend((0..len.saturating_sub(1)).map(|k| (i * 7 + k) as u8));
+    p
+}
+
+/// Header pages, then pages of 3 packets each; the last page's granule trims `trim` samples.
+fn opus_file(npk: usize, pre_skip: u16, trim: i64) -> Vec<u8> {
+    let mut f = Vec::new();
+    let head = opus_head(pre_skip);
+    let (l, b) = lace(&[&head], false);
+    page(&mut f, 0x02, 0, 9, 0, &l, &b);
+    let tags = b"OpusTags\x00\x00\x00\x00\x00\x00\x00\x00".to_vec();
+    let (l, b) = lace(&[&tags], false);
+    page(&mut f, 0, 0, 9, 1, &l, &b);
+    let pkts: Vec<Vec<u8>> = (0..npk).map(|i| pkt(i, 40 + i % 5)).collect();
+    let mut done = 0;
+    for (seq, chunk) in (2..).zip(pkts.chunks(3)) {
+        done += chunk.len();
+        let last = done == npk;
+        let mut g = done as i64 * 960;
+        if last {
+            g -= trim;
+        }
+        let refs: Vec<&[u8]> = chunk.iter().map(Vec::as_slice).collect();
+        let (l, b) = lace(&refs, false);
+        page(&mut f, if last { 0x04 } else { 0 }, g, 9, seq, &l, &b);
+    }
+    f
+}
+
+#[test]
+fn crc_matches_known_value() {
+    // CRC-32/CKSUM parameters without its final XOR (check value 0x765E7680 ^ 0xFFFFFFFF)
+    assert_eq!(crc32(b"123456789"), 0x89A1_897F);
+    assert_eq!(crc32(b""), 0);
+    assert_ne!(crc32(b"OggS"), crc32(b"OggT"));
+}
+
+#[test]
+fn opus_pages_packets_and_timing() {
+    let f = opus_file(10, 312, 500);
+    assert!(sniff(&f));
+    let o = open(&f).unwrap();
+    assert!(o.warnings.is_empty(), "{:?}", o.warnings);
+    let s = o.stream_of(Codec::Opus).unwrap();
+    let st = &o.streams[s];
+    assert_eq!(st.headers.len(), 2);
+    assert_eq!(st.packets.len(), 10);
+    assert!(st.saw_eos);
+    assert_eq!(o.read_packet(&f, s, 4).unwrap(), pkt(4, 44));
+    let t = OpusTiming::of(st, 312).unwrap();
+    assert_eq!(t.durations, vec![960; 10]);
+    assert_eq!(t.starts[0], -312);
+    assert_eq!(t.starts[9], 9 * 960 - 312);
+    // end trimming: the last page granule is 500 short
+    assert_eq!(t.total, 10 * 960 - 500 - 312);
+}
+
+#[test]
+fn packets_spanning_pages() {
+    let mut f = Vec::new();
+    let head = opus_head(0);
+    let (l, b) = lace(&[&head], false);
+    page(&mut f, 0x02, 0, 1, 0, &l, &b);
+    let (l, b) = lace(&[b"OpusTags"], false);
+    page(&mut f, 0, 0, 1, 1, &l, &b);
+    let big = pkt(0, 700);
+    // first 510 bytes on one page (two 255 lacing values, packet continues), rest on the next
+    let (l, b) = (vec![255, 255], big[..510].to_vec());
+    page(&mut f, 0, -1, 1, 2, &l, &b);
+    let rest = &big[510..];
+    let small = pkt(1, 30);
+    let (l, b) = lace(&[rest, &small], false);
+    page(&mut f, 0x01 | 0x04, 1920, 1, 3, &l, &b);
+    let o = open(&f).unwrap();
+    let st = &o.streams[0];
+    assert_eq!(st.packets.len(), 2);
+    assert_eq!(st.packets[0].parts.len(), 2);
+    assert_eq!(o.read_packet(&f, 0, 0).unwrap(), big);
+    assert_eq!(o.read_packet(&f, 0, 1).unwrap(), small);
+    let t = OpusTiming::of(st, 0).unwrap();
+    assert_eq!(t.starts, vec![0, 960]);
+    assert_eq!(t.total, 1920);
+}
+
+#[test]
+fn corrupt_pages_are_skipped_and_truncation_is_safe() {
+    let f = opus_file(12, 312, 0);
+    // flip a byte inside the third data page's body: that page fails its CRC and is dropped
+    let mut g = f.clone();
+    let third = g.windows(4).enumerate().filter(|(_, w)| *w == b"OggS").map(|(i, _)| i).nth(4).unwrap();
+    g[third + 40] ^= 0xFF;
+    let o = open(&g).unwrap();
+    assert!(o.warnings.iter().any(|w| w.contains("CRC")), "{:?}", o.warnings);
+    assert_eq!(o.streams[0].packets.len(), 9);
+    let t = OpusTiming::of(&o.streams[0], 312).unwrap();
+    // the granules after the gap put the later packets at their true positions
+    assert_eq!(*t.starts.last().unwrap(), 11 * 960 - 312);
+    for cut in 0..f.len() {
+        if let Ok(o) = open(&f[..cut].to_vec()) {
+            for st in &o.streams {
+                let t = OpusTiming::of(st, 312).unwrap();
+                assert_eq!(t.starts.len(), st.packets.len());
+            }
+        }
+    }
+    let mut seed = 99u64;
+    for _ in 0..300 {
+        let mut g = f.clone();
+        seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+        let at = (seed >> 33) as usize % g.len();
+        g[at] = (seed >> 20) as u8;
+        if let Ok(o) = open(&g) {
+            for st in &o.streams {
+                let _ = OpusTiming::of(st, 312);
+            }
+        }
+    }
+    assert!(matches!(open(&b"not ogg at all, no capture pattern".to_vec()), Err(Error::NotOgg)));
+}
+
+#[test]
+fn opus_toc_durations() {
+    assert_eq!(opus_packet_samples([0x00, 0], 10), Some(480)); // SILK NB 10 ms
+    assert_eq!(opus_packet_samples([0x18, 0], 10), Some(2880)); // SILK NB 60 ms
+    assert_eq!(opus_packet_samples([0x78 | 1, 0], 10), Some(1920)); // hybrid 20 ms × 2
+    assert_eq!(opus_packet_samples([0x80 | 3, 6], 10), Some(720)); // CELT 2.5 ms × 6
+    assert_eq!(opus_packet_samples([0xF8 | 3, 7], 10), None); // 140 ms: invalid
+    assert_eq!(opus_packet_samples([0xF8, 0], 0), None);
+}
+
+#[test]
+fn opus_timing_rejects_a_granule_that_overflows() {
+    let packet = |granule: i64| Stream {
+        serial: 1,
+        codec: Codec::Opus,
+        headers: vec![],
+        packets: vec![Packet { parts: vec![], size: 10, granule: Some(granule), page: 0, eos: true, prefix: [0x00, 0] }],
+        pages: 1,
+        last_granule: Some(granule),
+        saw_eos: true,
+    };
+    let ok = OpusTiming::of(&packet(480), 0).unwrap();
+    assert_eq!(ok.starts, vec![0]);
+    assert_eq!(ok.total, 480);
+    assert!(OpusTiming::of(&packet(i64::MIN), 0).is_err());
+}
+
+/// A source that counts the bytes read from it.
+struct Counting<'a> {
+    data: &'a [u8],
+    read: Cell<u64>,
+}
+
+impl ByteSource for Counting<'_> {
+    fn len(&self) -> u64 {
+        self.data.len() as u64
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        self.read.set(self.read.get() + buf.len() as u64);
+        self.data.read_at(offset, buf)
+    }
+}
+
+/// A valid file followed by `len` bytes of 0xFF with a capture pattern every 64 bytes. Each one
+/// claims 255 full lacing values, so it reads as a page of about 64 KiB that fails its CRC.
+fn dense_fake_pages(len: usize) -> Vec<u8> {
+    let mut f = opus_file(6, 312, 0);
+    let start = f.len();
+    f.resize(start + len, 0xFF);
+    for at in (start..start + len - 64).step_by(64) {
+        f[at..at + 5].copy_from_slice(b"OggS\0");
+        f[at + 26] = 255;
+    }
+    f
+}
+
+#[test]
+fn recovery_reads_a_bounded_amount_of_a_damaged_file() {
+    let f = dense_fake_pages(1 << 20);
+    let src = Counting { data: &f, read: Cell::new(0) };
+    let o = open(&src).unwrap();
+    assert_eq!(o.streams[0].packets.len(), 6, "the good pages are kept");
+    let read = src.read.get();
+    assert!(read <= 40 << 20, "read {read} bytes of a {} byte file", f.len());
+    assert!(o.warnings.iter().any(|w| w.contains("recovery budget")), "{:?}", o.warnings);
+}
+
+#[test]
+fn warnings_are_capped() {
+    // 100,000 pages with no segments and a wrong CRC, 27 bytes each
+    let mut f = opus_file(6, 312, 0);
+    for _ in 0..100_000 {
+        let at = f.len();
+        f.extend_from_slice(b"OggS\0\0");
+        f.resize(at + 27, 0);
+        f[at + 22] = 1;
+    }
+    let o = open(&f).unwrap();
+    assert!(o.warnings.len() <= 257, "{} warnings", o.warnings.len());
+    assert!(o.warnings.iter().any(|w| w.contains("omitted")), "{:?}", o.warnings.last());
+}
+
+#[test]
+fn a_file_of_good_pages_is_not_charged_for_recovery() {
+    let f = opus_file(2000, 312, 0);
+    let src = Counting { data: &f, read: Cell::new(0) };
+    let o = open(&src).unwrap();
+    assert_eq!(o.streams[0].packets.len(), 2000);
+    assert!(o.warnings.is_empty(), "{:?}", o.warnings);
+}
+
+#[test]
+fn a_budget_too_small_to_search_is_spent() {
+    // 1 to 3 bytes left cannot hold a capture pattern: the scan would stop without saying why
+    let mut scanner = CaptureScanner::new();
+    assert!(!scanner.spent());
+    assert!(scanner.charge(super::RECOVERY_BUDGET - 3));
+    assert!(scanner.spent());
+    let f = opus_file(6, 312, 0);
+    assert_eq!(scanner.find(&f, 0, f.len() as u64).unwrap(), None);
+}
@@ -0,0 +1,12 @@
+[package]
+name = "deckcraft-opus"
+description = "Clean-room pure-Rust Opus decoder (RFC 6716 / RFC 8251; OpusHead, multistream surround)"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
@@ -0,0 +1,678 @@
+//! CELT layer decoder (RFC 6716 §4.3).
+
+pub(crate) mod bands;
+pub(crate) mod energy;
+pub(crate) mod mdct;
+pub(crate) mod rate;
+pub(crate) mod tables;
+
+use std::sync::OnceLock;
+
+use bands::{anti_collapse, denormalise_bands, quant_all_bands, renormalise_vector};
+use energy::{unquant_coarse_energy, unquant_energy_finalise, unquant_fine_energy};
+use mdct::ImdctScratch;
+use rate::{Mode, compute_allocation};
+use tables::{COMB_GAINS, EBANDS, MAX_LM, NB_EBANDS, OVERLAP, PREEMPH, SHORT_MDCT, SPREAD_ICDF, TAPSET_ICDF, TF_SELECT_TABLE, TRIM_ICDF};
+
+use crate::range::{BITRES, RangeDecoder};
+
+const DECODE_BUFFER_SIZE: usize = 2048;
+const COMBFILTER_MINPERIOD: i32 = 15;
+const PLC_PITCH_LAG_MAX: usize = 720;
+const PLC_PITCH_LAG_MIN: usize = 100;
+
+pub(crate) fn mode() -> &'static Mode {
+    static MODE: OnceLock<Mode> = OnceLock::new();
+    MODE.get_or_init(Mode::new)
+}
+
+/// CELT decoder state for one (mono or stereo) stream.
+pub struct CeltDecoder {
+    m: &'static Mode,
+    /// Output channels.
+    channels: usize,
+    /// Channels coded in the stream.
+    pub stream_channels: usize,
+    downsample: usize,
+    pub start: usize,
+    pub end: usize,
+    pub disable_inv: bool,
+    pub rng: u32,
+    loss_count: u32,
+    skip_plc: bool,
+    postfilter_period: i32,
+    postfilter_period_old: i32,
+    postfilter_gain: f32,
+    postfilter_gain_old: f32,
+    postfilter_tapset: usize,
+    postfilter_tapset_old: usize,
+    preemph_mem: [f32; 2],
+    decode_mem: Vec<f32>,
+    old_band_e: [f32; 2 * NB_EBANDS],
+    old_log_e: [f32; 2 * NB_EBANDS],
+    old_log_e2: [f32; 2 * NB_EBANDS],
+    background_log_e: [f32; 2 * NB_EBANDS],
+    // scratch
+    x: Vec<f32>,
+    freq: Vec<f32>,
+    imdct: ImdctScratch,
+    pcm_scratch: Vec<f32>,
+}
+
+/// Detects the silence flag, advancing the decoder to the end of the frame when set. Returns the flag and the new bit position.
+fn read_silence(dec: &mut RangeDecoder, total_bits_raw: i32) -> (bool, i32) {
+    let tell = dec.tell();
+    let silence = tell >= total_bits_raw || (tell == 1 && dec.bit_logp(15));
+    if silence {
+        // Pretend we've read all the remaining bits.
+        dec.skip_to_end(total_bits_raw);
+        return (true, total_bits_raw);
+    }
+    (false, tell)
+}
+
+struct PostfilterParams {
+    gain: f32,
+    pitch: i32,
+    tapset: usize,
+    tell: i32,
+}
+
+/// Reads the optional post-filter header (pitch, gain, tapset) at the start of a frame.
+fn read_postfilter_params(dec: &mut RangeDecoder, start: usize, tell: i32, total_bits_raw: i32) -> PostfilterParams {
+    let mut p = PostfilterParams { gain: 0.0, pitch: 0, tapset: 0, tell };
+    if start == 0 && tell + 16 <= total_bits_raw {
+        if dec.bit_logp(1) {
+            let octave = dec.uint(6);
+            p.pitch = ((16 << octave) + dec.bits(4 + octave)) as i32 - 1;
+            let qg = dec.bits(3);
+            if dec.tell() + 2 <= total_bits_raw {
+                p.tapset = dec.icdf(&TAPSET_ICDF, 2);
+            }
+            p.gain = 0.09375 * (qg + 1) as f32;
+        }
+        p.tell = dec.tell();
+    }
+    p
+}
+
+/// Decodes per-band dynamic allocation boosts. Returns the offsets, the fractional bit position and the remaining bit budget.
+fn decode_dynalloc(
+    dec: &mut RangeDecoder,
+    start: usize,
+    end: usize,
+    c: usize,
+    lm: usize,
+    cap: &[i32],
+    total_bits_raw: i32,
+) -> ([i32; NB_EBANDS], i32, i32) {
+    let mut offsets = [0i32; NB_EBANDS];
+    let mut dynalloc_logp = 6;
+    let mut total_bits = total_bits_raw << BITRES;
+    let mut tellf = dec.tell_frac() as i32;
+    for i in start..end {
+        let width = (c as i32 * (EBANDS[i + 1] - EBANDS[i])) << lm;
+        let quanta = (width << BITRES).min((6 << BITRES).max(width));
+        let mut loop_logp = dynalloc_logp;
+        let mut boost = 0;
+        while tellf + (loop_logp << BITRES) < total_bits && boost < cap[i] {
+            let flag = dec.bit_logp(loop_logp as u32);
+            tellf = dec.tell_frac() as i32;
+            if !flag {
+                break;
+            }
+            boost += quanta;
+            total_bits -= quanta;
+            loop_logp = 1;
+        }
+        offsets[i] = boost;
+        if boost > 0 {
+            dynalloc_logp = 2.max(dynalloc_logp - 1);
+        }
+    }
+    (offsets, tellf, total_bits)
+}
+
+impl CeltDecoder {
+    /// `sample_rate` is the output rate (48000, 24000, 16000, 12000 or 8000).
+    pub fn new(sample_rate: u32, channels: usize) -> CeltDecoder {
+        let downsample = (48000 / sample_rate) as usize;
+        let mut d = CeltDecoder {
+            m: mode(),
+            channels,
+            stream_channels: channels,
+            downsample,
+            start: 0,
+            end: NB_EBANDS,
+            disable_inv: channels == 1,
+            rng: 0,
+            loss_count: 0,
+            skip_plc: true,
+            postfilter_period: 0,
+            postfilter_period_old: 0,
+            postfilter_gain: 0.0,
+            postfilter_gain_old: 0.0,
+            postfilter_tapset: 0,
+            postfilter_tapset_old: 0,
+            preemph_mem: [0.0; 2],
+            decode_mem: vec![0.0; channels * (DECODE_BUFFER_SIZE + OVERLAP)],
+            old_band_e: [0.0; 2 * NB_EBANDS],
+            old_log_e: [0.0; 2 * NB_EBANDS],
+            old_log_e2: [0.0; 2 * NB_EBANDS],
+            background_log_e: [0.0; 2 * NB_EBANDS],
+            x: Vec::new(),
+            freq: Vec::new(),
+            imdct: ImdctScratch::default(),
+            pcm_scratch: Vec::new(),
+        };
+        d.reset();
+        d
+    }
+
+    /// `OPUS_RESET_STATE`.
+    pub fn reset(&mut self) {
+        self.rng = 0;
+        self.loss_count = 0;
+        self.skip_plc = true;
+        self.postfilter_period = 0;
+        self.postfilter_period_old = 0;
+        self.postfilter_gain = 0.0;
+        self.postfilter_gain_old = 0.0;
+        self.postfilter_tapset = 0;
+        self.postfilter_tapset_old = 0;
+        self.preemph_mem = [0.0; 2];
+        self.decode_mem.fill(0.0);
+        self.old_band_e = [0.0; 2 * NB_EBANDS];
+        self.old_log_e = [-28.0; 2 * NB_EBANDS];
+        self.old_log_e2 = [-28.0; 2 * NB_EBANDS];
+        self.background_log_e = [0.0; 2 * NB_EBANDS];
+    }
+
+    fn mem_len(&self) -> usize {
+        DECODE_BUFFER_SIZE + OVERLAP
+    }
+
+    /// Decodes one CELT frame of `frame_size` samples (at the output rate) into interleaved `pcm`
+    /// (`channels` wide). With `accum`, the output is added to `pcm`. `data = None` (or fewer than
+    /// two bytes) runs the packet-loss concealment.
+    pub fn decode(
+        &mut self,
+        data: Option<&[u8]>,
+        frame_size: usize,
+        pcm: &mut [f32],
+        accum: bool,
+        dec: Option<&mut RangeDecoder>,
+    ) -> Result<usize, crate::Error> {
+        let n_full = frame_size * self.downsample;
+        let lm = match n_full {
+            120 => 0,
+            240 => 1,
+            480 => 2,
+            960 => 3,
+            _ => return Err(crate::Error::InvalidArgument("CELT frame size")),
+        };
+        let data = match data {
+            Some(d) if d.len() > 1 => d,
+            _ => {
+                self.decode_lost(n_full, lm);
+                self.deemphasis(n_full, pcm, accum);
+                return Ok(frame_size);
+            }
+        };
+        if data.len() > 1275 {
+            return Err(crate::Error::InvalidPacket("CELT frame too long"));
+        }
+        match dec {
+            Some(d) => self.decode_frame(d, data.len(), n_full, lm),
+            None => {
+                let mut own = RangeDecoder::new(data);
+                self.decode_frame(&mut own, data.len(), n_full, lm)
+            }
+        }
+        self.deemphasis(n_full, pcm, accum);
+        Ok(frame_size)
+    }
+
+    fn decode_frame(&mut self, dec: &mut RangeDecoder, len: usize, n: usize, lm: usize) {
+        let cc = self.channels;
+        let c = self.stream_channels;
+        let m = self.m;
+        let mm = 1usize << lm;
+        let start = self.start;
+        let end = self.end;
+        let eff_end = end.min(NB_EBANDS);
+        if self.loss_count == 0 {
+            self.skip_plc = false;
+        }
+        if c == 1 {
+            for i in 0..NB_EBANDS {
+                self.old_band_e[i] = self.old_band_e[i].max(self.old_band_e[NB_EBANDS + i]);
+            }
+        }
+        let total_bits_raw = len as i32 * 8;
+        let (silence, mut tell) = read_silence(dec, total_bits_raw);
+        let pf = read_postfilter_params(dec, start, tell, total_bits_raw);
+        tell = pf.tell;
+        let (postfilter_gain, postfilter_pitch, postfilter_tapset) = (pf.gain, pf.pitch, pf.tapset);
+        let is_transient = if lm > 0 && tell + 3 <= total_bits_raw {
+            let t = dec.bit_logp(3);
+            tell = dec.tell();
+            t
+        } else {
+            false
+        };
+        let short_blocks = is_transient;
+        let intra = if tell + 3 <= total_bits_raw { dec.bit_logp(3) } else { false };
+        unquant_coarse_energy(start, end, &mut self.old_band_e, intra, dec, c, lm);
+        let mut tf_res = [0i32; NB_EBANDS];
+        tf_decode(start, end, is_transient, &mut tf_res, lm, dec);
+        tell = dec.tell();
+        let mut spread = 2usize;
+        if tell + 4 <= total_bits_raw {
+            spread = dec.icdf(&SPREAD_ICDF, 5);
+        }
+        let cap = m.init_caps(lm, c);
+        let (offsets, tellf, total_bits) = decode_dynalloc(dec, start, end, c, lm, &cap, total_bits_raw);
+        let alloc_trim = if tellf + (6 << BITRES) <= total_bits { dec.icdf(&TRIM_ICDF, 7) as i32 } else { 5 };
+        let mut bits = ((len as i32 * 8) << BITRES) - dec.tell_frac() as i32 - 1;
+        let anti_collapse_rsv = if is_transient && lm >= 2 && bits >= ((lm as i32 + 2) << BITRES) { 1 << BITRES } else { 0 };
+        bits -= anti_collapse_rsv;
+        let alloc = compute_allocation(m, start, end, &offsets, &cap, alloc_trim, bits, c, lm, dec);
+        unquant_fine_energy(start, end, &mut self.old_band_e, &alloc.fine_quant, dec, c);
+
+        // Shift the decode memory by one frame.
+        let ml = self.mem_len();
+        for ch in 0..cc {
+            let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+            mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
+        }
+
+        let mut collapse_masks = vec![0u32; c * NB_EBANDS];
+        let mut x = std::mem::take(&mut self.x);
+        x.clear();
+        x.resize(c * n, 0.0);
+        {
+            let (xa, xb) = x.split_at_mut(n);
+            let yb = if c == 2 { Some(xb) } else { None };
+            let mut seed = self.rng;
+            quant_all_bands(
+                m,
+                start,
+                end,
+                xa,
+                yb,
+                &mut collapse_masks,
+                &alloc.pulses,
+                short_blocks,
+                spread,
+                alloc.dual_stereo,
+                alloc.intensity,
+                &tf_res,
+                ((len as i32) * (8 << BITRES)) - anti_collapse_rsv,
+                alloc.balance,
+                dec,
+                lm,
+                alloc.coded_bands,
+                &mut seed,
+                self.disable_inv,
+            );
+            self.rng = seed;
+        }
+        let mut anti_collapse_on = false;
+        if anti_collapse_rsv > 0 {
+            anti_collapse_on = dec.bits(1) != 0;
+        }
+        let bits_left = len as i32 * 8 - dec.tell();
+        unquant_energy_finalise(start, end, &mut self.old_band_e, &alloc.fine_quant, &alloc.fine_priority, bits_left, dec, c);
+        if anti_collapse_on {
+            anti_collapse(
+                &mut x,
+                &collapse_masks,
+                lm,
+                c,
+                n,
+                start,
+                end,
+                &self.old_band_e,
+                &self.old_log_e,
+                &self.old_log_e2,
+                &alloc.pulses,
+                self.rng,
+            );
+        }
+        if silence {
+            for v in self.old_band_e[..c * NB_EBANDS].iter_mut() {
+                *v = -28.0;
+            }
+        }
+        self.synthesis(&x, n, start, eff_end, c, is_transient, lm, silence);
+        self.x = x;
+
+        // Post-filter.
+        for ch in 0..cc {
+            self.postfilter_period = self.postfilter_period.max(COMBFILTER_MINPERIOD);
+            self.postfilter_period_old = self.postfilter_period_old.max(COMBFILTER_MINPERIOD);
+            let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+            let off = DECODE_BUFFER_SIZE - n;
+            comb_filter(
+                mem,
+                off,
+                self.postfilter_period_old,
+                self.postfilter_period,
+                SHORT_MDCT,
+                self.postfilter_gain_old,
+                self.postfilter_gain,
+                self.postfilter_tapset_old,
+                self.postfilter_tapset,
+                &m.window,
+            );
+            if lm != 0 {
+                comb_filter(
+                    mem,
+                    off + SHORT_MDCT,
+                    self.postfilter_period,
+                    postfilter_pitch,
+                    n - SHORT_MDCT,
+                    self.postfilter_gain,
+                    postfilter_gain,
+                    self.postfilter_tapset,
+                    postfilter_tapset,
+                    &m.window,
+                );
+            }
+        }
+        self.postfilter_period_old = self.postfilter_period;
+        self.postfilter_gain_old = self.postfilter_gain;
+        self.postfilter_tapset_old = self.postfilter_tapset;
+        self.postfilter_period = postfilter_pitch;
+        self.postfilter_gain = postfilter_gain;
+        self.postfilter_tapset = postfilter_tapset;
+        if lm != 0 {
+            self.postfilter_period_old = self.postfilter_period;
+            self.postfilter_gain_old = self.postfilter_gain;
+            self.postfilter_tapset_old = self.postfilter_tapset;
+        }
+
+        if c == 1 {
+            let (a, b) = self.old_band_e.split_at_mut(NB_EBANDS);
+            b.copy_from_slice(a);
+        }
+        if !is_transient {
+            self.old_log_e2 = self.old_log_e;
+            self.old_log_e = self.old_band_e;
+            for i in 0..2 * NB_EBANDS {
+                self.background_log_e[i] = (self.background_log_e[i] + mm as f32 * 0.001).min(self.old_band_e[i]);
+            }
+        } else {
+            for i in 0..2 * NB_EBANDS {
+                self.old_log_e[i] = self.old_log_e[i].min(self.old_band_e[i]);
+            }
+        }
+        for ch in 0..2 {
+            for i in (0..start).chain(end..NB_EBANDS) {
+                self.old_band_e[ch * NB_EBANDS + i] = 0.0;
+                self.old_log_e[ch * NB_EBANDS + i] = -28.0;
+                self.old_log_e2[ch * NB_EBANDS + i] = -28.0;
+            }
+        }
+        self.rng = dec.rng();
+        self.loss_count = 0;
+    }
+
+    /// Denormalisation + IMDCT into the decode memory (`celt_synthesis`).
+    #[allow(clippy::too_many_arguments)]
+    fn synthesis(&mut self, x: &[f32], n: usize, start: usize, eff_end: usize, c: usize, is_transient: bool, lm: usize, silence: bool) {
+        let cc = self.channels;
+        let m = self.m;
+        let mm = 1usize << lm;
+        let (bcount, nb, shift) = if is_transient { (mm, SHORT_MDCT, MAX_LM) } else { (1, SHORT_MDCT << lm, MAX_LM - lm) };
+        let ml = self.mem_len();
+        let mut freq = std::mem::take(&mut self.freq);
+        freq.clear();
+        freq.resize(2 * n, 0.0);
+        let (f0, f1) = freq.split_at_mut(n);
+        let out_off = DECODE_BUFFER_SIZE - n;
+        if cc == 2 && c == 1 {
+            denormalise_bands(x, f0, &self.old_band_e, start, eff_end, mm, self.downsample, silence);
+            f1.copy_from_slice(f0);
+            for (ch, f) in [(0usize, &*f1), (1usize, &*f0)] {
+                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+                for b in 0..bcount {
+                    m.mdct[shift].backward(&f[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
+                }
+            }
+        } else if cc == 1 && c == 2 {
+            denormalise_bands(x, f0, &self.old_band_e, start, eff_end, mm, self.downsample, silence);
+            denormalise_bands(&x[n..], f1, &self.old_band_e[NB_EBANDS..], start, eff_end, mm, self.downsample, silence);
+            for i in 0..n {
+                f0[i] = 0.5 * (f0[i] + f1[i]);
+            }
+            let mem = &mut self.decode_mem[..ml];
+            for b in 0..bcount {
+                m.mdct[shift].backward(&f0[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
+            }
+        } else {
+            for ch in 0..cc {
+                denormalise_bands(&x[ch * n..], f0, &self.old_band_e[ch * NB_EBANDS..], start, eff_end, mm, self.downsample, silence);
+                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+                for b in 0..bcount {
+                    m.mdct[shift].backward(&f0[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
+                }
+            }
+        }
+        self.freq = freq;
+    }
+
+    fn deemphasis(&mut self, n: usize, pcm: &mut [f32], accum: bool) {
+        let cc = self.channels;
+        let ml = self.mem_len();
+        let ds = self.downsample;
+        let out_off = DECODE_BUFFER_SIZE - n;
+        let mut scratch = std::mem::take(&mut self.pcm_scratch);
+        for ch in 0..cc {
+            let mem = &self.decode_mem[ch * ml + out_off..ch * ml + out_off + n];
+            let mut mstate = self.preemph_mem[ch];
+            scratch.clear();
+            for &v in mem {
+                let tmp = v + 1e-30 + mstate;
+                mstate = PREEMPH * tmp;
+                scratch.push(tmp);
+            }
+            self.preemph_mem[ch] = mstate;
+            for j in 0..n / ds {
+                let v = scratch[j * ds] * (1.0 / 32768.0);
+                let o = &mut pcm[j * cc + ch];
+                if accum {
+                    *o += v;
+                } else {
+                    *o = v;
+                }
+            }
+        }
+        self.pcm_scratch = scratch;
+    }
+
+    /// Packet-loss concealment: pitch-periodic extension for the first lost frames, then
+    /// decaying shaped noise.
+    fn decode_lost(&mut self, n: usize, lm: usize) {
+        let cc = self.channels;
+        let ml = self.mem_len();
+        let m = self.m;
+        let pitch_based = self.loss_count < 5 && self.start == 0 && !self.skip_plc;
+        if !pitch_based {
+            let decay = if self.loss_count == 0 { 1.5 } else { 0.5 };
+            for ch in 0..cc {
+                for i in self.start..self.end {
+                    let k = ch * NB_EBANDS + i;
+                    self.old_band_e[k] = self.background_log_e[k].max(self.old_band_e[k] - decay);
+                }
+            }
+            let mut seed = self.rng;
+            let mut x = std::mem::take(&mut self.x);
+            x.clear();
+            x.resize(cc * n, 0.0);
+            let eff_end = self.end.min(NB_EBANDS);
+            for ch in 0..cc {
+                for i in self.start..eff_end {
+                    let off = n * ch + ((EBANDS[i] as usize) << lm);
+                    let blen = ((EBANDS[i + 1] - EBANDS[i]) as usize) << lm;
+                    for v in x[off..off + blen].iter_mut() {
+                        seed = bands::lcg_rand(seed);
+                        *v = ((seed as i32) >> 20) as f32;
+                    }
+                    renormalise_vector(&mut x[off..off + blen], 1.0);
+                }
+            }
+            self.rng = seed;
+            for ch in 0..cc {
+                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+                mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
+            }
+            let saved_sc = self.stream_channels;
+            self.stream_channels = cc;
+            self.synthesis(&x, n, self.start, eff_end, cc, false, lm, false);
+            self.stream_channels = saved_sc;
+            self.x = x;
+        } else {
+            // Pitch search on the (mono-mixed) history.
+            let hist_len = 1024usize;
+            let base = DECODE_BUFFER_SIZE - hist_len;
+            let mut mono = vec![0f32; hist_len];
+            for ch in 0..cc {
+                for (i, v) in mono.iter_mut().enumerate() {
+                    *v += self.decode_mem[ch * ml + base + i];
+                }
+            }
+            let period = if self.loss_count == 0 { find_pitch(&mono) } else { self.postfilter_period_old.max(PLC_PITCH_LAG_MIN as i32) as usize };
+            let period = period.clamp(PLC_PITCH_LAG_MIN, PLC_PITCH_LAG_MAX);
+            // Remember the period for subsequent losses in the (otherwise unused) old period slot.
+            self.postfilter_period_old = period as i32;
+            let fade = 0.8f32.powi(self.loss_count as i32 + 1);
+            let mut ext = vec![0f32; n + OVERLAP];
+            for ch in 0..cc {
+                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+                // Energy decay across the last two periods.
