address review: charge pictures already held at their own size in the decoder budget

- A macroblock that an earlier slice of the same picture already decoded is
  refused, so overlapping slices cannot redo the picture's reconstruction
  once per slice.
- The memory budget check counts pictures waiting in the output queue that
  have left the DPB (one decode call may carry many access units) and the
  DPB's actual size, counting shared buffers once.
- frame_num gap concealment advances the POC state across the skipped run in
  constant time instead of once per missing frame_num.
- Storing a reference picture evicts until the DPB is under capacity, rather
  than evicting one picture and inserting regardless.

crates/anim/src/morph.rs

@@ -1,7 +1,5 @@
 //! Morph: matching shapes between two slides, interpolating their boxes and building the frames.
 
-use std::collections::{HashMap, HashSet, VecDeque};
-
 use deckcraft_model::resolve::{self, Ctx};
 use deckcraft_model::{ColorRef, Fill, Geom, Presentation, Rgba, Shape, ShapeId, ShapeKind, Slide, Xfrm, walk};
 
@@ -17,66 +15,48 @@ fn text_of(s: &Shape) -> String {
 /// kind and preset geometry if neither carries text. A text box with neither a name nor its text on
 /// the other slide stays unpaired and fades in place, as in PowerPoint (#119). Each shape is used
 /// once; top-level shapes only (groups move whole).
-///
-/// Each pass compares a key of the two shapes, so the shapes of `b` are indexed by key once per
-/// pass: matching costs the sum of the two shape lists, not their product.
 pub fn morph_pairs(a: &Slide, b: &Slide) -> Vec<(ShapeId, ShapeId)> {
     let mut pairs: Vec<(ShapeId, ShapeId)> = Vec::new();
     let mut used_a = vec![false; a.shapes.len()];
     let mut used_b = vec![false; b.shapes.len()];
-    // Each shape's text, worked out once rather than inside every comparison.
-    let text_a: Vec<String> = a.shapes.iter().map(text_of).collect();
-    let text_b: Vec<String> = b.shapes.iter().map(text_of).collect();
-    let forced = |s: &Shape, _: &str| (s.name.starts_with("!!")).then(|| MorphKey::Name(s.name.clone()));
-    let named = |s: &Shape, _: &str| (!s.name.is_empty()).then(|| MorphKey::Name(s.name.clone()));
-    let same_text = |s: &Shape, t: &str| (!t.trim().is_empty()).then(|| MorphKey::Text(s.kind_name(), t.to_string()));
-    let same_geom = |s: &Shape, t: &str| match s.geom.preset_name() {
-        Some(g) if t.trim().is_empty() => Some(MorphKey::Geom(s.kind_name(), g.to_string())),
-        _ => None,
-    };
-    let passes: [&dyn Fn(&Shape, &str) -> Option<MorphKey>; 4] = [&forced, &named, &same_text, &same_geom];
-    for key in passes {
-        // Unused shapes of `b` by key, in slide order: the front of each queue is the first unused
-        // match, which is the one a search through `b` would find.
-        let mut index: HashMap<MorphKey, VecDeque<usize>> = HashMap::new();
-        for (j, sb) in b.shapes.iter().enumerate() {
-            if used_b.get(j).copied().unwrap_or(true) {
-                continue;
+    let passes: [&dyn Fn(&Shape, &Shape) -> bool; 4] = [
+        &|x, y| x.name.starts_with("!!") && x.name == y.name,
+        &|x, y| !x.name.is_empty() && x.name == y.name,
+        &|x, y| {
+            if x.kind_name() != y.kind_name() {
+                return false;
             }
-            if let Some(k) = key(sb, text_b.get(j).map_or("", String::as_str)) {
-                index.entry(k).or_default().push_back(j);
-            }
-        }
-        if index.is_empty() {
-            continue;
-        }
+            let tx = text_of(x);
+            !tx.trim().is_empty() && tx == text_of(y)
+        },
+        &|x, y| {
+            x.kind_name() == y.kind_name()
+                && x.geom.preset_name().is_some()
+                && x.geom.preset_name() == y.geom.preset_name()
+                && text_of(x).trim().is_empty()
+                && text_of(y).trim().is_empty()
+        },
+    ];
+    for pass in passes {
         for (i, sa) in a.shapes.iter().enumerate() {
             if used_a.get(i).copied().unwrap_or(true) {
                 continue;
             }
-            let Some(k) = key(sa, text_a.get(i).map_or("", String::as_str)) else { continue };
-            let Some(j) = index.get_mut(&k).and_then(VecDeque::pop_front) else { continue };
-            let Some(sb) = b.shapes.get(j) else { continue };
-            if let Some(u) = used_a.get_mut(i) {
-                *u = true;
+            let found = b.shapes.iter().enumerate().find(|(j, sb)| !used_b.get(*j).copied().unwrap_or(true) && pass(sa, sb));
+            if let Some((j, sb)) = found {
+                if let Some(u) = used_a.get_mut(i) {
+                    *u = true;
+                }
+                if let Some(u) = used_b.get_mut(j) {
+                    *u = true;
+                }
+                pairs.push((sa.id, sb.id));
             }
-            if let Some(u) = used_b.get_mut(j) {
-                *u = true;
-            }
-            pairs.push((sa.id, sb.id));
         }
     }
     pairs
 }
 
-/// What one [`morph_pairs`] pass matches shapes on.
-#[derive(Clone, Debug, PartialEq, Eq, Hash)]
-enum MorphKey {
-    Name(String),
-    Text(&'static str, String),
-    Geom(&'static str, String),
-}
-
 fn lerp(a: f64, b: f64, t: f64) -> f64 {
     let v = a + (b - a) * t;
     if v.is_finite() {
@@ -276,23 +256,13 @@ pub fn morph_frame(pres: &Presentation, a: &Slide, b: &Slide, t: f64, hidden_b:
         f.shapes.push((sh, old));
         id
     };
-    // Lookups by id, built once (the first shape or pair with an id wins, as a search would).
-    let paired_a: HashSet<ShapeId> = pairs.iter().map(|(ia, _)| *ia).collect();
-    let mut partner: HashMap<ShapeId, ShapeId> = HashMap::with_capacity(pairs.len());
-    for (ia, ib) in &pairs {
-        partner.entry(*ib).or_insert(*ia);
-    }
-    let mut a_by_id: HashMap<ShapeId, &Shape> = HashMap::with_capacity(a.shapes.len());
-    for x in &a.shapes {
-        a_by_id.entry(x.id).or_insert(x);
-    }
     for sa in &a.shapes {
-        if !paired_a.contains(&sa.id) {
+        if !pairs.iter().any(|(ia, _)| *ia == sa.id) {
             push(sa.clone(), true, 1.0 - s);
         }
     }
     for sb in &b.shapes {
-        let pair = partner.get(&sb.id).and_then(|ia| a_by_id.get(ia).copied());
+        let pair = pairs.iter().find(|(_, ib)| *ib == sb.id).and_then(|(ia, _)| a.shapes.iter().find(|x| x.id == *ia));
         let Some(sa) = pair else {
             if !hidden_b(sb.id) {
                 push(sb.clone(), false, s);

