CI: nightly release dry run

release.yml also runs nightly on main with craft-common-actions' dry-run: every release build
except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits
(riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release
day, as it did on 11 Nov 2026.

.github/workflows/ci.yml

@@ -26,6 +26,10 @@ jobs:
       # Same craft-fonts commit as release.yml.
       CRAFT_FONTS_REF: 37827adc41fd165f9a9234ac40f94dbad353aa69
     steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
       - name: Check out craft-fonts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/packaging-lint.yml

@@ -27,6 +27,10 @@ jobs:
     name: Windows installation policy (no app build)
     runs-on: windows-latest
     steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false

.github/workflows/release.yml

@@ -1,6 +1,10 @@
 name: Release
 
 on:
+  # A nightly dry run on main: every release build except macOS, nothing signed or released
+  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
+  schedule:
+    - cron: "16 1 * * *"
   push:
     branches: [release]
   workflow_dispatch:
@@ -30,6 +34,7 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
+      dry-run: ${{ github.event_name == 'schedule' }}
       app-name: deckcraft
       app-title: DeckCraft
       # Keep identical to ci.yml and freebsd.yml. The shared release workflow sets

Cargo.lock

@@ -844,15 +844,24 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "craft-audio"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=75895c0321d8cb6e175a42466cba050352b117c5#75895c0321d8cb6e175a42466cba050352b117c5"
+dependencies = [
+ "craft-media",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 
 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
  "fixed_decimal",
  "icu_decimal",
@@ -875,7 +884,7 @@ dependencies = [
 [[package]]
 name = "craft-media"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=75895c0321d8cb6e175a42466cba050352b117c5#75895c0321d8cb6e175a42466cba050352b117c5"
 dependencies = [
  "thiserror 2.0.21",
 ]
@@ -883,7 +892,7 @@ dependencies = [
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
  "krilla",
  "thiserror 2.0.21",
@@ -892,7 +901,7 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
  "craft-fonts-build",
  "craft-i18n",
@@ -912,7 +921,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
  "chrono",
  "dunce",
@@ -922,6 +931,7 @@ dependencies = [
  "image",
  "log",
  "plist",
+ "rustix 1.1.5",
  "semver",
  "serde",
  "serde_json",
@@ -935,10 +945,21 @@ dependencies = [
  "zip 9.1.0",
 ]
 
+[[package]]
+name = "craft-web-api"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=fd5e2feff6ea25bed371a99cc732b3968d621505#fd5e2feff6ea25bed371a99cc732b3968d621505"
+dependencies = [
+ "js-sys",
+ "serde_json",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+]
+
 [[package]]
 name = "craft-web-host"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=2e2312ddaf21bc3d85cd3395d0955c7d239306f6#2e2312ddaf21bc3d85cd3395d0955c7d239306f6"
+source = "git+https://github.com/storytold/craft-libs?rev=fd5e2feff6ea25bed371a99cc732b3968d621505#fd5e2feff6ea25bed371a99cc732b3968d621505"
 dependencies = [
  "wasm-bindgen",
  "web-sys",
@@ -1017,7 +1038,7 @@ checksum = "0c87e182de0887fd5361989c677c4e8f5000cd9491d6d563161a8f3a5519fc7f"
 
 [[package]]
 name = "deckcraft"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "arboard",
  "chrono",
@@ -1039,7 +1060,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-anim"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-geom",
  "deckcraft-model",
@@ -1048,7 +1069,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-av1"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1057,14 +1078,14 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-bitstream"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "craft-media",
 ]
 
 [[package]]
 name = "deckcraft-cli"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-engine",
  "deckcraft-mcp",
@@ -1074,14 +1095,14 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-color"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "deckcraft-engine"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "chrono",
  "deckcraft-anim",
@@ -1107,7 +1128,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-fonts"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "epaint_default_fonts",
  "harfrust 0.13.3",
@@ -1119,7 +1140,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-format"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-model",
  "serde",
@@ -1130,7 +1151,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-geom"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "kurbo",
  "serde",
@@ -1138,7 +1159,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-h264"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1147,30 +1168,16 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-hevc"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
  "thiserror 2.0.21",
 ]
 