+                let e1: f32 = mem[DECODE_BUFFER_SIZE - period..DECODE_BUFFER_SIZE].iter().map(|v| v * v).sum();
+                let e0: f32 = mem[DECODE_BUFFER_SIZE - 2 * period..DECODE_BUFFER_SIZE - period].iter().map(|v| v * v).sum();
+                let decay = if e0 > 0.0 { (e1 / e0).sqrt().min(1.0) } else { 0.0 };
+                let mut g = 1.0f32;
+                for (i, e) in ext.iter_mut().enumerate() {
+                    if i > 0 && i % period == 0 {
+                        g *= decay;
+                    }
+                    let src = DECODE_BUFFER_SIZE - period + (i % period);
+                    *e = mem[src] * g * fade;
+                }
+                mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
+                let out_off = DECODE_BUFFER_SIZE - n;
+                // Cross-fade the start with the previous overlap so the transition is smooth.
+                mem[out_off..out_off + n].copy_from_slice(&ext[..n]);
+                let tail = &ext[n..n + OVERLAP];
+                for i in 0..OVERLAP / 2 {
+                    mem[DECODE_BUFFER_SIZE + i] = m.window[i] * tail[OVERLAP - 1 - i] + m.window[OVERLAP - 1 - i] * tail[i];
+                }
+            }
+        }
+        self.loss_count += 1;
+    }
+}
+
+fn find_pitch(x: &[f32]) -> usize {
+    let n = x.len();
+    let win = 512.min(n - PLC_PITCH_LAG_MAX);
+    let tgt = &x[n - win..];
+    let mut best = PLC_PITCH_LAG_MIN;
+    let mut best_score = f32::MIN;
+    let e_t: f32 = tgt.iter().map(|v| v * v).sum::<f32>() + 1e-9;
+    for lag in PLC_PITCH_LAG_MIN..=PLC_PITCH_LAG_MAX {
+        let src = &x[n - win - lag..n - lag];
+        let mut xy = 0f32;
+        let mut yy = 1e-9f32;
+        for (a, b) in tgt.iter().zip(src) {
+            xy += a * b;
+            yy += b * b;
+        }
+        let score = xy / (e_t * yy).sqrt();
+        if score > best_score {
+            best_score = score;
+            best = lag;
+        }
+    }
+    best
+}
+
+fn tf_decode(start: usize, end: usize, is_transient: bool, tf_res: &mut [i32; NB_EBANDS], lm: usize, dec: &mut RangeDecoder) {
+    let mut budget = dec.storage() as i32 * 8;
+    let mut tell = dec.tell();
+    let mut logp: u32 = if is_transient { 2 } else { 4 };
+    let tf_select_rsv = lm > 0 && tell + (logp as i32) < budget;
+    budget -= tf_select_rsv as i32;
+    let mut tf_changed = 0;
+    let mut curr = 0;
+    for r in tf_res.iter_mut().take(end).skip(start) {
+        if tell + logp as i32 <= budget {
+            curr ^= dec.bit_logp(logp) as i32;
+            tell = dec.tell();
+            tf_changed |= curr;
+        }
+        *r = curr;
+        logp = if is_transient { 4 } else { 5 };
+    }
+    let mut tf_select = 0;
+    let ti = 4 * is_transient as usize;
+    if tf_select_rsv && TF_SELECT_TABLE[lm][ti + tf_changed as usize] != TF_SELECT_TABLE[lm][ti + 2 + tf_changed as usize] {
+        tf_select = dec.bit_logp(1) as usize;
+    }
+    for r in tf_res.iter_mut().take(end).skip(start) {
+        *r = TF_SELECT_TABLE[lm][ti + 2 * tf_select + *r as usize] as i32;
+    }
+}
+
+/// Pitch post-filter (in place on `buf[off .. off + n]`, reading history before `off`).
+#[allow(clippy::too_many_arguments)]
+fn comb_filter(buf: &mut [f32], off: usize, t0: i32, t1: i32, n: usize, g0: f32, g1: f32, tapset0: usize, tapset1: usize, window: &[f32; OVERLAP]) {
+    if g0 == 0.0 && g1 == 0.0 {
+        return;
+    }
+    let t0 = t0.max(COMBFILTER_MINPERIOD) as usize;
+    let t1 = t1.max(COMBFILTER_MINPERIOD) as usize;
+    let g00 = g0 * COMB_GAINS[tapset0][0];
+    let g01 = g0 * COMB_GAINS[tapset0][1];
+    let g02 = g0 * COMB_GAINS[tapset0][2];
+    let g10 = g1 * COMB_GAINS[tapset1][0];
+    let g11 = g1 * COMB_GAINS[tapset1][1];
+    let g12 = g1 * COMB_GAINS[tapset1][2];
+    let mut x1 = buf[off + 1 - t1];
+    let mut x2 = buf[off - t1];
+    let mut x3 = buf[off - t1 - 1];
+    let mut x4 = buf[off - t1 - 2];
+    let overlap = if g0 == g1 && t0 == t1 && tapset0 == tapset1 { 0 } else { OVERLAP.min(n) };
+    let mut i = 0;
+    while i < overlap {
+        let p = off + i;
+        let x0 = buf[p + 2 - t1];
+        let f = window[i] * window[i];
+        let a = 1.0 - f;
+        buf[p] = buf[p]
+            + a * g00 * buf[p - t0]
+            + a * g01 * (buf[p + 1 - t0] + buf[p - t0 - 1])
+            + a * g02 * (buf[p + 2 - t0] + buf[p - t0 - 2])
+            + f * g10 * x2
+            + f * g11 * (x1 + x3)
+            + f * g12 * (x0 + x4);
+        x4 = x3;
+        x3 = x2;
+        x2 = x1;
+        x1 = x0;
+        i += 1;
+    }
+    if g1 == 0.0 {
+        return;
+    }
+    // Constant filter for the rest of the block.
+    let t = t1;
+    for i in overlap..n {
+        let p = off + i;
+        buf[p] = buf[p] + g10 * buf[p - t] + g11 * (buf[p + 1 - t] + buf[p - t - 1]) + g12 * (buf[p + 2 - t] + buf[p - t - 2]);
+    }
+}
@@ -0,0 +1,171 @@
+//! Band energy decoding: Laplace-coded coarse energy, fine energy and the final refinement
+//! (RFC 6716 §4.3.2).
+
+use super::rate::MAX_FINE_BITS;
+use super::tables::{BETA_COEF, BETA_INTRA, E_PROB_MODEL, NB_EBANDS, PRED_COEF, SMALL_ENERGY_ICDF};
+use crate::range::RangeDecoder;
+
+const LAPLACE_MINP: u32 = 1;
+const LAPLACE_NMIN: u32 = 16;
+
+fn laplace_get_freq1(fs0: u32, decay: u32) -> u32 {
+    let ft = 32768 - LAPLACE_MINP * (2 * LAPLACE_NMIN) - fs0;
+    (ft * (16384 - decay)) >> 15
+}
+
+/// Decodes a Laplace-distributed integer (`fs` = probability of 0 in Q15, `decay` in Q14).
+pub fn laplace_decode(dec: &mut RangeDecoder, mut fs: u32, decay: u32) -> i32 {
+    let mut val = 0i32;
+    let fm = dec.decode_bin(15);
+    let mut fl = 0u32;
+    if fm >= fs {
+        val += 1;
+        fl = fs;
+        fs = laplace_get_freq1(fs, decay) + LAPLACE_MINP;
+        while fs > LAPLACE_MINP && fm >= fl + 2 * fs {
+            fs *= 2;
+            fl += fs;
+            fs = (((fs - 2 * LAPLACE_MINP) * decay) >> 15) + LAPLACE_MINP;
+            val += 1;
+        }
+        if fs <= LAPLACE_MINP {
+            let di = (fm - fl) >> 1;
+            val += di as i32;
+            fl += 2 * di * LAPLACE_MINP;
+        }
+        if fm < fl + fs {
+            val = -val;
+        } else {
+            fl += fs;
+        }
+    }
+    dec.update_bin(fl, (fl + fs).min(32768), 15);
+    val
+}
+
+/// `unquant_coarse_energy`.
+#[allow(clippy::too_many_arguments)]
+pub fn unquant_coarse_energy(start: usize, end: usize, old_e: &mut [f32], intra: bool, dec: &mut RangeDecoder, c: usize, lm: usize) {
+    let prob = &E_PROB_MODEL[lm][intra as usize];
+    let (coef, beta) = if intra { (0.0, BETA_INTRA) } else { (PRED_COEF[lm], BETA_COEF[lm]) };
+    let budget = dec.storage() as i32 * 8;
+    let mut prev = [0f32; 2];
+    for i in start..end {
+        for ch in 0..c {
+            let tell = dec.tell();
+            let qi = if budget - tell >= 15 {
+                let pi = 2 * i.min(20);
+                laplace_decode(dec, (prob[pi] as u32) << 7, (prob[pi + 1] as u32) << 6)
+            } else if budget - tell >= 2 {
+                let q = dec.icdf(&SMALL_ENERGY_ICDF, 2) as i32;
+                (q >> 1) ^ -(q & 1)
+            } else if budget - tell >= 1 {
+                -(dec.bit_logp(1) as i32)
+            } else {
+                -1
+            };
+            let q = qi as f32;
+            let idx = i + ch * NB_EBANDS;
+            old_e[idx] = old_e[idx].max(-9.0);
+            let tmp = coef * old_e[idx] + prev[ch] + q;
+            old_e[idx] = tmp;
+            prev[ch] = prev[ch] + q - beta * q;
+        }
+    }
+}
+
+pub fn unquant_fine_energy(start: usize, end: usize, old_e: &mut [f32], fine_quant: &[i32; NB_EBANDS], dec: &mut RangeDecoder, c: usize) {
+    for i in start..end {
+        let fq = fine_quant[i];
+        if fq <= 0 {
+            continue;
+        }
+        for ch in 0..c {
+            let q2 = dec.bits(fq as u32);
+            let offset = (q2 as f32 + 0.5) * (1 << (14 - fq)) as f32 / 16384.0 - 0.5;
+            old_e[i + ch * NB_EBANDS] += offset;
+        }
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+pub fn unquant_energy_finalise(
+    start: usize,
+    end: usize,
+    old_e: &mut [f32],
+    fine_quant: &[i32; NB_EBANDS],
+    fine_priority: &[i32; NB_EBANDS],
+    mut bits_left: i32,
+    dec: &mut RangeDecoder,
+    c: usize,
+) {
+    for prio in 0..2 {
+        let mut i = start;
+        while i < end && bits_left >= c as i32 {
+            if fine_quant[i] >= MAX_FINE_BITS || fine_priority[i] != prio {
+                i += 1;
+                continue;
+            }
+            for ch in 0..c {
+                let q2 = dec.bits(1);
+                let offset = (q2 as f32 - 0.5) * (1 << (14 - fine_quant[i] - 1)) as f32 / 16384.0;
+                old_e[i + ch * NB_EBANDS] += offset;
+                bits_left -= 1;
+            }
+            i += 1;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::range::enc::RangeEncoder;
+
+    fn laplace_encode(e: &mut RangeEncoder, value: i32, mut fs: u32, decay: u32) {
+        let mut fl = 0u32;
+        let mut val = value;
+        if val != 0 {
+            let s: i32 = if val < 0 { -1 } else { 0 };
+            val = val.abs();
+            fl = fs;
+            fs = laplace_get_freq1(fs, decay);
+            let mut i = 1;
+            while fs > 0 && i < val {
+                fs *= 2;
+                fl += fs + 2 * LAPLACE_MINP;
+                fs = (fs * decay) >> 15;
+                i += 1;
+            }
+            if fs == 0 {
+                let ndi_max = (32768 - fl + LAPLACE_MINP - 1) as i32;
+                let ndi_max = (ndi_max - s) >> 1;
+                let di = (val - i).min(ndi_max - 1);
+                fl = (fl as i32 + (2 * di + 1 + s) * LAPLACE_MINP as i32) as u32;
+                fs = LAPLACE_MINP.min(32768 - fl);
+            } else {
+                fs += LAPLACE_MINP;
+                if s == 0 {
+                    fl += fs;
+                }
+            }
+        }
+        e.encode(fl, fl + fs, 32768);
+    }
+
+    #[test]
+    fn laplace_roundtrip() {
+        for &(fs, decay) in &[(72u32 << 7, 127u32 << 6), (24 << 7, 179 << 6), (177 << 7, 11 << 6)] {
+            let vals: Vec<i32> = (-12..=12).collect();
+            let mut e = RangeEncoder::new(400);
+            for &v in &vals {
+                laplace_encode(&mut e, v, fs, decay);
+            }
+            let buf = e.done();
+            let mut d = RangeDecoder::new(&buf);
+            for &v in &vals {
+                assert_eq!(laplace_decode(&mut d, fs, decay), v, "fs={fs} v={v}");
+            }
+        }
+    }
+}
@@ -0,0 +1,205 @@
+//! Inverse MDCT with the low-overlap window and in-place TDAC (RFC 6716 §4.3.7).
+//!
+//! The IMDCT is computed through an N/4-point complex FFT (pre-rotation, FFT, post-rotation),
+//! producing the N/2 "folded" time samples; the window overlap region is then unfolded against the
+//! folded tail of the previous block, which the caller keeps in place in the output buffer.
+
+#[derive(Clone, Copy, Default, Debug)]
+pub struct Cpx {
+    pub re: f32,
+    pub im: f32,
+}
+
+impl Cpx {
+    #[inline]
+    fn mul(self, o: Cpx) -> Cpx {
+        Cpx { re: self.re * o.re - self.im * o.im, im: self.re * o.im + self.im * o.re }
+    }
+    #[inline]
+    fn add(self, o: Cpx) -> Cpx {
+        Cpx { re: self.re + o.re, im: self.im + o.im }
+    }
+}
+
+/// Mixed-radix (2, 3, 4, 5) forward complex FFT, unscaled.
+pub struct Fft {
+    n: usize,
+    factors: Vec<usize>,
+    twiddle: Vec<Cpx>,
+}
+
+impl Fft {
+    pub fn new(n: usize) -> Fft {
+        let mut factors = Vec::new();
+        let mut m = n;
+        for p in [4usize, 2, 3, 5] {
+            while m.is_multiple_of(p) {
+                factors.push(p);
+                m /= p;
+            }
+        }
+        assert_eq!(m, 1, "unsupported FFT size {n}");
+        let twiddle = (0..n)
+            .map(|k| {
+                let ph = -2.0 * std::f64::consts::PI * k as f64 / n as f64;
+                Cpx { re: ph.cos() as f32, im: ph.sin() as f32 }
+            })
+            .collect();
+        Fft { n, factors, twiddle }
+    }
+
+    pub fn process(&self, data: &mut [Cpx], scratch: &mut Vec<Cpx>) {
+        scratch.clear();
+        scratch.extend_from_slice(&data[..self.n]);
+        self.rec(&mut data[..self.n], scratch, 1, self.n, 0, 1);
+    }
+
+    fn rec(&self, out: &mut [Cpx], inp: &[Cpx], in_stride: usize, n: usize, fi: usize, tw_stride: usize) {
+        let p = self.factors[fi];
+        let m = n / p;
+        if m == 1 {
+            for (i, o) in out.iter_mut().enumerate().take(p) {
+                *o = inp[i * in_stride];
+            }
+        } else {
+            for q in 0..p {
+                self.rec(&mut out[q * m..(q + 1) * m], &inp[q * in_stride..], in_stride * p, m, fi + 1, tw_stride * p);
+            }
+        }
+        let big = self.n;
+        let mut t = [Cpx::default(); 5];
+        for k in 0..m {
+            for q in 0..p {
+                let w = self.twiddle[(q * k * tw_stride) % big];
+                t[q] = out[q * m + k].mul(w);
+            }
+            for q2 in 0..p {
+                let mut acc = Cpx::default();
+                for (q, tq) in t.iter().enumerate().take(p) {
+                    let w = self.twiddle[((q * q2) % p) * (big / p)];
+                    acc = acc.add(tq.mul(w));
+                }
+                out[q2 * m + k] = acc;
+            }
+        }
+    }
+}
+
+pub struct Imdct {
+    /// Full MDCT length (2x the number of coefficients).
+    n: usize,
+    trig: Vec<f32>,
+    fft: Fft,
+}
+
+impl Imdct {
+    pub fn new(n: usize) -> Imdct {
+        let trig = (0..n / 2).map(|i| (2.0 * std::f64::consts::PI * (i as f64 + 0.125) / n as f64).cos() as f32).collect();
+        Imdct { n, trig, fft: Fft::new(n / 4) }
+    }
+
+    /// Inverse transform of `n/2` coefficients read from `input` at `stride`.
+    ///
+    /// Writes the folded block to `out[overlap/2 .. overlap/2 + n/2]` and unfolds the first
+    /// `overlap` samples against the previous block's folded tail already stored in
+    /// `out[0 .. overlap/2]`.
+    pub fn backward(&self, input: &[f32], stride: usize, out: &mut [f32], window: &[f32], overlap: usize, work: &mut ImdctScratch) {
+        let n2 = self.n >> 1;
+        let n4 = self.n >> 2;
+        let t = &self.trig;
+        let z = &mut work.z;
+        z.clear();
+        for i in 0..n4 {
+            let x1 = input[2 * i * stride];
+            let x2 = input[stride * (n2 - 1 - 2 * i)];
+            let yr = x2 * t[i] + x1 * t[n4 + i];
+            let yi = x1 * t[i] - x2 * t[n4 + i];
+            z.push(Cpx { re: yi, im: yr });
+        }
+        self.fft.process(z, &mut work.scratch);
+        let base = overlap >> 1;
+        let y = &mut out[base..base + n2];
+        for i in 0..n4.div_ceil(2) {
+            let front = z[i];
+            let back = z[n4 - 1 - i];
+            let (re, im) = (front.im, front.re);
+            let (t0, t1) = (t[i], t[n4 + i]);
+            let yr0 = re * t0 + im * t1;
+            let yi0 = re * t1 - im * t0;
+            let (re, im) = (back.im, back.re);
+            let (t0, t1) = (t[n4 - i - 1], t[n2 - i - 1]);
+            let yr1 = re * t0 + im * t1;
+            let yi1 = re * t1 - im * t0;
+            y[2 * i] = yr0;
+            y[n2 - 1 - 2 * i] = yi0;
+            y[n2 - 2 - 2 * i] = yr1;
+            y[2 * i + 1] = yi1;
+        }
+        // Mirror on both sides for TDAC.
+        for i in 0..overlap / 2 {
+            let x1 = out[overlap - 1 - i];
+            let x2 = out[i];
+            let w1 = window[i];
+            let w2 = window[overlap - 1 - i];
+            out[i] = x2 * w2 - x1 * w1;
+            out[overlap - 1 - i] = x2 * w1 + x1 * w2;
+        }
+    }
+}
+
+#[derive(Default)]
+pub struct ImdctScratch {
+    z: Vec<Cpx>,
+    scratch: Vec<Cpx>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn fft_matches_dft() {
+        for &n in &[60usize, 120, 240, 480] {
+            let fft = Fft::new(n);
+            let x: Vec<Cpx> = (0..n).map(|i| Cpx { re: ((i * 7) % 13) as f32 - 6.0, im: ((i * 3) % 5) as f32 - 2.0 }).collect();
+            let mut y = x.clone();
+            fft.process(&mut y, &mut Vec::new());
+            for k in [0, 1, 7, n / 2, n - 1] {
+                let mut acc = (0f64, 0f64);
+                for (i, v) in x.iter().enumerate() {
+                    let ph = -2.0 * std::f64::consts::PI * (i * k) as f64 / n as f64;
+                    acc.0 += v.re as f64 * ph.cos() - v.im as f64 * ph.sin();
+                    acc.1 += v.re as f64 * ph.sin() + v.im as f64 * ph.cos();
+                }
+                assert!((acc.0 - y[k].re as f64).abs() < 1e-2 && (acc.1 - y[k].im as f64).abs() < 1e-2, "n={n} k={k}");
+            }
+        }
+    }
+
+    /// The folded output must equal the direct IMDCT formula folded by TDAC symmetry.
+    #[test]
+    fn imdct_matches_direct_formula() {
+        let n = 240;
+        let n2 = n / 2;
+        let im = Imdct::new(n);
+        let x: Vec<f32> = (0..n2).map(|k| ((k * 37 % 11) as f32 - 5.0) / 5.0).collect();
+        let overlap = 0;
+        let mut out = vec![0f32; n2];
+        im.backward(&x, 1, &mut out, &[], overlap, &mut ImdctScratch::default());
+        // Direct IMDCT y[t] = sum X[k] cos(2pi/N (t + 1/2 + N/4)(k + 1/2)), t in 0..N.
+        let y: Vec<f64> = (0..n)
+            .map(|t| {
+                (0..n2)
+                    .map(|k| x[k] as f64 * (2.0 * std::f64::consts::PI / n as f64 * (t as f64 + 0.5 + n as f64 / 4.0) * (k as f64 + 0.5)).cos())
+                    .sum()
+            })
+            .collect();
+        // The folded half: out[i] relates to y in the middle half; check proportionality.
+        let mid: Vec<f64> = (0..n2).map(|i| y[n / 4 + i]).collect();
+        let dot: f64 = mid.iter().zip(&out).map(|(a, b)| a * *b as f64).sum();
+        let ea: f64 = mid.iter().map(|a| a * a).sum();
+        let eb: f64 = out.iter().map(|b| (*b as f64).powi(2)).sum();
+        let corr = dot.abs() / (ea.sqrt() * eb.sqrt());
+        assert!(corr > 0.999, "corr {corr}");
+    }
+}
@@ -0,0 +1,584 @@
+//! Pulse cache and bit allocation (RFC 6716 §4.3.3, §4.3.4.1).
+
+use super::tables::{ALLOC, EBANDS, LOG2_FRAC_TABLE, MAX_LM, NB_EBANDS, OVERLAP};
+use crate::range::{BITRES, RangeDecoder};
+
+const MAX_PSEUDO: i32 = 40;
+const LOG_MAX_PSEUDO: i32 = 6;
+pub const MAX_FINE_BITS: i32 = 8;
+const FINE_OFFSET: i32 = 21;
+pub const QTHETA_OFFSET: i32 = 4;
+pub const QTHETA_OFFSET_TWOPHASE: i32 = 16;
+const ALLOC_STEPS: i32 = 6;
+
+/// Number of pulses represented by pseudo-pulse index `i`.
+pub fn get_pulses(i: i32) -> i32 {
+    if i < 8 { i } else { (8 + (i & 7)) << ((i >> 3) - 1) }
+}
+
+/// Conservative (rounded up) log2 of `val` with `frac` fractional bits.
+pub fn log2_frac(mut val: u32, mut frac: u32) -> i32 {
+    let mut l = crate::range::ilog(val);
+    if val & val.wrapping_sub(1) != 0 {
+        if l > 16 {
+            val = ((val - 1) >> (l - 16)) + 1;
+        } else {
+            val <<= 16 - l;
+        }
+        let mut l = (l - 1) << frac;
+        loop {
+            let b = (val >> 16) as i32;
+            l += b << frac;
+            val = (val + b as u32) >> b;
+            val = (val * val + 0x7FFF) >> 15;
+            if frac == 0 {
+                break;
+            }
+            frac -= 1;
+        }
+        l + (val > 0x8000) as i32
+    } else {
+        l -= 1;
+        l << frac
+    }
+}
+
+/// PVQ codebook size V(N, K) as u128 (saturating far above 2^32).
+pub fn pvq_v(n: usize, k: usize) -> u128 {
+    // V(N,K) = V(N-1,K) + V(N,K-1) + V(N-1,K-1); computed row by row.
+    if k == 0 {
+        return 1;
+    }
+    if n == 0 {
+        return 0;
+    }
+    let mut row = vec![0u128; k + 1]; // V(0, k)
+    row[0] = 1;
+    for _ in 0..n {
+        let mut prev_diag = row[0]; // V(n-1, 0)
+        // V(n, 0) = 1
+        for kk in 1..=k {
+            let up = row[kk]; // V(n-1, kk)
+            let v = up.saturating_add(row[kk - 1]).saturating_add(prev_diag);
+            prev_diag = up;
+            row[kk] = v.min(u128::MAX >> 8);
+        }
+        row[0] = 1;
+    }
+    row[k]
+}
+
+fn fits_in32(n: usize, k: i32) -> bool {
+    pvq_v(n, k as usize) <= u32::MAX as u128
+}
+
+/// Precomputed per-mode data shared by all CELT decoders.
+pub struct Mode {
+    /// log2 of band width in 1/8 bits.
+    pub log_n: [i32; NB_EBANDS],
+    /// Index into `cache_bits` for `(LM+1)*NB_EBANDS + band` (-1 when unused).
+    pub cache_index: Vec<i16>,
+    /// `cache[0]` = max pseudo-pulses; `cache[k]` = bits(k) - 1 in 1/8 bits.
+    pub cache_bits: Vec<u8>,
+    /// Per-band maximum allocation: `[(2*LM + C-1)*NB_EBANDS + band]`.
+    pub caps: Vec<u8>,
+    pub window: [f32; OVERLAP],
+    pub mdct: [super::mdct::Imdct; MAX_LM + 1],
+}
+
+impl Mode {
+    pub fn new() -> Mode {
+        let mut log_n = [0i32; NB_EBANDS];
+        for (i, l) in log_n.iter_mut().enumerate() {
+            *l = log2_frac((EBANDS[i + 1] - EBANDS[i]) as u32, BITRES);
+        }
+        let (cache_index, cache_bits) = compute_pulse_cache(MAX_LM as i32);
+        let mut m = Mode {
+            log_n,
+            cache_index,
+            cache_bits,
+            caps: Vec::new(),
+            window: [0.0; OVERLAP],
+            mdct: [super::mdct::Imdct::new(1920), super::mdct::Imdct::new(960), super::mdct::Imdct::new(480), super::mdct::Imdct::new(240)],
+        };
+        m.caps = compute_caps(&m);
+        for i in 0..OVERLAP {
+            let x = std::f64::consts::FRAC_PI_2 * (i as f64 + 0.5) / OVERLAP as f64;
+            let s = x.sin();
+            m.window[i] = (std::f64::consts::FRAC_PI_2 * s * s).sin() as f32;
+        }
+        m
+    }
+
+    #[inline]
+    pub fn cache(&self, lm: i32, band: usize) -> &[u8] {
+        let idx = self.cache_index[((lm + 1) as usize) * NB_EBANDS + band];
+        &self.cache_bits[idx.max(0) as usize..]
+    }
+
+    pub fn bits2pulses(&self, band: usize, lm: i32, bits: i32) -> i32 {
+        let cache = self.cache(lm, band);
+        let mut lo = 0i32;
+        let mut hi = cache[0] as i32;
+        let bits = bits - 1;
+        for _ in 0..LOG_MAX_PSEUDO {
+            let mid = (lo + hi + 1) >> 1;
+            if cache[mid as usize] as i32 >= bits {
+                hi = mid;
+            } else {
+                lo = mid;
+            }
+        }
+        let lo_bits = if lo == 0 { -1 } else { cache[lo as usize] as i32 };
+        if bits - lo_bits <= cache[hi as usize] as i32 - bits { lo } else { hi }
+    }
+
+    pub fn pulses2bits(&self, band: usize, lm: i32, pulses: i32) -> i32 {
+        if pulses == 0 { 0 } else { self.cache(lm, band)[pulses as usize] as i32 + 1 }
+    }
+
+    /// Per-band allocation caps for this frame (`init_caps`).
+    pub fn init_caps(&self, lm: usize, c: usize) -> [i32; NB_EBANDS] {
+        let mut cap = [0i32; NB_EBANDS];
+        for (i, cp) in cap.iter_mut().enumerate() {
+            let n = (EBANDS[i + 1] - EBANDS[i]) << lm;
+            *cp = (self.caps[NB_EBANDS * (2 * lm + c - 1) + i] as i32 + 64) * c as i32 * n >> 2;
+        }
+        cap
+    }
+}
+
+fn compute_pulse_cache(lm_max: i32) -> (Vec<i16>, Vec<u8>) {
+    let nb = NB_EBANDS;
+    let rows = (lm_max + 2) as usize;
+    let mut index = vec![-1i16; nb * rows];
+    let mut entries: Vec<(usize, i32, usize)> = Vec::new(); // (N, K, offset)
+    let mut curr = 0usize;
+    for i in 0..rows {
+        for j in 0..nb {
+            let n = (((EBANDS[j + 1] - EBANDS[j]) << i) >> 1) as usize;
+            index[i * nb + j] = -1;
+            // Reuse the entry of an earlier band with the same size.
+            'search: for k in 0..=i {
+                for nn in 0..nb {
+                    if k == i && nn >= j {
+                        break;
+                    }
+                    if n == (((EBANDS[nn + 1] - EBANDS[nn]) << k) >> 1) as usize {
+                        index[i * nb + j] = index[k * nb + nn];
+                        break 'search;
+                    }
+                }
+            }
+            if index[i * nb + j] == -1 && n != 0 {
+                let mut k = 0;
+                while k < MAX_PSEUDO && fits_in32(n, get_pulses(k + 1)) {
+                    k += 1;
+                }
+                index[i * nb + j] = curr as i16;
+                entries.push((n, k, curr));
+                curr += (k + 1) as usize;
+            }
+        }
+    }
+    let mut bits = vec![0u8; curr];
+    for &(n, k, off) in &entries {
+        let maxk = get_pulses(k) as usize;
+        let tmp = required_bits(n, maxk, BITRES);
+        for j in 1..=k {
+            bits[off + j as usize] = (tmp[get_pulses(j) as usize] - 1) as u8;
+        }
+        bits[off] = k as u8;
+    }
+    (index, bits)
+}
+
+/// Bits (1/2^frac units, rounded up) needed for each K in `0..=maxk` for dimension `n`.
+fn required_bits(n: usize, maxk: usize, frac: u32) -> Vec<i32> {
+    let mut out = vec![0i32; maxk + 1];
+    if n == 1 {
+        for o in out.iter_mut().skip(1) {
+            *o = 1 << frac;
+        }
+    } else {
+        for (k, o) in out.iter_mut().enumerate().skip(1) {
+            let v = pvq_v(n, k);
+            *o = log2_frac(v as u32, frac);
+        }
+    }
+    out
+}
+
+fn compute_caps(m: &Mode) -> Vec<u8> {
+    let nb = NB_EBANDS;
+    let mut caps = vec![0u8; (MAX_LM + 1) * 2 * nb];
+    for i in 0..=MAX_LM as i32 {
+        for c in 1..=2i32 {
+            for j in 0..nb {
+                let mut n0 = EBANDS[j + 1] - EBANDS[j];
+                let max_bits = if n0 << i == 1 {
+                    c * (1 + MAX_FINE_BITS) << BITRES
+                } else {
+                    let mut lm0 = 0;
+                    if n0 > 2 {
+                        n0 >>= 1;
+                        lm0 -= 1;
+                    } else if n0 <= 1 {
+                        lm0 = i.min(1);
+                        n0 <<= lm0;
+                    }
+                    let pcache = m.cache(lm0, j);
+                    let mut mb = pcache[pcache[0] as usize] as i32 + 1;
+                    let mut n = n0;
+                    for k in 0..(i - lm0) {
+                        mb <<= 1;
+                        let offset = ((m.log_n[j] + ((lm0 + k) << BITRES)) >> 1) - QTHETA_OFFSET;
+                        let num = 459 * ((2 * n - 1) * offset + mb);
+                        let den = ((2 * n - 1) << 9) - 459;
+                        let qb = ((num + (den >> 1)) / den).min(57);
+                        mb += qb;
+                        n <<= 1;
+                    }
+                    if c == 2 {
+                        mb <<= 1;
+                        let offset = ((m.log_n[j] + (i << BITRES)) >> 1) - if n == 2 { QTHETA_OFFSET_TWOPHASE } else { QTHETA_OFFSET };
+                        let ndof = 2 * n - 1 - (n == 2) as i32;
+                        let p = if n == 2 { 512 } else { 487 };
+                        let num = p * (mb + ndof * offset);
+                        let den = (ndof << 9) - p;
+                        let qb = ((num + (den >> 1)) / den).min(if n == 2 { 64 } else { 61 });
+                        mb += qb;
+                    }
+                    let ndof = c * n + if c == 2 && n > 2 { 1 } else { 0 };
+                    let mut offset = ((m.log_n[j] + (i << BITRES)) >> 1) - FINE_OFFSET;
+                    if n == 2 {
+                        offset += (1 << BITRES) >> 2;
+                    }
+                    let num = mb + ndof * offset;
+                    let den = (ndof - 1) << BITRES;
+                    let qb = ((num + (den >> 1)) / den).min(MAX_FINE_BITS);
+                    mb += c * qb << BITRES;
+                    mb
+                };
+                let w = c * ((EBANDS[j + 1] - EBANDS[j]) << i);
+                let v = (4 * max_bits / w) - 64;
+                caps[((i * 2 + c - 1) as usize) * nb + j] = v.clamp(0, 255) as u8;
+            }
+        }
+    }
+    caps
+}
+
+/// Result of the allocation process.