crates/anim/src/tests.rs

@@ -1155,58 +1155,3 @@ fn many_by_paragraph_animations_on_one_shape_share_paragraph_targets() {
     assert_eq!(tl.effects().len(), 6_000);
     assert_eq!(tl.paragraph_targets(ShapeId(1)), vec![0, 1, 2]);
 }
-
-#[test]
-fn morph_pairs_take_the_first_unused_match_in_slide_order() {
-    let mut a = Slide::default();
-    let mut b = Slide::default();
-    a.shapes = vec![shape(1, "Same"), shape(2, "Same"), shape(3, "Other")];
-    b.shapes = vec![shape(11, "Same"), shape(12, "Same"), shape(13, "Same")];
-    // By name first, in slide order; the shape of `a` left over pairs by kind and geometry with
-    // the shape of `b` left over.
-    assert_eq!(morph_pairs(&a, &b), [(ShapeId(1), ShapeId(11)), (ShapeId(2), ShapeId(12)), (ShapeId(3), ShapeId(13))]);
-}
-
-#[test]
-fn morph_of_large_slides_stays_linear() {
-    let n = 20_000u32;
-    let text = |i: u32, side: &str| Some(TextBody::from_text(&format!("{side} {i}")));
-    let mut a = Slide::default();
-    let mut b = Slide::default();
-    // Text no shape on the other slide shares: every pass looks for a partner and finds none.
-    a.shapes = (0..n).map(|i| Shape { text: text(i, "a"), ..shape(i + 1, "") }).collect();
-    b.shapes = (0..n).map(|i| Shape { text: text(i, "b"), ..shape(n + i + 1, "") }).collect();
-    // One named pair at opposite ends.
-    a.shapes[0].name = "Logo".into();
-    b.shapes[n as usize - 1].name = "Logo".into();
-    // No wall-clock bound (it would flake on a loaded runner): at this size a quadratic pairing
-    // takes minutes, so a regression shows as a test that hangs rather than a failed assertion.
-    assert_eq!(morph_pairs(&a, &b), [(ShapeId(1), ShapeId(2 * n))]);
-    let p = deckcraft_model::defaults::new_presentation(None);
-    let f = morph_frame(&p, &a, &b, 0.5, &|_| false);
-    // Every shape fades in place; the named pair differs in text, so it cross-fades as two.
-    assert_eq!(f.shapes.len(), 2 * n as usize);
-}
-
-#[test]
-fn paragraph_states_of_a_large_build_stay_linear() {
-    let n = 20_000usize;
-    let mut s = slide_with(vec![]);
-    let mut body = TextBody::from_text(&vec!["line"; n].join("\n"));
-    // One first-level paragraph owning every other paragraph.
-    for p in body.paragraphs.iter_mut().skip(1) {
-        p.level = 1;
-    }
-    s.shapes[0].text = Some(body);
-    let mut a = anim(1, AnimClass::Entrance, "fade", AnimStart::OnClick);
-    a.text_build = TextBuild::ByParagraph;
-    s.animations = vec![a];
-    let tl = Timeline::new(&s, W, H);
-    // No wall-clock bound, as above: a per-paragraph scan of the slide would take minutes here.
-    assert_eq!(tl.paragraph_targets(ShapeId(1)).len(), n);
-    for p in 0..n {
-        assert!(!tl.state(ShapeId(1), Some(p), 0, 0.0).visible);
-        assert!(tl.state(ShapeId(1), Some(p), 1, 0.0).visible);
-    }
-    assert_eq!(tl.animated_shapes(), [ShapeId(1)]);
-}

crates/anim/src/timeline.rs

@@ -103,41 +103,6 @@ pub struct Timeline {
     /// By-paragraph builds animate first-level paragraphs; deeper paragraphs follow their parent:
     /// (shape, member paragraph, owner paragraph).
     groups: Vec<(ShapeId, usize, usize)>,
-    /// Lookups built with the timeline, so evaluating a shape or paragraph costs its own effects
-    /// rather than a scan of every effect, group and colour on the slide.
-    index: TimelineIndex,
-}
-
-#[derive(Clone, Debug, Default)]
-struct TimelineIndex {
-    /// Effects (indices into `effects`, in order) by target shape and paragraph.
-    by_target: HashMap<(ShapeId, Option<usize>), Vec<usize>>,
-    /// Effects (indices into `effects`, in order) by target shape.
-    by_shape: HashMap<ShapeId, Vec<usize>>,
-    /// Owner paragraph of each member paragraph (the first group recorded wins).
-    owner: HashMap<(ShapeId, usize), usize>,
-    /// Groups (member, owner) by shape, in order.
-    groups_by_shape: HashMap<ShapeId, Vec<(usize, usize)>>,
-    /// Base colour by shape (the first recorded wins).
-    color: HashMap<ShapeId, Rgba>,
-}
-
-impl TimelineIndex {
-    fn build(effects: &[Effect], groups: &[(ShapeId, usize, usize)], colors: &[(ShapeId, Rgba)]) -> TimelineIndex {
-        let mut ix = TimelineIndex::default();
-        for (i, e) in effects.iter().enumerate() {
-            ix.by_target.entry((e.timing.shape, e.timing.paragraph)).or_default().push(i);
-            ix.by_shape.entry(e.timing.shape).or_default().push(i);
-        }
-        for &(shape, member, owner) in groups {
-            ix.owner.entry((shape, member)).or_insert(owner);
-            ix.groups_by_shape.entry(shape).or_default().push((member, owner));
-        }
-        for &(shape, c) in colors {
-            ix.color.entry(shape).or_insert(c);
-        }
-        ix
-    }
 }
 
 enum Status {
@@ -359,7 +324,6 @@ impl Timeline {
             };
             tl.colors.push((id, c));
         }
-        tl.index = TimelineIndex::build(&tl.effects, &tl.groups, &tl.colors);
         tl
     }
 