-[[package]]
-name = "deckcraft-isobmff"
-version = "0.15.0"
-dependencies = [
- "craft-media",
-]
-
-[[package]]
-name = "deckcraft-matroska"
-version = "0.15.0"
-dependencies = [
- "craft-media",
-]
-
 [[package]]
 name = "deckcraft-mcp"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-engine",
  "deckcraft-render",
@@ -1180,15 +1187,13 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-media"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
+ "craft-audio",
+ "craft-media",
  "deckcraft-av1",
  "deckcraft-h264",
  "deckcraft-hevc",
- "deckcraft-isobmff",
- "deckcraft-matroska",
- "deckcraft-ogg",
- "deckcraft-opus",
  "deckcraft-vp9",
  "image",
  "log",
@@ -1198,7 +1203,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-metafile"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "image",
  "kurbo",
@@ -1207,7 +1212,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-model"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-color",
  "deckcraft-geom",
@@ -1217,17 +1222,9 @@ dependencies = [
  "unicode-segmentation",
 ]
 
-[[package]]
-name = "deckcraft-ogg"
-version = "0.15.0"
-
-[[package]]
-name = "deckcraft-opus"
-version = "0.15.0"
-
 [[package]]
 name = "deckcraft-pdf"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "craft-pdf",
  "deckcraft-fonts",
@@ -1245,7 +1242,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-pptx"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-color",
  "deckcraft-engine",
@@ -1261,7 +1258,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-render"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-anim",
  "deckcraft-color",
@@ -1280,7 +1277,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-text"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "chrono",
  "deckcraft-color",
@@ -1294,7 +1291,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-ui-egui"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "craft-ui",
  "craft-update",
@@ -1320,7 +1317,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-vp9"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1329,8 +1326,9 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-web"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
+ "craft-web-api",
  "craft-web-host",
  "deckcraft-engine",
  "deckcraft-ui-egui",
@@ -2779,7 +2777,7 @@ dependencies = [
 [[package]]
 name = "krilla"
 version = "0.8.2"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
 dependencies = [
  "base64 0.22.1",
  "bumpalo",
@@ -6313,7 +6311,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.15.0"
+version = "0.18.1"
 dependencies = [
  "serde_json",
 ]
@@ -6559,7 +6557,6 @@ dependencies = [
  "nix",
  "typed-path",
  "windows-sys 0.61.2",
- "zopfli",
 ]
 
 [[package]]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/deckcraft", "apps/deckcraft-cli"]
 
 [workspace.package]
-version = "0.15.0"
+version = "0.18.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -27,16 +27,12 @@ deckcraft-engine = { path = "crates/engine" }
 deckcraft-mcp = { path = "crates/mcp" }
 deckcraft-ui-egui = { path = "crates/ui-egui" }
 deckcraft-media = { path = "crates/media" }
-# codecs (ported from FilmCraft, same owner and licence)
+# video codecs (ported from FilmCraft, same owner and licence)
 deckcraft-bitstream = { path = "crates/bitstream" }
 deckcraft-h264 = { path = "crates/h264" }
 deckcraft-hevc = { path = "crates/hevc" }
 deckcraft-vp9 = { path = "crates/vp9" }
 deckcraft-av1 = { path = "crates/av1" }
-deckcraft-isobmff = { path = "crates/isobmff" }
-deckcraft-matroska = { path = "crates/matroska" }
-deckcraft-ogg = { path = "crates/ogg" }
-deckcraft-opus = { path = "crates/opus" }
 
 # foundation
 kurbo = { version = "0.13", features = ["serde"] }
@@ -59,11 +55,13 @@ harfrust = "0.13"
 vello_cpu = "0.2"
 vello_common = { version = "0.2", default-features = false }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
-craft-media = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.1.0", default-features = false }
-craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.1.0", default-features = false, features = ["write", "write-simple-text"] }
+# craft-media and craft-audio share types and stay on one rev.
+craft-media = { git = "https://github.com/storytold/craft-libs", rev = "75895c0321d8cb6e175a42466cba050352b117c5", version = "=0.1.0", default-features = false }
+craft-audio = { git = "https://github.com/storytold/craft-libs", rev = "75895c0321d8cb6e175a42466cba050352b117c5", version = "=0.1.0", default-features = false, features = ["opus-decode"] }
+craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.1.0", default-features = false, features = ["write", "write-simple-text"] }
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
-craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.1.0" }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", features = ["egui"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.1.0" }
 i_overlay = "9"
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
@@ -109,7 +107,7 @@ codegen-units = 16
 debug = 0
 