+pub struct Allocation {
+    pub coded_bands: usize,
+    pub intensity: usize,
+    pub dual_stereo: bool,
+    pub balance: i32,
+    pub pulses: [i32; NB_EBANDS],
+    pub fine_quant: [i32; NB_EBANDS],
+    pub fine_priority: [i32; NB_EBANDS],
+}
+
+/// `clt_compute_allocation` (decoder side).
+#[allow(clippy::too_many_arguments)]
+pub fn compute_allocation(
+    m: &Mode,
+    start: usize,
+    end: usize,
+    offsets: &[i32; NB_EBANDS],
+    cap: &[i32; NB_EBANDS],
+    alloc_trim: i32,
+    total: i32,
+    c: usize,
+    lm: usize,
+    dec: &mut RangeDecoder,
+) -> Allocation {
+    let ci = c as i32;
+    let lmi = lm as i32;
+    let mut total = total.max(0);
+    let mut skip_start = start;
+    let skip_rsv = if total >= 1 << BITRES { 1 << BITRES } else { 0 };
+    total -= skip_rsv;
+    let mut intensity_rsv = 0;
+    let mut dual_stereo_rsv = 0;
+    if c == 2 {
+        intensity_rsv = LOG2_FRAC_TABLE[end - start];
+        if intensity_rsv > total {
+            intensity_rsv = 0;
+        } else {
+            total -= intensity_rsv;
+            dual_stereo_rsv = if total >= 1 << BITRES { 1 << BITRES } else { 0 };
+            total -= dual_stereo_rsv;
+        }
+    }
+    let mut bits1 = [0i32; NB_EBANDS];
+    let mut bits2 = [0i32; NB_EBANDS];
+    let mut thresh = [0i32; NB_EBANDS];
+    let mut trim_offset = [0i32; NB_EBANDS];
+    for j in start..end {
+        let w = EBANDS[j + 1] - EBANDS[j];
+        thresh[j] = (ci << BITRES).max((3 * w << lmi << BITRES) >> 4);
+        trim_offset[j] = ci * w * (alloc_trim - 5 - lmi) * (end as i32 - j as i32 - 1) * (1 << (lmi + BITRES as i32)) >> 6;
+        if w << lmi == 1 {
+            trim_offset[j] -= ci << BITRES;
+        }
+    }
+    let nb_alloc = ALLOC.len() as i32;
+    let mut lo = 1;
+    let mut hi = nb_alloc - 1;
+    loop {
+        let mut done = false;
+        let mut psum = 0;
+        let mid = (lo + hi) >> 1;
+        for j in (start..end).rev() {
+            let n = EBANDS[j + 1] - EBANDS[j];
+            let mut bitsj = ci * n * (ALLOC[mid as usize][j] as i32) << lmi >> 2;
+            if bitsj > 0 {
+                bitsj = (bitsj + trim_offset[j]).max(0);
+            }
+            bitsj += offsets[j];
+            if bitsj >= thresh[j] || done {
+                done = true;
+                psum += bitsj.min(cap[j]);
+            } else if bitsj >= ci << BITRES {
+                psum += ci << BITRES;
+            }
+        }
+        if psum > total {
+            hi = mid - 1;
+        } else {
+            lo = mid + 1;
+        }
+        if lo > hi {
+            break;
+        }
+    }
+    hi = lo;
+    lo -= 1;
+    for j in start..end {
+        let n = EBANDS[j + 1] - EBANDS[j];
+        let mut bits1j = ci * n * (ALLOC[lo as usize][j] as i32) << lmi >> 2;
+        let mut bits2j = if hi >= nb_alloc { cap[j] } else { ci * n * (ALLOC[hi as usize][j] as i32) << lmi >> 2 };
+        if bits1j > 0 {
+            bits1j = (bits1j + trim_offset[j]).max(0);
+        }
+        if bits2j > 0 {
+            bits2j = (bits2j + trim_offset[j]).max(0);
+        }
+        if lo > 0 {
+            bits1j += offsets[j];
+        }
+        bits2j += offsets[j];
+        if offsets[j] > 0 {
+            skip_start = j;
+        }
+        bits2j = (bits2j - bits1j).max(0);
+        bits1[j] = bits1j;
+        bits2[j] = bits2j;
+    }
+    interp_bits2pulses(m, start, end, skip_start, &bits1, &bits2, &thresh, cap, total, skip_rsv, intensity_rsv, dual_stereo_rsv, c, lm, dec)
+}
+
+#[allow(clippy::too_many_arguments)]
+fn interp_bits2pulses(
+    m: &Mode,
+    start: usize,
+    end: usize,
+    skip_start: usize,
+    bits1: &[i32; NB_EBANDS],
+    bits2: &[i32; NB_EBANDS],
+    thresh: &[i32; NB_EBANDS],
+    cap: &[i32; NB_EBANDS],
+    mut total: i32,
+    skip_rsv: i32,
+    mut intensity_rsv: i32,
+    mut dual_stereo_rsv: i32,
+    c: usize,
+    lm: usize,
+    dec: &mut RangeDecoder,
+) -> Allocation {
+    let ci = c as i32;
+    let alloc_floor = ci << BITRES;
+    let stereo = (c > 1) as i32;
+    let log_m = (lm as i32) << BITRES;
+    let mut lo = 0;
+    let mut hi = 1 << ALLOC_STEPS;
+    for _ in 0..ALLOC_STEPS {
+        let mid = (lo + hi) >> 1;
+        let mut psum = 0;
+        let mut done = false;
+        for j in (start..end).rev() {
+            let tmp = bits1[j] + (mid * bits2[j] >> ALLOC_STEPS);
+            if tmp >= thresh[j] || done {
+                done = true;
+                psum += tmp.min(cap[j]);
+            } else if tmp >= alloc_floor {
+                psum += alloc_floor;
+            }
+        }
+        if psum > total {
+            hi = mid;
+        } else {
+            lo = mid;
+        }
+    }
+    let mut bits = [0i32; NB_EBANDS];
+    let mut psum = 0;
+    let mut done = false;
+    for j in (start..end).rev() {
+        let mut tmp = bits1[j] + (lo * bits2[j] >> ALLOC_STEPS);
+        if tmp < thresh[j] && !done {
+            tmp = if tmp >= alloc_floor { alloc_floor } else { 0 };
+        } else {
+            done = true;
+        }
+        tmp = tmp.min(cap[j]);
+        bits[j] = tmp;
+        psum += tmp;
+    }
+    let s = start;
+    let mut coded_bands = end;
+    loop {
+        let j = coded_bands - 1;
+        if j <= skip_start {
+            total += skip_rsv;
+            break;
+        }
+        let mut left = total - psum;
+        let span = EBANDS[coded_bands] - EBANDS[s];
+        let percoeff = left / span;
+        left -= span * percoeff;
+        let rem = (left - (EBANDS[j] - EBANDS[s])).max(0);
+        let band_width = EBANDS[coded_bands] - EBANDS[j];
+        let mut band_bits = bits[j] + percoeff * band_width + rem;
+        if band_bits >= thresh[j].max(alloc_floor + (1 << BITRES)) {
+            if dec.bit_logp(1) {
+                break;
+            }
+            psum += 1 << BITRES;
+            band_bits -= 1 << BITRES;
+        }
+        psum -= bits[j] + intensity_rsv;
+        if intensity_rsv > 0 {
+            intensity_rsv = LOG2_FRAC_TABLE[j - s];
+        }
+        psum += intensity_rsv;
+        if band_bits >= alloc_floor {
+            psum += alloc_floor;
+            bits[j] = alloc_floor;
+        } else {
+            bits[j] = 0;
+        }
+        coded_bands -= 1;
+    }
+    let intensity = if intensity_rsv > 0 { s + dec.uint((coded_bands + 1 - s) as u32) as usize } else { 0 };
+    if intensity <= s {
+        total += dual_stereo_rsv;
+        dual_stereo_rsv = 0;
+    }
+    let dual_stereo = if dual_stereo_rsv > 0 { dec.bit_logp(1) } else { false };
+    let mut left = total - psum;
+    let span = EBANDS[coded_bands] - EBANDS[s];
+    let percoeff = left / span;
+    left -= span * percoeff;
+    for j in s..coded_bands {
+        bits[j] += percoeff * (EBANDS[j + 1] - EBANDS[j]);
+    }
+    for j in s..coded_bands {
+        let tmp = left.min(EBANDS[j + 1] - EBANDS[j]);
+        bits[j] += tmp;
+        left -= tmp;
+    }
+    let mut ebits = [0i32; NB_EBANDS];
+    let mut fine_priority = [0i32; NB_EBANDS];
+    let mut balance = 0;
+    for j in s..coded_bands {
+        let n0 = EBANDS[j + 1] - EBANDS[j];
+        let n = n0 << lm;
+        let bit = bits[j] + balance;
+        let mut excess;
+        if n > 1 {
+            excess = (bit - cap[j]).max(0);
+            bits[j] = bit - excess;
+            let den = ci * n + if c == 2 && n > 2 && !dual_stereo && j < intensity { 1 } else { 0 };
+            let nclogn = den * (m.log_n[j] + log_m);
+            let mut offset = (nclogn >> 1) - den * FINE_OFFSET;
+            if n == 2 {
+                offset += (den << BITRES) >> 2;
+            }
+            if bits[j] + offset < den * 2 << BITRES {
+                offset += nclogn >> 2;
+            } else if bits[j] + offset < den * 3 << BITRES {
+                offset += nclogn >> 3;
+            }
+            let mut eb = (bits[j] + offset + (den << (BITRES - 1))).max(0);
+            eb = (eb / den) >> BITRES;
+            if ci * eb > (bits[j] >> BITRES) {
+                eb = bits[j] >> stereo >> BITRES;
+            }
+            eb = eb.min(MAX_FINE_BITS);
+            ebits[j] = eb;
+            fine_priority[j] = (eb * (den << BITRES) >= bits[j] + offset) as i32;
+            bits[j] -= ci * eb << BITRES;
+        } else {
+            excess = (bit - (ci << BITRES)).max(0);
+            bits[j] = bit - excess;
+            ebits[j] = 0;
+            fine_priority[j] = 1;
+        }
+        if excess > 0 {
+            let extra_fine = (excess >> (stereo + BITRES as i32)).min(MAX_FINE_BITS - ebits[j]);
+            ebits[j] += extra_fine;
+            let extra_bits = extra_fine * ci << BITRES;
+            fine_priority[j] = (extra_bits >= excess - balance) as i32;
+            excess -= extra_bits;
+        }
+        balance = excess;
+    }
+    for j in coded_bands..end {
+        ebits[j] = bits[j] >> stereo >> BITRES;
+        bits[j] = 0;
+        fine_priority[j] = (ebits[j] < 1) as i32;
+    }
+    Allocation { coded_bands, intensity, dual_stereo, balance, pulses: bits, fine_quant: ebits, fine_priority }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn log2_frac_values() {
+        assert_eq!(log2_frac(1, 3), 0);
+        assert_eq!(log2_frac(2, 3), 8);
+        assert_eq!(log2_frac(4, 3), 16);
+        assert_eq!(log2_frac(6, 3), 21);
+        assert_eq!(log2_frac(18, 3), 34);
+        assert_eq!(log2_frac(22, 3), 36);
+    }
+
+    #[test]
+    fn pvq_counts() {
+        // V(N,1) = 2N, V(1,K) = 2 (K>0), V(2,K) = 4K.
+        assert_eq!(pvq_v(5, 1), 10);
+        assert_eq!(pvq_v(1, 7), 2);
+        assert_eq!(pvq_v(2, 9), 36);
+        assert_eq!(pvq_v(3, 2), 18);
+        assert_eq!(pvq_v(0, 0), 1);
+        assert_eq!(pvq_v(0, 3), 0);
+    }
+
+    #[test]
+    fn caps_match_reference_shape() {
+        let m = Mode::new();
+        // 1-bin bands at LM=0 (mono and stereo) are capped at 224.
+        assert!(m.caps[..8].iter().all(|&c| c == 224));
+        assert!(m.caps[21..29].iter().all(|&c| c == 224));
+        let first_rows: [u8; 42] = [
+            224, 224, 224, 224, 224, 224, 224, 224, 160, 160, 160, 160, 185, 185, 185, 178, 178, 168, 134, 61, 37, 224, 224, 224, 224, 224, 224, 224,
+            224, 240, 240, 240, 240, 207, 207, 207, 198, 198, 183, 144, 66, 40,
+        ];
+        assert_eq!(&m.caps[..42], &first_rows[..]);
+    }
+}
@@ -0,0 +1,130 @@
+//! Constant tables of the 48 kHz CELT mode (RFC 6716 §4.3).
+
+/// Number of energy bands.
+pub const NB_EBANDS: usize = 21;
+/// Band edges in units of 2.5 ms MDCT bins (Table 55).
+pub const EBANDS: [i32; NB_EBANDS + 1] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 12, 14, 16, 20, 24, 28, 34, 40, 48, 60, 78, 100];
+/// Overlap of the low-overlap window (samples at 48 kHz).
+pub const OVERLAP: usize = 120;
+/// Size of the shortest MDCT (2.5 ms).
+pub const SHORT_MDCT: usize = 120;
+/// Largest LM (20 ms frames).
+pub const MAX_LM: usize = 3;
+/// Pre-emphasis coefficient.
+pub const PREEMPH: f32 = 0.850_006_1;
+
+/// Static allocation table (Table 57), indexed `[quality][band]`, in 1/32 bit per MDCT bin.
+pub const ALLOC: [[u8; NB_EBANDS]; 11] = transpose([
+    [0, 90, 110, 118, 126, 134, 144, 152, 162, 172, 200],
+    [0, 80, 100, 110, 119, 127, 137, 145, 155, 165, 200],
+    [0, 75, 90, 103, 112, 120, 130, 138, 148, 158, 200],
+    [0, 69, 84, 93, 104, 114, 124, 132, 142, 152, 200],
+    [0, 63, 78, 86, 95, 103, 113, 123, 133, 143, 200],
+    [0, 56, 71, 80, 89, 97, 107, 117, 127, 137, 200],
+    [0, 49, 65, 75, 83, 91, 101, 111, 121, 131, 200],
+    [0, 40, 58, 70, 78, 85, 95, 105, 115, 125, 200],
+    [0, 34, 51, 65, 72, 78, 88, 98, 108, 118, 198],
+    [0, 29, 45, 59, 66, 72, 82, 92, 102, 112, 193],
+    [0, 20, 39, 53, 60, 66, 76, 86, 96, 106, 188],
+    [0, 18, 32, 47, 54, 60, 70, 80, 90, 100, 183],
+    [0, 10, 26, 40, 47, 54, 64, 74, 84, 94, 178],
+    [0, 0, 20, 31, 39, 47, 57, 67, 77, 87, 173],
+    [0, 0, 12, 23, 32, 41, 51, 61, 71, 81, 168],
+    [0, 0, 0, 15, 25, 35, 45, 55, 65, 75, 163],
+    [0, 0, 0, 4, 17, 29, 39, 49, 59, 69, 158],
+    [0, 0, 0, 0, 12, 23, 33, 43, 53, 63, 153],
+    [0, 0, 0, 0, 1, 16, 26, 36, 46, 56, 148],
+    [0, 0, 0, 0, 0, 10, 15, 20, 30, 45, 129],
+    [0, 0, 0, 0, 0, 1, 1, 1, 1, 20, 104],
+]);
+
+const fn transpose(t: [[u8; 11]; NB_EBANDS]) -> [[u8; NB_EBANDS]; 11] {
+    let mut out = [[0u8; NB_EBANDS]; 11];
+    let mut b = 0;
+    while b < NB_EBANDS {
+        let mut q = 0;
+        while q < 11 {
+            out[q][b] = t[b][q];
+            q += 1;
+        }
+        b += 1;
+    }
+    out
+}
+
+/// Mean band energy (log2 domain) removed before coarse quantisation.
+pub const E_MEANS: [f32; 25] = [
+    6.4375, 6.25, 5.75, 5.3125, 5.0625, 4.8125, 4.5, 4.375, 4.875, 4.6875, 4.5625, 4.4375, 4.875, 4.625, 4.3125, 4.5, 4.375, 4.625, 4.75, 4.4375,
+    3.75, 3.75, 3.75, 3.75, 3.75,
+];
+
+/// Inter-frame prediction coefficient (alpha) per LM, Q15.
+pub const PRED_COEF: [f32; 4] = [29440.0 / 32768.0, 26112.0 / 32768.0, 21248.0 / 32768.0, 16384.0 / 32768.0];
+/// Inter-band prediction coefficient (beta) per LM for inter frames, Q15.
+pub const BETA_COEF: [f32; 4] = [30147.0 / 32768.0, 22282.0 / 32768.0, 12124.0 / 32768.0, 6554.0 / 32768.0];
+/// Beta for intra frames.
+pub const BETA_INTRA: f32 = 4915.0 / 32768.0;
+
+/// Laplace model parameters for coarse energy: `[LM][intra][2*band + {0: prob, 1: decay}]`.
+pub const E_PROB_MODEL: [[[u8; 42]; 2]; 4] = [
+    [
+        [
+            72, 127, 65, 129, 66, 128, 65, 128, 64, 128, 62, 128, 64, 128, 64, 128, 92, 78, 92, 79, 92, 78, 90, 79, 116, 41, 115, 40, 114, 40, 132,
+            26, 132, 26, 145, 17, 161, 12, 176, 10, 177, 11,
+        ],
+        [
+            24, 179, 48, 138, 54, 135, 54, 132, 53, 134, 56, 133, 55, 132, 55, 132, 61, 114, 70, 96, 74, 88, 75, 88, 87, 74, 89, 66, 91, 67, 100, 59,
+            108, 50, 120, 40, 122, 37, 97, 43, 78, 50,
+        ],
+    ],
+    [
+        [
+            83, 78, 84, 81, 88, 75, 86, 74, 87, 71, 90, 73, 93, 74, 93, 74, 109, 40, 114, 36, 117, 34, 117, 34, 143, 17, 145, 18, 146, 19, 162, 12,
+            165, 10, 178, 7, 189, 6, 190, 8, 177, 9,
+        ],
+        [
+            23, 178, 54, 115, 63, 102, 66, 98, 69, 99, 74, 89, 71, 91, 73, 91, 78, 89, 86, 80, 92, 66, 93, 64, 102, 59, 103, 60, 104, 60, 117, 52,
+            123, 44, 138, 35, 133, 31, 97, 38, 77, 45,
+        ],
+    ],
+    [
+        [
+            61, 90, 93, 60, 105, 42, 107, 41, 110, 45, 116, 38, 113, 38, 112, 38, 124, 26, 132, 27, 136, 19, 140, 20, 155, 14, 159, 16, 158, 18, 170,
+            13, 177, 10, 187, 8, 192, 6, 175, 9, 159, 10,
+        ],
+        [
+            21, 178, 59, 110, 71, 86, 75, 85, 84, 83, 91, 66, 88, 73, 87, 72, 92, 75, 98, 72, 105, 58, 107, 54, 115, 52, 114, 55, 112, 56, 129, 51,
+            132, 40, 150, 33, 140, 29, 98, 35, 77, 42,
+        ],
+    ],
+    [
+        [
+            42, 121, 96, 66, 108, 43, 111, 40, 117, 44, 123, 32, 120, 36, 119, 33, 127, 33, 134, 34, 139, 21, 147, 23, 152, 20, 158, 25, 154, 26,
+            166, 21, 173, 16, 184, 13, 184, 10, 150, 13, 139, 15,
+        ],
+        [
+            22, 178, 63, 114, 74, 82, 84, 83, 92, 82, 103, 62, 96, 72, 96, 67, 101, 73, 107, 72, 113, 55, 118, 52, 125, 52, 118, 52, 117, 55, 135,
+            49, 137, 39, 157, 32, 145, 29, 97, 33, 77, 40,
+        ],
+    ],
+];
+
+/// Inverse CDF for coarse energy when only a few bits remain.
+pub const SMALL_ENERGY_ICDF: [u8; 3] = [2, 1, 0];
+/// Conservative log2 in 1/8 bits of the number of coded bands (intensity reservation).
+pub const LOG2_FRAC_TABLE: [i32; 24] = [0, 8, 13, 16, 19, 21, 23, 24, 26, 27, 28, 29, 30, 31, 32, 32, 33, 34, 34, 35, 36, 36, 37, 37];
+/// TF resolution changes: `[LM][4*transient + 2*tf_select + tf_flag]`.
+pub const TF_SELECT_TABLE: [[i8; 8]; 4] =
+    [[0, -1, 0, -1, 0, -1, 0, -1], [0, -1, 0, -2, 1, 0, 1, -1], [0, -2, 0, -3, 2, 0, 1, -1], [0, -2, 0, -3, 3, 0, 1, -1]];
+/// Spreading decision `{7, 2, 21, 2}/32`.
+pub const SPREAD_ICDF: [u8; 4] = [25, 23, 2, 0];
+/// Allocation trim (Table 58).
+pub const TRIM_ICDF: [u8; 11] = [126, 124, 119, 109, 87, 41, 19, 9, 4, 2, 0];
+/// Post-filter tapset `{2, 1, 1}/4`.
+pub const TAPSET_ICDF: [u8; 3] = [2, 1, 0];
+/// Post-filter tap gains per tapset.
+pub const COMB_GAINS: [[f32; 3]; 3] =
+    [[0.306_640_62, 0.217_041_02, 0.129_638_67], [0.463_867_2, 0.268_066_4, 0.0], [0.799_804_7, 0.100_097_656, 0.0]];
+
+/// Hadamard "sequency" ordering for 2, 4, 8 and 16 blocks, concatenated.
+pub const ORDERY: [usize; 30] = [1, 0, 3, 0, 2, 1, 7, 0, 4, 3, 6, 1, 5, 2, 15, 0, 8, 7, 12, 3, 11, 4, 14, 1, 9, 6, 13, 2, 10, 5];
@@ -0,0 +1,477 @@
+//! Single-stream Opus decoder: mode switching, hybrid summation, redundancy and transitions
+//! (RFC 6716 §4, §4.5).
+
+use crate::celt::CeltDecoder;
+use crate::celt::tables::OVERLAP;
+use crate::packet::{Bandwidth, Mode, Packet};
+use crate::range::RangeDecoder;
+use crate::silk::{LostFlag, SilkDecoder};
+use crate::{Error, Result};
+
+/// Output sample rates supported by the decoder.
+pub const SAMPLE_RATES: [u32; 5] = [8000, 12000, 16000, 24000, 48000];
+
+/// Decoder for one elementary Opus stream (mono or stereo), like `OpusDecoder`.
+pub struct StreamDecoder {
+    rate: u32,
+    channels: usize,
+    celt: CeltDecoder,
+    silk: SilkDecoder,
+    stream_channels: usize,
+    bandwidth: Bandwidth,
+    mode: Option<Mode>,
+    prev_mode: Option<Mode>,
+    frame_size: usize,
+    prev_redundancy: bool,
+    last_packet_duration: usize,
+    range_final: u32,
+    /// Output gain in Q8 dB (OpusHead output gain).
+    gain_q8: i16,
+}
+
+impl StreamDecoder {
+    /// Creates a decoder producing `channels` (1 or 2) at `rate` (8/12/16/24/48 kHz).
+    pub fn new(rate: u32, channels: usize) -> Result<StreamDecoder> {
+        if !SAMPLE_RATES.contains(&rate) {
+            return Err(Error::InvalidArgument("sample rate must be 8000, 12000, 16000, 24000 or 48000"));
+        }
+        if !(1..=2).contains(&channels) {
+            return Err(Error::InvalidArgument("channels must be 1 or 2"));
+        }
+        Ok(StreamDecoder {
+            rate,
+            channels,
+            celt: CeltDecoder::new(rate, channels),
+            silk: SilkDecoder::new(rate, channels),
+            stream_channels: channels,
+            bandwidth: Bandwidth::Fullband,
+            mode: None,
+            prev_mode: None,
+            frame_size: rate as usize / 400,
+            prev_redundancy: false,
+            last_packet_duration: 0,
+            range_final: 0,
+            gain_q8: 0,
+        })
+    }
+
+    pub fn sample_rate(&self) -> u32 {
+        self.rate
+    }
+
+    pub fn channels(&self) -> usize {
+        self.channels
+    }
+
+    /// Final range coder state of the last decoded frame (for conformance checks).
+    pub fn final_range(&self) -> u32 {
+        self.range_final
+    }
+
+    /// Duration (samples per channel) of the last decoded packet.
+    pub fn last_packet_duration(&self) -> usize {
+        self.last_packet_duration
+    }
+
+    /// Sets the output gain in Q8 dB (as in the OpusHead header).
+    pub fn set_gain_q8(&mut self, gain: i16) {
+        self.gain_q8 = gain;
+    }
+
+    /// Disables the 180-degree intensity-stereo phase inversion (RFC 8251 §10).
+    pub fn set_phase_inversion_disabled(&mut self, disabled: bool) {
+        self.celt.disable_inv = disabled;
+    }
+
+    /// `OPUS_RESET_STATE`.
+    pub fn reset(&mut self) {
+        self.celt.reset();
+        self.silk.reset();
+        self.stream_channels = self.channels;
+        self.bandwidth = Bandwidth::Fullband;
+        self.mode = None;
+        self.prev_mode = None;
+        self.frame_size = self.rate as usize / 400;
+        self.prev_redundancy = false;
+        self.last_packet_duration = 0;
+        self.range_final = 0;
+    }
+
+    /// Decodes a packet into interleaved samples appended to `out`. `None` conceals one lost
+    /// packet of the last packet's duration. Returns samples per channel.
+    pub fn decode_interleaved(&mut self, packet: Option<&[u8]>, out: &mut Vec<f32>) -> Result<usize> {
+        match packet {
+            Some(p) if !p.is_empty() => self.decode_packet(p, out),
+            _ => {
+                let n = if self.last_packet_duration > 0 { self.last_packet_duration } else { self.rate as usize / 50 };
+                self.conceal(n, out)
+            }
+        }
+    }
+
+    /// Conceals `n` samples (a multiple of 2.5 ms).
+    pub fn conceal(&mut self, n: usize, out: &mut Vec<f32>) -> Result<usize> {
+        let f2_5 = self.rate as usize / 400;
+        if n == 0 || !n.is_multiple_of(f2_5) {
+            return Err(Error::InvalidArgument("concealment length must be a multiple of 2.5 ms"));
+        }
+        let start = out.len();
+        out.resize(start + n * self.channels, 0.0);
+        let mut done = 0;
+        while done < n {
+            let r = self.decode_frame(None, &mut out[start + done * self.channels..], n - done, false)?;
+            done += r;
+        }
+        self.last_packet_duration = n;
+        Ok(n)
+    }
+
+    /// Decodes the in-band FEC (LBRR) of `packet` for the previous (lost) packet of `n` samples.
+    pub fn decode_fec(&mut self, packet: &[u8], n: usize, out: &mut Vec<f32>) -> Result<usize> {
+        let p = Packet::parse(packet)?;
+        let pfs = p.toc.frame_samples(self.rate);
+        if n < pfs || p.toc.mode == Mode::CeltOnly || self.mode == Some(Mode::CeltOnly) {
+            return self.conceal(n, out);
+        }
+        let start = out.len();
+        if n > pfs {
+            self.conceal(n - pfs, out)?;
+        }
+        self.mode = Some(p.toc.mode);
+        self.bandwidth = p.toc.bandwidth;
+        self.frame_size = pfs;
+        self.stream_channels = p.toc.channels();
+        let off = out.len();
+        out.resize(off + pfs * self.channels, 0.0);
+        self.decode_frame(Some(p.frames[0]), &mut out[off..], pfs, true)?;
+        self.last_packet_duration = n;
+        debug_assert_eq!(out.len() - start, n * self.channels);
+        Ok(n)
+    }
+
+    fn decode_packet(&mut self, data: &[u8], out: &mut Vec<f32>) -> Result<usize> {
+        let p = Packet::parse(data)?;
+        let fs = p.toc.frame_samples(self.rate);
+        self.mode = Some(p.toc.mode);
+        self.bandwidth = p.toc.bandwidth;
+        self.frame_size = fs;
+        self.stream_channels = p.toc.channels();
+        let start = out.len();
+        out.resize(start + fs * p.frames.len() * self.channels, 0.0);
+        let mut nb = 0;
+        for f in &p.frames {
+            let r = self.decode_frame(Some(f), &mut out[start + nb * self.channels..], fs, false)?;
+            nb += r;
+        }
+        out.truncate(start + nb * self.channels);
+        self.last_packet_duration = nb;
+        Ok(nb)
+    }
+
+    /// `opus_decode_frame`: decodes one frame (or conceals when `data` is `None`/≤1 byte).
+    fn decode_frame(&mut self, data: Option<&[u8]>, pcm: &mut [f32], frame_size: usize, fec: bool) -> Result<usize> {
+        let ch = self.channels;
+        let fs = self.rate as usize;
+        let f20 = fs / 50;
+        let f10 = f20 >> 1;
+        let f5 = f10 >> 1;
+        let f2_5 = f5 >> 1;
+        let mut frame_size = frame_size.min(fs / 25 * 3);
+        let data = match data {
+            Some(d) if d.len() > 1 => Some(d),
+            _ => {
+                frame_size = frame_size.min(self.frame_size);
+                None
+            }
+        };
+        let (mut audiosize, mode, bandwidth);
+        match data {
+            Some(_) => {
+                audiosize = self.frame_size;
+                mode = self.mode.unwrap_or(Mode::CeltOnly);
+                bandwidth = Some(self.bandwidth);
+            }
+            None => {
+                audiosize = frame_size;
+                bandwidth = None;
+                mode = match self.prev_mode {
+                    None => {
+                        pcm[..audiosize * ch].fill(0.0);
+                        return Ok(audiosize);
+                    }
+                    Some(m) => m,
+                };
+                if audiosize > f20 {
+                    self.conceal_long(pcm, audiosize, f20)?;
+                    return Ok(frame_size);
+                }
+                audiosize = shorten_concealment(audiosize, mode, fs);
+            }
+        }
+        let data_len = data.map_or(0, <[_]>::len);
+        let mut dec_storage;
+        let mut dec: Option<&mut RangeDecoder> = match data {
+            Some(d) => {
+                dec_storage = RangeDecoder::new(d);
+                Some(&mut dec_storage)
+            }
+            None => None,
+        };
+        let mut transition = false;
+        if data.is_some()
+            && self.prev_mode.is_some()
+            && ((mode == Mode::CeltOnly && self.prev_mode != Some(Mode::CeltOnly) && !self.prev_redundancy)
+                || (mode != Mode::CeltOnly && self.prev_mode == Some(Mode::CeltOnly)))
+        {
+            transition = true;
+        }
+        let mut pcm_transition = Vec::new();
+        if transition && mode == Mode::CeltOnly {
+            pcm_transition.resize(f5 * ch, 0.0);
+            let n = f5.min(audiosize);
+            self.decode_frame(None, &mut pcm_transition, n, false)?;
+        }
+        if audiosize > frame_size {
+            return Err(Error::InvalidArgument("frame larger than output buffer"));
+        }
+        frame_size = audiosize;
+
+        // SILK.