@@ -449,12 +413,8 @@ impl Timeline {
 
     /// Paragraph indices of `shape` animated separately (by-paragraph builds).
     pub fn paragraph_targets(&self, shape: ShapeId) -> Vec<usize> {
-        let mine = self.index.by_shape.get(&shape).map_or(&[][..], Vec::as_slice);
-        let mut v: Vec<usize> = mine.iter().filter_map(|&i| self.effects.get(i)).filter_map(|e| e.timing.paragraph).collect();
-        let owners: HashSet<usize> = v.iter().copied().collect();
-        if let Some(groups) = self.index.groups_by_shape.get(&shape) {
-            v.extend(groups.iter().filter(|(_, owner)| owners.contains(owner)).map(|(member, _)| *member));
-        }
+        let mut v: Vec<usize> = self.effects.iter().filter(|e| e.timing.shape == shape).filter_map(|e| e.timing.paragraph).collect();
+        v.extend(self.groups.iter().filter(|g| g.0 == shape && v.contains(&g.2)).map(|g| g.1).collect::<Vec<_>>());
         v.sort_unstable();
         v.dedup();
         v
@@ -462,8 +422,13 @@ impl Timeline {
 
     /// Shapes with any effect.
     pub fn animated_shapes(&self) -> Vec<ShapeId> {
-        let mut seen: HashSet<ShapeId> = HashSet::new();
-        self.effects.iter().map(|e| e.timing.shape).filter(|s| seen.insert(*s)).collect()
+        let mut v: Vec<ShapeId> = Vec::new();
+        for e in &self.effects {
+            if !v.contains(&e.timing.shape) {
+                v.push(e.timing.shape);
+            }
+        }
+        v
     }
 
     /// State of `shape` (or of one of its paragraphs, `para`) when `step` main steps have been
@@ -491,9 +456,9 @@ impl Timeline {
         triggers: &[TriggerPlay],
         stamps: &[StepStamp],
     ) -> AnimState {
-        let para = para.map(|p| self.index.owner.get(&(shape, p)).copied().unwrap_or(p));
-        let mine = self.index.by_target.get(&(shape, para)).map_or(&[][..], Vec::as_slice).iter().filter_map(|&i| self.effects.get(i));
-        let base_color = self.index.color.get(&shape).copied().unwrap_or(Rgba::rgb(0x15, 0x60, 0x82));
+        let para = para.map(|p| self.groups.iter().find(|g| g.0 == shape && g.1 == p).map(|g| g.2).unwrap_or(p));
+        let mine = self.effects.iter().filter(|e| e.timing.shape == shape && e.timing.paragraph == para);
+        let base_color = self.colors.iter().find(|(s, _)| *s == shape).map(|(_, c)| *c).unwrap_or(Rgba::rgb(0x15, 0x60, 0x82));
         let mut st = AnimState::default();
         // Initial visibility comes from the first effect in the Animation Pane order.
         let mut ordered: Vec<&Effect> = mine.collect();

crates/fonts/src/shape.rs

@@ -37,146 +37,56 @@ pub struct ShapeParams<'a> {
     pub language: Option<&'a str>,
 }
 