 [patch.crates-io]
-krilla = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.8.2" }
+krilla = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.8.2" }
 ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }

NOTICE

@@ -76,8 +76,9 @@ Code dependencies
 - symphonia (audio decoding for MP3, AAC, ALAC, FLAC, Vorbis, WAV, AIFF, CAF) is used unmodified
   under the Mozilla Public License 2.0; its source is available at
   https://github.com/pdeljanov/Symphonia.
-- The H.264, HEVC, VP9, AV1, Opus, MP4, Matroska and Ogg crates under crates/ are ported from
-  FilmCraft (same owner, MIT OR Apache-2.0).
+- The H.264, HEVC, VP9 and AV1 crates under crates/ are ported from FilmCraft (same owner,
+  MIT OR Apache-2.0). The Opus decoder (craft-audio) and the MP4, Matroska and Ogg demuxers
+  (craft-media) come from craft-libs (same owner, MIT OR Apache-2.0).
 
 - Krilla 0.8.2 (https://github.com/LaurenzV/krilla) is used through craft-pdf under
   MIT OR Apache-2.0. craft-libs vendors that version with page/surface unwind recovery

ROADMAP.md

@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~20 points and ~120–210 h away
 
-> **Last reviewed:** 2026-11-04 · **Last updated:** 2026-11-04 · **Change:** trivial (Ogg Opus recovery includes trailing packets without granules in its reported duration; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-11-04 · **Last updated:** 2026-11-11 · **Change:** trivial (the Opus decoder and the Ogg, MP4 and Matroska demuxers come from craft-libs; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-11-02 · **Last updated:** 2026-11-03 · **Change:** trivial (progress log: web `?host=parent` bridge opens and saves through a same-origin framing page; scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 
 > **Last reviewed:** 2026-11-02 · **Last updated:** 2026-11-03 · **Change:** trivial (community PR wave 10: PPTX and native saves keep table cell centred anchoring, text overflow, compatible line spacing, normalised character height, Thai distributed alignment, RTL table direction, alternate run language and reflection transforms; imported effects placed by parent time-node delays; Reuse Slides fits the destination size and brings custom table styles; deleted slides leave custom shows; merged shapes drop their animations; Compress Pictures measures grouped pictures at displayed size; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
@@ -154,6 +154,7 @@ app's JSON control channel (`deckcraft --control PORT`).
 
 | Date | What landed |
 |---|---|
+| 2026-11-11 | Media: the Opus decoder and the Ogg, MP4/MOV and Matroska demuxers are craft-audio and craft-media from craft-libs; DeckCraft's own copies and re-export crates are removed |
 | 2026-11-04 | Ogg Opus recovery keeps trailing packets without granules in the total duration, matching their recovered positions; valid end trimming stays covered |
 | 2026-11-03 | Web: the `?host=parent` bridge (as in GridCraft, WordCraft and PdfCraft) lets a same-origin page that frames DeckCraft send a presentation and store its saves; Save writes an opened .pptx back as .pptx under its own name, as on the desktop |
 | 2026-11-02 | Slide show on Linux and the BSDs: Presenter View stays off when winit lists exactly one display, as in PowerPoint; if it lists none, the setting is kept. On one display the presenter window covered the show, and the hidden window stalled every frame: slide changes took up to ~1.7 s under Hyprland (#1156) |
@@ -340,6 +341,7 @@ app's JSON control channel (`deckcraft --control PORT`).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-11 | trivial | Opus and container code moved to craft-libs crates; parity scores unchanged |
 | 2026-11-04 | trivial | Ogg Opus recovery duration includes its recovered tail; parity scores unchanged |
 | 2026-11-02 | trivial | Progress log: run alternate-language metadata round-trips through native and PPTX formats; product parity scores unchanged |
 | 2026-11-03 | trivial | Reuse Slides brings referenced custom table styles along; scores unchanged |

apps/deckcraft-web/Cargo.toml

@@ -16,8 +16,10 @@ path = "src/main.rs"
 [dependencies]
 deckcraft-engine = { workspace = true }
 deckcraft-ui-egui = { workspace = true }
+# The page command API (storytold/craft-libs#413): window.deckcraft over the control channel.
+craft-web-api = { git = "https://github.com/storytold/craft-libs", rev = "fd5e2feff6ea25bed371a99cc732b3968d621505", version = "0.1.0" }
 # The host messages (storytold/craft-libs): one contract and one bridge for the web builds.
-craft-web-host = { git = "https://github.com/storytold/craft-libs", rev = "2e2312ddaf21bc3d85cd3395d0955c7d239306f6", version = "0.1.0" }
+craft-web-host = { git = "https://github.com/storytold/craft-libs", rev = "fd5e2feff6ea25bed371a99cc732b3968d621505", version = "0.1.0" }
 egui = { workspace = true }
 log = { workspace = true }
 serde_json = { workspace = true }