+        let mut pcm_silk: Vec<f32> = Vec::new();
+        if mode != Mode::CeltOnly {
+            pcm_silk = self.decode_silk_layer(
+                dec.as_deref_mut(),
+                SilkLayer { mode, bandwidth, lost: lost_flag(data.is_some(), fec), frame_size, audiosize, f10 },
+            )?;
+        }
+
+        let mut start_band = 0;
+        let mut redundancy = Redundancy::none(data_len);
+        if !fec
+            && mode != Mode::CeltOnly
+            && let Some(d) = dec.as_deref_mut()
+        {
+            redundancy = Redundancy::parse(d, mode, self.mode == Some(Mode::Hybrid), data_len);
+        }
+        let Redundancy { present: redundancy, celt_to_silk, bytes: redundancy_bytes, len } = redundancy;
+        if mode != Mode::CeltOnly {
+            start_band = 17;
+        }
+        if redundancy {
+            transition = false;
+        }
+        if transition && mode != Mode::CeltOnly {
+            pcm_transition.resize(f5 * ch, 0.0);
+            let n = f5.min(audiosize);
+            self.decode_frame(None, &mut pcm_transition, n, false)?;
+        }
+        if let Some(bw) = bandwidth {
+            self.celt.end = bw.celt_end_band();
+        }
+        self.celt.stream_channels = self.stream_channels;
+        let mut redundant_audio = vec![0f32; if redundancy { f5 * ch } else { 0 }];
+        let mut redundant_rng = 0u32;
+        let red_data = data.map(|d| &d[len..len + redundancy_bytes]);
+        if redundancy && celt_to_silk {
+            self.celt.start = 0;
+            self.celt.decode(red_data, f5, &mut redundant_audio, false, None)?;
+            redundant_rng = self.celt.rng;
+        }
+        self.celt.start = start_band;
+
+        if mode != Mode::SilkOnly {
+            let celt_frame = f20.min(frame_size);
+            if self.prev_mode.is_some() && Some(mode) != self.prev_mode && !self.prev_redundancy {
+                self.celt.reset();
+            }
+            let cdata = if fec { None } else { data.map(|d| &d[..len]) };
+            let cdec = if fec { None } else { dec.as_deref_mut() };
+            self.celt.decode(cdata, celt_frame, pcm, false, cdec)?;
+        } else {
+            pcm[..frame_size * ch].fill(0.0);
+            if self.prev_mode == Some(Mode::Hybrid) && !(redundancy && celt_to_silk && self.prev_redundancy) {
+                self.celt.start = 0;
+                let silence = [0xFFu8, 0xFF];
+                self.celt.decode(Some(&silence), f2_5, pcm, true, None)?;
+            }
+        }
+        if mode != Mode::CeltOnly {
+            for (o, s) in pcm[..frame_size * ch].iter_mut().zip(&pcm_silk) {
+                *o += *s;
+            }
+        }
+        let window = &crate::celt::mode().window;
+        if redundancy && !celt_to_silk {
+            self.celt.reset();
+            self.celt.start = 0;
+            self.celt.decode(red_data, f5, &mut redundant_audio, false, None)?;
+            redundant_rng = self.celt.rng;
+            let o = ch * (frame_size - f2_5);
+            let tail: Vec<f32> = pcm[o..o + f2_5 * ch].to_vec();
+            smooth_fade(&tail, &redundant_audio[ch * f2_5..], &mut pcm[o..], f2_5, ch, window, self.rate);
+        }
+        if redundancy && celt_to_silk {
+            self.fade_in_from(pcm, &redundant_audio, f2_5);
+        }
+        if transition {
+            if audiosize >= f5 {
+                self.fade_in_from(pcm, &pcm_transition, f2_5);
+            } else {
+                let cur: Vec<f32> = pcm[..ch * f2_5].to_vec();
+                smooth_fade(&pcm_transition, &cur, pcm, f2_5, ch, window, self.rate);
+            }
+        }
+        if self.gain_q8 != 0 {
+            let g = (6.488_141e-4f32 * self.gain_q8 as f32).exp2();
+            for v in pcm[..frame_size * ch].iter_mut() {
+                *v *= g;
+            }
+        }
+        self.range_final = match dec.as_deref() {
+            Some(d) if data_len > 1 => d.rng() ^ redundant_rng,
+            _ => 0,
+        };
+        self.prev_mode = Some(mode);
+        self.prev_redundancy = redundancy && !celt_to_silk;
+        Ok(audiosize)
+    }
+
+    /// Conceals a lost span longer than 20 ms by decoding it in 20 ms pieces.
+    fn conceal_long(&mut self, pcm: &mut [f32], audiosize: usize, f20: usize) -> Result<()> {
+        let mut done = 0;
+        while done < audiosize {
+            done += self.decode_frame(None, &mut pcm[done * self.channels..], (audiosize - done).min(f20), false)?;
+        }
+        Ok(())
+    }
+
+    /// Replaces the first `f2_5` samples of `pcm` with `src` and cross-fades the following `f2_5` samples from `src` into `pcm`.
+    fn fade_in_from(&self, pcm: &mut [f32], src: &[f32], f2_5: usize) {
+        let ch = self.channels;
+        let window = &crate::celt::mode().window;
+        pcm[..f2_5 * ch].copy_from_slice(&src[..f2_5 * ch]);
+        let cur: Vec<f32> = pcm[ch * f2_5..ch * 2 * f2_5].to_vec();
+        smooth_fade(&src[ch * f2_5..], &cur, &mut pcm[ch * f2_5..], f2_5, ch, window, self.rate);
+    }
+
+    /// Runs the SILK layer over the frame, zero-filling spans it cannot decode when the packet was lost.
+    fn decode_silk_layer(&mut self, mut dec: Option<&mut RangeDecoder>, l: SilkLayer) -> Result<Vec<f32>> {
+        let ch = self.channels;
+        let mut pcm_silk = vec![0.0; l.frame_size.max(l.f10) * ch];
+        if self.prev_mode == Some(Mode::CeltOnly) {
+            self.silk.reset();
+        }
+        let payload_ms = (1000 * l.audiosize / self.rate as usize).max(10);
+        if l.lost != LostFlag::Lost {
+            self.silk.set_stream(self.stream_channels, silk_internal_rate(l.mode, l.bandwidth));
+        }
+        let mut decoded = 0;
+        while decoded < l.frame_size {
+            let first = decoded == 0;
+            let out = &mut pcm_silk[decoded * ch..];
+            let n = match self.silk.decode(dec.as_deref_mut(), l.lost, first, payload_ms, out) {
+                Ok(n) => n,
+                Err(_) if l.lost != LostFlag::Normal => {
+                    let n = l.frame_size - decoded;
+                    pcm_silk[decoded * ch..(decoded + n) * ch].fill(0.0);
+                    n
+                }
+                Err(e) => return Err(e),
+            };
+            if n == 0 {
+                break;
+            }
+            decoded += n;
+        }
+        Ok(pcm_silk)
+    }
+}
+
+/// Inputs for one SILK-layer decode.
+struct SilkLayer {
+    mode: Mode,
+    bandwidth: Option<Bandwidth>,
+    lost: LostFlag,
+    frame_size: usize,
+    audiosize: usize,
+    f10: usize,
+}
+
+fn lost_flag(has_data: bool, fec: bool) -> LostFlag {
+    if !has_data {
+        LostFlag::Lost
+    } else if fec {
+        LostFlag::Lbrr
+    } else {
+        LostFlag::Normal
+    }
+}
+
+fn silk_internal_rate(mode: Mode, bandwidth: Option<Bandwidth>) -> u32 {
+    match (mode, bandwidth) {
+        (Mode::SilkOnly, Some(Bandwidth::Narrowband)) => 8000,
+        (Mode::SilkOnly, Some(Bandwidth::Mediumband)) => 12000,
+        _ => 16000,
+    }
+}
+
+/// Picks the shorter concealment length for spans of at most 20 ms (10 ms, or 5 ms outside SILK-only mode).
+fn shorten_concealment(audiosize: usize, mode: Mode, rate: usize) -> usize {
+    let f20 = rate / 50;
+    let f10 = f20 >> 1;
+    let f5 = f10 >> 1;
+    if audiosize >= f20 {
+        audiosize
+    } else if audiosize > f10 {
+        f10
+    } else if mode != Mode::SilkOnly && audiosize > f5 && audiosize < f10 {
+        f5
+    } else {
+        audiosize
+    }
+}
+
+/// In-band redundancy header of a packet: whether a redundant CELT frame follows, its direction and size.
+struct Redundancy {
+    present: bool,
+    celt_to_silk: bool,
+    bytes: usize,
+    /// Payload length left for the main frame.
+    len: usize,
+}
+
+impl Redundancy {
+    fn none(len: usize) -> Self {
+        Self { present: false, celt_to_silk: false, bytes: 0, len }
+    }
+
+    fn parse(d: &mut RangeDecoder, mode: Mode, prev_hybrid: bool, len: usize) -> Self {
+        let mut r = Self::none(len);
+        if d.tell() + 17 + 20 * prev_hybrid as i32 > 8 * len as i32 {
+            return r;
+        }
+        r.present = if mode == Mode::Hybrid { d.bit_logp(12) } else { true };
+        if !r.present {
+            return r;
+        }
+        r.celt_to_silk = d.bit_logp(1);
+        r.bytes = if mode == Mode::Hybrid { d.uint(256) as usize + 2 } else { len - ((d.tell() as usize + 7) >> 3) };
+        if r.bytes > len || (len - r.bytes) * 8 < d.tell() as usize {
+            r = Self { celt_to_silk: r.celt_to_silk, ..Self::none(0) };
+        } else {
+            r.len -= r.bytes;
+        }
+        d.shrink_storage(r.bytes);
+        r
+    }
+}
+
+fn smooth_fade(in1: &[f32], in2: &[f32], out: &mut [f32], overlap: usize, ch: usize, window: &[f32; OVERLAP], rate: u32) {
+    let inc = (48000 / rate) as usize;
+    for c in 0..ch {
+        for i in 0..overlap {
+            let w = window[i * inc] * window[i * inc];
+            out[i * ch + c] = w * in2[i * ch + c] + (1.0 - w) * in1[i * ch + c];
+        }
+    }
+}
@@ -0,0 +1,196 @@
+//! Opus identification header (`OpusHead`, RFC 7845 §5.1) and the ISO-BMFF `dOps` box payload.
+
+use crate::{Error, Result};
+
+/// Decoder configuration: channel layout, multistream mapping, pre-skip and output gain.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct OpusHead {
+    /// Output channel count (1..=255).
+    pub channels: usize,
+    /// Samples (at 48 kHz) to discard from the start of the decoded stream.
+    pub pre_skip: u16,
+    /// Sample rate of the original input (informational only).
+    pub input_sample_rate: u32,
+    /// Output gain in Q7.8 dB.
+    pub output_gain: i16,
+    /// Channel mapping family (0: mono/stereo, 1: Vorbis order surround, 255: unspecified order).
+    pub mapping_family: u8,
+    /// Number of elementary streams.
+    pub streams: usize,
+    /// Number of coupled (stereo) streams; these come first.
+    pub coupled_streams: usize,
+    /// Output channel → decoded channel index (255 = silence).
+    pub mapping: Vec<u8>,
+}
+
+impl OpusHead {
+    /// A family-0 configuration for plain mono/stereo streams (no header present).
+    pub fn simple(channels: usize) -> Result<OpusHead> {
+        if !(1..=2).contains(&channels) {
+            return Err(Error::InvalidArgument("family 0 supports 1 or 2 channels"));
+        }
+        Ok(OpusHead {
+            channels,
+            pre_skip: 0,
+            input_sample_rate: 48000,
+            output_gain: 0,
+            mapping_family: 0,
+            streams: 1,
+            coupled_streams: channels - 1,
+            mapping: (0..channels as u8).collect(),
+        })
+    }
+
+    /// Parses an `OpusHead` packet (Ogg first packet, Matroska `CodecPrivate`).
+    pub fn parse(data: &[u8]) -> Result<OpusHead> {
+        if data.len() < 19 || &data[..8] != b"OpusHead" {
+            return Err(Error::InvalidHeader("missing OpusHead magic"));
+        }
+        let version = data[8];
+        if version >> 4 != 0 {
+            return Err(Error::Unsupported("OpusHead major version"));
+        }
+        let channels = data[9] as usize;
+        let pre_skip = u16::from_le_bytes([data[10], data[11]]);
+        let input_sample_rate = u32::from_le_bytes([data[12], data[13], data[14], data[15]]);
+        let output_gain = i16::from_le_bytes([data[16], data[17]]);
+        let family = data[18];
+        Self::build(channels, pre_skip, input_sample_rate, output_gain, family, &data[19..])
+    }
+
+    /// Parses the payload of an ISO-BMFF `dOps` box (Opus in MP4, big-endian fields).
+    pub fn from_dops(data: &[u8]) -> Result<OpusHead> {
+        if data.len() < 11 {
+            return Err(Error::InvalidHeader("dOps too short"));
+        }
+        if data[0] != 0 {
+            return Err(Error::Unsupported("dOps version"));
+        }
+        let channels = data[1] as usize;
+        let pre_skip = u16::from_be_bytes([data[2], data[3]]);
+        let input_sample_rate = u32::from_be_bytes([data[4], data[5], data[6], data[7]]);
+        let output_gain = i16::from_be_bytes([data[8], data[9]]);
+        Self::build(channels, pre_skip, input_sample_rate, output_gain, data[10], &data[11..])
+    }
+
+    /// Serialises as an `OpusHead` packet.
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let mut v = b"OpusHead".to_vec();
+        v.push(1);
+        v.push(self.channels as u8);
+        v.extend(self.pre_skip.to_le_bytes());
+        v.extend(self.input_sample_rate.to_le_bytes());
+        v.extend(self.output_gain.to_le_bytes());
+        v.push(self.mapping_family);
+        if self.mapping_family != 0 {
+            v.push(self.streams as u8);
+            v.push(self.coupled_streams as u8);
+            v.extend(&self.mapping);
+        }
+        v
+    }
+
+    fn build(channels: usize, pre_skip: u16, input_sample_rate: u32, output_gain: i16, family: u8, rest: &[u8]) -> Result<OpusHead> {
+        if channels == 0 {
+            return Err(Error::InvalidHeader("zero channels"));
+        }
+        let (streams, coupled, mapping) = if family == 0 {
+            if channels > 2 {
+                return Err(Error::InvalidHeader("family 0 allows at most 2 channels"));
+            }
+            (1, channels - 1, (0..channels as u8).collect::<Vec<_>>())
+        } else {
+            if family == 3 {
+                return Err(Error::Unsupported("channel mapping family 3 (projection)"));
+            }
+            if rest.len() < 2 + channels {
+                return Err(Error::InvalidHeader("truncated channel mapping table"));
+            }
+            let streams = rest[0] as usize;
+            let coupled = rest[1] as usize;
+            if streams == 0 || coupled > streams || streams + coupled > 255 {
+                return Err(Error::InvalidHeader("bad stream counts"));
+            }
+            if family == 1 && !(1..=8).contains(&channels) {
+                return Err(Error::InvalidHeader("family 1 allows 1 to 8 channels"));
+            }
+            let mapping = rest[2..2 + channels].to_vec();
+            if mapping.iter().any(|&m| m != 255 && m as usize >= streams + coupled) {
+                return Err(Error::InvalidHeader("channel mapping out of range"));
+            }
+            (streams, coupled, mapping)
+        };
+        Ok(OpusHead { channels, pre_skip, input_sample_rate, output_gain, mapping_family: family, streams, coupled_streams: coupled, mapping })
+    }
+
+    /// Checks the invariants the decoder indexes by, for headers built by hand rather than parsed.
+    pub fn validate(&self) -> Result<()> {
+        if self.channels == 0 {
+            return Err(Error::InvalidHeader("zero channels"));
+        }
+        if self.streams == 0 || self.coupled_streams > self.streams || self.streams + self.coupled_streams > 255 {
+            return Err(Error::InvalidHeader("bad stream counts"));
+        }
+        if self.mapping.len() != self.channels {
+            return Err(Error::InvalidHeader("channel mapping length differs from channel count"));
+        }
+        if self.mapping.iter().any(|&m| m != 255 && m as usize >= self.streams + self.coupled_streams) {
+            return Err(Error::InvalidHeader("channel mapping out of range"));
+        }
+        Ok(())
+    }
+
+    /// Linear output gain factor.
+    pub fn gain_linear(&self) -> f32 {
+        10f32.powf(self.output_gain as f32 / (20.0 * 256.0))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_family0_and_roundtrip() {
+        let mut h = b"OpusHead".to_vec();
+        h.extend([1, 2, 0x38, 0x01, 0x80, 0xBB, 0, 0, 0x00, 0x01, 0]);
+        let head = OpusHead::parse(&h).unwrap();
+        assert_eq!(head.channels, 2);
+        assert_eq!(head.pre_skip, 312);
+        assert_eq!(head.input_sample_rate, 48000);
+        assert_eq!(head.output_gain, 256);
+        assert_eq!((head.streams, head.coupled_streams), (1, 1));
+        assert_eq!(head.to_bytes(), h);
+        assert!((head.gain_linear() - 1.122).abs() < 1e-3);
+    }
+
+    #[test]
+    fn parse_family1_51() {
+        let mut h = b"OpusHead".to_vec();
+        h.extend([1, 6, 0x38, 0x01, 0x80, 0xBB, 0, 0, 0, 0, 1, 4, 2, 0, 4, 1, 2, 3, 5]);
+        let head = OpusHead::parse(&h).unwrap();
+        assert_eq!((head.channels, head.streams, head.coupled_streams), (6, 4, 2));
+        assert_eq!(head.mapping, vec![0, 4, 1, 2, 3, 5]);
+        assert_eq!(OpusHead::parse(&head.to_bytes()).unwrap(), head);
+    }
+
+    #[test]
+    fn rejects_garbage() {
+        assert!(OpusHead::parse(b"OpusHea").is_err());
+        assert!(OpusHead::parse(b"OpusTags...........").is_err());
+        let mut h = b"OpusHead".to_vec();
+        h.extend([1, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+        assert!(OpusHead::parse(&h).is_err());
+        let mut h = b"OpusHead".to_vec();
+        h.extend([1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 5]);
+        assert!(OpusHead::parse(&h).is_err());
+    }
+
+    #[test]
+    fn dops() {
+        let d = [0u8, 2, 0x01, 0x38, 0, 0, 0xBB, 0x80, 0, 0, 0];
+        let head = OpusHead::from_dops(&d).unwrap();
+        assert_eq!(head.pre_skip, 312);
+        assert_eq!(head.channels, 2);
+    }
+}
@@ -0,0 +1,46 @@
+//! Clean-room pure-Rust Opus decoder (RFC 6716, updated by RFC 8251).
+//!
+//! Layer L0: no dependencies beyond `std`; no `unsafe`; builds for `wasm32-unknown-unknown`.
+
+// Spec-style indexed loops (FilmCraft allows this lint workspace-wide).
+#![allow(clippy::needless_range_loop)]
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+// The fixed-point parts mirror the normative integer arithmetic; keep C-like shift expressions.
+#![allow(clippy::precedence, clippy::int_plus_one)]
+
+pub(crate) mod celt;
+mod decoder;
+mod header;
+mod multistream;
+pub mod packet;
+pub(crate) mod range;
+pub(crate) mod silk;
+
+pub use decoder::{SAMPLE_RATES, StreamDecoder};
+pub use header::OpusHead;
+pub use multistream::Decoder;
+pub use packet::{Bandwidth, Mode, Packet, Toc};
+
+/// Errors from header parsing and decoding.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Error {
+    InvalidArgument(&'static str),
+    InvalidPacket(&'static str),
+    InvalidHeader(&'static str),
+    Unsupported(&'static str),
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Error::InvalidArgument(s) => write!(f, "invalid argument: {s}"),
+            Error::InvalidPacket(s) => write!(f, "invalid packet: {s}"),
+            Error::InvalidHeader(s) => write!(f, "invalid header: {s}"),
+            Error::Unsupported(s) => write!(f, "unsupported: {s}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+pub type Result<T> = std::result::Result<T, Error>;
@@ -0,0 +1,198 @@
+//! Public decoder: OpusHead-configured (multistream) decoding to planar f32.
+
+use crate::decoder::StreamDecoder;
+use crate::header::OpusHead;
+use crate::packet::Packet;
+use crate::{Error, Result};
+
+/// Opus decoder for an `OpusHead` configuration (mono, stereo, or multistream surround).
+///
+/// Produces planar f32 at the chosen output rate. Pre-skip is *not* removed unless
+/// [`Decoder::set_trim_pre_skip`] is enabled (containers usually handle it via edit lists /
+/// granule positions). The header's output gain is applied.
+pub struct Decoder {
+    head: OpusHead,
+    rate: u32,
+    streams: Vec<StreamDecoder>,
+    trim_pre_skip: bool,
+    skip_remaining: usize,
+    scratch: Vec<Vec<f32>>,
+}
+
+impl Decoder {
+    /// Creates a 48 kHz decoder from an `OpusHead` packet (Ogg / Matroska `CodecPrivate`).
+    pub fn new(opus_head: &[u8]) -> Result<Decoder> {
+        Self::from_head(OpusHead::parse(opus_head)?, 48000)
+    }
+
+    /// Creates a decoder for plain mono/stereo packets without a header.
+    pub fn simple(sample_rate: u32, channels: usize) -> Result<Decoder> {
+        Self::from_head(OpusHead::simple(channels)?, sample_rate)
+    }
+
+    /// Creates a decoder for a parsed header at `sample_rate` (8/12/16/24/48 kHz).
+    pub fn from_head(head: OpusHead, sample_rate: u32) -> Result<Decoder> {
+        head.validate()?;
+        let mut streams = Vec::with_capacity(head.streams);
+        for s in 0..head.streams {
+            let ch = if s < head.coupled_streams { 2 } else { 1 };
+            let mut d = StreamDecoder::new(sample_rate, ch)?;
+            d.set_gain_q8(head.output_gain);
+            streams.push(d);
+        }
+        Ok(Decoder { rate: sample_rate, streams, trim_pre_skip: false, skip_remaining: 0, scratch: vec![Vec::new(); head.streams], head })
+    }
+
+    pub fn head(&self) -> &OpusHead {
+        &self.head
+    }
+
+    pub fn sample_rate(&self) -> u32 {
+        self.rate
+    }
+
+    pub fn channels(&self) -> usize {
+        self.head.channels
+    }
+
+    /// Pre-skip in samples at the output rate.
+    pub fn pre_skip(&self) -> usize {
+        self.head.pre_skip as usize * self.rate as usize / 48000
+    }
+
+    /// When enabled, the first [`Self::pre_skip`] output samples are dropped.
+    pub fn set_trim_pre_skip(&mut self, enable: bool) {
+        self.trim_pre_skip = enable;
+        self.skip_remaining = if enable { self.pre_skip() } else { 0 };
+    }
+
+    /// Disables intensity-stereo phase inversion (useful when downmixing; RFC 8251 section 10).
+    pub fn set_phase_inversion_disabled(&mut self, disabled: bool) {
+        for s in &mut self.streams {
+            s.set_phase_inversion_disabled(disabled);
+        }
+    }
+
+    /// Final range coder state of the first stream (conformance testing).
+    pub fn final_range(&self) -> u32 {
+        self.streams.first().map_or(0, |s| s.final_range())
+    }
+
+    pub fn reset(&mut self) {
+        for s in &mut self.streams {
+            s.reset();
+        }
+        self.skip_remaining = if self.trim_pre_skip { self.pre_skip() } else { 0 };
+    }
+
+    /// Decodes one packet (`None` = lost packet, concealed) into planar channels.
+    pub fn decode(&mut self, packet: Option<&[u8]>) -> Result<Vec<Vec<f32>>> {
+        let n = self.streams.len();
+        for b in &mut self.scratch {
+            b.clear();
+        }
+        let mut samples = None;
+        match packet {
+            Some(data) if !data.is_empty() => {
+                let mut off = 0;
+                for s in 0..n {
+                    let rest = &data[off..];
+                    if rest.is_empty() {
+                        return Err(Error::InvalidPacket("truncated multistream packet"));
+                    }
+                    let used = if s + 1 < n { Packet::parse_self_delimited(rest)?.1 } else { rest.len() };
+                    let pkt = &rest[..used];
+                    let r = if s + 1 < n {
+                        // Re-frame the self-delimited packet as a regular one for the stream decoder.
+                        let (p, _) = Packet::parse_self_delimited(pkt)?;
+                        let regular = reframe(&p);
+                        self.streams[s].decode_interleaved(Some(&regular), &mut self.scratch[s])?
+                    } else {
+                        self.streams[s].decode_interleaved(Some(pkt), &mut self.scratch[s])?
+                    };
+                    if *samples.get_or_insert(r) != r {
+                        return Err(Error::InvalidPacket("multistream frame durations differ"));
+                    }
+                    off += used;
+                }
+            }
+            _ => {
+                let dur = match self.streams[0].last_packet_duration() {
+                    0 => self.rate as usize / 50,
+                    d => d,
+                };
+                for s in 0..n {
+                    self.streams[s].conceal(dur, &mut self.scratch[s])?;
+                }
+                samples = Some(dur);
+            }
+        }
+        let samples = samples.unwrap_or(0);
+        let mut out = vec![vec![0f32; samples]; self.head.channels];
+        for (c, o) in out.iter_mut().enumerate() {
+            let m = self.head.mapping[c] as usize;
+            if m == 255 {
+                continue;
+            }
+            let (s, ch, nch) = if m < 2 * self.head.coupled_streams { (m / 2, m % 2, 2) } else { (m - self.head.coupled_streams, 0, 1) };
+            let src = &self.scratch[s];
+            for (i, v) in o.iter_mut().enumerate() {
+                *v = src[i * nch + ch];
+            }
+        }
+        if self.skip_remaining > 0 {
+            let k = self.skip_remaining.min(samples);
+            for o in &mut out {
+                o.drain(..k);
+            }
+            self.skip_remaining -= k;
+        }
+        Ok(out)
+    }
+}
+
+/// Rebuilds a regular (code 3 VBR) packet from a parsed self-delimited one.
+fn reframe(p: &Packet) -> Vec<u8> {
+    let mut v = vec![(p.toc.config << 3) | if p.toc.stereo { 4 } else { 0 } | 3];
+    v.push(0x80 | p.frames.len() as u8);
+    for f in &p.frames[..p.frames.len() - 1] {
+        let s = f.len();
+        if s < 252 {
+            v.push(s as u8);
+        } else {
+            let b0 = 252 + (s & 3);
+            v.push(b0 as u8);
+            v.push(((s - b0) >> 2) as u8);
+        }
+    }
+    for f in &p.frames {
+        v.extend_from_slice(f);
+    }
+    v
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn head(channels: usize, streams: usize, coupled: usize, mapping: Vec<u8>) -> OpusHead {
+        OpusHead { channels, pre_skip: 0, input_sample_rate: 48000, output_gain: 0, mapping_family: 1, streams, coupled_streams: coupled, mapping }
+    }
+
+    #[test]
+    fn from_head_rejects_inconsistent_headers() {
+        assert!(Decoder::from_head(head(1, 0, 0, vec![0]), 48000).is_err(), "zero streams");
+        assert!(Decoder::from_head(head(2, 1, 0, vec![0]), 48000).is_err(), "short mapping");
+        assert!(Decoder::from_head(head(1, 1, 0, vec![1]), 48000).is_err(), "mapping index out of range");
+        assert!(Decoder::from_head(head(1, 1, 2, vec![0]), 48000).is_err(), "more coupled than streams");
+        assert!(Decoder::from_head(head(0, 1, 0, vec![]), 48000).is_err(), "zero channels");
+    }
+
+    #[test]
+    fn from_head_accepts_valid_headers() {
+        assert!(Decoder::from_head(head(1, 1, 0, vec![0]), 48000).is_ok());
+        assert!(Decoder::from_head(head(2, 1, 1, vec![0, 1]), 48000).is_ok());
+        assert!(Decoder::from_head(head(3, 2, 1, vec![0, 1, 2]), 48000).is_ok());
+        assert!(Decoder::from_head(head(2, 1, 0, vec![0, 255]), 48000).is_ok());
+    }
+}
@@ -0,0 +1,340 @@
+//! TOC byte and frame packing (RFC 6716 §3).
+
+use crate::Error;
+
+/// Coding mode of an Opus frame.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Mode {
+    SilkOnly,
+    Hybrid,
+    CeltOnly,
+}
+
+/// Audio bandwidth.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Bandwidth {
+    /// 4 kHz.
+    Narrowband,
+    /// 6 kHz.
+    Mediumband,
+    /// 8 kHz.
+    Wideband,
+    /// 12 kHz.
+    SuperWideband,
+    /// 20 kHz.
+    Fullband,
+}
+
+impl Bandwidth {
+    /// Number of CELT bands coded for this bandwidth.
+    pub fn celt_end_band(self) -> usize {
+        match self {
+            Bandwidth::Narrowband => 13,
+            Bandwidth::Mediumband | Bandwidth::Wideband => 17,
+            Bandwidth::SuperWideband => 19,
+            Bandwidth::Fullband => 21,
+        }
+    }
+}
+
+/// Decoded table-of-contents byte.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Toc {
+    pub config: u8,
+    pub mode: Mode,
+    pub bandwidth: Bandwidth,
+    pub stereo: bool,
+    /// Frame count code (0..=3).
+    pub code: u8,
+}
+
+impl Toc {
+    pub fn parse(b: u8) -> Toc {
+        let config = b >> 3;
+        let (mode, bandwidth) = match config {
+            0..=3 => (Mode::SilkOnly, Bandwidth::Narrowband),
+            4..=7 => (Mode::SilkOnly, Bandwidth::Mediumband),
+            8..=11 => (Mode::SilkOnly, Bandwidth::Wideband),
+            12..=13 => (Mode::Hybrid, Bandwidth::SuperWideband),
+            14..=15 => (Mode::Hybrid, Bandwidth::Fullband),
+            16..=19 => (Mode::CeltOnly, Bandwidth::Narrowband),
+            20..=23 => (Mode::CeltOnly, Bandwidth::Wideband),
+            24..=27 => (Mode::CeltOnly, Bandwidth::SuperWideband),
+            _ => (Mode::CeltOnly, Bandwidth::Fullband),
+        };
+        Toc { config, mode, bandwidth, stereo: b & 4 != 0, code: b & 3 }
+    }
+
+    /// Samples per frame at 48 kHz.
+    pub fn frame_samples_48k(&self) -> usize {
+        self.frame_samples(48000)
+    }
+
+    /// Samples per frame at `rate`.
+    pub fn frame_samples(&self, rate: u32) -> usize {
+        let rate = rate as usize;
+        let c = self.config as usize;
+        match self.mode {
+            Mode::CeltOnly => (rate << (c & 3)) / 400,
+            Mode::Hybrid => {
+                if c & 1 != 0 {
+                    rate / 50
+                } else {
+                    rate / 100
+                }
+            }
+            Mode::SilkOnly => match c & 3 {
+                3 => rate * 60 / 1000,
+                s => (rate << s) / 100,
+            },
+        }
+    }
+
+    pub fn channels(&self) -> usize {
+        if self.stereo { 2 } else { 1 }
+    }
+}
+
+/// A parsed packet: TOC plus the byte ranges of each frame.
+#[derive(Clone, Debug)]
+pub struct Packet<'a> {
+    pub toc: Toc,
+    pub frames: Vec<&'a [u8]>,
+    /// Bytes of padding (code 3 only).
+    pub padding: usize,
+}
+
+fn parse_size(data: &[u8]) -> Option<(usize, usize)> {
+    match data.first() {
+        None => None,
+        Some(&b) if b < 252 => Some((b as usize, 1)),
+        Some(&b) => data.get(1).map(|&b1| (4 * b1 as usize + b as usize, 2)),
+    }
+}
+
+impl<'a> Packet<'a> {
+    /// Parses a packet (RFC 6716 section 3.2), enforcing requirements R1 to R7.
+    pub fn parse(data: &'a [u8]) -> Result<Packet<'a>, Error> {
+        Self::parse_impl(data, false).map(|(p, _)| p)
+    }
+
+    /// Parses a self-delimited packet (RFC 6716 Appendix B, used for all but the last stream of
+    /// a multistream packet); returns the packet and the number of bytes it occupies.