-/// Most bytes of text given to the shaper at once. The shaper lets one call grow its buffers to
-/// 256 glyphs per character (a font's substitutions decide how many), so a long item is shaped in
-/// pieces of this size, each with the rest of the paragraph as context.
-const MAX_SHAPE_CHUNK: usize = 1024;
-/// Most glyphs kept per character of a piece: a piece the font expands further is laid out one
-/// glyph per character from the cmap instead.
-const MAX_GLYPHS_PER_CHAR: usize = 32;
-
 /// Shape `para[range]` with `face`, the rest of `para` as context. Glyphs are in visual order
 /// (left to right) and clusters are byte offsets into `para`. `map` substitutes characters (All
 /// Caps) without moving clusters. An empty or out-of-bounds range shapes nothing.
 pub fn shape_range(face: &FontFace, para: &str, range: Range<usize>, params: &ShapeParams, map: impl Fn(char) -> char) -> Vec<ShapedGlyph> {
-    let (Some(_), Some(text), Some(_)) = (para.get(..range.start), para.get(range.clone()), para.get(range.end..)) else {
+    let (Some(pre), Some(text), Some(post)) = (para.get(..range.start), para.get(range.clone()), para.get(range.end..)) else {
         return Vec::new();
     };
-    let chunks = chunks(text, MAX_SHAPE_CHUNK);
-    let mut pieces: Vec<Vec<ShapedGlyph>> = Vec::with_capacity(chunks.len());
+    let mut out = Vec::with_capacity(text.len());
     let shaped = face.hb().map(|hb| {
         let shaper = face.shaper.shaper(&hb).instance(face.instance.as_ref()).build();
-        // Pieces of one item share the script the whole item would be guessed to have.
-        let item_script = (chunks.len() > 1 && params.script.is_none()).then(|| {
-            let mut probe = UnicodeBuffer::new();
-            for c in text.chars() {
-                probe.add(map(c), 0);
-            }
-            probe.guess_segment_properties();
-            probe.script()
-        });
-        for c in &chunks {
-            let r = (range.start + c.start)..(range.start + c.end);
-            let (Some(pre), Some(piece), Some(post)) = (para.get(..r.start), para.get(r.clone()), para.get(r.end..)) else { continue };
-            let mut buf = UnicodeBuffer::new();
-            buf.set_pre_context(pre);
-            buf.set_post_context(post);
-            for (i, c) in piece.char_indices() {
-                buf.add(map(c), (r.start + i) as u32);
-            }
-            buf.guess_segment_properties();
-            if let Some(s) = params.script.and_then(|t| Script::from_iso15924_tag(Tag::new(&t))) {
-                buf.set_script(s);
-            } else if let Some(s) = item_script {
-                buf.set_script(s);
-            }
-            if let Some(l) =
-                params.language.or_else(|| params.script.and_then(crate::script::default_language)).and_then(|l| l.parse::<Language>().ok())
-            {
-                buf.set_language(l);
-            }
-            buf.set_direction(if params.rtl { Direction::RightToLeft } else { Direction::LeftToRight });
-            let gb = shaper.shape(buf, ShapeOptions::new().features(params.features));
-            let budget = piece.chars().count().saturating_mul(MAX_GLYPHS_PER_CHAR);
-            if gb.len() > budget {
-                // Font-controlled expansion past anything real text needs: keep it bounded.
-                pieces.push(cmap_glyphs(face, para, r, params.rtl, &map));
-                continue;
-            }
-            pieces.push(
-                gb.glyph_infos()
-                    .iter()
-                    .zip(gb.glyph_positions())
-                    .map(|(info, pos)| ShapedGlyph {
-                        gid: info.glyph_id,
-                        cluster: info.cluster as usize,
-                        x_advance: pos.x_advance,
-                        x_offset: pos.x_offset,
-                        y_offset: pos.y_offset,
-                    })
-                    .collect(),
-            );
+        let mut buf = UnicodeBuffer::new();
+        buf.set_pre_context(pre);
+        buf.set_post_context(post);
+        for (i, c) in text.char_indices() {
+            buf.add(map(c), (range.start + i) as u32);
+        }
+        buf.guess_segment_properties();
+        if let Some(s) = params.script.and_then(|t| Script::from_iso15924_tag(Tag::new(&t))) {
+            buf.set_script(s);
+        }
+        if let Some(l) = params.language.or_else(|| params.script.and_then(crate::script::default_language)).and_then(|l| l.parse::<Language>().ok())
+        {
+            buf.set_language(l);
+        }
+        buf.set_direction(if params.rtl { Direction::RightToLeft } else { Direction::LeftToRight });
+        let gb = shaper.shape(buf, ShapeOptions::new().features(params.features));
+        for (info, pos) in gb.glyph_infos().iter().zip(gb.glyph_positions()) {
+            out.push(ShapedGlyph {
+                gid: info.glyph_id,
+                cluster: info.cluster as usize,
+                x_advance: pos.x_advance,
+                x_offset: pos.x_offset,
+                y_offset: pos.y_offset,
+            });
         }
     });
-    if shaped.is_none() {
+    if shaped.is_none()
+        && let Some(f) = face.skrifa()
+    {
         // No shaper for this face: one glyph per character from the cmap, in visual order.
-        return cmap_glyphs(face, para, range, params.rtl, &map);
-    }
-    // Each piece is in visual order; right to left, the later pieces come first.
-    if params.rtl {
-        pieces.reverse();
-    }
-    let mut out = Vec::with_capacity(pieces.iter().map(Vec::len).sum());
-    for p in pieces {
-        out.extend(p);
-    }
-    out
-}
-
-/// One glyph per character of `para[range]` from the cmap, in visual order.
-fn cmap_glyphs(face: &FontFace, para: &str, range: Range<usize>, rtl: bool, map: &impl Fn(char) -> char) -> Vec<ShapedGlyph> {
-    let (Some(text), Some(f)) = (para.get(range.clone()), face.skrifa()) else { return Vec::new() };
-    let cmap = f.charmap();
-    let gm = f.glyph_metrics(Size::unscaled(), face.location());
-    let mut out = Vec::with_capacity(text.len());
-    for (i, c) in text.char_indices() {
-        let g = cmap.map(map(c)).unwrap_or_default();
-        let adv = gm.advance_width(g).unwrap_or(face.upem as f32 * 0.5);
-        out.push(ShapedGlyph { gid: g.to_u32(), cluster: range.start + i, x_advance: adv.round() as i32, x_offset: 0, y_offset: 0 });
-    }
-    if rtl {
-        out.reverse();
-    }
-    out
-}
-
-/// `text` cut into byte ranges of at most `max` bytes (or one character, if longer), at the last
-/// space of a piece where there is one, else before a character that starts a cluster (not a
-/// combining mark or joiner, not after a joiner). Text that fits is one piece.
-fn chunks(text: &str, max: usize) -> Vec<Range<usize>> {
-    use unicode_bidi::BidiClass::{BN, NSM};
-    let mut out = Vec::new();
-    let mut start = 0;
-    while text.len() - start > max {
-        let window = text.get(start..).unwrap_or_default();
-        let mut space = None;
-        let mut boundary = None;
-        let mut any = None;
-        let mut prev: Option<char> = None;
-        for (i, c) in window.char_indices() {
-            if i > max {
-                break;
-            }
-            if i > 0 {
-                any = Some(i);
-                let joined = prev.is_some_and(|p| matches!(unicode_bidi::bidi_class(p), BN));
-                if !joined && !matches!(unicode_bidi::bidi_class(c), NSM | BN) {
-                    boundary = Some(i);
-                    if prev.is_some_and(char::is_whitespace) {
-                        space = Some(i);
-                    }
-                }
-            }
-            prev = Some(c);
+        let cmap = f.charmap();
+        let gm = f.glyph_metrics(Size::unscaled(), face.location());
+        for (i, c) in text.char_indices() {
+            let g = cmap.map(map(c)).unwrap_or_default();
+            let adv = gm.advance_width(g).unwrap_or(face.upem as f32 * 0.5);
+            out.push(ShapedGlyph { gid: g.to_u32(), cluster: range.start + i, x_advance: adv.round() as i32, x_offset: 0, y_offset: 0 });
+        }
+        if params.rtl {
+            out.reverse();
         }
-        // A piece always moves forward by at least one character.
-        let first = window.chars().next().map_or(window.len(), char::len_utf8);
-        let cut = space.filter(|&i| i >= max / 2).or(boundary).or(any).unwrap_or(first).max(first);
-        out.push(start..start + cut);
-        start += cut;
-    }
-    if start < text.len() || out.is_empty() {
-        out.push(start..text.len());
     }
     out
 }
@@ -211,37 +121,4 @@ mod tests {
         // Not a char boundary.
         assert!(shape_range(&face, "سنة", 1..2, &ShapeParams::default(), |c| c).is_empty());
     }
-
-    #[test]
-    fn long_items_are_shaped_in_bounded_pieces() {
-        for text in ["word ".repeat(2_000), "e\u{301}".repeat(2_000), "x".repeat(5_000), "\u{1f469}\u{200d}\u{1f4bb} ".repeat(500)] {
-            let pieces = chunks(&text, MAX_SHAPE_CHUNK);
-            assert_eq!(pieces.first().map(|r| r.start), Some(0));
-            assert_eq!(pieces.last().map(|r| r.end), Some(text.len()));
-            for w in pieces.windows(2) {
-                assert_eq!(w[0].end, w[1].start);
-            }
-            for r in &pieces {
-                assert!(!r.is_empty() && r.len() <= MAX_SHAPE_CHUNK);
-                // Never before a combining mark, never after a joiner.
-                let rest = &text[r.end..];
-                assert!(!rest.starts_with('\u{301}'));
-                assert!(!text[..r.end].ends_with('\u{200d}') || rest.is_empty());
-            }
-        }
-        assert_eq!(chunks("short", MAX_SHAPE_CHUNK), vec![0..5]);
-        assert_eq!(chunks("", MAX_SHAPE_CHUNK), vec![0..0]);
-    }
-
-    #[test]
-    fn long_items_keep_every_cluster_in_visual_order() {
-        let face = FontDb::global().face(DEFAULT_FAMILY, "Regular");
-        let text = "ab cd ".repeat(1_000);
-        let g = shape_range(&face, &text, 0..text.len(), &ShapeParams::default(), |c| c);
-        assert_eq!(g.len(), text.len());
-        assert!(g.windows(2).all(|w| w[0].cluster < w[1].cluster));
-        let rtl = shape_range(&face, &text, 0..text.len(), &ShapeParams { rtl: true, ..Default::default() }, |c| c);
-        assert_eq!(rtl.len(), text.len());
-        assert!(rtl.windows(2).all(|w| w[0].cluster > w[1].cluster));
-    }
 }