apps/deckcraft-web/src/api.rs

@@ -0,0 +1,151 @@
+//! `window.deckcraft`: the page command API (`craft-web-api`, storytold/craft-libs#413) over the
+//! app's own control channel, the one the desktop control server drives (`docs/control-protocol.md`).
+//!
+//! The crate owns the JavaScript side (`request`, `execute`, `commands`, `docInspect`, `uiInspect`,
+//! `screenshot`, as promises with a timeout). This module is DeckCraft's part: a [`Request`] that
+//! queues a [`ControlRequest`] for the app, which answers it on its next frame, and waits for the
+//! reply. A call the page gave up on is released ([`Pending`]), so the app skips it if it has not started it, instead of
+//! applying a command the page was told had failed.
+
+use std::sync::Arc;
+use std::sync::atomic::AtomicU8;
+use std::sync::mpsc::{Receiver, TryRecvError};
+
+use deckcraft_ui_egui::ControlRequest;
+use serde_json::{Value, json};
+
+/// How often a waiting call looks for the app's reply, in milliseconds (about a frame).
+#[cfg(target_arch = "wasm32")]
+const POLL_MS: i32 = 16;
+
+/// A queued control request whose reply has not arrived. Dropping it before the reply (the page's
+/// timeout fired, or the call was abandoned) releases the request: the app skips it if it has not started it (one it has taken still finishes).
+struct Pending {
+    reply: Receiver<Value>,
+    state: Arc<AtomicU8>,
+    answered: bool,
+}
+
+impl Pending {
+    /// `Some` once the app has answered or gone away; `None` while the request is still waiting.
+    fn poll(&mut self) -> Option<Value> {
+        match self.reply.try_recv() {
+            Ok(reply) => {
+                self.answered = true;
+                Some(reply)
+            }
+            Err(TryRecvError::Empty) => None,
+            Err(TryRecvError::Disconnected) => {
+                self.answered = true;
+                Some(json!({"ok": false, "error": "the app dropped the request"}))
+            }
+        }
+    }
+}
+
+impl Drop for Pending {
+    fn drop(&mut self) {
+        if !self.answered {
+            ControlRequest::abandon(&self.state);
+        }
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+pub use web::install;
+
+#[cfg(target_arch = "wasm32")]
+mod web {
+    use std::rc::Rc;
+    use std::sync::mpsc::channel;
+
+    use craft_web_api::methods::Methods;
+    use craft_web_api::page::{PageApi, Request};
+    use deckcraft_ui_egui::{ControlRequest, SlideApp};
+    use serde_json::json;
+    use wasm_bindgen_futures::JsFuture;
+
+    use super::{POLL_MS, Pending};
+
+    /// The app id in `window.<app>`.
+    const APP: &str = "deckcraft";
+
+    /// Give the app its control queue and put `window.deckcraft` on the page. An existing
+    /// `window.deckcraft` keeps the functions it already has.
+    pub fn install(app: &mut SlideApp, ctx: egui::Context) {
+        let (queue, requests) = channel::<ControlRequest>();
+        app.control_rx = Some(requests);
+        let request: Request = Rc::new(move |method, params| {
+            let (control, reply) = ControlRequest::new(method, params);
+            let mut pending = Pending { reply, state: control.state.clone(), answered: false };
+            if queue.send(control).is_err() {
+                pending.answered = true;
+                return Box::pin(async { json!({"ok": false, "error": "the app is not running"}) });
+            }
+            ctx.request_repaint();
+            Box::pin(async move {
+                loop {
+                    if let Some(reply) = pending.poll() {
+                        return reply;
+                    }
+                    sleep(POLL_MS).await;
+                }
+            })
+        });
+        if let Err(e) = Rc::new(PageApi::new(APP, Methods::default(), request)).install() {
+            log::warn!("couldn't install window.{APP}: {e:?}");
+        }
+    }
+
+    async fn sleep(ms: i32) {
+        let promise = js_sys::Promise::new(&mut |resolve, _| {
+            if let Some(window) = web_sys::window() {
+                let _ = window.set_timeout_with_callback_and_timeout_and_arguments_0(&resolve, ms);
+            }
+        });
+        let _ = JsFuture::from(promise).await;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::atomic::Ordering;
+
+    use super::*;
+
+    /// `ControlRequest`'s `state` values (`deckcraft_ui_egui::control`): the app has started it, or its
+    /// sender gave up.
+    const TAKEN: u8 = 1;
+    const ABANDONED: u8 = 2;
+
+    fn pending() -> (Pending, ControlRequest) {
+        let (control, reply) = ControlRequest::new("document.inspect", json!({}));
+        (Pending { reply, state: control.state.clone(), answered: false }, control)
+    }
+
+    #[test]
+    fn a_call_the_page_gave_up_on_is_released_so_the_app_skips_it() {
+        let (waiting, control) = pending();
+        drop(waiting);
+        assert_eq!(control.state.load(Ordering::SeqCst), ABANDONED);
+        assert!(!control.take(), "the app must not run a request the page was told had failed");
+    }
+
+    #[test]
+    fn an_answered_call_is_not_released() {
+        let (mut waiting, control) = pending();
+        assert!(control.take());
+        control.reply.send(json!({"ok": true, "result": 1})).unwrap_or_default();
+        assert_eq!(waiting.poll(), Some(json!({"ok": true, "result": 1})));
+        drop(waiting);
+        assert_eq!(control.state.load(Ordering::SeqCst), TAKEN);
+    }
+
+    #[test]
+    fn a_request_the_app_never_runs_waits_until_it_is_dropped() {
+        let (mut waiting, control) = pending();
+        assert_eq!(waiting.poll(), None);
+        drop(control);
+        assert_eq!(waiting.poll().and_then(|r| r["ok"].as_bool()), Some(false), "the app went away");
+    }
+}