+    pub fn parse_self_delimited(data: &'a [u8]) -> Result<(Packet<'a>, usize), Error> {
+        Self::parse_impl(data, true)
+    }
+
+    fn parse_impl(data: &'a [u8], self_delimited: bool) -> Result<(Packet<'a>, usize), Error> {
+        const BAD: Error = Error::InvalidPacket("malformed packet framing");
+        if data.is_empty() {
+            return Err(Error::InvalidPacket("empty packet"));
+        }
+        let toc = Toc::parse(data[0]);
+        let fs = toc.frame_samples_48k();
+        let mut pos = 1usize;
+        let mut len = data.len() as isize - 1;
+        let mut sizes: Vec<isize> = Vec::new();
+        let mut padding = 0usize;
+        let mut cbr = false;
+        let count;
+        let mut last_size = len;
+        let read_size = |pos: &mut usize, len: &mut isize| -> Result<isize, Error> {
+            let avail = &data[*pos..(*pos + (*len).max(0) as usize).min(data.len())];
+            let (s, n) = parse_size(avail).ok_or(BAD)?;
+            *pos += n;
+            *len -= n as isize;
+            Ok(s as isize)
+        };
+        match toc.code {
+            0 => count = 1,
+            1 => {
+                count = 2;
+                cbr = true;
+                if !self_delimited {
+                    if len & 1 != 0 {
+                        return Err(BAD);
+                    }
+                    last_size = len / 2;
+                    sizes.push(last_size);
+                }
+            }
+            2 => {
+                count = 2;
+                let s0 = read_size(&mut pos, &mut len)?;
+                if s0 > len {
+                    return Err(BAD);
+                }
+                sizes.push(s0);
+                last_size = len - s0;
+            }
+            _ => {
+                if len < 1 {
+                    return Err(BAD);
+                }
+                let ch = data[pos];
+                pos += 1;
+                len -= 1;
+                count = (ch & 0x3F) as usize;
+                if count == 0 || fs * count > 5760 {
+                    return Err(BAD);
+                }
+                if ch & 0x40 != 0 {
+                    loop {
+                        if len <= 0 {
+                            return Err(BAD);
+                        }
+                        let b = data[pos];
+                        pos += 1;
+                        len -= 1;
+                        let tmp = if b == 255 { 254 } else { b as isize };
+                        len -= tmp;
+                        padding += tmp as usize;
+                        if b != 255 {
+                            break;
+                        }
+                    }
+                }
+                if len < 0 {
+                    return Err(BAD);
+                }
+                cbr = ch & 0x80 == 0;
+                if !cbr {
+                    last_size = len;
+                    for _ in 0..count - 1 {
+                        let before = len;
+                        let s = read_size(&mut pos, &mut len)?;
+                        if s > len {
+                            return Err(BAD);
+                        }
+                        sizes.push(s);
+                        last_size -= (before - len) + s;
+                    }
+                    if last_size < 0 {
+                        return Err(BAD);
+                    }
+                } else if !self_delimited {
+                    last_size = len / count as isize;
+                    if last_size * count as isize != len {
+                        return Err(BAD);
+                    }
+                    for _ in 0..count - 1 {
+                        sizes.push(last_size);
+                    }
+                }
+            }
+        }
+        if self_delimited {
+            let before = len;
+            let s = read_size(&mut pos, &mut len)?;
+            if s > len {
+                return Err(BAD);
+            }
+            if cbr {
+                if s * count as isize > len {
+                    return Err(BAD);
+                }
+                sizes = vec![s; count - 1];
+            } else if (before - len) + s > last_size {
+                return Err(BAD);
+            }
+            last_size = s;
+        }
+        if last_size > 1275 || sizes.iter().any(|&s| s > 1275) {
+            return Err(BAD);
+        }
+        sizes.push(last_size);
+        let mut frames = Vec::with_capacity(count);
+        for &s in &sizes {
+            let s = s as usize;
+            if pos + s > data.len() {
+                return Err(BAD);
+            }
+            frames.push(&data[pos..pos + s]);
+            pos += s;
+        }
+        let total = if self_delimited { pos + padding } else { data.len() };
+        if total > data.len() {
+            return Err(BAD);
+        }
+        Ok((Packet { toc, frames, padding }, total))
+    }
+}
+
+/// Number of samples (at 48 kHz) in a packet, or an error for malformed framing.
+pub fn packet_samples_48k(data: &[u8]) -> Result<usize, Error> {
+    let p = Packet::parse(data)?;
+    Ok(p.toc.frame_samples_48k() * p.frames.len())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn toc_configs() {
+        for cfg in 0u8..32 {
+            let t = Toc::parse(cfg << 3);
+            let ms10 = t.frame_samples(48000) * 10 / 48; // tenths of ms
+            let expect = match cfg {
+                0..=11 => [100, 200, 400, 600][cfg as usize & 3],
+                12..=15 => [100, 200][cfg as usize & 1],
+                _ => [25, 50, 100, 200][cfg as usize & 3],
+            };
+            assert_eq!(ms10, expect, "config {cfg}");
+        }
+        assert!(Toc::parse(0x04).stereo);
+    }
+
+    #[test]
+    fn frame_codes() {
+        // code 0
+        let p = Packet::parse(&[0x00, 1, 2, 3]).unwrap();
+        assert_eq!(p.frames, vec![&[1u8, 2, 3][..]]);
+        // code 1 (odd payload is invalid)
+        assert!(Packet::parse(&[0x01, 1, 2, 3]).is_err());
+        let p = Packet::parse(&[0x01, 1, 2, 3, 4]).unwrap();
+        assert_eq!(p.frames.len(), 2);
+        // code 2
+        let p = Packet::parse(&[0x02, 1, 9, 8, 7]).unwrap();
+        assert_eq!(p.frames, vec![&[9u8][..], &[8u8, 7][..]]);
+        assert!(Packet::parse(&[0x02, 5, 1]).is_err());
+        // code 3 CBR with padding: 2 frames of 2 bytes, 3 bytes padding
+        let p = Packet::parse(&[0x03, 0x42, 3, 1, 2, 3, 4, 0, 0, 0]).unwrap();
+        assert_eq!(p.frames, vec![&[1u8, 2][..], &[3u8, 4][..]]);
+        assert_eq!(p.padding, 3);
+        // code 3 VBR
+        let p = Packet::parse(&[0x03, 0x83, 1, 2, 10, 20, 21, 30]).unwrap();
+        assert_eq!(p.frames, vec![&[10u8][..], &[20u8, 21][..], &[30u8][..]]);
+        // too many frames (> 120 ms)
+        assert!(Packet::parse(&[0x03 | (3 << 3), 0x03, 0]).is_err());
+        // zero frames
+        assert!(Packet::parse(&[0x03, 0x00]).is_err());
+        assert!(Packet::parse(&[]).is_err());
+    }
+
+    #[test]
+    fn two_byte_sizes() {
+        let mut pkt = vec![0x02u8, 252, 1];
+        pkt.extend(std::iter::repeat_n(7u8, 256));
+        pkt.extend([1, 2]);
+        let p = Packet::parse(&pkt).unwrap();
+        assert_eq!(p.frames[0].len(), 256);
+        assert_eq!(p.frames[1], &[1, 2]);
+    }
+
+    #[test]
+    fn self_delimited() {
+        // code 0 with explicit size, followed by trailing data of the next stream.
+        let (p, used) = Packet::parse_self_delimited(&[0x00, 2, 5, 6, 0xAA, 0xBB]).unwrap();
+        assert_eq!(p.frames, vec![&[5u8, 6][..]]);
+        assert_eq!(used, 4);
+        // code 1: one size for both frames.
+        let (p, used) = Packet::parse_self_delimited(&[0x01, 1, 5, 6, 9]).unwrap();
+        assert_eq!(p.frames, vec![&[5u8][..], &[6u8][..]]);
+        assert_eq!(used, 4);
+        // code 3 VBR, 2 frames: size of frame 0, then size of last frame.
+        let (p, used) = Packet::parse_self_delimited(&[0x03, 0x82, 1, 2, 7, 8, 9, 0xFF]).unwrap();
+        assert_eq!(p.frames, vec![&[7u8][..], &[8u8, 9][..]]);
+        assert_eq!(used, 7);
+    }
+}
@@ -0,0 +1,497 @@
+//! Range decoder (RFC 6716 §4.1).
+//!
+//! The decoder reads range-coded symbols from the front of the buffer and raw bits from the back.
+//! Reading past either end yields zeros (never panics); callers detect corruption through
+//! [`RangeDecoder::tell`] exceeding the budget or through out-of-range values.
+
+const SYM_BITS: u32 = 8;
+const CODE_BITS: u32 = 32;
+const SYM_MAX: u32 = (1 << SYM_BITS) - 1;
+#[cfg(test)]
+const CODE_SHIFT: u32 = CODE_BITS - SYM_BITS - 1;
+const CODE_TOP: u32 = 1 << (CODE_BITS - 1);
+const CODE_BOT: u32 = CODE_TOP >> SYM_BITS;
+const CODE_EXTRA: u32 = (CODE_BITS - 2) % SYM_BITS + 1;
+/// Bit resolution of [`RangeDecoder::tell_frac`] (1/8 bit).
+pub const BITRES: u32 = 3;
+
+/// Number of bits needed to represent `x` (0 for 0).
+#[inline]
+pub fn ilog(x: u32) -> i32 {
+    (32 - x.leading_zeros()) as i32
+}
+
+#[derive(Clone, Debug)]
+pub struct RangeDecoder<'a> {
+    buf: &'a [u8],
+    /// Bytes available to the decoder (may be reduced, e.g. for redundancy).
+    storage: usize,
+    offs: usize,
+    end_offs: usize,
+    end_window: u32,
+    nend_bits: i32,
+    nbits_total: i32,
+    rng: u32,
+    val: u32,
+    rem: u32,
+    /// Set when an out-of-range value was decoded.
+    pub error: bool,
+}
+
+impl<'a> RangeDecoder<'a> {
+    pub fn new(buf: &'a [u8]) -> Self {
+        let mut d = RangeDecoder {
+            buf,
+            storage: buf.len(),
+            offs: 0,
+            end_offs: 0,
+            end_window: 0,
+            nend_bits: 0,
+            nbits_total: (CODE_BITS + 1 - ((CODE_BITS - CODE_EXTRA) / SYM_BITS) * SYM_BITS) as i32,
+            rng: 1 << CODE_EXTRA,
+            val: 0,
+            rem: 0,
+            error: false,
+        };
+        d.rem = d.read_byte();
+        d.val = d.rng - 1 - (d.rem >> (SYM_BITS - CODE_EXTRA));
+        d.normalize();
+        d
+    }
+
+    /// Size of the buffer in bytes as seen by the decoder.
+    pub fn storage(&self) -> usize {
+        self.storage
+    }
+
+    /// Shrinks the buffer seen by the decoder (raw bits are then read from the new end).
+    pub fn shrink_storage(&mut self, by: usize) {
+        self.storage = self.storage.saturating_sub(by);
+    }
+
+    pub fn rng(&self) -> u32 {
+        self.rng
+    }
+
+    #[inline]
+    fn read_byte(&mut self) -> u32 {
+        if self.offs < self.storage {
+            let b = self.buf[self.offs];
+            self.offs += 1;
+            b as u32
+        } else {
+            0
+        }
+    }
+
+    #[inline]
+    fn read_byte_from_end(&mut self) -> u32 {
+        if self.end_offs < self.storage {
+            self.end_offs += 1;
+            self.buf[self.storage - self.end_offs] as u32
+        } else {
+            0
+        }
+    }
+
+    #[inline]
+    fn normalize(&mut self) {
+        while self.rng <= CODE_BOT {
+            self.nbits_total += SYM_BITS as i32;
+            self.rng <<= SYM_BITS;
+            let sym = self.rem;
+            self.rem = self.read_byte();
+            let sym = ((sym << SYM_BITS) | self.rem) >> (SYM_BITS - CODE_EXTRA);
+            self.val = ((self.val << SYM_BITS).wrapping_add(SYM_MAX & !sym)) & (CODE_TOP - 1);
+        }
+    }
+
+    /// Returns the cumulative frequency of the next symbol for total `ft` (call [`Self::update`] next).
+    #[inline]
+    pub fn decode(&mut self, ft: u32) -> u32 {
+        let ext = self.rng / ft;
+        let s = self.val / ext;
+        // stash ext in rem-free form: recomputed by update()
+        ft - (s + 1).min(ft)
+    }
+
+    /// Like [`Self::decode`] with `ft = 1 << bits`.
+    #[inline]
+    pub fn decode_bin(&mut self, bits: u32) -> u32 {
+        let ext = self.rng >> bits;
+        let s = self.val / ext;
+        (1 << bits) - (s + 1).min(1 << bits)
+    }
+
+    /// Consumes the symbol with cumulative range `[fl, fh)` of total `ft`.
+    #[inline]
+    pub fn update(&mut self, fl: u32, fh: u32, ft: u32) {
+        let ext = self.rng / ft;
+        let s = ext * (ft - fh);
+        self.val = self.val.wrapping_sub(s);
+        self.rng = if fl > 0 { ext * (fh - fl) } else { self.rng - s };
+        self.normalize();
+    }
+
+    /// Like [`Self::update`] for a symbol decoded with [`Self::decode_bin`].
+    #[inline]
+    pub fn update_bin(&mut self, fl: u32, fh: u32, bits: u32) {
+        let ext = self.rng >> bits;
+        let ft = 1u32 << bits;
+        let s = ext * (ft - fh);
+        self.val = self.val.wrapping_sub(s);
+        self.rng = if fl > 0 { ext * (fh - fl) } else { self.rng - s };
+        self.normalize();
+    }
+
+    /// Decodes a binary symbol whose probability of being 1 is `1/2^logp`.
+    #[inline]
+    pub fn bit_logp(&mut self, logp: u32) -> bool {
+        let r = self.rng;
+        let d = self.val;
+        let s = r >> logp;
+        let ret = d < s;
+        if !ret {
+            self.val = d - s;
+        }
+        self.rng = if ret { s } else { r - s };
+        self.normalize();
+        ret
+    }
+
+    /// Decodes a symbol with an "inverse CDF" table (`icdf[i] = ft - cdf[i+1]`, `ft = 1 << ftb`).
+    #[inline]
+    pub fn icdf(&mut self, icdf: &[u8], ftb: u32) -> usize {
+        let mut s = self.rng;
+        let d = self.val;
+        let r = s >> ftb;
+        let mut ret = 0usize;
+        let mut t;
+        loop {
+            t = s;
+            let v = icdf.get(ret).copied().unwrap_or(0) as u32;
+            s = r * v;
+            if d >= s || ret + 1 >= icdf.len() {
+                break;
+            }
+            ret += 1;
+        }
+        // If the table is exhausted without d >= s, force the last symbol (only on corrupt tables).
+        if d < s {
+            s = 0;
+        }
+        self.val = d - s;
+        self.rng = t - s;
+        self.normalize();
+        ret
+    }
+
+    /// Decodes a uniformly distributed integer in `[0, ft)` (`ft >= 2`).
+    pub fn uint(&mut self, ft: u32) -> u32 {
+        debug_assert!(ft > 1);
+        let ft1 = ft - 1;
+        let ftb = ilog(ft1);
+        if ftb > 8 {
+            let ftb = (ftb - 8) as u32;
+            let top = (ft1 >> ftb) + 1;
+            let s = self.decode(top);
+            self.update(s, s + 1, top);
+            let t = (s << ftb) | self.bits(ftb);
+            if t <= ft1 {
+                return t;
+            }
+            self.error = true;
+            ft1
+        } else {
+            let s = self.decode(ft);
+            self.update(s, s + 1, ft);
+            s
+        }
+    }
+
+    /// Reads `bits` raw bits (0..=25) from the end of the buffer.
+    pub fn bits(&mut self, bits: u32) -> u32 {
+        if bits == 0 {
+            return 0;
+        }
+        let mut window = self.end_window;
+        let mut available = self.nend_bits;
+        if (available as u32) < bits {
+            loop {
+                window |= self.read_byte_from_end() << available;
+                available += SYM_BITS as i32;
+                if available > (CODE_BITS - SYM_BITS) as i32 {
+                    break;
+                }
+            }
+        }
+        let ret = window & ((1u32 << bits) - 1);
+        window >>= bits;
+        available -= bits as i32;
+        self.end_window = window;
+        self.nend_bits = available;
+        self.nbits_total += bits as i32;
+        ret
+    }
+
+    /// Advances the bit counter so that [`Self::tell`] reports `total` (CELT silence frames).
+    pub fn skip_to_end(&mut self, total: i32) {
+        let t = self.tell();
+        self.nbits_total += total - t;
+    }
+
+    /// Number of bits consumed so far (rounded up).
+    #[inline]
+    pub fn tell(&self) -> i32 {
+        self.nbits_total - ilog(self.rng)
+    }
+
+    /// Number of 1/8 bits consumed so far (rounded up).
+    pub fn tell_frac(&self) -> u32 {
+        let nbits = (self.nbits_total as u32) << BITRES;
+        let mut l = ilog(self.rng) as u32;
+        let mut r = self.rng >> (l - 16);
+        for _ in 0..BITRES {
+            r = (r * r) >> 15;
+            let b = r >> 16;
+            l = (l << 1) | b;
+            r >>= b;
+        }
+        nbits.wrapping_sub(l)
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod enc {
+    //! Minimal range encoder (RFC 6716 §5.1), used only to build test streams.
+    use super::*;
+
+    pub struct RangeEncoder {
+        out: Vec<u8>,
+        end: Vec<u8>,
+        end_window: u32,
+        nend_bits: i32,
+        rng: u32,
+        low: u32,
+        rem: i32,
+        ext: u32,
+        size: usize,
+    }
+
+    impl RangeEncoder {
+        pub fn new(size: usize) -> Self {
+            RangeEncoder { out: Vec::new(), end: Vec::new(), end_window: 0, nend_bits: 0, rng: CODE_TOP, low: 0, rem: -1, ext: 0, size }
+        }
+        fn carry_out(&mut self, c: u32) {
+            if c != SYM_MAX {
+                let carry = c >> SYM_BITS;
+                if self.rem >= 0 {
+                    self.out.push((self.rem as u32 + carry) as u8);
+                }
+                if self.ext > 0 {
+                    let sym = (SYM_MAX + carry) & SYM_MAX;
+                    for _ in 0..self.ext {
+                        self.out.push(sym as u8);
+                    }
+                    self.ext = 0;
+                }
+                self.rem = (c & SYM_MAX) as i32;
+            } else {
+                self.ext += 1;
+            }
+        }
+        fn normalize(&mut self) {
+            while self.rng <= CODE_BOT {
+                self.carry_out(self.low >> CODE_SHIFT);
+                self.low = (self.low << SYM_BITS) & (CODE_TOP - 1);
+                self.rng <<= SYM_BITS;
+            }
+        }
+        pub fn encode(&mut self, fl: u32, fh: u32, ft: u32) {
+            let r = self.rng / ft;
+            if fl > 0 {
+                self.low += self.rng - r * (ft - fl);
+                self.rng = r * (fh - fl);
+            } else {
+                self.rng -= r * (ft - fh);
+            }
+            self.normalize();
+        }
+        pub fn bit_logp(&mut self, val: bool, logp: u32) {
+            let r = self.rng;
+            let s = r >> logp;
+            let r2 = r - s;
+            if val {
+                self.low += r2;
+                self.rng = s;
+            } else {
+                self.rng = r2;
+            }
+            self.normalize();
+        }
+        pub fn icdf(&mut self, s: usize, icdf: &[u8], ftb: u32) {
+            let r = self.rng >> ftb;
+            if s > 0 {
+                self.low += self.rng - r * icdf[s - 1] as u32;
+                self.rng = r * (icdf[s - 1] as u32 - icdf[s] as u32);
+            } else {
+                self.rng -= r * icdf[s] as u32;
+            }
+            self.normalize();
+        }
+        pub fn uint(&mut self, fl: u32, ft: u32) {
+            let ft1 = ft - 1;
+            let ftb = ilog(ft1);
+            if ftb > 8 {
+                let ftb = (ftb - 8) as u32;
+                let top = (ft1 >> ftb) + 1;
+                let v = fl >> ftb;
+                self.encode(v, v + 1, top);
+                self.bits(fl & ((1 << ftb) - 1), ftb);
+            } else {
+                self.encode(fl, fl + 1, ft);
+            }
+        }
+        pub fn bits(&mut self, val: u32, bits: u32) {
+            let mut window = self.end_window;
+            let mut used = self.nend_bits;
+            if used as u32 + bits > CODE_BITS {
+                while used >= SYM_BITS as i32 {
+                    self.end.push((window & SYM_MAX) as u8);
+                    window >>= SYM_BITS;
+                    used -= SYM_BITS as i32;
+                }
+            }
+            window |= val << used;
+            used += bits as i32;
+            self.end_window = window;
+            self.nend_bits = used;
+        }
+        /// Finalises and returns a buffer of exactly `size` bytes.
+        pub fn done(mut self) -> Vec<u8> {
+            let mut l = CODE_BITS as i32 - ilog(self.rng);
+            let mut msk = (CODE_TOP - 1) >> l;
+            let mut end = (self.low + msk) & !msk;
+            if (end | msk) >= self.low + self.rng {
+                l += 1;
+                msk >>= 1;
+                end = (self.low + msk) & !msk;
+            }
+            while l > 0 {
+                self.carry_out(end >> CODE_SHIFT);
+                end = (end << SYM_BITS) & (CODE_TOP - 1);
+                l -= SYM_BITS as i32;
+            }
+            if self.rem >= 0 || self.ext > 0 {
+                self.carry_out(0);
+            }
+            let mut window = self.end_window;
+            let mut used = self.nend_bits;
+            while used > 0 {
+                self.end.push((window & SYM_MAX) as u8);
+                window >>= SYM_BITS;
+                used -= SYM_BITS as i32;
+            }
+            assert!(self.out.len() + self.end.len() <= self.size, "range encoder overflow");
+            let mut buf = self.out;
+            buf.resize(self.size - self.end.len(), 0);
+            for &b in self.end.iter().rev() {
+                buf.push(b);
+            }
+            buf
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::enc::RangeEncoder;
+    use super::*;
+
+    struct Lcg(u32);
+    impl Lcg {
+        fn next(&mut self) -> u32 {
+            self.0 = self.0.wrapping_mul(1664525).wrapping_add(1013904223);
+            self.0 >> 8
+        }
+    }
+
+    #[test]
+    fn roundtrip_mixed_symbols() {
+        let mut rng = Lcg(1);
+        for trial in 0..200 {
+            let n = 1 + (rng.next() % 300) as usize;
+            let mut ops = Vec::new();
+            for _ in 0..n {
+                match rng.next() % 5 {
+                    0 => {
+                        let ft = 2 + rng.next() % 1000;
+                        let v = rng.next() % ft;
+                        ops.push((0u8, v, ft));
+                    }
+                    1 => {
+                        let logp = 1 + rng.next() % 15;
+                        ops.push((1, rng.next().is_multiple_of(7) as u32, logp));
+                    }
+                    2 => {
+                        let bits = 1 + rng.next() % 24;
+                        ops.push((2, rng.next() & ((1 << bits) - 1), bits));
+                    }
+                    3 => {
+                        let ft = 2 + rng.next() % 100_000_000;
+                        ops.push((3, rng.next() % ft, ft));
+                    }
+                    _ => ops.push((4, rng.next() % 4, 0)),
+                }
+            }
+            let icdf: [u8; 4] = [200, 120, 30, 0];
+            let mut e = RangeEncoder::new(8 * n + 16);
+            for &(k, v, p) in &ops {
+                match k {
+                    0 => e.encode(v, v + 1, p),
+                    1 => e.bit_logp(v != 0, p),
+                    2 => e.bits(v, p),
+                    3 => e.uint(v, p),
+                    _ => e.icdf(v as usize, &icdf, 8),
+                }
+            }
+            let buf = e.done();
+            let mut d = RangeDecoder::new(&buf);
+            for (i, &(k, v, p)) in ops.iter().enumerate() {
+                let got = match k {
+                    0 => {
+                        let s = d.decode(p);
+                        d.update(s, s + 1, p);
+                        s
+                    }
+                    1 => d.bit_logp(p) as u32,
+                    2 => d.bits(p),
+                    3 => d.uint(p),
+                    _ => d.icdf(&icdf, 8) as u32,
+                };
+                assert_eq!(got, v, "trial {trial} op {i} kind {k}");
+            }
+            assert!(!d.error);
+        }
+    }
+
+    #[test]
+    fn tell_starts_at_one_bit() {
+        let buf = [0u8; 8];
+        let d = RangeDecoder::new(&buf);
+        assert_eq!(d.tell(), 1);
+        assert_eq!(d.tell_frac(), 8);
+    }
+
+    #[test]
+    fn empty_and_garbage_never_panic() {
+        let mut d = RangeDecoder::new(&[]);
+        for i in 0..100 {
+            d.bits(1 + i % 20);
+            d.uint(3 + i * 77);
+            d.icdf(&[250, 100, 0], 8);
+            d.bit_logp(1 + i % 15);
+        }
+        let _ = d.tell_frac();
+    }
+}
@@ -0,0 +1,912 @@
+//! SILK layer decoder (RFC 6716 §4.2).
+//!
+//! Parameter decoding and reconstruction follow the normative fixed-point arithmetic so that the
+//! output matches the reference decoder sample for sample at the internal rate. Resampling to the
+//! output rate uses our own linear-phase interpolator with the delays of RFC 6716 Table 54.
+
+pub(crate) mod lpc;
+mod resampler;
+#[allow(dead_code)]
+pub(crate) mod tables;
+
+use lpc::{MAX_LPC_ORDER, bwexpander, div32_varq, inverse32_varq, nlsf_decode, nlsf2a, rshift_round, sat16, smlawb, smulwb, smulww};
+use resampler::Resampler;
+use tables::{
+    CB_NB_10, CB_NB_20, CB_WB_10, CB_WB_20, DELTA_GAIN, EXC_LSB, EXC_SIGN, GAIN_MSB, LBRR_FLAGS, LTP_FILTER, LTP_PERIODICITY, LTP_SCALE, LTP_TAPS_0,
+    LTP_TAPS_1, LTP_TAPS_2, MID_ONLY, NLSF_EXT, NLSF_INTERP, NLSF_SEL_NBMB, NLSF_SEL_WB, NLSF_STAGE1, NLSF_STAGE2, PITCH_CONTOUR, PITCH_DELTA,
+    PITCH_HIGH, PITCH_LOW, PULSE_COUNT, RATE_LEVEL, SHELL_2, SHELL_4, SHELL_8, SHELL_16, STEREO_PRED_JOINT, STEREO_WEIGHTS_Q13, TYPE_ACTIVE,
+    TYPE_INACTIVE, UNIFORM3, UNIFORM4, UNIFORM5, UNIFORM8,
+};
+
+use crate::range::RangeDecoder;
+use crate::{Error, Result};
+
+const MAX_FRAME: usize = 320;
+const MAX_SUBFR: usize = 80;
+const LTP_ORDER: usize = 5;
+const OUT_BUF: usize = MAX_FRAME + 2 * MAX_SUBFR;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LostFlag {
+    Normal,
+    Lost,
+    Lbrr,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Cond {
+    Independently,
+    IndependentlyNoLtpScaling,
+    Conditionally,
+}
+
+#[derive(Clone, Default)]
+struct Indices {
+    gains: [i32; 4],
+    ltp_index: [usize; 4],
+    nlsf: [i32; 17],
+    lag_index: i32,
+    contour_index: usize,
+    signal_type: usize,
+    quant_offset_type: usize,
+    nlsf_interp_q2: i32,
+    per_index: usize,
+    ltp_scale_index: usize,
+    seed: i32,
+}
+
+#[derive(Clone)]
+struct Channel {
+    fs_khz: usize,
+    nb_subfr: usize,
+    frame_length: usize,
+    subfr_length: usize,
+    ltp_mem_length: usize,
+    lpc_order: usize,
+    prev_gain_q16: i32,
+    s_lpc_q14: [i32; MAX_LPC_ORDER],
+    out_buf: [i16; OUT_BUF],
+    lag_prev: i32,
+    last_gain_index: i32,
+    prev_signal_type: usize,
+    first_frame_after_reset: bool,
+    prev_nlsf_q15: [i32; MAX_LPC_ORDER],
+    ec_prev_signal_type: usize,
+    ec_prev_lag_index: i32,
+    vad_flags: [bool; 3],
+    lbrr_flag: bool,
+    lbrr_flags: [bool; 3],
+    n_frames_decoded: usize,
+    n_frames_per_packet: usize,
+    loss_cnt: u32,
+    indices: Indices,
+    resampler: Resampler,
+    // PLC memory.
+    plc_lpc_q12: [i32; MAX_LPC_ORDER],
+    plc_gain_q16: i32,
+    plc_pitch: i32,
+    plc_rand: u32,
+}
+
+impl Channel {
+    fn new() -> Channel {
+        Channel {
+            fs_khz: 0,
+            nb_subfr: 4,
+            frame_length: 0,
+            subfr_length: 0,
+            ltp_mem_length: 0,
+            lpc_order: 0,
+            prev_gain_q16: 65536,
+            s_lpc_q14: [0; MAX_LPC_ORDER],
+            out_buf: [0; OUT_BUF],
+            lag_prev: 100,
+            last_gain_index: 10,
+            prev_signal_type: 0,
+            first_frame_after_reset: true,
+            prev_nlsf_q15: [0; MAX_LPC_ORDER],
+            ec_prev_signal_type: 0,
+            ec_prev_lag_index: 0,
+            vad_flags: [false; 3],
+            lbrr_flag: false,
+            lbrr_flags: [false; 3],
+            n_frames_decoded: 0,
+            n_frames_per_packet: 1,
+            loss_cnt: 0,
+            indices: Indices::default(),
+            resampler: Resampler::new(16000, 16000),
+            plc_lpc_q12: [0; MAX_LPC_ORDER],
+            plc_gain_q16: 0,
+            plc_pitch: 0,
+            plc_rand: 22222,
+        }
+    }
+
+    fn set_fs(&mut self, fs_khz: usize, api_rate: u32) {
+        self.subfr_length = 5 * fs_khz;
+        let frame_length = self.nb_subfr * self.subfr_length;
+        if self.fs_khz != fs_khz || self.resampler.rates() != (fs_khz as u32 * 1000, api_rate) {
+            self.resampler = Resampler::new(fs_khz as u32 * 1000, api_rate);
+        }
+        if self.fs_khz != fs_khz || frame_length != self.frame_length {
+            if self.fs_khz != fs_khz {
+                self.ltp_mem_length = 20 * fs_khz;
+                self.lpc_order = if fs_khz == 16 { 16 } else { 10 };
+                self.first_frame_after_reset = true;
+                self.lag_prev = 100;
+                self.last_gain_index = 10;
+                self.prev_signal_type = 0;
+                self.out_buf = [0; OUT_BUF];
+                self.s_lpc_q14 = [0; MAX_LPC_ORDER];
+            }
+            self.fs_khz = fs_khz;
+            self.frame_length = frame_length;
+        }
+    }
+
+    fn decode_indices(&mut self, dec: &mut RangeDecoder, frame_index: usize, decode_lbrr: bool, cond: Cond) {
+        let ix = if decode_lbrr || self.vad_flags[frame_index] { dec.icdf(&TYPE_ACTIVE, 8) + 2 } else { dec.icdf(&TYPE_INACTIVE, 8) };
+        let ind = &mut self.indices;
+        ind.signal_type = ix >> 1;
+        ind.quant_offset_type = ix & 1;
+        if cond == Cond::Conditionally {
+            ind.gains[0] = dec.icdf(&DELTA_GAIN, 8) as i32;
+        } else {
+            ind.gains[0] = (dec.icdf(GAIN_MSB[ind.signal_type], 8) as i32) << 3;
+            ind.gains[0] += dec.icdf(&UNIFORM8, 8) as i32;
+        }
+        for i in 1..self.nb_subfr {
+            ind.gains[i] = dec.icdf(&DELTA_GAIN, 8) as i32;
+        }
+        let wb = self.lpc_order == 16;
+        let s1 = (ind.signal_type >> 1) + if wb { 2 } else { 0 };
+        let i1 = dec.icdf(NLSF_STAGE1[s1], 8);
+        ind.nlsf[0] = i1 as i32;
+        for i in 0..self.lpc_order {
+            let cb = if wb { 8 + NLSF_SEL_WB[i1][i] as usize } else { NLSF_SEL_NBMB[i1][i] as usize };
+            let mut v = dec.icdf(NLSF_STAGE2[cb], 8) as i32;
+            if v == 0 {
+                v -= dec.icdf(&NLSF_EXT, 8) as i32;
+            } else if v == 8 {
+                v += dec.icdf(&NLSF_EXT, 8) as i32;
+            }
+            ind.nlsf[i + 1] = v - 4;
+        }
+        ind.nlsf_interp_q2 = if self.nb_subfr == 4 { dec.icdf(&NLSF_INTERP, 8) as i32 } else { 4 };
+        if ind.signal_type == 2 {
+            let mut absolute = true;
+            if cond == Cond::Conditionally && self.ec_prev_signal_type == 2 {
+                let d = dec.icdf(&PITCH_DELTA, 8) as i32;
+                if d > 0 {
+                    ind.lag_index = self.ec_prev_lag_index + d - 9;
+                    absolute = false;
+                }
+            }
+            if absolute {
+                ind.lag_index = dec.icdf(&PITCH_HIGH, 8) as i32 * (self.fs_khz as i32 >> 1);
+                let low = match self.fs_khz {
+                    8 => PITCH_LOW[0],
+                    12 => PITCH_LOW[1],
+                    _ => PITCH_LOW[2],
+                };
+                ind.lag_index += dec.icdf(low, 8) as i32;
+            }
+            self.ec_prev_lag_index = ind.lag_index;
+            let contour = match (self.fs_khz, self.nb_subfr) {
+                (8, 2) => PITCH_CONTOUR[0],
+                (8, _) => PITCH_CONTOUR[1],
+                (_, 2) => PITCH_CONTOUR[2],
+                _ => PITCH_CONTOUR[3],
+            };
+            ind.contour_index = dec.icdf(contour, 8);
+            ind.per_index = dec.icdf(&LTP_PERIODICITY, 8);
+            for k in 0..self.nb_subfr {
+                ind.ltp_index[k] = dec.icdf(LTP_FILTER[ind.per_index], 8);
+            }
+            ind.ltp_scale_index = if cond == Cond::Independently { dec.icdf(&LTP_SCALE, 8) } else { 0 };
+        }
+        self.ec_prev_signal_type = ind.signal_type;
+        ind.seed = dec.icdf(&UNIFORM4, 8) as i32;
+    }
+
+    fn decode_frame(&mut self, dec: Option<&mut RangeDecoder>, out: &mut [i16], lost: LostFlag, cond: Cond) {
+        let l = self.frame_length;
+        let decode = match (lost, &dec) {
+            (LostFlag::Normal, Some(_)) => true,
+            (LostFlag::Lbrr, Some(_)) => self.lbrr_flags[self.n_frames_decoded],
+            _ => false,
+        };
+        if decode && let Some(dec) = dec {
+            self.decode_indices(dec, self.n_frames_decoded, lost == LostFlag::Lbrr, cond);
+            let mut pulses = [0i32; MAX_FRAME + 16];
+            decode_pulses(dec, &mut pulses, self.indices.signal_type, self.indices.quant_offset_type, l);
+            let ctrl = self.decode_parameters(cond);
+            self.decode_core(&ctrl, &pulses, out);
+            self.plc_lpc_q12 = ctrl.pred_coef_q12[1];
+            self.plc_gain_q16 = ctrl.gains_q16[self.nb_subfr - 1];
+            self.plc_pitch = if self.indices.signal_type == 2 { ctrl.pitch_l[self.nb_subfr - 1] } else { 0 };
+            self.loss_cnt = 0;
+            self.prev_signal_type = self.indices.signal_type;
+            self.first_frame_after_reset = false;
+            self.lag_prev = ctrl.pitch_l[self.nb_subfr - 1];
+        } else {
+            self.conceal(out);
+        }
+        // Update the output buffer.