crates/h264/src/cabac_mb.rs

@@ -48,7 +48,7 @@ impl SliceDecoder<'_> {
         let intra_slice = self.sh.slice_type.is_intra();
         loop {
             ensure!(addr < total, "macroblock address {addr} out of range");
-            self.start_mb(addr);
+            self.start_mb(addr)?;
             let skip = !intra_slice && self.decode_skip_flag(&mut c);
             if skip {
                 self.decode_skip()?;

crates/h264/src/decoder.rs

@@ -451,13 +451,19 @@ impl Decoder {
             chroma_planes: if chroma == 0 { 0 } else { 2 },
             bytes_per_sample: 1,
         };
-        let pictures = (sps.max_dpb_frames() + 1 + self.max_in_flight) as u64;
-        ensure!(
-            shape.fits(pictures, self.memory_budget),
-            "{}x{} pictures with {pictures} in the decoder exceed the memory budget",
-            sps.width(),
-            sps.height()
-        );
+        // Pictures already held count at their own size, not the incoming SPS's: after a
+        // resolution change, larger pictures of the old size can still be in the DPB or waiting
+        // for output (one decode call may carry many access units). A buffer shared with a DPB
+        // entry is counted once.
+        let pic = shape.bytes().unwrap_or(u64::MAX);
+        let held = |frames: &mut dyn Iterator<Item = &Arc<Frame>>| frames.fold(0u64, |n, f| n.saturating_add(f.bytes()));
+        let queued = held(&mut self.out_queue.iter().filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame))).map(|o| &o.frame));
+        let in_dpb = held(&mut self.dpb.entries.iter().map(|e| &e.frame));
+        let dpb = sps.max_dpb_frames().max(self.dpb.entries.len()) as u64;
+        // The DPB (the larger of its new slots and what it holds now), the picture being decoded,
+        // and what is in flight or queued.
+        let bytes = pic.saturating_mul(dpb).max(in_dpb).saturating_add(pic).saturating_add(pic.saturating_mul(self.max_in_flight as u64).max(queued));
+        ensure!(bytes <= self.memory_budget, "{}x{} pictures with {bytes} bytes in the decoder exceed the memory budget", sps.width(), sps.height());
         Ok(())
     }
 

crates/h264/src/dpb.rs

@@ -139,8 +139,9 @@ impl Dpb {
         let mut unused = (prev_ref_frame_num + 1) % max_frame_num;
         // Only the last `max_num_ref_frames` "non-existing" frames can survive the sliding window, and
         // inserting more than that evicts every earlier short-term reference. Skip straight to that tail
-        // (keeping the POC state walk for every missing frame_num) so a hostile gap of up to 65535
-        // frames costs at most `max_num_ref_frames` frame allocations instead of one per missing frame.
+        // (advancing the POC state across the skipped run in constant time) so a hostile gap of up to
+        // 65535 frames costs at most `max_num_ref_frames` frame allocations and POC updates instead of
+        // one per missing frame.
         let gap = frame_num.wrapping_add(max_frame_num).wrapping_sub(unused) % max_frame_num;
         let keep = u32::try_from(max_num_ref_frames.max(1)).unwrap_or(u32::MAX);
         let skip = gap.saturating_sub(keep);
@@ -149,10 +150,17 @@ impl Dpb {
                 e.mark = RefMark::Unused;
             }
             self.prune();
-            for _ in 0..skip {
-                poc_state(unused);
-                unused = (unused + 1) % max_frame_num;
+            // The POC state only advances FrameNumOffset where frame_num decreases, so walking the
+            // skipped run is the same as visiting its first value, the wrap (if the run crosses
+            // it) and its last value: constant work however long the gap.
+            let last = (unused + (skip - 1) % max_frame_num) % max_frame_num;
+            poc_state(unused);
+            if last < unused {
+                poc_state(max_frame_num - 1);
+                poc_state(0);
             }
+            poc_state(last);
+            unused = (last + 1) % max_frame_num;
         }
         let mut guard = 0;
         while unused != frame_num && guard < max_frame_num {
@@ -438,14 +446,15 @@ impl Dpb {
                 }
             }
         } else {
-            while self.entries.len() >= self.capacity {
+            // Evict until there is room (frame_num gap concealment can leave the DPB over-full), so
+            // the store never holds more pictures than the memory budget was checked for.
+            while self.entries.len() >= self.capacity.max(1) {
                 if !self.bump(out) {
                     if let Some(pos) = self.entries.iter().position(|e| !e.needed_for_output) {
                         self.entries.remove(pos);
                     } else {
                         self.entries.remove(0);
                     }
-                    break;
                 }
             }
         }
@@ -546,6 +555,37 @@ mod tests {
         (made, walk, left)
     }
 