apps/deckcraft-web/src/main.rs

@@ -21,6 +21,8 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
+#[cfg(any(target_arch = "wasm32", test))]
+mod api;
 #[cfg(target_arch = "wasm32")]
 mod host;
 #[cfg(target_arch = "wasm32")]

apps/deckcraft-web/src/web.rs

@@ -79,6 +79,7 @@ pub fn start() {
                     {
                         crate::host::Bridge::set_author(&mut app, &author);
                     }
+                    crate::api::install(&mut app, cc.egui_ctx.clone());
                     Ok(Box::new(WebShell { app, inbox, bridge: app_bridge }))
                 }),
             )

apps/deckcraft/src/logging.rs

@@ -148,7 +148,19 @@ pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
 /// One formatted log line: `<timestamp> <LEVEL> [<thread>] <target>: <message>\n`.
 pub fn format_line(ts: &str, level: log::Level, thread: &str, target: &str, message: &str) -> String {
     let message = message.strip_suffix('\n').unwrap_or(message);
-    format!("{ts} {level:<5} [{thread}] {target}: {message}\n")
+    // Messages can embed document-controlled text (a part name, a relationship id): control
+    // characters other than tab are escaped and each continuation line is marked, so such text
+    // cannot start a line that looks like a record of its own.
+    let mut text = String::with_capacity(message.len());
+    for c in message.chars() {
+        match c {
+            '\n' => text.push_str("\n    | "),
+            '\t' => text.push(c),
+            c if c.is_control() => text.extend(c.escape_default()),
+            c => text.push(c),
+        }
+    }
+    format!("{ts} {level:<5} [{thread}] {target}: {text}\n")
 }
 
 /// Where formatted lines go besides standard error: kept in memory until a file is attached,
@@ -446,8 +458,13 @@ mod tests {
             ),
             "2026-10-08T07:59:17.728Z WARN  [main] deckcraft_pptx::opc: pptx: skipping oversized part ppt/media/image1.png\n"
         );
-        // A multi-line message keeps its lines; the record still ends in exactly one newline.
-        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\nb\n"));
+        // A multi-line message keeps its lines, each continuation marked; the record still ends in
+        // exactly one newline.
+        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\n    | b\n"));
+        // Injected line breaks and escape sequences cannot forge a record.
+        let line = format_line("t", log::Level::Warn, "w", "x", "part a\r\n2026 ERROR [m] y: forged\x1b[2J");
+        assert_eq!(line.matches('\n').count(), 2);
+        assert!(!line.contains('\r') && !line.contains('\x1b'));
     }
 