+        let mv = self.ltp_mem_length - l;
+        self.out_buf.copy_within(l..l + mv, 0);
+        self.out_buf[mv..mv + l].copy_from_slice(&out[..l]);
+    }
+
+    fn decode_parameters(&mut self, cond: Cond) -> Ctrl {
+        let mut ctrl = Ctrl::default();
+        let nb = self.nb_subfr;
+        // Gains.
+        let mut prev = self.last_gain_index;
+        for k in 0..nb {
+            let ind = self.indices.gains[k];
+            if k == 0 && cond != Cond::Conditionally {
+                prev = ind.max(prev - 16);
+            } else {
+                let tmp = ind - 4;
+                let thr = 2 * 36 - 64 + prev;
+                if tmp > thr {
+                    prev += (tmp << 1) - thr;
+                } else {
+                    prev += tmp;
+                }
+            }
+            prev = prev.clamp(0, 63);
+            ctrl.gains_q16[k] = log2lin((smulwb(0x1D1C71, prev) + 2090).min(3967));
+        }
+        self.last_gain_index = prev;
+        // LPC.
+        let order = self.lpc_order;
+        let nlsf = nlsf_decode(&self.indices.nlsf, order == 16);
+        ctrl.pred_coef_q12[1] = nlsf2a(&nlsf[..order]);
+        if self.first_frame_after_reset {
+            self.indices.nlsf_interp_q2 = 4;
+        }
+        if self.indices.nlsf_interp_q2 < 4 {
+            let mut n0 = [0i32; MAX_LPC_ORDER];
+            for i in 0..order {
+                n0[i] = self.prev_nlsf_q15[i] + ((self.indices.nlsf_interp_q2 * (nlsf[i] - self.prev_nlsf_q15[i])) >> 2);
+            }
+            ctrl.pred_coef_q12[0] = nlsf2a(&n0[..order]);
+        } else {
+            ctrl.pred_coef_q12[0] = ctrl.pred_coef_q12[1];
+        }
+        self.prev_nlsf_q15 = nlsf;
+        if self.loss_cnt > 0 {
+            bwexpander(&mut ctrl.pred_coef_q12[0][..order], 63570);
+            bwexpander(&mut ctrl.pred_coef_q12[1][..order], 63570);
+        }
+        if self.indices.signal_type == 2 {
+            let fs = self.fs_khz as i32;
+            let min_lag = 2 * fs;
+            let max_lag = 18 * fs;
+            let lag = min_lag + self.indices.lag_index;
+            for k in 0..nb {
+                let off = match (self.fs_khz, nb) {
+                    (8, 2) => CB_NB_10[self.indices.contour_index][k],
+                    (8, _) => CB_NB_20[self.indices.contour_index][k],
+                    (_, 2) => CB_WB_10[self.indices.contour_index][k],
+                    _ => CB_WB_20[self.indices.contour_index][k],
+                };
+                ctrl.pitch_l[k] = (lag + off).clamp(min_lag, max_lag);
+            }
+            for k in 0..nb {
+                let ix = self.indices.ltp_index[k];
+                let taps = match self.indices.per_index {
+                    0 => LTP_TAPS_0[ix.min(7)],
+                    1 => LTP_TAPS_1[ix.min(15)],
+                    _ => LTP_TAPS_2[ix.min(31)],
+                };
+                for i in 0..LTP_ORDER {
+                    ctrl.ltp_coef_q14[k * LTP_ORDER + i] = taps[i] << 7;
+                }
+            }
+            ctrl.ltp_scale_q14 = [15565, 12288, 8192][self.indices.ltp_scale_index];
+        }
+        ctrl
+    }
+
+    fn decode_core(&mut self, ctrl: &Ctrl, pulses: &[i32], xq: &mut [i16]) {
+        let ind = &self.indices;
+        let l = self.frame_length;
+        let sub = self.subfr_length;
+        let order = self.lpc_order;
+        let ltp_mem = self.ltp_mem_length;
+        let mut s_ltp = [0i16; MAX_FRAME];
+        let mut s_ltp_q15 = [0i32; 2 * MAX_FRAME];
+        let mut res_q14 = [0i32; MAX_SUBFR];
+        let mut s_lpc = [0i32; MAX_SUBFR + MAX_LPC_ORDER];
+        let offset_q10 = [[100, 240], [32, 100]][ind.signal_type >> 1][ind.quant_offset_type];
+        let interp = ind.nlsf_interp_q2 < 4;
+        let mut exc = [0i32; MAX_FRAME];
+        let mut seed = ind.seed;
+        for i in 0..l {
+            seed = seed.wrapping_mul(196_314_165).wrapping_add(907_633_515);
+            let mut e = pulses[i] << 14;
+            if e > 0 {
+                e -= 80 << 4;
+            } else if e < 0 {
+                e += 80 << 4;
+            }
+            e += offset_q10 << 4;
+            if seed < 0 {
+                e = -e;
+            }
+            exc[i] = e;
+            seed = seed.wrapping_add(pulses[i]);
+        }
+        s_lpc[..MAX_LPC_ORDER].copy_from_slice(&self.s_lpc_q14);
+        let mut ltp_buf_idx = ltp_mem;
+        for k in 0..self.nb_subfr {
+            let a_q12 = &ctrl.pred_coef_q12[k >> 1];
+            let mut b_q14 = [0i32; LTP_ORDER];
+            b_q14.copy_from_slice(&ctrl.ltp_coef_q14[k * LTP_ORDER..(k + 1) * LTP_ORDER]);
+            let mut signal_type = ind.signal_type;
+            let gain_q10 = ctrl.gains_q16[k] >> 6;
+            let mut inv_gain_q31 = inverse32_varq(ctrl.gains_q16[k], 47);
+            let gain_adj_q16 = if ctrl.gains_q16[k] != self.prev_gain_q16 {
+                let g = div32_varq(self.prev_gain_q16, ctrl.gains_q16[k], 16);
+                for v in s_lpc[..MAX_LPC_ORDER].iter_mut() {
+                    *v = smulww(g, *v);
+                }
+                g
+            } else {
+                1 << 16
+            };
+            self.prev_gain_q16 = ctrl.gains_q16[k];
+            let mut lag = ctrl.pitch_l[k];
+            if self.loss_cnt > 0 && self.prev_signal_type == 2 && signal_type != 2 && k < 2 {
+                b_q14 = [0; LTP_ORDER];
+                b_q14[LTP_ORDER / 2] = 1 << 12;
+                signal_type = 2;
+                lag = self.lag_prev;
+            }
+            if signal_type == 2 {
+                let lag_u = lag as usize;
+                if k == 0 || (k == 2 && interp) {
+                    let start_idx = ltp_mem as isize - lag as isize - order as isize - (LTP_ORDER / 2) as isize;
+                    let start_idx = start_idx.max(0) as usize;
+                    if k == 2 {
+                        self.out_buf[ltp_mem..ltp_mem + 2 * sub].copy_from_slice(&xq[..2 * sub]);
+                    }
+                    let src_off = start_idx + k * sub;
+                    lpc_analysis_filter(&mut s_ltp[start_idx..ltp_mem], &self.out_buf[src_off..src_off + ltp_mem - start_idx], a_q12, order);
+                    if k == 0 {
+                        inv_gain_q31 = smulwb(inv_gain_q31, ctrl.ltp_scale_q14) << 2;
+                    }
+                    for i in 0..(lag_u + LTP_ORDER / 2).min(ltp_mem) {
+                        s_ltp_q15[ltp_buf_idx - i - 1] = smulwb(inv_gain_q31, s_ltp[ltp_mem - i - 1] as i32);
+                    }
+                } else if gain_adj_q16 != 1 << 16 {
+                    for i in 0..(lag_u + LTP_ORDER / 2).min(ltp_buf_idx) {
+                        let p = ltp_buf_idx - i - 1;
+                        s_ltp_q15[p] = smulww(gain_adj_q16, s_ltp_q15[p]);
+                    }
+                }
+                let base = ltp_buf_idx as isize - lag as isize + (LTP_ORDER / 2) as isize;
+                for i in 0..sub {
+                    let p = base + i as isize;
+                    let g = |o: isize| -> i32 { if p - o >= 0 { s_ltp_q15[(p - o) as usize] } else { 0 } };
+                    let mut pred = 2i32;
+                    pred = smlawb(pred, g(0), b_q14[0]);
+                    pred = smlawb(pred, g(1), b_q14[1]);
+                    pred = smlawb(pred, g(2), b_q14[2]);
+                    pred = smlawb(pred, g(3), b_q14[3]);
+                    pred = smlawb(pred, g(4), b_q14[4]);
+                    res_q14[i] = exc[k * sub + i].wrapping_add(pred << 1);
+                    s_ltp_q15[ltp_buf_idx] = res_q14[i] << 1;
+                    ltp_buf_idx += 1;
+                }
+            } else {
+                res_q14[..sub].copy_from_slice(&exc[k * sub..(k + 1) * sub]);
+            }
+            for i in 0..sub {
+                let mut pred = (order >> 1) as i32;
+                for j in 0..order {
+                    pred = smlawb(pred, s_lpc[MAX_LPC_ORDER + i - 1 - j], a_q12[j]);
+                }
+                let v = res_q14[i].saturating_add(pred.saturating_mul(16));
+                s_lpc[MAX_LPC_ORDER + i] = v;
+                xq[k * sub + i] = sat16(rshift_round(smulww(v, gain_q10), 8)) as i16;
+            }
+            s_lpc.copy_within(sub..sub + MAX_LPC_ORDER, 0);
+        }
+        self.s_lpc_q14.copy_from_slice(&s_lpc[..MAX_LPC_ORDER]);
+    }
+
+    /// Basic concealment: pitch-periodic repetition for voiced history, otherwise LPC-shaped
+    /// noise at the residual level of the history; both fade out over successive losses.
+    fn conceal(&mut self, out: &mut [i16]) {
+        let l = self.frame_length;
+        if l == 0 {
+            return;
+        }
+        self.loss_cnt += 1;
+        let order = self.lpc_order;
+        let mem = self.ltp_mem_length;
+        let fade = 0.85f32.powi(self.loss_cnt as i32);
+        let hist: Vec<f32> = self.out_buf[..mem].iter().map(|&v| v as f32).collect();
+        let pitch = self.plc_pitch as usize;
+        let mut y = hist.clone();
+        if pitch > 0 && pitch < mem {
+            for _ in 0..l {
+                let v = y[y.len() - pitch] * fade;
+                y.push(v);
+            }
+        } else {
+            let mut a12 = self.plc_lpc_q12;
+            bwexpander(&mut a12[..order], 64880);
+            self.plc_lpc_q12 = a12;
+            let a: Vec<f32> = a12[..order].iter().map(|&v| v as f32 / 4096.0).collect();
+            let mut e = 0f32;
+            for i in order..mem {
+                let mut r = hist[i];
+                for j in 0..order {
+                    r -= a[j] * hist[i - 1 - j];
+                }
+                e += r * r;
+            }
+            let rms = (e / (mem - order).max(1) as f32).sqrt() * fade;
+            for _ in 0..l {
+                self.plc_rand = self.plc_rand.wrapping_mul(196_314_165).wrapping_add(907_633_515);
+                let mut v = ((self.plc_rand as i32) >> 16) as f32 / 32768.0 * rms * 1.7;
+                for j in 0..order {
+                    v += a[j] * y[y.len() - 1 - j];
+                }
+                y.push(v.clamp(-32768.0, 32767.0));
+            }
+        }
+        for (o, v) in out.iter_mut().zip(&y[mem..mem + l]) {
+            *o = v.clamp(-32768.0, 32767.0) as i16;
+        }
+        // Keep the LPC synthesis state consistent for the next decoded frame.
+        let g = self.prev_gain_q16.max(1) as i64;
+        for j in 0..MAX_LPC_ORDER {
+            let v = out[l - MAX_LPC_ORDER + j] as i64;
+            self.s_lpc_q14[j] = ((v << 30) / g).clamp(i32::MIN as i64, i32::MAX as i64) as i32;
+        }
+        self.lag_prev = self.plc_pitch.max(1);
+        self.first_frame_after_reset = false;
+    }
+}
+
+#[derive(Default)]
+struct Ctrl {
+    gains_q16: [i32; 4],
+    pred_coef_q12: [[i32; MAX_LPC_ORDER]; 2],
+    pitch_l: [i32; 4],
+    ltp_coef_q14: [i32; 4 * LTP_ORDER],
+    ltp_scale_q14: i32,
+}
+
+fn log2lin(in_log_q7: i32) -> i32 {
+    if in_log_q7 < 0 {
+        return 0;
+    }
+    if in_log_q7 >= 3967 {
+        return i32::MAX;
+    }
+    let out = 1i32 << (in_log_q7 >> 7);
+    let frac = in_log_q7 & 0x7F;
+    if in_log_q7 < 2048 {
+        out + ((out * smlawb(frac, frac * (128 - frac), -174)) >> 7)
+    } else {
+        out + (out >> 7) * smlawb(frac, frac * (128 - frac), -174)
+    }
+}
+
+fn lpc_analysis_filter(out: &mut [i16], input: &[i16], b: &[i32], d: usize) {
+    let len = out.len();
+    for ix in d..len {
+        let mut acc: i32 = 0;
+        for j in 0..d {
+            acc = acc.wrapping_add((input[ix - 1 - j] as i32).wrapping_mul(b[j]));
+        }
+        let v = ((input[ix] as i32) << 12).wrapping_sub(acc);
+        out[ix] = sat16(rshift_round(v, 12)) as i16;
+    }
+    for v in out.iter_mut().take(d.min(len)) {
+        *v = 0;
+    }
+}
+
+fn decode_pulses(dec: &mut RangeDecoder, pulses: &mut [i32], signal_type: usize, quant_offset_type: usize, frame_length: usize) {
+    let rate_level = dec.icdf(RATE_LEVEL[signal_type >> 1], 8);
+    let mut iter = frame_length >> 4;
+    if iter * 16 < frame_length {
+        iter += 1;
+    }
+    let mut sum_pulses = [0i32; 20];
+    let mut n_lshifts = [0i32; 20];
+    for i in 0..iter {
+        let mut s = dec.icdf(PULSE_COUNT[rate_level], 8) as i32;
+        while s == 17 {
+            n_lshifts[i] += 1;
+            let tab = if n_lshifts[i] == 10 { PULSE_COUNT[10] } else { PULSE_COUNT[9] };
+            s = dec.icdf(tab, 8) as i32;
+        }
+        sum_pulses[i] = s;
+    }
+    for i in 0..iter {
+        let blk = &mut pulses[i * 16..(i + 1) * 16];
+        if sum_pulses[i] > 0 {
+            shell_decode(dec, blk, sum_pulses[i]);
+        } else {
+            blk.fill(0);
+        }
+    }
+    for i in 0..iter {
+        let nls = n_lshifts[i];
+        if nls > 0 {
+            for p in pulses[i * 16..(i + 1) * 16].iter_mut() {
+                let mut a = *p;
+                for _ in 0..nls {
+                    a = (a << 1) + dec.icdf(&EXC_LSB, 8) as i32;
+                }
+                *p = a;
+            }
+            sum_pulses[i] |= nls << 5;
+        }
+    }
+    // Signs.
+    let base = 7 * (quant_offset_type + (signal_type << 1));
+    let len = (frame_length + 8) >> 4;
+    for i in 0..len {
+        let p = sum_pulses[i];
+        if p > 0 {
+            let tab = EXC_SIGN[base + ((p & 0x1F) as usize).min(6)];
+            for q in pulses[i * 16..(i + 1) * 16].iter_mut() {
+                if *q > 0 && dec.icdf(tab, 8) == 0 {
+                    *q = -*q;
+                }
+            }
+        }
+    }
+}
+
+fn shell_decode(dec: &mut RangeDecoder, out: &mut [i32], total: i32) {
+    fn split(dec: &mut RangeDecoder, out: &mut [i32], n: usize, count: i32) {
+        if n == 1 {
+            out[0] = count;
+            return;
+        }
+        if count == 0 {
+            out[..n].fill(0);
+            return;
+        }
+        let tab = match n {
+            16 => SHELL_16[(count - 1) as usize],
+            8 => SHELL_8[(count - 1) as usize],
+            4 => SHELL_4[(count - 1) as usize],
+            _ => SHELL_2[(count - 1) as usize],
+        };
+        let left = dec.icdf(tab, 8) as i32;
+        let h = n / 2;
+        let (a, b) = out.split_at_mut(h);
+        split(dec, a, h, left);
+        split(dec, b, h, count - left);
+    }
+    split(dec, out, 16, total.min(16));
+}
+
+#[derive(Default, Clone)]
+struct Stereo {
+    pred_prev_q13: [i32; 2],
+    s_mid: [i16; 2],
+    s_side: [i16; 2],
+}
+
+fn stereo_decode_pred(dec: &mut RangeDecoder) -> [i32; 2] {
+    let n = dec.icdf(&STEREO_PRED_JOINT, 8);
+    let mut ix = [[0usize; 3]; 2];
+    ix[0][2] = n / 5;
+    ix[1][2] = n - 5 * ix[0][2];
+    for v in ix.iter_mut() {
+        v[0] = dec.icdf(&UNIFORM3, 8);
+        v[1] = dec.icdf(&UNIFORM5, 8);
+    }
+    let mut pred = [0i32; 2];
+    for (p, v) in pred.iter_mut().zip(ix.iter_mut()) {
+        v[0] += 3 * v[2];
+        let low = STEREO_WEIGHTS_Q13[v[0]];
+        let step = smulwb(STEREO_WEIGHTS_Q13[v[0] + 1] - low, 6554);
+        *p = low + step * (2 * v[1] as i32 + 1);
+    }
+    pred[0] -= pred[1];
+    pred
+}
+
+fn stereo_ms_to_lr(st: &mut Stereo, x1: &mut [i16], x2: &mut [i16], pred_q13: [i32; 2], fs_khz: usize, len: usize) {
+    x1[..2].copy_from_slice(&st.s_mid);
+    x2[..2].copy_from_slice(&st.s_side);
+    st.s_mid.copy_from_slice(&x1[len..len + 2]);
+    st.s_side.copy_from_slice(&x2[len..len + 2]);
+    let mut p0 = st.pred_prev_q13[0];
+    let mut p1 = st.pred_prev_q13[1];
+    let denom_q16 = (1 << 16) / (8 * fs_khz as i32);
+    let d0 = rshift_round((pred_q13[0] - st.pred_prev_q13[0]) as i16 as i32 * denom_q16 as i16 as i32, 16);
+    let d1 = rshift_round((pred_q13[1] - st.pred_prev_q13[1]) as i16 as i32 * denom_q16 as i16 as i32, 16);
+    let interp = 8 * fs_khz;
+    for n in 0..len {
+        if n < interp {
+            p0 += d0;
+            p1 += d1;
+        } else if n == interp {
+            p0 = pred_q13[0];
+            p1 = pred_q13[1];
+        }
+        let sum = ((x1[n] as i32 + x1[n + 2] as i32) + ((x1[n + 1] as i32) << 1)) << 9;
+        let mut s = smlawb((x2[n + 1] as i32) << 8, sum, p0);
+        s = smlawb(s, (x1[n + 1] as i32) << 11, p1);
+        x2[n + 1] = sat16(rshift_round(s, 8)) as i16;
+    }
+    st.pred_prev_q13 = pred_q13;
+    for n in 0..len {
+        let a = x1[n + 1] as i32;
+        let b = x2[n + 1] as i32;
+        x1[n + 1] = sat16(a + b) as i16;
+        x2[n + 1] = sat16(a - b) as i16;
+    }
+}
+
+/// SILK decoder for up to two internal channels (`silk_decoder`).
+pub struct SilkDecoder {
+    api_rate: u32,
+    api_channels: usize,
+    ch: [Channel; 2],
+    stereo: Stereo,
+    channels_internal: usize,
+    channels_internal_prev: usize,
+    internal_rate: u32,
+    prev_decode_only_middle: bool,
+    ms_pred: [i32; 2],
+    decode_only_middle: bool,
+}
+
+impl SilkDecoder {
+    pub fn new(api_rate: u32, api_channels: usize) -> SilkDecoder {
+        SilkDecoder {
+            api_rate,
+            api_channels,
+            ch: [Channel::new(), Channel::new()],
+            stereo: Stereo::default(),
+            channels_internal: api_channels,
+            channels_internal_prev: 0,
+            internal_rate: 16000,
+            prev_decode_only_middle: false,
+            ms_pred: [0; 2],
+            decode_only_middle: false,
+        }
+    }
+
+    pub fn reset(&mut self) {
+        self.ch = [Channel::new(), Channel::new()];
+        self.stereo = Stereo::default();
+        self.prev_decode_only_middle = false;
+        self.channels_internal_prev = 0;
+    }
+
+    pub fn set_stream(&mut self, channels: usize, internal_rate: u32) {
+        self.channels_internal = channels;
+        self.internal_rate = internal_rate;
+    }
+
+    /// Decodes one SILK frame (10 or 20 ms) into interleaved `out` at the API rate.
+    pub fn decode(
+        &mut self,
+        mut dec: Option<&mut RangeDecoder>,
+        lost: LostFlag,
+        new_packet: bool,
+        payload_ms: usize,
+        out: &mut [f32],
+    ) -> Result<usize> {
+        let nci = self.channels_internal;
+        if new_packet {
+            for c in self.ch.iter_mut() {
+                c.n_frames_decoded = 0;
+            }
+        }
+        if nci > self.channels_internal_prev && self.channels_internal_prev != 0 {
+            self.ch[1] = Channel::new();
+        }
+        let stereo_to_mono = nci == 1 && self.channels_internal_prev == 2 && self.internal_rate == 1000 * self.ch[0].fs_khz as u32;
+        if self.ch[0].n_frames_decoded == 0 {
+            self.configure_channels(nci, payload_ms)?;
+        }
+        if self.api_channels == 2 && nci == 2 && self.channels_internal_prev == 1 {
+            self.stereo.pred_prev_q13 = [0; 2];
+            self.stereo.s_side = [0; 2];
+            self.ch[1].resampler = self.ch[0].resampler.clone();
+        }
+        self.channels_internal_prev = nci;
+
+        if lost != LostFlag::Lost && self.ch[0].n_frames_decoded == 0 {
+            let d = dec.as_deref_mut().ok_or(Error::InvalidPacket("missing SILK data"))?;
+            self.read_packet_flags(d, nci);
+            if lost == LostFlag::Normal {
+                self.skip_lbrr_data(d, nci);
+            }
+        }
+        if nci == 2 {
+            self.decode_stereo_prediction(dec.as_deref_mut(), lost);
+        }
+        if nci == 2 && !self.decode_only_middle && self.prev_decode_only_middle {
+            self.reset_side_channel();
+        }
+        let l = self.ch[0].frame_length;
+        let mut buf = [[0i16; MAX_FRAME + 2]; 2];
+        self.decode_channel_frames(dec, lost, nci, &mut buf);
+        if self.api_channels == 2 && nci == 2 {
+            let (a, b) = buf.split_at_mut(1);
+            stereo_ms_to_lr(&mut self.stereo, &mut a[0], &mut b[0], self.ms_pred, self.ch[0].fs_khz, l);
+        } else {
+            buf[0][..2].copy_from_slice(&self.stereo.s_mid);
+            self.stereo.s_mid.copy_from_slice(&buf[0][l..l + 2]);
+        }
+        let n_out = self.resample_to_output(&buf, nci, stereo_to_mono, out);
+        if lost == LostFlag::Lost {
+            for c in self.ch.iter_mut().take(nci) {
+                c.last_gain_index = 10;
+            }
+        } else {
+            self.prev_decode_only_middle = self.decode_only_middle;
+        }
+        Ok(n_out)
+    }
+
+    /// Applies the packet's frame layout and internal sampling rate to the first `nci` channels.
+    fn configure_channels(&mut self, nci: usize, payload_ms: usize) -> Result<()> {
+        let (nfpp, nb) = match payload_ms {
+            10 => (1, 2),
+            20 => (1, 4),
+            40 => (2, 4),
+            60 => (3, 4),
+            _ => return Err(Error::InvalidPacket("bad SILK frame size")),
+        };
+        let fs_khz = ((self.internal_rate >> 10) + 1) as usize;
+        for c in self.ch.iter_mut().take(nci) {
+            c.n_frames_per_packet = nfpp;
+            c.nb_subfr = nb;
+            c.set_fs(fs_khz, self.api_rate);
+        }
+        Ok(())
+    }
+
+    /// Reads the per-frame VAD flags and LBRR flags at the start of a packet.
+    fn read_packet_flags(&mut self, d: &mut RangeDecoder, nci: usize) {
+        for c in self.ch.iter_mut().take(nci) {
+            for i in 0..c.n_frames_per_packet {
+                c.vad_flags[i] = d.bit_logp(1);
+            }
+            c.lbrr_flag = d.bit_logp(1);
+        }
+        for c in self.ch.iter_mut().take(nci) {
+            c.lbrr_flags = [false; 3];
+            if !c.lbrr_flag {
+                continue;
+            }
+            if c.n_frames_per_packet == 1 {
+                c.lbrr_flags[0] = true;
+            } else {
+                let sym = d.icdf(LBRR_FLAGS[c.n_frames_per_packet - 2], 8) + 1;
+                for i in 0..c.n_frames_per_packet {
+                    c.lbrr_flags[i] = (sym >> i) & 1 != 0;
+                }
+            }
+        }
+    }
+
+    /// Consumes (without using) the in-band LBRR frames of a normally decoded packet.
+    fn skip_lbrr_data(&mut self, d: &mut RangeDecoder, nci: usize) {
+        for i in 0..self.ch[0].n_frames_per_packet {
+            for n in 0..nci {
+                if !self.ch[n].lbrr_flags[i] {
+                    continue;
+                }
+                if nci == 2 && n == 0 {
+                    stereo_decode_pred(d);
+                    if !self.ch[1].lbrr_flags[i] {
+                        d.icdf(&MID_ONLY, 8);
+                    }
+                }
+                let cond = if i > 0 && self.ch[n].lbrr_flags[i - 1] { Cond::Conditionally } else { Cond::Independently };
+                let c = &mut self.ch[n];
+                c.decode_indices(d, i, true, cond);
+                let mut pulses = [0i32; MAX_FRAME + 16];
+                decode_pulses(d, &mut pulses, c.indices.signal_type, c.indices.quant_offset_type, c.frame_length);
+            }
+        }
+    }
+
+    /// Reads the mid/side prediction weights, or reuses the previous ones when this frame carries none.
+    fn decode_stereo_prediction(&mut self, dec: Option<&mut RangeDecoder>, lost: LostFlag) {
+        let fi = self.ch[0].n_frames_decoded;
+        let coded = lost == LostFlag::Normal || (lost == LostFlag::Lbrr && self.ch[0].lbrr_flags[fi]);
+        match dec {
+            Some(d) if coded => {
+                self.ms_pred = stereo_decode_pred(d);
+                let side_inactive = (lost == LostFlag::Normal && !self.ch[1].vad_flags[fi]) || (lost == LostFlag::Lbrr && !self.ch[1].lbrr_flags[fi]);
+                self.decode_only_middle = side_inactive && d.icdf(&MID_ONLY, 8) == 1;
+            }
+            _ => self.ms_pred = self.stereo.pred_prev_q13,
+        }
+    }
+
+    /// Resets the side channel's decoder state when it resumes after a mid-only stretch.
+    fn reset_side_channel(&mut self) {
+        let c = &mut self.ch[1];
+        c.out_buf = [0; OUT_BUF];
+        c.s_lpc_q14 = [0; MAX_LPC_ORDER];
+        c.lag_prev = 100;
+        c.last_gain_index = 10;
+        c.prev_signal_type = 0;
+        c.first_frame_after_reset = true;
+    }
+
+    /// Frame-coding condition for channel `n` of the frame currently being decoded.
+    fn frame_condition(&self, n: usize, lost: LostFlag) -> Cond {
+        let frame_index = self.ch[0].n_frames_decoded as isize - n as isize;
+        if frame_index <= 0 {
+            Cond::Independently
+        } else if lost == LostFlag::Lbrr {
+            if self.ch[n].lbrr_flags[frame_index as usize - 1] { Cond::Conditionally } else { Cond::Independently }
+        } else if n > 0 && self.prev_decode_only_middle {
+            Cond::IndependentlyNoLtpScaling
+        } else {
+            Cond::Conditionally
+        }
+    }
+
+    /// Decodes the current frame of every active channel into `buf` (silence for an inactive side channel).
+    fn decode_channel_frames(&mut self, mut dec: Option<&mut RangeDecoder>, lost: LostFlag, nci: usize, buf: &mut [[i16; MAX_FRAME + 2]; 2]) {
+        let has_side = if lost == LostFlag::Normal {
+            !self.decode_only_middle
+        } else {
+            !self.prev_decode_only_middle || (nci == 2 && lost == LostFlag::Lbrr && self.ch[1].lbrr_flags[self.ch[1].n_frames_decoded])
+        };
+        let l = self.ch[0].frame_length;
+        for n in 0..nci {
+            if n == 0 || has_side {
+                let cond = self.frame_condition(n, lost);
+                self.ch[n].decode_frame(dec.as_deref_mut(), &mut buf[n][2..], lost, cond);
+            } else {
+                buf[n][2..2 + l].fill(0);
+            }
+            self.ch[n].n_frames_decoded += 1;
+        }
+    }
+
+    /// Resamples the decoded channels to the API rate into interleaved `out`; returns samples per channel.
+    fn resample_to_output(&mut self, buf: &[[i16; MAX_FRAME + 2]; 2], nci: usize, stereo_to_mono: bool, out: &mut [f32]) -> usize {
+        let l = self.ch[0].frame_length;
+        let n_out = l * self.api_rate as usize / (self.ch[0].fs_khz * 1000);
+        let ach = self.api_channels;
+        let mut tmp = Vec::with_capacity(n_out);
+        for n in 0..ach.min(nci) {
+            tmp.clear();
+            self.ch[n].resampler.process(&buf[n][1..1 + l], &mut tmp);
+            for (i, &v) in tmp.iter().enumerate().take(n_out) {
+                out[i * ach + n] = v / 32768.0;
+            }
+        }
+        if ach == 2 && nci == 1 {
+            if stereo_to_mono {
+                tmp.clear();
+                self.ch[1].resampler.process(&buf[0][1..1 + l], &mut tmp);
+                for (i, &v) in tmp.iter().enumerate().take(n_out) {
+                    out[i * 2 + 1] = v / 32768.0;
+                }
+            } else {
+                for i in 0..n_out {
+                    out[i * 2 + 1] = out[i * 2];
+                }
+            }
+        }
+        n_out
+    }
+}
@@ -0,0 +1,377 @@
+//! Fixed-point NLSF decoding, NLSF→LPC conversion and filter stabilisation
+//! (RFC 6716 §4.2.7.5, with the RFC 8251 §6/§7 overflow fixes).