+    /// (FrameNumOffset, prev frame_num) after `walk`, by the rule of `PocState::update_gap_frame`.
+    fn poc_after(walk: &[u32], prev: u32, max: u32) -> (u64, u32) {
+        walk.iter().fold((0, prev), |(off, prev), &f| (if prev > f { off + u64::from(max) } else { off }, f))
+    }
+
+    #[test]
+    fn gap_walk_matches_every_frame_num_for_any_skip() {
+        for (prev, cur) in [(1, 9), (10, 3), (14, 0), (15, 14), (0, 15), (7, 6)] {
+            for refs in 1..4 {
+                let mut dpb = Dpb::new();
+                let (_, walk, _) = fill(&mut dpb, prev, cur, 16, refs);
+                let every: Vec<u32> = (1..16).map(|i| (prev + i) % 16).take_while(|&f| f != cur).collect();
+                assert_eq!(poc_after(&walk, prev, 16), poc_after(&every, prev, 16), "{prev} -> {cur}, {refs} refs");
+                assert_eq!(walk.last(), every.last(), "{prev} -> {cur}, {refs} refs");
+            }
+        }
+    }
+
+    #[test]
+    fn reference_store_evicts_down_to_capacity() {
+        let mut dpb = Dpb::new();
+        dpb.capacity = 2;
+        // Gap concealment can leave more non-output references than the capacity.
+        for i in 0..5 {
+            short(&mut dpb, i, i);
+        }
+        let mut out = Vec::new();
+        assert!(!dpb.bump_for_space(RefMark::Short, 0, &mut out));
+        assert!(dpb.entries.len() < 2, "{} pictures left before storing into a 2-picture DPB", dpb.entries.len());
+    }
+
     #[test]
     fn huge_gap_makes_only_the_frames_that_stay_referenced() {
         let mut dpb = Dpb::new();
@@ -553,8 +593,9 @@ mod tests {
         short(&mut dpb, 2, 1);
         let (made, walk, left) = fill(&mut dpb, 1, 65535, 65536, 4);
         assert_eq!(made, 4);
-        // The POC state still walks every missing frame_num, in order.
-        assert_eq!(walk.len(), 65533);
+        // The POC state ends where walking every missing frame_num would leave it, in a few steps.
+        assert_eq!(poc_after(&walk, 1, 65536), poc_after(&(2..65535).collect::<Vec<_>>(), 1, 65536));
+        assert!(walk.len() <= 8, "{} POC updates", walk.len());
         assert_eq!(walk.first(), Some(&2));
         assert_eq!(walk.last(), Some(&65534));
         assert_eq!(left, vec![(65531, true), (65532, true), (65533, true), (65534, true)]);
@@ -566,7 +607,9 @@ mod tests {
         short(&mut dpb, 1, 65000);
         let (made, walk, left) = fill(&mut dpb, 65000, 3, 65536, 2);
         assert_eq!(made, 2);
-        assert_eq!(walk.len(), 538);
+        let every: Vec<u32> = (65001..65536).chain(0..3).collect();
+        assert_eq!(poc_after(&walk, 65000, 65536), poc_after(&every, 65000, 65536));
+        assert!(walk.len() <= 6, "{} POC updates", walk.len());
         assert_eq!(walk.first(), Some(&65001));
         assert_eq!(walk.last(), Some(&2));
         assert_eq!(left, vec![(1, true), (2, true)]);

crates/h264/src/picture.rs

@@ -160,6 +160,14 @@ impl Frame {
         self.rows.len()
     }
 
+    /// Sample bytes this picture holds (luma and both chroma planes), as the decoder's memory
+    /// budget counts a picture.
+    pub fn bytes(&self) -> u64 {
+        (self.width as u64)
+            .saturating_mul(self.height as u64)
+            .saturating_add((self.cwidth as u64).saturating_mul(self.cheight as u64).saturating_mul(2))
+    }
+
     /// Publish MB row `r` (ignored if already published).
     pub fn publish(&self, r: usize, row: FrameRow) {
         let _ = self.rows[r].set(row);

crates/h264/src/slicedec.rs

@@ -346,8 +346,11 @@ impl<'a> SliceDecoder<'a> {
     // Neighbour helpers
     // ------------------------------------------------------------------------------------------
 
-    /// Set up the current macroblock address and neighbour availability.
-    pub fn start_mb(&mut self, addr: usize) {
+    /// Set up the current macroblock address and neighbour availability. A macroblock an earlier
+    /// slice of this picture already decoded is refused: overlapping slices would otherwise redo
+    /// the picture's reconstruction once per slice.
+    pub fn start_mb(&mut self, addr: usize) -> Result<()> {
+        ensure!(self.pic.mbs[addr].slice_num == u32::MAX, "macroblock {addr} overlaps an earlier slice");
         self.mb_addr = addr;
         self.mb_x = addr % self.mb_w;
         self.mb_y = addr / self.mb_w;
@@ -364,6 +367,7 @@ impl<'a> SliceDecoder<'a> {
         ];
         self.mv_done = 0;
         self.pic.mbs[addr] = MbState { slice_num: sn, ..MbState::default() };
+        Ok(())
     }
 
     #[inline]
@@ -1467,7 +1471,7 @@ impl<'a> SliceDecoder<'a> {
                 let run = r.read_ue()? as usize;
                 ensure!(addr + run <= total, "mb_skip_run out of range");
                 for _ in 0..run {
-                    self.start_mb(addr);
+                    self.start_mb(addr)?;
                     self.decode_skip()?;
                     self.pic.mb_done(addr);
                     addr += 1;
@@ -1477,7 +1481,7 @@ impl<'a> SliceDecoder<'a> {
                 }
                 ensure!(addr < total, "macroblock address {addr} out of range");
             }
-            self.start_mb(addr);
+            self.start_mb(addr)?;
             self.decode_mb_cavlc(r)?;
             self.pic.mb_done(addr);
             addr += 1;

crates/h264/src/synth_tests.rs

@@ -113,6 +113,7 @@ fn avcc_rejects_a_valid_picture_slice_without_starting_a_picture() {
             poc_lsb: Some(0),
             poc_delta: None,
             wt: None,
+            first_mb: 0,
         },
         false,
     );
@@ -153,6 +154,8 @@ struct Pic {
     /// Explicit weights (luma, cb, cr) as (weight, offset) for refIdx 0 of list 0 and list 1;
     /// log2 denominators are 5 (luma) and 3 (chroma).
     wt: Option<[[(i32, i32); 3]; 2]>,
+    /// first_mb_in_slice (`mbs` then lists the slice's macroblocks from there).
+    first_mb: u32,
 }
 