+
+use super::tables::{
+    COS_Q12, LSF_ORDER_NBMB, LSF_ORDER_WB, NLSF_CB_NBMB, NLSF_CB_WB, NLSF_MIN_SPACING_NBMB, NLSF_MIN_SPACING_WB, NLSF_PRED_NBMB, NLSF_PRED_WB,
+    NLSF_PSEL_NBMB, NLSF_PSEL_WB,
+};
+
+pub const MAX_LPC_ORDER: usize = 16;
+
+#[inline]
+pub fn smulwb(a: i32, b: i32) -> i32 {
+    ((a as i64 * (b as i16) as i64) >> 16) as i32
+}
+#[inline]
+pub fn smlawb(a: i32, b: i32, c: i32) -> i32 {
+    a.wrapping_add(smulwb(b, c))
+}
+#[inline]
+pub fn smulww(a: i32, b: i32) -> i32 {
+    ((a as i64 * b as i64) >> 16) as i32
+}
+#[inline]
+pub fn smmul(a: i32, b: i32) -> i32 {
+    ((a as i64 * b as i64) >> 32) as i32
+}
+#[inline]
+pub fn rshift_round(a: i32, s: u32) -> i32 {
+    if s == 1 { (a >> 1) + (a & 1) } else { ((a >> (s - 1)) + 1) >> 1 }
+}
+#[inline]
+pub fn rshift_round64(a: i64, s: u32) -> i64 {
+    if s == 1 { (a >> 1) + (a & 1) } else { ((a >> (s - 1)) + 1) >> 1 }
+}
+#[inline]
+pub fn sat16(a: i32) -> i32 {
+    a.clamp(-32768, 32767)
+}
+
+/// `silk_INVERSE32_varQ`: approximation of `(1 << q_res) / b32`.
+pub fn inverse32_varq(b32: i32, q_res: i32) -> i32 {
+    let b_headrm = b32.unsigned_abs().leading_zeros() as i32 - 1;
+    let b32_nrm = b32.wrapping_shl(b_headrm as u32);
+    let b32_inv = (i32::MAX >> 2) / (b32_nrm >> 16);
+    let mut result = b32_inv << 16;
+    let err_q32 = ((1i32 << 29).wrapping_sub(smulwb(b32_nrm, b32_inv))).wrapping_shl(3);
+    result = result.wrapping_add(((err_q32 as i64 * b32_inv as i64) >> 16) as i32);
+    let lshift = 61 - b_headrm - q_res;
+    if lshift <= 0 {
+        let s = (-lshift) as u32;
+        let lim_hi = i32::MAX >> s;
+        let lim_lo = i32::MIN >> s;
+        result.clamp(lim_lo, lim_hi) << s
+    } else if lshift < 32 {
+        result >> lshift
+    } else {
+        0
+    }
+}
+
+/// `silk_DIV32_varQ`: approximation of `(a32 << q_res) / b32`.
+pub fn div32_varq(a32: i32, b32: i32, q_res: i32) -> i32 {
+    let a_headrm = a32.unsigned_abs().leading_zeros() as i32 - 1;
+    let a32_nrm = a32.wrapping_shl(a_headrm as u32);
+    let b_headrm = b32.unsigned_abs().leading_zeros() as i32 - 1;
+    let b32_nrm = b32.wrapping_shl(b_headrm as u32);
+    let b32_inv = (i32::MAX >> 2) / (b32_nrm >> 16);
+    let mut result = smulwb(a32_nrm, b32_inv);
+    let a32_nrm = a32_nrm.wrapping_sub(((smmul(b32_nrm, result) as i64) << 3) as i32);
+    result = smlawb(result, a32_nrm, b32_inv);
+    let lshift = 29 + a_headrm - b_headrm - q_res;
+    if lshift < 0 {
+        let s = (-lshift) as u32;
+        let lim_hi = i32::MAX >> s;
+        let lim_lo = i32::MIN >> s;
+        result.clamp(lim_lo, lim_hi) << s
+    } else if lshift < 32 {
+        result >> lshift
+    } else {
+        0
+    }
+}
+
+fn sqrt_approx(x: i32) -> i32 {
+    if x <= 0 {
+        return 0;
+    }
+    let lz = x.leading_zeros() as i32;
+    let frac = (x.rotate_right((24 - lz).rem_euclid(32) as u32)) & 0x7f;
+    let mut y = if lz & 1 != 0 { 32768 } else { 46214 };
+    y >>= lz >> 1;
+    smlawb(y, y, 213 * frac)
+}
+
+/// Decodes the stage-1/stage-2 indices into stabilised NLSFs (Q15).
+pub fn nlsf_decode(indices: &[i32], wb: bool) -> [i32; MAX_LPC_ORDER] {
+    let order = if wb { 16 } else { 10 };
+    let i1 = indices[0] as usize;
+    let cb1: &[i32] = if wb { &NLSF_CB_WB[i1] } else { &NLSF_CB_NBMB[i1] };
+    let qstep = if wb { 9830 } else { 11796 };
+    // Residual dequantisation with backwards prediction.
+    let mut res_q10 = [0i32; MAX_LPC_ORDER];
+    let mut out_q10 = 0i32;
+    for i in (0..order).rev() {
+        let pred = if i + 1 < order {
+            let sel = if wb { NLSF_PSEL_WB[i1][i] } else { NLSF_PSEL_NBMB[i1][i] } as usize;
+            let w = if wb { NLSF_PRED_WB[sel][i] } else { NLSF_PRED_NBMB[sel][i] };
+            (out_q10 * w) >> 8
+        } else {
+            0
+        };
+        let mut v = indices[i + 1] << 10;
+        if v > 0 {
+            v -= 102;
+        } else if v < 0 {
+            v += 102;
+        }
+        out_q10 = smlawb(pred, v, qstep);
+        res_q10[i] = out_q10;
+    }
+    // Laroia weights.
+    let mut nlsf = [0i32; MAX_LPC_ORDER];
+    for k in 0..order {
+        let prev = if k == 0 { 0 } else { cb1[k - 1] };
+        let next = if k + 1 == order { 256 } else { cb1[k + 1] };
+        let w = (1024 / (cb1[k] - prev).max(1) + 1024 / (next - cb1[k]).max(1)).min(32767);
+        let w_q9 = sqrt_approx(w << 16);
+        let v = (cb1[k] << 7) + (res_q10[k] << 14) / w_q9.max(1);
+        nlsf[k] = v.clamp(0, 32767);
+    }
+    let dmin: &[i32] = if wb { &NLSF_MIN_SPACING_WB } else { &NLSF_MIN_SPACING_NBMB };
+    nlsf_stabilize(&mut nlsf[..order], dmin);
+    nlsf
+}
+
+pub fn nlsf_stabilize(nlsf: &mut [i32], dmin: &[i32]) {
+    let l = nlsf.len();
+    for _ in 0..20 {
+        let mut min_diff = nlsf[0] - dmin[0];
+        let mut idx = 0;
+        for i in 1..l {
+            let d = nlsf[i] - (nlsf[i - 1] + dmin[i]);
+            if d < min_diff {
+                min_diff = d;
+                idx = i;
+            }
+        }
+        let d = 32768 - (nlsf[l - 1] + dmin[l]);
+        if d < min_diff {
+            min_diff = d;
+            idx = l;
+        }
+        if min_diff >= 0 {
+            return;
+        }
+        if idx == 0 {
+            nlsf[0] = dmin[0];
+        } else if idx == l {
+            nlsf[l - 1] = 32768 - dmin[l];
+        } else {
+            let mut min_center = dmin[..idx].iter().sum::<i32>();
+            min_center += dmin[idx] >> 1;
+            let mut max_center = 32768 - dmin[idx + 1..=l].iter().sum::<i32>();
+            max_center -= dmin[idx] >> 1;
+            let c = rshift_round(nlsf[idx - 1] + nlsf[idx], 1);
+            let c = if min_center > max_center { c.clamp(max_center, min_center) } else { c.clamp(min_center, max_center) };
+            nlsf[idx - 1] = c - (dmin[idx] >> 1);
+            nlsf[idx] = nlsf[idx - 1] + dmin[idx];
+        }
+    }
+    // Fallback.
+    nlsf.sort_unstable();
+    nlsf[0] = nlsf[0].max(dmin[0]);
+    for i in 1..l {
+        nlsf[i] = nlsf[i].max(sat16(nlsf[i - 1] + dmin[i]));
+    }
+    nlsf[l - 1] = nlsf[l - 1].min(32768 - dmin[l]);
+    for i in (0..l - 1).rev() {
+        nlsf[i] = nlsf[i].min(nlsf[i + 1] - dmin[i + 1]);
+    }
+}
+
+fn bwexpander_32(ar: &mut [i32], mut chirp_q16: i32) {
+    let d = ar.len();
+    let chirp_minus_one = chirp_q16 - 65536;
+    for v in ar.iter_mut().take(d - 1) {
+        *v = smulww(chirp_q16, *v);
+        chirp_q16 += rshift_round(chirp_q16.wrapping_mul(chirp_minus_one), 16);
+    }
+    ar[d - 1] = smulww(chirp_q16, ar[d - 1]);
+}
+
+/// `silk_bwexpander` on Q12 coefficients (16-bit).
+pub fn bwexpander(ar: &mut [i32], mut chirp_q16: i32) {
+    let d = ar.len();
+    let chirp_minus_one = chirp_q16 - 65536;
+    for v in ar.iter_mut().take(d - 1) {
+        *v = rshift_round(chirp_q16.wrapping_mul(*v), 16);
+        chirp_q16 += rshift_round(chirp_q16.wrapping_mul(chirp_minus_one), 16);
+    }
+    ar[d - 1] = rshift_round(chirp_q16.wrapping_mul(ar[d - 1]), 16);
+}
+
+fn lpc_inverse_pred_gain(a_q12: &[i32]) -> i32 {
+    const QA: u32 = 24;
+    const A_LIMIT: i32 = 16_773_022;
+    let order = a_q12.len();
+    let mut a = [0i32; MAX_LPC_ORDER];
+    let mut dc = 0;
+    for k in 0..order {
+        dc += a_q12[k];
+        a[k] = a_q12[k] << (QA - 12);
+    }
+    if dc >= 4096 {
+        return 0;
+    }
+    let mut inv_gain: i32 = 1 << 30;
+    let mul32_frac_q31 = |x: i32, y: i32| rshift_round64(x as i64 * y as i64, 31) as i32;
+    for k in (1..order).rev() {
+        if a[k] > A_LIMIT || a[k] < -A_LIMIT {
+            return 0;
+        }
+        let rc_q31 = -(a[k] << (31 - QA));
+        let rc_mult1 = (1i32 << 30) - smmul(rc_q31, rc_q31);
+        inv_gain = smmul(inv_gain, rc_mult1) << 2;
+        if inv_gain < 107_374 {
+            return 0;
+        }
+        let mult2q = 32 - rc_mult1.unsigned_abs().leading_zeros() as i32;
+        let rc_mult2 = inverse32_varq(rc_mult1, mult2q + 30);
+        for n in 0..(k + 1) >> 1 {
+            let t1 = a[n];
+            let t2 = a[k - n - 1];
+            let v1 = rshift_round64(t1.saturating_sub(mul32_frac_q31(t2, rc_q31)) as i64 * rc_mult2 as i64, mult2q as u32);
+            if v1 > i32::MAX as i64 || v1 < i32::MIN as i64 {
+                return 0;
+            }
+            let v2 = rshift_round64(t2.saturating_sub(mul32_frac_q31(t1, rc_q31)) as i64 * rc_mult2 as i64, mult2q as u32);
+            if v2 > i32::MAX as i64 || v2 < i32::MIN as i64 {
+                return 0;
+            }
+            a[n] = v1 as i32;
+            a[k - n - 1] = v2 as i32;
+        }
+    }
+    if a[0] > A_LIMIT || a[0] < -A_LIMIT {
+        return 0;
+    }
+    let rc_q31 = -(a[0] << (31 - QA));
+    let rc_mult1 = (1i32 << 30) - smmul(rc_q31, rc_q31);
+    inv_gain = smmul(inv_gain, rc_mult1) << 2;
+    if inv_gain < 107_374 {
+        return 0;
+    }
+    inv_gain
+}
+
+/// Converts NLSFs (Q15) to stable Q12 LPC coefficients (`silk_NLSF2A`).
+pub fn nlsf2a(nlsf: &[i32]) -> [i32; MAX_LPC_ORDER] {
+    let d = nlsf.len();
+    let ordering: &[usize] = if d == 16 { &LSF_ORDER_WB } else { &LSF_ORDER_NBMB };
+    let mut c_q17 = [0i32; MAX_LPC_ORDER];
+    for k in 0..d {
+        let i = (nlsf[k] >> 8) as usize;
+        let f = nlsf[k] & 255;
+        let c0 = COS_Q12[i];
+        let c1 = COS_Q12[(i + 1).min(128)];
+        c_q17[ordering[k]] = (c0 * 256 + (c1 - c0) * f + 4) >> 3;
+    }
+    let d2 = d / 2;
+    let find_poly = |off: usize| -> [i64; 10] {
+        let mut out = [0i64; 10];
+        out[0] = 1 << 16;
+        out[1] = -(c_q17[off] as i64);
+        for k in 1..d2 {
+            let ftmp = c_q17[2 * k + off] as i64;
+            out[k + 1] = 2 * out[k - 1] - ((ftmp * out[k] + 32768) >> 16);
+            for n in (2..=k).rev() {
+                out[n] += out[n - 2] - ((ftmp * out[n - 1] + 32768) >> 16);
+            }
+            out[1] -= ftmp;
+        }
+        out
+    };
+    let p = find_poly(0);
+    let q = find_poly(1);
+    let mut a32 = [0i32; MAX_LPC_ORDER];
+    for k in 0..d2 {
+        let ptmp = p[k + 1] + p[k];
+        let qtmp = q[k + 1] - q[k];
+        a32[k] = (-qtmp - ptmp) as i32;
+        a32[d - k - 1] = (qtmp - ptmp) as i32;
+    }
+    let a32 = &mut a32[..d];
+    // Limit the dynamic range (silk_LPC_fit with QIN = 17, QOUT = 12).
+    let mut a_q12 = [0i32; MAX_LPC_ORDER];
+    let mut i = 0;
+    while i < 10 {
+        let mut maxabs = 0i32;
+        let mut idx = 0;
+        for (k, &v) in a32.iter().enumerate() {
+            let av = v.saturating_abs();
+            if av > maxabs {
+                maxabs = av;
+                idx = k;
+            }
+        }
+        let maxabs = rshift_round(maxabs, 5);
+        if maxabs > 32767 {
+            let maxabs = maxabs.min(163_838);
+            let chirp = 65470 - ((maxabs - 32767) << 14) / ((maxabs * (idx as i32 + 1)) >> 2);
+            bwexpander_32(a32, chirp);
+        } else {
+            break;
+        }
+        i += 1;
+    }
+    if i == 10 {
+        for k in 0..d {
+            a_q12[k] = sat16(rshift_round(a32[k], 5));
+            a32[k] = a_q12[k] << 5;
+        }
+    } else {
+        for k in 0..d {
+            a_q12[k] = rshift_round(a32[k], 5);
+        }
+    }
+    for i in 0..16 {
+        if lpc_inverse_pred_gain(&a_q12[..d]) == 0 {
+            bwexpander_32(a32, 65536 - (2 << i));
+            for k in 0..d {
+                a_q12[k] = rshift_round(a32[k], 5);
+            }
+        } else {
+            break;
+        }
+    }
+    a_q12
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn flat_nlsf_gives_small_lpc() {
+        // Uniformly spaced NLSFs correspond to an (almost) flat spectrum.
+        let nlsf: Vec<i32> = (1..=16).map(|k| k * 32768 / 17).collect();
+        let a = nlsf2a(&nlsf);
+        assert!(a.iter().all(|v| v.abs() < 600), "{a:?}");
+        let nlsf: Vec<i32> = (1..=10).map(|k| k * 32768 / 11).collect();
+        let a = nlsf2a(&nlsf);
+        assert!(a[..10].iter().all(|v| v.abs() < 600), "{a:?}");
+    }
+
+    #[test]
+    fn stabilize_enforces_spacing() {
+        let mut v = [100, 90, 80, 30000, 30001, 30002, 31000, 32000, 32700, 32760];
+        nlsf_stabilize(&mut v, &NLSF_MIN_SPACING_NBMB);
+        assert!(v[0] >= NLSF_MIN_SPACING_NBMB[0]);
+        for i in 1..10 {
+            assert!(v[i] - v[i - 1] >= NLSF_MIN_SPACING_NBMB[i], "{v:?}");
+        }
+        assert!(32768 - v[9] >= NLSF_MIN_SPACING_NBMB[10]);
+    }
+
+    #[test]
+    fn inverse_approximations() {
+        for &b in &[65536, 100_000, 1 << 20, 81920, 1_686_110_208] {
+            let inv = inverse32_varq(b, 47) as f64;
+            let exact = 2f64.powi(47) / b as f64;
+            assert!((inv - exact).abs() / exact < 1e-3, "{b}");
+        }
+        let q = div32_varq(65536, 131072, 16) as f64;
+        assert!((q - 32768.0).abs() < 2.0);
+    }
+}
@@ -0,0 +1,205 @@
+//! SILK output resampler (RFC 6716 §4.2.9: non-normative filter, normative delay budget).
+//!
+//! A windowed-sinc polyphase interpolator whose group delay matches the delay allocation of
+//! RFC 6716 Table 54 (and the integer delays used when no rate conversion is needed), so that the
+//! SILK output lines up with the CELT layer in Hybrid mode.
+
+#[derive(Clone)]
+pub struct Resampler {
+    fin: u32,
+    fout: u32,
+    /// Pure-delay mode (equal rates): delay line.
+    copy_delay: usize,
+    /// Polyphase taps per output phase.
+    phases: Vec<(i64, Vec<f32>)>,
+    period: u64,
+    /// Total delay in units of 1/fout input samples.
+    delay_q: i64,
+    half: i64,
+    future: i64,
+    hist: Vec<f32>,
+    /// Absolute input index of `hist[0]`.
+    hist_start: i64,
+    n_in: i64,
+    n_out: u64,
+}
+
+fn gcd(a: u32, b: u32) -> u32 {
+    if b == 0 { a } else { gcd(b, a % b) }
+}
+
+/// Least-squares fractional-delay interpolator: taps at offsets `-past+1 ..= future` (in input
+/// samples) approximating a delay of `frac` samples over `[0, wp]`, with zero response weighted
+/// over `[ws, pi]` when `ws < pi` (decimation).
+fn design_fractional(past: i64, future: i64, frac: f64, wp: f64, ws: f64) -> Vec<f64> {
+    let offs: Vec<f64> = ((-past + 1)..=future).map(|m| m as f64).collect();
+    let n = offs.len();
+    // \int_a^b cos(w x) dw
+    let ic = |x: f64, a: f64, b: f64| if x.abs() < 1e-12 { b - a } else { ((b * x).sin() - (a * x).sin()) / x };
+    let stop_w = 30.0;
+    const LOW_W: f64 = 0.05;
+    let mut q = vec![vec![0f64; n + 1]; n];
+    for i in 0..n {
+        for k in 0..n {
+            let d = offs[i] - offs[k];
+            let mut v = ic(d, 0.0, 0.6 * wp) + LOW_W * ic(d, 0.6 * wp, wp);
+            if ws < std::f64::consts::PI {
+                v += stop_w * ic(d, ws, std::f64::consts::PI);
+            }
+            q[i][k] = v + if i == k { 1e-9 } else { 0.0 };
+        }
+        q[i][n] = ic(offs[i] - frac, 0.0, 0.6 * wp) + LOW_W * ic(offs[i] - frac, 0.6 * wp, wp);
+    }
+    // Gaussian elimination with partial pivoting.
+    for c in 0..n {
+        let p = (c..n).max_by(|&a, &b| q[a][c].abs().total_cmp(&q[b][c].abs())).unwrap_or(c);
+        q.swap(c, p);
+        let piv = q[c][c];
+        for r in 0..n {
+            if r != c {
+                let f = q[r][c] / piv;
+                if f != 0.0 {
+                    for k in c..=n {
+                        q[r][k] -= f * q[c][k];
+                    }
+                }
+            }
+        }
+    }
+    (0..n).map(|i| q[i][n] / q[i][i]).collect()
+}
+
+impl Resampler {
+    pub fn new(fin: u32, fout: u32) -> Resampler {
+        let mut r = Resampler {
+            fin,
+            fout,
+            copy_delay: 0,
+            phases: Vec::new(),
+            period: 1,
+            delay_q: 0,
+            half: 0,
+            future: 0,
+            hist: Vec::new(),
+            hist_start: 0,
+            n_in: 0,
+            n_out: 0,
+        };
+        if fin == fout {
+            r.copy_delay = match fin {
+                8000 => 4,
+                12000 => 9,
+                _ => 12,
+            };
+            r.hist = vec![0.0; r.copy_delay];
+            return r;
+        }
+        // Delay in milliseconds per internal bandwidth (RFC 6716 Table 54).
+        let delay_ms = match fin {
+            8000 => 0.538,
+            12000 => 0.692,
+            _ => 0.706,
+        };
+        let d_in = delay_ms * fin as f64 / 1000.0; // input samples
+        // Future taps are limited by the delay budget; past taps are free.
+        let future = (d_in.floor() as i64).max(1);
+        let past = 24i64;
+        r.half = past;
+        r.future = future;
+        r.delay_q = (d_in * fout as f64).round() as i64;
+        let g = gcd(fin, fout);
+        r.period = (fout / g) as u64;
+        let pi = std::f64::consts::PI;
+        // Passband edge and (for decimation) stopband edge in radians per input sample.
+        let (wp, ws) = if fout > fin { (0.94 * pi, pi) } else { (0.88 * pi * fout as f64 / fin as f64, pi * fout as f64 / fin as f64) };
+        for j in 0..r.period as i64 {
+            let num = j * fin as i64 - r.delay_q;
+            let base = num.div_euclid(fout as i64);
+            let frac = num.rem_euclid(fout as i64) as f64 / fout as f64;
+            let taps = design_fractional(past, future, frac, wp, ws);
+            r.phases.push((base, taps.iter().map(|&t| t as f32).collect()));
+        }
+        r.hist = vec![0.0; (past + future + 4) as usize];
+        r.hist_start = -(past + future + 4);
+        r
+    }
+
+    pub fn rates(&self) -> (u32, u32) {
+        (self.fin, self.fout)
+    }
+
+    /// Resamples `input` (16-bit scale) and appends the output samples.
+    pub fn process(&mut self, input: &[i16], out: &mut Vec<f32>) {
+        if self.fin == self.fout {
+            for &v in input {
+                self.hist.push(v as f32);
+            }
+            let n = self.hist.len() - self.copy_delay;
+            out.extend_from_slice(&self.hist[..n]);
+            self.hist.drain(..n);
+            return;
+        }
+        self.hist.extend(input.iter().map(|&v| v as f32));
+        self.n_in += input.len() as i64;
+        let total_out = (self.n_in as u64 * self.fout as u64) / self.fin as u64;
+        while self.n_out < total_out {
+            let j = self.n_out;
+            let cycle = (j / self.period) as i64;
+            let (base0, ref taps) = self.phases[(j % self.period) as usize];
+            let base = base0 + cycle * self.fin as i64 * self.period as i64 / self.fout as i64;
+            let first = base - self.half + 1;
+            let mut acc = 0f32;
+            for (m, &t) in taps.iter().enumerate() {
+                let idx = first + m as i64 - self.hist_start;
+                if idx >= 0 && (idx as usize) < self.hist.len() {
+                    acc += self.hist[idx as usize] * t;
+                }
+            }
+            out.push(acc);
+            self.n_out += 1;
+        }
+        // Trim history, keeping enough for the next taps.
+        let keep_from = self.n_in - (self.half + self.future + 4);
+        if keep_from > self.hist_start {
+            let drop = (keep_from - self.hist_start) as usize;
+            self.hist.drain(..drop.min(self.hist.len()));
+            self.hist_start = keep_from;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn upsample_sine_and_delay() {
+        for &(fin, fout) in &[(16000u32, 48000u32), (8000, 48000), (12000, 48000), (16000, 24000), (16000, 8000), (12000, 16000)] {
+            let mut r = Resampler::new(fin, fout);
+            let f = 440.0;
+            let n = fin as usize / 10;
+            let x: Vec<i16> = (0..n).map(|i| ((2.0 * std::f64::consts::PI * f * i as f64 / fin as f64).sin() * 10000.0) as i16).collect();
+            let mut y = Vec::new();
+            for c in x.chunks(fin as usize / 50) {
+                r.process(c, &mut y);
+            }
+            assert_eq!(y.len(), n * fout as usize / fin as usize);
+            // Compare against the ideal delayed sine.
+            let delay_ms = match fin {
+                8000 => 0.538,
+                12000 => 0.692,
+                _ => 0.706,
+            };
+            let mut err = 0f64;
+            let mut sig = 0f64;
+            for (j, &v) in y.iter().enumerate().skip(fout as usize / 100) {
+                let t = j as f64 / fout as f64 - delay_ms / 1000.0;
+                let ideal = (2.0 * std::f64::consts::PI * f * t).sin() * 10000.0;
+                err += (v as f64 - ideal).powi(2);
+                sig += ideal * ideal;
+            }
+            let snr = 10.0 * (sig / err).log10();
+            assert!(snr > 35.0, "{fin}->{fout}: {snr} dB");
+        }
+    }
+}
@@ -0,0 +1,540 @@
+//! SILK probability tables and codebooks, transcribed from RFC 6716 §4.2 (Tables 4–53).
+//!
+//! PDFs are written as in the RFC (`{...}/256`) and converted at compile time to the inverse-CDF
+//! form consumed by the range decoder.
+
+/// Converts a PDF (summing to 256) into an inverse CDF (`256 - cdf[i+1]`).