 impl Pic {
@@ -165,7 +168,7 @@ impl Pic {
 }
 
 fn slice_header(w: &mut BitWriter, p: &Pic, cabac: bool) {
-    w.write_ue(0); // first_mb
+    w.write_ue(p.first_mb);
     w.write_ue(if p.b {
         6
     } else if p.is_p() {
@@ -660,3 +663,63 @@ fn frame_num_gap_is_filled_when_the_sps_allows_gaps() {
     assert_eq!(out.len(), 2);
     assert_eq!(dec.stats().frame_num_gaps, 1);
 }
+
+/// An IDR picture followed by `pictures` reference P pictures of P_Skip macroblocks.
+fn skip_stream(pictures: u32) -> (Vec<u8>, Vec<Vec<u8>>) {
+    let mut seed = 11u32;
+    let a: Vec<Option<Vec<u8>>> = (0..NMB).map(|_| Some(random_mb(&mut seed))).collect();
+    let mut head = sps(66, 2, false, PocType::T2);
+    head.extend(pps(false, false));
+    head.extend(slice_nal(&Pic { idr: true, frame_num: 0, ref_idc: 3, mbs: a, ..Default::default() }, false));
+    let ps = (1..=pictures).map(|k| slice_nal(&Pic { frame_num: k % 16, ref_idc: 2, mbs: vec![None; NMB], ..Default::default() }, false)).collect();
+    (head, ps)
+}
+
+#[test]
+fn overlapping_slices_are_not_reconstructed_twice() {
+    let (head, ps) = skip_stream(1);
+    let mut once = Decoder::with_threads(1);
+    let mut out = once.decode(&[head.clone(), ps[0].clone()].concat(), 0).unwrap();
+    out.extend(once.flush());
+    assert!(once.take_error().is_none());
+    assert_eq!(out.len(), 2);
+    // A second slice of the same picture starting at macroblock 1 covers those macroblocks again.
+    let again = slice_nal(&Pic { frame_num: 1, ref_idc: 2, mbs: vec![None; NMB - 1], first_mb: 1, ..Default::default() }, false);
+    let mut twice = Decoder::with_threads(1);
+    let result = twice.decode(&[head, ps[0].clone(), again].concat(), 0);
+    twice.flush();
+    let err = result.err().or_else(|| twice.take_error()).expect("overlapping slice refused");
+    assert!(err.to_string().contains("overlaps"), "{err}");
+}
+
+#[test]
+fn output_queue_counts_against_the_memory_budget() {
+    let (head, ps) = skip_stream(40);
+    let sps_nal = sps(66, 2, false, PocType::T2);
+    let parsed = crate::params::Sps::parse(&deckcraft_bitstream::unescape_rbsp(&sps_nal[5..])).unwrap();
+    let one = (NMB * 256 + 2 * NMB * 64) as u64;
+    let budget = (parsed.max_dpb_frames() + 1 + 3) as u64 * one;
+    // One access unit per call: output drains as it goes, and the stream fits.
+    let mut dec = Decoder::with_threads(1);
+    dec.set_memory_budget(budget);
+    let mut out = dec.decode(&head, 0).unwrap();
+    for (i, p) in ps.iter().enumerate() {
+        out.extend(dec.decode(p, i as i64 + 1).unwrap());
+    }
+    out.extend(dec.flush());
+    assert!(dec.take_error().is_none());
+    assert_eq!(out.len(), 41);
+    // Every access unit in one call: the pictures held for output stop fitting the budget.
+    let mut dec = Decoder::with_threads(1);
+    dec.set_memory_budget(budget);
+    let err = dec.decode(&[head, ps.concat()].concat(), 0).expect_err("output queue is over budget");
+    assert!(err.to_string().contains("memory budget"), "{err}");
+}
+
+/// A held picture is charged at its own size (luma and both 4:2:0 chroma planes), the same
+/// count the budget uses for the incoming SPS's pictures.
+#[test]
+fn a_held_frame_is_charged_at_its_own_size() {
+    let f = crate::picture::Frame::new(0, 0, 2, 3);
+    assert_eq!(f.bytes(), (2 * 3 * 256 + 2 * 2 * 3 * 64) as u64);
+}

crates/mcp/src/server.rs

@@ -16,12 +16,6 @@ const INVALID_REQUEST: i64 = -32600;
 const METHOD_NOT_FOUND: i64 = -32601;
 const INVALID_PARAMS: i64 = -32602;
 const INTERNAL_ERROR: i64 = -32603;
-
-/// Entries one batch (a JSON-RPC batch, or the `batch` tool's commands) may hold.
-pub(crate) const MAX_BATCH_ITEMS: usize = 1000;
-/// Bytes of results one batch may gather before the rest of it is refused: each result can copy
-/// much of the document (an inspection holds every note), so a batch holds at most this much.
-pub(crate) const MAX_BATCH_BYTES: usize = 64 << 20;
 const RESOURCE_NOT_FOUND: i64 = -32002;
 /// Keep request frames in step with the connected backend's reply limit.
 const MAX_FRAME_BYTES: usize = 16 * 1024 * 1024;
@@ -99,28 +93,8 @@ impl Server {
                 // Batches were removed in 2025-06-18; still answer older clients sensibly.
                 if batch.is_empty() {
                     Some(error(Value::Null, INVALID_REQUEST, "empty batch"))
-                } else if batch.len() > MAX_BATCH_ITEMS {
-                    Some(error(Value::Null, INVALID_REQUEST, format!("a batch holds at most {MAX_BATCH_ITEMS} messages")))
                 } else {
-                    let mut used = 0usize;
-                    let mut replies: Vec<Value> = Vec::new();
-                    for m in batch {
-                        if used > MAX_BATCH_BYTES {
-                            // Not run: answer each remaining request with a short error.
-                            if let Some(id) = m.get("id").filter(|id| id.is_string() || id.is_number()) {
-                                replies.push(error(id.clone(), INTERNAL_ERROR, "the batch's replies passed 64 MiB; not run"));
-                            }
-                            continue;
-                        }
-                        if let Some(r) = self.handle(m) {
-                            used = used.saturating_add(r.to_string().len());
-                            replies.push(if used > MAX_BATCH_BYTES {
-                                error(r.get("id").cloned().unwrap_or(Value::Null), INTERNAL_ERROR, "the batch's replies passed 64 MiB; reply dropped")
-                            } else {
-                                r
-                            });
-                        }
-                    }
+                    let replies: Vec<Value> = batch.into_iter().filter_map(|m| self.handle(m)).collect();
                     (!replies.is_empty()).then_some(Value::Array(replies))
                 }
             }