+pub const fn icdf<const N: usize>(pdf: &[u8; N]) -> [u8; N] {
+    let mut out = [0u8; N];
+    let mut acc: u32 = 0;
+    let mut i = 0;
+    while i < N {
+        acc += pdf[i] as u32;
+        out[i] = (256 - acc) as u8;
+        i += 1;
+    }
+    out
+}
+
+pub const STEREO_PRED_JOINT: [u8; 25] = icdf(&[7, 2, 1, 1, 1, 10, 24, 8, 1, 1, 3, 23, 92, 23, 3, 1, 1, 8, 24, 10, 1, 1, 1, 2, 7]);
+pub const UNIFORM3: [u8; 3] = icdf(&[85, 86, 85]);
+pub const UNIFORM5: [u8; 5] = icdf(&[51, 51, 52, 51, 51]);
+pub const STEREO_WEIGHTS_Q13: [i32; 16] = [-13732, -10050, -8266, -7526, -6500, -5000, -2950, -820, 820, 2950, 5000, 6500, 7526, 8266, 10050, 13732];
+pub const MID_ONLY: [u8; 2] = icdf(&[192, 64]);
+pub const TYPE_INACTIVE: [u8; 2] = icdf(&[26, 230]);
+pub const TYPE_ACTIVE: [u8; 4] = icdf(&[24, 74, 148, 10]);
+pub const GAIN_MSB: [&[u8]; 3] =
+    [&icdf::<8>(&[32, 112, 68, 29, 12, 1, 1, 1]), &icdf::<8>(&[2, 17, 45, 60, 62, 47, 19, 4]), &icdf::<8>(&[1, 3, 26, 71, 94, 50, 9, 2])];
+pub const UNIFORM8: [u8; 8] = icdf(&[32, 32, 32, 32, 32, 32, 32, 32]);
+pub const DELTA_GAIN: [u8; 41] =
+    icdf(&[6, 5, 11, 31, 132, 21, 8, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]);
+pub const NLSF_STAGE1: [&[u8]; 4] = [
+    &icdf::<32>(&[44, 34, 30, 19, 21, 12, 11, 3, 3, 2, 16, 2, 2, 1, 5, 2, 1, 3, 3, 1, 1, 2, 2, 2, 3, 1, 9, 9, 2, 7, 2, 1]),
+    &icdf::<32>(&[1, 10, 1, 8, 3, 8, 8, 14, 13, 14, 1, 14, 12, 13, 11, 11, 12, 11, 10, 10, 11, 8, 9, 8, 7, 8, 1, 1, 6, 1, 6, 5]),
+    &icdf::<32>(&[31, 21, 3, 17, 1, 8, 17, 4, 1, 18, 16, 4, 2, 3, 1, 10, 1, 3, 16, 11, 16, 2, 2, 3, 2, 11, 1, 4, 9, 8, 7, 3]),
+    &icdf::<32>(&[1, 4, 16, 5, 18, 11, 5, 14, 15, 1, 3, 12, 13, 14, 14, 6, 14, 12, 2, 6, 1, 12, 12, 11, 10, 3, 10, 5, 1, 1, 1, 3]),
+];
+pub const NLSF_STAGE2: [&[u8]; 16] = [
+    &icdf::<9>(&[1, 1, 1, 15, 224, 11, 1, 1, 1]),
+    &icdf::<9>(&[1, 1, 2, 34, 183, 32, 1, 1, 1]),
+    &icdf::<9>(&[1, 1, 4, 42, 149, 55, 2, 1, 1]),
+    &icdf::<9>(&[1, 1, 8, 52, 123, 61, 8, 1, 1]),
+    &icdf::<9>(&[1, 3, 16, 53, 101, 74, 6, 1, 1]),
+    &icdf::<9>(&[1, 3, 17, 55, 90, 73, 15, 1, 1]),
+    &icdf::<9>(&[1, 7, 24, 53, 74, 67, 26, 3, 1]),
+    &icdf::<9>(&[1, 1, 18, 63, 78, 58, 30, 6, 1]),
+    &icdf::<9>(&[1, 1, 1, 9, 232, 9, 1, 1, 1]),
+    &icdf::<9>(&[1, 1, 2, 28, 186, 35, 1, 1, 1]),
+    &icdf::<9>(&[1, 1, 3, 42, 152, 53, 2, 1, 1]),
+    &icdf::<9>(&[1, 1, 10, 49, 126, 65, 2, 1, 1]),
+    &icdf::<9>(&[1, 4, 19, 48, 100, 77, 5, 1, 1]),
+    &icdf::<9>(&[1, 1, 14, 54, 100, 72, 12, 1, 1]),
+    &icdf::<9>(&[1, 1, 15, 61, 87, 61, 25, 4, 1]),
+    &icdf::<9>(&[1, 7, 21, 50, 77, 81, 17, 1, 1]),
+];
+pub const NLSF_SEL_NBMB: [[u8; 10]; 32] = [
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [1, 3, 1, 2, 2, 1, 2, 1, 1, 1],
+    [2, 1, 1, 1, 1, 1, 1, 1, 1, 1],
+    [1, 2, 2, 2, 2, 1, 2, 1, 1, 1],
+    [2, 3, 3, 3, 3, 2, 2, 2, 2, 2],
+    [0, 5, 3, 3, 2, 2, 2, 2, 1, 1],
+    [0, 2, 2, 2, 2, 2, 2, 2, 2, 1],
+    [2, 3, 6, 4, 4, 4, 5, 4, 5, 5],
+    [2, 4, 5, 5, 4, 5, 4, 6, 4, 4],
+    [2, 4, 4, 7, 4, 5, 4, 5, 5, 4],
+    [4, 3, 3, 3, 2, 3, 2, 2, 2, 2],
+    [1, 5, 5, 6, 4, 5, 4, 5, 5, 5],
+    [2, 7, 4, 6, 5, 5, 5, 5, 5, 5],
+    [2, 7, 5, 5, 5, 5, 5, 6, 5, 4],
+    [3, 3, 5, 4, 4, 5, 4, 5, 4, 4],
+    [2, 3, 3, 5, 5, 4, 4, 4, 4, 4],
+    [2, 4, 4, 6, 4, 5, 4, 5, 5, 5],
+    [2, 5, 4, 6, 5, 5, 5, 4, 5, 4],
+    [2, 7, 4, 5, 4, 5, 4, 5, 5, 5],
+    [2, 5, 4, 6, 7, 6, 5, 6, 5, 4],
+    [3, 6, 7, 4, 6, 5, 5, 6, 4, 5],
+    [2, 7, 6, 4, 4, 4, 5, 4, 5, 5],
+    [4, 5, 5, 4, 6, 6, 5, 6, 5, 4],
+    [2, 5, 5, 6, 5, 6, 4, 6, 4, 4],
+    [4, 5, 5, 5, 3, 7, 4, 5, 5, 4],
+    [2, 3, 4, 5, 5, 6, 4, 5, 5, 4],
+    [2, 3, 2, 3, 3, 4, 2, 3, 3, 3],
+    [1, 1, 2, 2, 2, 2, 2, 3, 2, 2],
+    [4, 5, 5, 6, 6, 6, 5, 6, 4, 5],
+    [3, 5, 5, 4, 4, 4, 4, 3, 3, 2],
+    [2, 5, 3, 7, 5, 5, 4, 4, 5, 4],
+    [4, 4, 5, 4, 5, 6, 5, 6, 5, 4],
+];
+pub const NLSF_SEL_WB: [[u8; 16]; 32] = [
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [2, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 0, 3],
+    [2, 5, 5, 3, 7, 4, 4, 5, 2, 5, 4, 5, 5, 4, 3, 3],
+    [0, 2, 1, 2, 2, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1],
+    [0, 6, 5, 4, 6, 4, 7, 5, 4, 4, 4, 5, 5, 4, 4, 3],
+    [0, 3, 5, 5, 4, 3, 3, 5, 3, 3, 3, 3, 3, 3, 2, 4],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 2, 6, 3, 7, 2, 5, 3, 4, 5, 5, 4, 3, 3, 2, 3],
+    [0, 6, 2, 6, 6, 4, 5, 4, 6, 5, 4, 4, 5, 3, 3, 3],
+    [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [2, 2, 3, 4, 5, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 3],
+    [2, 2, 3, 3, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 1, 3],
+    [3, 4, 4, 4, 6, 4, 4, 5, 3, 5, 4, 4, 5, 4, 3, 4],
+    [0, 6, 4, 5, 4, 7, 5, 2, 6, 5, 7, 4, 4, 3, 5, 3],
+    [0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0],
+    [1, 6, 5, 7, 5, 4, 5, 3, 4, 5, 4, 4, 4, 3, 3, 4],
+    [1, 3, 3, 4, 4, 3, 3, 5, 2, 3, 3, 5, 5, 5, 3, 4],
+    [2, 3, 3, 2, 2, 2, 3, 2, 1, 2, 1, 2, 1, 1, 1, 4],
+    [0, 2, 3, 5, 3, 3, 2, 2, 2, 1, 1, 0, 0, 0, 0, 0],
+    [3, 4, 3, 5, 3, 3, 2, 2, 1, 1, 1, 1, 1, 2, 2, 4],
+    [2, 6, 3, 7, 7, 4, 5, 4, 5, 3, 5, 3, 3, 2, 3, 3],
+    [2, 3, 5, 6, 6, 3, 5, 3, 4, 4, 3, 3, 3, 3, 2, 4],
+    [1, 3, 3, 4, 4, 4, 4, 3, 5, 5, 5, 3, 1, 1, 1, 1],
+    [2, 5, 3, 6, 6, 4, 7, 4, 4, 5, 3, 4, 4, 3, 3, 3],
+    [0, 6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 6, 6, 3, 5, 2, 5, 5, 3, 4, 4, 7, 7, 4, 4, 4],
+    [3, 3, 7, 3, 5, 4, 3, 3, 3, 2, 2, 3, 3, 3, 2, 3],
+    [0, 0, 1, 0, 0, 0, 2, 1, 2, 1, 1, 2, 2, 2, 1, 1],
+    [0, 3, 2, 5, 3, 3, 2, 3, 2, 1, 0, 0, 1, 0, 0, 1],
+    [3, 5, 5, 4, 7, 5, 3, 3, 2, 3, 2, 2, 1, 0, 1, 0],
+    [2, 3, 5, 3, 4, 3, 3, 3, 2, 1, 2, 6, 4, 0, 0, 0],
+];
+pub const NLSF_EXT: [u8; 7] = icdf(&[156, 60, 24, 9, 4, 2, 1]);
+pub const NLSF_PRED_NBMB: [[i32; 9]; 2] = [[179, 138, 140, 148, 151, 149, 153, 151, 163], [116, 67, 82, 59, 92, 72, 100, 89, 92]];
+pub const NLSF_PRED_WB: [[i32; 15]; 2] = [
+    [175, 148, 160, 176, 178, 173, 174, 164, 177, 174, 196, 182, 198, 192, 182],
+    [68, 62, 66, 60, 72, 117, 85, 90, 118, 136, 151, 142, 160, 142, 155],
+];
+pub const NLSF_PSEL_NBMB: [[u8; 9]; 32] = [
+    [0, 1, 0, 0, 0, 0, 0, 0, 0],
+    [1, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [1, 1, 1, 0, 0, 0, 0, 1, 0],
+    [0, 1, 0, 0, 0, 0, 0, 0, 0],
+    [0, 1, 0, 0, 0, 0, 0, 0, 0],
+    [1, 0, 1, 1, 0, 0, 0, 1, 0],
+    [0, 1, 1, 0, 0, 1, 1, 0, 0],
+    [0, 0, 1, 1, 0, 1, 0, 1, 1],
+    [0, 0, 1, 1, 0, 0, 1, 1, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 1, 0, 1, 1, 1, 1, 1, 0],
+    [0, 1, 0, 1, 1, 1, 1, 1, 0],
+    [0, 1, 1, 1, 1, 1, 1, 1, 0],
+    [1, 0, 1, 1, 0, 1, 1, 1, 1],
+    [0, 1, 1, 1, 1, 1, 0, 1, 0],
+    [0, 0, 1, 1, 0, 1, 0, 1, 0],
+    [0, 0, 1, 1, 1, 0, 1, 1, 1],
+    [0, 1, 1, 0, 0, 1, 1, 1, 0],
+    [0, 0, 0, 1, 1, 1, 0, 1, 0],
+    [0, 1, 1, 0, 0, 1, 0, 1, 0],
+    [0, 1, 1, 0, 0, 0, 1, 1, 0],
+    [0, 0, 0, 0, 0, 1, 1, 1, 1],
+    [0, 0, 1, 1, 0, 0, 0, 1, 1],
+    [0, 0, 0, 1, 0, 1, 1, 1, 1],
+    [0, 1, 1, 1, 1, 1, 1, 1, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 1, 0, 1, 1, 0, 1, 0],
+    [1, 0, 0, 1, 0, 0, 0, 0, 0],
+    [0, 0, 0, 1, 1, 0, 1, 0, 1],
+    [1, 0, 1, 1, 0, 1, 1, 1, 1],
+];
+pub const NLSF_PSEL_WB: [[u8; 15]; 32] = [
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0],
+    [0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0],
+    [0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0],
+    [0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1],
+    [0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0],
+    [0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0],
+    [0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0],
+    [0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1],
+    [0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0],
+    [0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0],
+    [0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0],
+    [0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0],
+    [0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0],
+    [0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1],
+    [0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0],
+    [0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0],
+];
+pub const NLSF_CB_NBMB: [[i32; 10]; 32] = [
+    [12, 35, 60, 83, 108, 132, 157, 180, 206, 228],
+    [15, 32, 55, 77, 101, 125, 151, 175, 201, 225],
+    [19, 42, 66, 89, 114, 137, 162, 184, 209, 230],
+    [12, 25, 50, 72, 97, 120, 147, 172, 200, 223],
+    [26, 44, 69, 90, 114, 135, 159, 180, 205, 225],
+    [13, 22, 53, 80, 106, 130, 156, 180, 205, 228],
+    [15, 25, 44, 64, 90, 115, 142, 168, 196, 222],
+    [19, 24, 62, 82, 100, 120, 145, 168, 190, 214],
+    [22, 31, 50, 79, 103, 120, 151, 170, 203, 227],
+    [21, 29, 45, 65, 106, 124, 150, 171, 196, 224],
+    [30, 49, 75, 97, 121, 142, 165, 186, 209, 229],
+    [19, 25, 52, 70, 93, 116, 143, 166, 192, 219],
+    [26, 34, 62, 75, 97, 118, 145, 167, 194, 217],
+    [25, 33, 56, 70, 91, 113, 143, 165, 196, 223],
+    [21, 34, 51, 72, 97, 117, 145, 171, 196, 222],
+    [20, 29, 50, 67, 90, 117, 144, 168, 197, 221],
+    [22, 31, 48, 66, 95, 117, 146, 168, 196, 222],
+    [24, 33, 51, 77, 116, 134, 158, 180, 200, 224],
+    [21, 28, 70, 87, 106, 124, 149, 170, 194, 217],
+    [26, 33, 53, 64, 83, 117, 152, 173, 204, 225],
+    [27, 34, 65, 95, 108, 129, 155, 174, 210, 225],
+    [20, 26, 72, 99, 113, 131, 154, 176, 200, 219],
+    [34, 43, 61, 78, 93, 114, 155, 177, 205, 229],
+    [23, 29, 54, 97, 124, 138, 163, 179, 209, 229],
+    [30, 38, 56, 89, 118, 129, 158, 178, 200, 231],
+    [21, 29, 49, 63, 85, 111, 142, 163, 193, 222],
+    [27, 48, 77, 103, 133, 158, 179, 196, 215, 232],
+    [29, 47, 74, 99, 124, 151, 176, 198, 220, 237],
+    [33, 42, 61, 76, 93, 121, 155, 174, 207, 225],
+    [29, 53, 87, 112, 136, 154, 170, 188, 208, 227],
+    [24, 30, 52, 84, 131, 150, 166, 186, 203, 229],
+    [37, 48, 64, 84, 104, 118, 156, 177, 201, 230],
+];
+pub const NLSF_CB_WB: [[i32; 16]; 32] = [
+    [7, 23, 38, 54, 69, 85, 100, 116, 131, 147, 162, 178, 193, 208, 223, 239],
+    [13, 25, 41, 55, 69, 83, 98, 112, 127, 142, 157, 171, 187, 203, 220, 236],
+    [15, 21, 34, 51, 61, 78, 92, 106, 126, 136, 152, 167, 185, 205, 225, 240],
+    [10, 21, 36, 50, 63, 79, 95, 110, 126, 141, 157, 173, 189, 205, 221, 237],
+    [17, 20, 37, 51, 59, 78, 89, 107, 123, 134, 150, 164, 184, 205, 224, 240],
+    [10, 15, 32, 51, 67, 81, 96, 112, 129, 142, 158, 173, 189, 204, 220, 236],
+    [8, 21, 37, 51, 65, 79, 98, 113, 126, 138, 155, 168, 179, 192, 209, 218],
+    [12, 15, 34, 55, 63, 78, 87, 108, 118, 131, 148, 167, 185, 203, 219, 236],
+    [16, 19, 32, 36, 56, 79, 91, 108, 118, 136, 154, 171, 186, 204, 220, 237],
+    [11, 28, 43, 58, 74, 89, 105, 120, 135, 150, 165, 180, 196, 211, 226, 241],
+    [6, 16, 33, 46, 60, 75, 92, 107, 123, 137, 156, 169, 185, 199, 214, 225],
+    [11, 19, 30, 44, 57, 74, 89, 105, 121, 135, 152, 169, 186, 202, 218, 234],
+    [12, 19, 29, 46, 57, 71, 88, 100, 120, 132, 148, 165, 182, 199, 216, 233],
+    [17, 23, 35, 46, 56, 77, 92, 106, 123, 134, 152, 167, 185, 204, 222, 237],
+    [14, 17, 45, 53, 63, 75, 89, 107, 115, 132, 151, 171, 188, 206, 221, 240],
+    [9, 16, 29, 40, 56, 71, 88, 103, 119, 137, 154, 171, 189, 205, 222, 237],
+    [16, 19, 36, 48, 57, 76, 87, 105, 118, 132, 150, 167, 185, 202, 218, 236],
+    [12, 17, 29, 54, 71, 81, 94, 104, 126, 136, 149, 164, 182, 201, 221, 237],
+    [15, 28, 47, 62, 79, 97, 115, 129, 142, 155, 168, 180, 194, 208, 223, 238],
+    [8, 14, 30, 45, 62, 78, 94, 111, 127, 143, 159, 175, 192, 207, 223, 239],
+    [17, 30, 49, 62, 79, 92, 107, 119, 132, 145, 160, 174, 190, 204, 220, 235],
+    [14, 19, 36, 45, 61, 76, 91, 108, 121, 138, 154, 172, 189, 205, 222, 238],
+    [12, 18, 31, 45, 60, 76, 91, 107, 123, 138, 154, 171, 187, 204, 221, 236],
+    [13, 17, 31, 43, 53, 70, 83, 103, 114, 131, 149, 167, 185, 203, 220, 237],
+    [17, 22, 35, 42, 58, 78, 93, 110, 125, 139, 155, 170, 188, 206, 224, 240],
+    [8, 15, 34, 50, 67, 83, 99, 115, 131, 146, 162, 178, 193, 209, 224, 239],
+    [13, 16, 41, 66, 73, 86, 95, 111, 128, 137, 150, 163, 183, 206, 225, 241],
+    [17, 25, 37, 52, 63, 75, 92, 102, 119, 132, 144, 160, 175, 191, 212, 231],
+    [19, 31, 49, 65, 83, 100, 117, 133, 147, 161, 174, 187, 200, 213, 227, 242],
+    [18, 31, 52, 68, 88, 103, 117, 126, 138, 149, 163, 177, 192, 207, 223, 239],
+    [16, 29, 47, 61, 76, 90, 106, 119, 133, 147, 161, 176, 193, 209, 224, 240],
+    [15, 21, 35, 50, 61, 73, 86, 97, 110, 119, 129, 141, 175, 198, 218, 237],
+];
+pub const NLSF_MIN_SPACING_NBMB: [i32; 11] = [250, 3, 6, 3, 3, 3, 4, 3, 3, 3, 461];
+pub const NLSF_MIN_SPACING_WB: [i32; 17] = [100, 3, 40, 3, 3, 3, 5, 14, 14, 10, 11, 3, 8, 9, 7, 3, 347];
+pub const NLSF_INTERP: [u8; 5] = icdf(&[13, 22, 29, 11, 181]);
+pub const LSF_ORDER_NBMB: [usize; 10] = [0, 9, 6, 3, 4, 5, 8, 1, 2, 7];
+pub const LSF_ORDER_WB: [usize; 16] = [0, 15, 8, 7, 4, 11, 12, 3, 2, 13, 10, 5, 6, 9, 14, 1];
+pub const COS_Q12: [i32; 129] = [
+    4096, 4095, 4091, 4085, 4076, 4065, 4052, 4036, 4017, 3997, 3973, 3948, 3920, 3889, 3857, 3822, 3784, 3745, 3703, 3659, 3613, 3564, 3513, 3461,
+    3406, 3349, 3290, 3229, 3166, 3102, 3035, 2967, 2896, 2824, 2751, 2676, 2599, 2520, 2440, 2359, 2276, 2191, 2106, 2019, 1931, 1842, 1751, 1660,
+    1568, 1474, 1380, 1285, 1189, 1093, 995, 897, 799, 700, 601, 501, 401, 301, 201, 101, 0, -101, -201, -301, -401, -501, -601, -700, -799, -897,
+    -995, -1093, -1189, -1285, -1380, -1474, -1568, -1660, -1751, -1842, -1931, -2019, -2106, -2191, -2276, -2359, -2440, -2520, -2599, -2676, -2751,
+    -2824, -2896, -2967, -3035, -3102, -3166, -3229, -3290, -3349, -3406, -3461, -3513, -3564, -3613, -3659, -3703, -3745, -3784, -3822, -3857,
+    -3889, -3920, -3948, -3973, -3997, -4017, -4036, -4052, -4065, -4076, -4085, -4091, -4095, -4096,
+];
+pub const PITCH_HIGH: [u8; 32] = icdf(&[3, 3, 6, 11, 21, 30, 32, 19, 11, 10, 12, 13, 13, 12, 11, 9, 8, 7, 6, 4, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1]);
+pub const PITCH_LOW: [&[u8]; 3] =
+    [&icdf::<4>(&[64, 64, 64, 64]), &icdf::<6>(&[43, 42, 43, 43, 42, 43]), &icdf::<8>(&[32, 32, 32, 32, 32, 32, 32, 32])];
+pub const PITCH_DELTA: [u8; 21] = icdf(&[46, 2, 2, 3, 4, 6, 10, 15, 26, 38, 30, 22, 15, 10, 7, 6, 4, 4, 2, 2, 2]);
+pub const PITCH_CONTOUR: [&[u8]; 4] = [
+    &icdf::<3>(&[143, 50, 63]),
+    &icdf::<11>(&[68, 12, 21, 17, 19, 22, 30, 24, 17, 16, 10]),
+    &icdf::<12>(&[91, 46, 39, 19, 14, 12, 8, 7, 6, 5, 5, 4]),
+    &icdf::<34>(&[33, 22, 18, 16, 15, 14, 14, 13, 13, 10, 9, 9, 8, 6, 6, 6, 5, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1]),
+];
+pub const CB_NB_10: [[i32; 2]; 3] = [[0, 0], [1, 0], [0, 1]];
+pub const CB_NB_20: [[i32; 4]; 11] = [
+    [0, 0, 0, 0],
+    [2, 1, 0, -1],
+    [-1, 0, 1, 2],
+    [-1, 0, 0, 1],
+    [-1, 0, 0, 0],
+    [0, 0, 0, 1],
+    [0, 0, 1, 1],
+    [1, 1, 0, 0],
+    [1, 0, 0, 0],
+    [0, 0, 0, -1],
+    [1, 0, 0, -1],
+];
+pub const CB_WB_10: [[i32; 2]; 12] = [[0, 0], [0, 1], [1, 0], [-1, 1], [1, -1], [-1, 2], [2, -1], [-2, 2], [2, -2], [-2, 3], [3, -2], [-3, 3]];
+pub const CB_WB_20: [[i32; 4]; 34] = [
+    [0, 0, 0, 0],
+    [0, 0, 1, 1],
+    [1, 1, 0, 0],
+    [-1, 0, 0, 0],
+    [0, 0, 0, 1],
+    [1, 0, 0, 0],
+    [-1, 0, 0, 1],
+    [0, 0, 0, -1],
+    [-1, 0, 1, 2],
+    [1, 0, 0, -1],
+    [-2, -1, 1, 2],
+    [2, 1, 0, -1],
+    [-2, 0, 0, 2],
+    [-2, 0, 1, 3],
+    [2, 1, -1, -2],
+    [-3, -1, 1, 3],
+    [2, 0, 0, -2],
+    [3, 1, 0, -2],
+    [-3, -1, 2, 4],
+    [-4, -1, 1, 4],
+    [3, 1, -1, -3],
+    [-4, -1, 2, 5],
+    [4, 2, -1, -3],
+    [4, 1, -1, -4],
+    [-5, -1, 2, 6],
+    [5, 2, -1, -4],
+    [-6, -2, 2, 6],
+    [-5, -2, 2, 5],
+    [6, 2, -1, -5],
+    [-7, -2, 3, 8],
+    [6, 2, -2, -6],
+    [5, 2, -2, -5],
+    [8, 3, -2, -7],
+    [-9, -3, 3, 9],
+];
+pub const LTP_PERIODICITY: [u8; 3] = icdf(&[77, 80, 99]);
+pub const LTP_FILTER: [&[u8]; 3] = [
+    &icdf::<8>(&[185, 15, 13, 13, 9, 9, 6, 6]),
+    &icdf::<16>(&[57, 34, 21, 20, 15, 13, 12, 13, 10, 10, 9, 10, 9, 8, 7, 8]),
+    &icdf::<32>(&[15, 16, 14, 12, 12, 12, 11, 11, 11, 10, 9, 9, 9, 9, 8, 8, 8, 8, 7, 7, 6, 6, 5, 4, 5, 4, 4, 4, 3, 4, 3, 2]),
+];
+pub const LTP_TAPS_0: [[i32; 5]; 8] = [
+    [4, 6, 24, 7, 5],
+    [0, 0, 2, 0, 0],
+    [12, 28, 41, 13, -4],
+    [-9, 15, 42, 25, 14],
+    [1, -2, 62, 41, -9],
+    [-10, 37, 65, -4, 3],
+    [-6, 4, 66, 7, -8],
+    [16, 14, 38, -3, 33],
+];
+pub const LTP_TAPS_1: [[i32; 5]; 16] = [
+    [13, 22, 39, 23, 12],
+    [-1, 36, 64, 27, -6],
+    [-7, 10, 55, 43, 17],
+    [1, 1, 8, 1, 1],
+    [6, -11, 74, 53, -9],
+    [-12, 55, 76, -12, 8],
+    [-3, 3, 93, 27, -4],
+    [26, 39, 59, 3, -8],
+    [2, 0, 77, 11, 9],
+    [-8, 22, 44, -6, 7],
+    [40, 9, 26, 3, 9],
+    [-7, 20, 101, -7, 4],
+    [3, -8, 42, 26, 0],
+    [-15, 33, 68, 2, 23],
+    [-2, 55, 46, -2, 15],
+    [3, -1, 21, 16, 41],
+];
+pub const LTP_TAPS_2: [[i32; 5]; 32] = [
+    [-6, 27, 61, 39, 5],
+    [-11, 42, 88, 4, 1],
+    [-2, 60, 65, 6, -4],
+    [-1, -5, 73, 56, 1],
+    [-9, 19, 94, 29, -9],
+    [0, 12, 99, 6, 4],
+    [8, -19, 102, 46, -13],
+    [3, 2, 13, 3, 2],
+    [9, -21, 84, 72, -18],
+    [-11, 46, 104, -22, 8],
+    [18, 38, 48, 23, 0],
+    [-16, 70, 83, -21, 11],
+    [5, -11, 117, 22, -8],
+    [-6, 23, 117, -12, 3],
+    [3, -8, 95, 28, 4],
+    [-10, 15, 77, 60, -15],
+    [-1, 4, 124, 2, -4],
+    [3, 38, 84, 24, -25],
+    [2, 13, 42, 13, 31],
+    [21, -4, 56, 46, -1],
+    [-1, 35, 79, -13, 19],
+    [-7, 65, 88, -9, -14],
+    [20, 4, 81, 49, -29],
+    [20, 0, 75, 3, -17],
+    [5, -9, 44, 92, -8],
+    [1, -3, 22, 69, 31],
+    [-6, 95, 41, -12, 5],
+    [39, 67, 16, -4, 1],
+    [0, -6, 120, 55, -36],
+    [-13, 44, 122, 4, -24],
+    [81, 5, 11, 3, 7],
+    [2, 0, 9, 10, 88],
+];
+pub const LTP_SCALE: [u8; 3] = icdf(&[128, 64, 64]);
+pub const UNIFORM4: [u8; 4] = icdf(&[64, 64, 64, 64]);
+pub const RATE_LEVEL: [&[u8]; 2] = [&icdf::<9>(&[15, 51, 12, 46, 45, 13, 33, 27, 14]), &icdf::<9>(&[33, 30, 36, 17, 34, 49, 18, 21, 18])];
+pub const PULSE_COUNT: [&[u8]; 11] = [
+    &icdf::<18>(&[131, 74, 25, 8, 3, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[58, 93, 60, 23, 7, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[43, 51, 46, 33, 24, 16, 11, 8, 6, 3, 3, 3, 2, 1, 1, 2, 1, 2]),
+    &icdf::<18>(&[17, 52, 71, 57, 31, 12, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[6, 21, 41, 53, 49, 35, 21, 11, 6, 3, 2, 2, 1, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[7, 14, 22, 28, 29, 28, 25, 20, 17, 13, 11, 9, 7, 5, 4, 4, 3, 10]),
+    &icdf::<18>(&[2, 5, 14, 29, 42, 46, 41, 31, 19, 11, 6, 3, 2, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[1, 2, 4, 10, 19, 29, 35, 37, 34, 28, 20, 14, 8, 5, 4, 2, 2, 2]),
+    &icdf::<18>(&[1, 2, 2, 5, 9, 14, 20, 24, 27, 28, 26, 23, 20, 15, 11, 8, 6, 15]),
+    &icdf::<18>(&[1, 1, 1, 6, 27, 58, 56, 39, 25, 14, 10, 6, 3, 3, 2, 1, 1, 2]),
+    &icdf::<18>(&[2, 1, 6, 27, 58, 56, 39, 25, 14, 10, 6, 3, 3, 2, 1, 1, 2, 0]),
+];
+pub const SHELL_16: [&[u8]; 16] = [
+    &icdf::<2>(&[126, 130]),
+    &icdf::<3>(&[56, 142, 58]),
+    &icdf::<4>(&[25, 101, 104, 26]),
+    &icdf::<5>(&[12, 60, 108, 64, 12]),
+    &icdf::<6>(&[7, 35, 84, 87, 37, 6]),
+    &icdf::<7>(&[4, 20, 59, 86, 63, 21, 3]),
+    &icdf::<8>(&[3, 12, 38, 72, 75, 42, 12, 2]),
+    &icdf::<9>(&[2, 8, 25, 54, 73, 59, 27, 7, 1]),
+    &icdf::<10>(&[2, 5, 17, 39, 63, 65, 42, 18, 4, 1]),
+    &icdf::<11>(&[1, 4, 12, 28, 49, 63, 54, 30, 11, 3, 1]),
+    &icdf::<12>(&[1, 4, 8, 20, 37, 55, 57, 41, 22, 8, 2, 1]),
+    &icdf::<13>(&[1, 3, 7, 15, 28, 44, 53, 48, 33, 16, 6, 1, 1]),
+    &icdf::<14>(&[1, 2, 6, 12, 21, 35, 47, 48, 40, 25, 12, 5, 1, 1]),
+    &icdf::<15>(&[1, 1, 4, 10, 17, 27, 37, 47, 43, 33, 21, 9, 4, 1, 1]),
+    &icdf::<16>(&[1, 1, 1, 8, 14, 22, 33, 40, 43, 38, 28, 16, 8, 1, 1, 1]),
+    &icdf::<17>(&[1, 1, 1, 1, 13, 18, 27, 36, 41, 41, 34, 24, 14, 1, 1, 1, 1]),
+];
+pub const SHELL_8: [&[u8]; 16] = [
+    &icdf::<2>(&[127, 129]),
+    &icdf::<3>(&[53, 149, 54]),
+    &icdf::<4>(&[22, 105, 106, 23]),
+    &icdf::<5>(&[11, 61, 111, 63, 10]),
+    &icdf::<6>(&[6, 35, 86, 88, 36, 5]),
+    &icdf::<7>(&[4, 20, 59, 87, 62, 21, 3]),
+    &icdf::<8>(&[3, 13, 40, 71, 73, 41, 13, 2]),
+    &icdf::<9>(&[3, 9, 27, 53, 70, 56, 28, 9, 1]),
+    &icdf::<10>(&[3, 8, 19, 37, 57, 61, 44, 20, 6, 1]),
+    &icdf::<11>(&[3, 7, 15, 28, 44, 54, 49, 33, 17, 5, 1]),
+    &icdf::<12>(&[1, 7, 13, 22, 34, 46, 48, 38, 28, 14, 4, 1]),
+    &icdf::<13>(&[1, 1, 11, 22, 27, 35, 42, 47, 33, 25, 10, 1, 1]),
+    &icdf::<14>(&[1, 1, 6, 14, 26, 37, 43, 43, 37, 26, 14, 6, 1, 1]),
+    &icdf::<15>(&[1, 1, 4, 10, 20, 31, 40, 42, 40, 31, 20, 10, 4, 1, 1]),
+    &icdf::<16>(&[1, 1, 3, 8, 16, 26, 35, 38, 38, 35, 26, 16, 8, 3, 1, 1]),
+    &icdf::<17>(&[1, 1, 2, 6, 12, 21, 30, 36, 38, 36, 30, 21, 12, 6, 2, 1, 1]),
+];
+pub const SHELL_4: [&[u8]; 16] = [
+    &icdf::<2>(&[127, 129]),
+    &icdf::<3>(&[49, 157, 50]),
+    &icdf::<4>(&[20, 107, 109, 20]),
+    &icdf::<5>(&[11, 60, 113, 62, 10]),
+    &icdf::<6>(&[7, 36, 84, 87, 36, 6]),
+    &icdf::<7>(&[6, 24, 57, 82, 60, 23, 4]),
+    &icdf::<8>(&[5, 18, 39, 64, 68, 42, 16, 4]),
+    &icdf::<9>(&[6, 14, 29, 47, 61, 52, 30, 14, 3]),
+    &icdf::<10>(&[1, 15, 23, 35, 51, 50, 40, 30, 10, 1]),
+    &icdf::<11>(&[1, 1, 21, 32, 42, 52, 46, 41, 18, 1, 1]),
+    &icdf::<12>(&[1, 6, 16, 27, 36, 42, 42, 36, 27, 16, 6, 1]),
+    &icdf::<13>(&[1, 5, 12, 21, 31, 38, 40, 38, 31, 21, 12, 5, 1]),
+    &icdf::<14>(&[1, 3, 9, 17, 26, 34, 38, 38, 34, 26, 17, 9, 3, 1]),
+    &icdf::<15>(&[1, 3, 7, 14, 22, 29, 34, 36, 34, 29, 22, 14, 7, 3, 1]),
+    &icdf::<16>(&[1, 2, 5, 11, 18, 25, 31, 35, 35, 31, 25, 18, 11, 5, 2, 1]),
+    &icdf::<17>(&[1, 1, 4, 9, 15, 21, 28, 32, 34, 32, 28, 21, 15, 9, 4, 1, 1]),
+];
+pub const SHELL_2: [&[u8]; 16] = [
+    &icdf::<2>(&[128, 128]),
+    &icdf::<3>(&[42, 172, 42]),
+    &icdf::<4>(&[21, 107, 107, 21]),
+    &icdf::<5>(&[12, 60, 112, 61, 11]),
+    &icdf::<6>(&[8, 34, 86, 86, 35, 7]),
+    &icdf::<7>(&[8, 23, 55, 90, 55, 20, 5]),
+    &icdf::<8>(&[5, 15, 38, 72, 72, 36, 15, 3]),
+    &icdf::<9>(&[6, 12, 27, 52, 77, 47, 20, 10, 5]),
+    &icdf::<10>(&[6, 19, 28, 35, 40, 40, 35, 28, 19, 6]),
+    &icdf::<11>(&[4, 14, 22, 31, 37, 40, 37, 31, 22, 14, 4]),
+    &icdf::<12>(&[3, 10, 18, 26, 33, 38, 38, 33, 26, 18, 10, 3]),
+    &icdf::<13>(&[2, 8, 13, 21, 29, 36, 38, 36, 29, 21, 13, 8, 2]),
+    &icdf::<14>(&[1, 5, 10, 17, 25, 32, 38, 38, 32, 25, 17, 10, 5, 1]),
+    &icdf::<15>(&[1, 4, 7, 13, 21, 29, 35, 36, 35, 29, 21, 13, 7, 4, 1]),
+    &icdf::<16>(&[1, 2, 5, 10, 17, 25, 32, 36, 36, 32, 25, 17, 10, 5, 2, 1]),
+    &icdf::<17>(&[1, 2, 4, 7, 13, 21, 28, 34, 36, 34, 28, 21, 13, 7, 4, 2, 1]),
+];
+pub const EXC_LSB: [u8; 2] = icdf(&[136, 120]);
+pub const EXC_SIGN: [&[u8]; 42] = [
+    &icdf::<2>(&[2, 254]),
+    &icdf::<2>(&[207, 49]),
+    &icdf::<2>(&[189, 67]),
+    &icdf::<2>(&[179, 77]),
+    &icdf::<2>(&[174, 82]),
+    &icdf::<2>(&[163, 93]),
+    &icdf::<2>(&[157, 99]),
+    &icdf::<2>(&[58, 198]),
+    &icdf::<2>(&[245, 11]),
+    &icdf::<2>(&[238, 18]),
+    &icdf::<2>(&[232, 24]),
+    &icdf::<2>(&[225, 31]),
+    &icdf::<2>(&[220, 36]),
+    &icdf::<2>(&[211, 45]),
+    &icdf::<2>(&[1, 255]),
+    &icdf::<2>(&[210, 46]),
+    &icdf::<2>(&[190, 66]),
+    &icdf::<2>(&[178, 78]),
+    &icdf::<2>(&[169, 87]),
+    &icdf::<2>(&[162, 94]),
+    &icdf::<2>(&[152, 104]),
+    &icdf::<2>(&[48, 208]),
+    &icdf::<2>(&[242, 14]),
+    &icdf::<2>(&[235, 21]),
+    &icdf::<2>(&[224, 32]),
+    &icdf::<2>(&[214, 42]),
+    &icdf::<2>(&[205, 51]),
+    &icdf::<2>(&[190, 66]),
+    &icdf::<2>(&[1, 255]),
+    &icdf::<2>(&[162, 94]),
+    &icdf::<2>(&[152, 104]),
+    &icdf::<2>(&[147, 109]),
+    &icdf::<2>(&[144, 112]),
+    &icdf::<2>(&[141, 115]),
+    &icdf::<2>(&[138, 118]),
+    &icdf::<2>(&[8, 248]),
+    &icdf::<2>(&[203, 53]),
+    &icdf::<2>(&[187, 69]),
+    &icdf::<2>(&[176, 80]),
+    &icdf::<2>(&[168, 88]),
+    &icdf::<2>(&[161, 95]),
+    &icdf::<2>(&[154, 102]),
+];
+pub const LBRR_FLAGS: [&[u8]; 2] = [&icdf::<3>(&[53, 53, 150]), &icdf::<7>(&[41, 20, 29, 41, 15, 28, 82])];
--- a/Show More
+++ b/Show More