crates/mcp/src/tools.rs

@@ -357,30 +357,18 @@ pub fn call_tool(b: &mut dyn Backend, name: &str, a: &Value) -> ToolResult {
             wrap(exec(b, c, a.get("params").cloned().unwrap_or(json!({}))))
         }
         "batch" => {
-            use crate::server::{MAX_BATCH_BYTES, MAX_BATCH_ITEMS};
             let keep = a.get("keepGoing").and_then(Value::as_bool).unwrap_or(false);
-            let commands = a.get("commands").and_then(Value::as_array).map(Vec::as_slice).unwrap_or_default();
-            if commands.len() > MAX_BATCH_ITEMS {
-                return ToolResult::error(format!("a batch holds at most {MAX_BATCH_ITEMS} commands"));
-            }
             let mut out = vec![];
-            let mut used = 0usize;
-            for c in commands {
+            for c in a.get("commands").and_then(Value::as_array).cloned().unwrap_or_default() {
                 let id = c.get("command").and_then(Value::as_str).unwrap_or("");
-                let (entry, failed) = match exec(b, id, c.get("params").cloned().unwrap_or(json!({}))) {
-                    Ok(v) => (json!({"command": id, "ok": true, "result": v}), false),
-                    Err(e) => (json!({"command": id, "ok": false, "error": e}), true),
-                };
-                // What the reply carries: the entry as text, escaped again inside the JSON-RPC reply.
-                // Failures count too: with keepGoing, a remote backend's large errors add up.
-                used = used.saturating_add(json!(entry.to_string()).to_string().len());
-                if used > MAX_BATCH_BYTES {
-                    out.push(json!({"command": id, "ok": false, "error": "the batch's results passed 64 MiB; stopped here"}));
-                    return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
-                }
-                out.push(entry);
-                if failed && !keep {
-                    return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
+                match exec(b, id, c.get("params").cloned().unwrap_or(json!({}))) {
+                    Ok(v) => out.push(json!({"command": id, "ok": true, "result": v})),
+                    Err(e) => {
+                        out.push(json!({"command": id, "ok": false, "error": e}));
+                        if !keep {
+                            return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
+                        }
+                    }
                 }
             }
             ToolResult::json(&Value::Array(out))

crates/mcp/tests/it/batch_budget.rs

@@ -1,70 +0,0 @@
-//! A batch (JSON-RPC or the `batch` tool) is bounded in entries and in the bytes of results it
-//! gathers, so a short request cannot copy a large document into memory hundreds of times.
-
-use deckcraft_mcp::{Headless, Server};
-use serde_json::{Value, json};
-
-fn server_with_notes(bytes: usize) -> Server {
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let line = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "run_command", "arguments": {"command": "slide.notes", "params": {"text": "n".repeat(bytes)}}}});
-    let reply: Value = serde_json::from_str(&server.handle_line(&line.to_string()).unwrap()).unwrap();
-    assert_ne!(reply["result"]["isError"], true, "{reply}");
-    server
-}
-
-#[test]
-fn json_rpc_batches_are_bounded_in_entries_and_reply_bytes() {
-    let mut server = server_with_notes(1 << 20);
-    let ping = |i: usize| json!({"jsonrpc": "2.0", "id": i, "method": "ping"});
-    let too_many: Vec<Value> = (0..1001).map(ping).collect();
-    let reply: Value = serde_json::from_str(&server.handle_line(&Value::Array(too_many).to_string()).unwrap()).unwrap();
-    assert_eq!(reply["error"]["code"], -32600, "{reply}");
-    // 100 inspections of a slide with 1 MB of notes: about 64 are answered, the rest refused.
-    let inspect = |i: usize| json!({"jsonrpc": "2.0", "id": i, "method": "tools/call", "params": {"name": "inspect_slide", "arguments": {}}});
-    let line = Value::Array((0..100).map(inspect).collect()).to_string();
-    let reply = server.handle_line(&line).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    let replies: Vec<Value> = serde_json::from_str(&reply).unwrap();
-    assert_eq!(replies.len(), 100, "every request is answered");
-    assert!(replies.last().unwrap()["error"]["message"].as_str().unwrap().contains("64 MiB"));
-}
-
-#[test]
-fn the_batch_tool_is_bounded_in_commands_and_result_bytes() {
-    let mut server = server_with_notes(1 << 20);
-    let call = |server: &mut Server, commands: Vec<Value>| {
-        let line = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-        let reply: Value = serde_json::from_str(&server.handle_line(&line.to_string()).unwrap()).unwrap();
-        (reply["result"]["isError"] == true, reply["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string())
-    };
-    let (err, text) = call(&mut server, vec![json!({"command": "document.inspect"}); 1001]);
-    assert!(err && text.contains("at most 1000"), "{text}");
-    let (err, text) = call(&mut server, vec![json!({"command": "slide.inspect"}); 100]);
-    assert!(err && text.contains("64 MiB"), "{}", &text[text.len().saturating_sub(200)..]);
-    assert!(text.len() < (64 << 20) + (4 << 20));
-}
-
-#[test]
-fn the_batch_tool_charges_the_escaped_reply() {
-    // Quotes escape twice on the way out (`\\\"`), so 30 results of ~2 MiB serialize to ~120 MiB.
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let notes = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "run_command", "arguments": {"command": "slide.notes", "params": {"text": "\"".repeat(1 << 20)}}}});
-    server.handle_line(&notes.to_string()).unwrap();
-    let commands = vec![json!({"command": "slide.inspect"}); 30];
-    let line = json!({"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-    let reply = server.handle_line(&line.to_string()).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    assert!(reply.contains("64 MiB"));
-}
-
-#[test]
-fn the_batch_tool_charges_failures_too() {
-    // Each unknown command's error echoes its ~1 MiB id; with keepGoing none of them is a result.
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let id = "x".repeat(1 << 20);
-    let commands = vec![json!({"command": id}); 70];
-    let line = json!({"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-    let reply = server.handle_line(&line.to_string()).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    assert!(reply.contains("64 MiB"));
-}

crates/mcp/tests/it/main.rs

@@ -1,5 +1,3 @@
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md).
 #[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 mod automation_roots;
-#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-mod batch_budget;