     #[test]

apps/deckcraft/src/main.rs

@@ -51,6 +51,9 @@ impl eframe::App for App {
     }
     fn on_exit(&mut self) {
         save_prefs(&self.0);
+        // The window is closing for good: a ready update's helper starts now and installs it once
+        // the process has exited.
+        self.0.start_pending_update();
         // macOS (#279): end the process here, before eframe tears the window down. AccessKit's
         // macOS adapter subclasses the window's content view and restores its class on teardown;
         // AppKit's Touch Bar support observes that view (KVO), so in the next display cycle

crates/av1/src/decoder.rs

@@ -118,6 +118,8 @@ enum Output {
         grain: FilmGrainParams,
         apply_film_grain: bool,
         pts: i64,
+        /// What copying the picture out costs, in the reference's own format.
+        bytes: u64,
     },
 }
 
@@ -132,7 +134,7 @@ impl Output {
     fn take(self) -> Result<Picture> {
         match self {
             Output::Decoded(s) => s.wait().map(|p| Arc::try_unwrap(p).unwrap_or_else(|p| (*p).clone())),
-            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts } => {
+            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts, .. } => {
                 let rf = slot.wait()?;
                 Ok(output_picture(&seq, &rf, width, height, &grain, apply_film_grain, pts))
             }
@@ -379,8 +381,8 @@ impl Decoder {
         // Output policy (7.18.1 note): with scalability, show one frame per temporal unit, the
         // highest spatial layer present.
         let scalable = self.seq.as_ref().is_some_and(|s| s.op_idc != 0);
-        if !scalable {
-            self.out.extend(out.into_iter().map(|(o, _, _)| o));
+        let kept: Vec<Output> = if !scalable {
+            out.into_iter().map(|(o, _, _)| o).collect()
         } else {
             let mut last: Option<(usize, u32)> = None;
             let mut sel: Vec<Output> = Vec::new();
@@ -400,8 +402,27 @@ impl Decoder {
                     }
                 }
             }
-            self.out.extend(sel);
+            sel
+        };
+        // Every repeat is copied out whole, so the repeats this call keeps (after the layer
+        // selection) must not queue more than half the decoder budget; the first one over it and
+        // everything after is dropped.
+        let mut r = r;
+        let mut repeat_bytes = 0u64;
+        let mut ok = Vec::with_capacity(kept.len());
+        for o in kept {
+            if let Output::Existing { bytes, .. } = &o {
+                repeat_bytes = repeat_bytes.saturating_add(*bytes);
+                if repeat_bytes > self.memory_budget / 2 {
+                    if r.is_ok() {
+                        r = Err(Error::Invalid("repeated frame outputs exceed the decoder memory budget"));
+                    }
+                    break;
+                }
+            }
+            ok.push(o);
         }
+        self.out.extend(ok);
         r
     }
 
@@ -503,6 +524,15 @@ impl Decoder {
             let idx = fh.frame_to_show_map_idx;
             let slot = self.ref_frames[idx].clone().ok_or(Error::Invalid("show_existing_frame of an empty slot"))?;
             let info = self.refs[idx].clone();
+            // Sized in the reference's own format: a new sequence header may differ from it.
+            let shape = deckcraft_bitstream::budget::PictureShape {
+                width: u64::from(info.upscaled_width),
+                height: u64::from(info.frame_height),
+                shift_x: u32::from(info.subsampling_x),
+                shift_y: u32::from(info.subsampling_y),
+                chroma_planes: if info.mono_chrome { 0 } else { 2 },
+                bytes_per_sample: 2,
+            };
             let o = Output::Existing {
                 slot: slot.clone(),
                 seq: seq.clone(),
@@ -511,6 +541,7 @@ impl Decoder {
                 grain: fh.film_grain.clone(),
                 apply_film_grain: self.apply_film_grain,
                 pts: self.pts,
+                bytes: shape.bytes().unwrap_or(u64::MAX),
             };
             if fh.frame_type == KEY_FRAME as u8 {
                 // reference frame loading process (7.21) then refresh every slot (7.20)
@@ -629,6 +660,9 @@ impl Decoder {
                 ri.lf_deltas = fh.lf.deltas;
                 ri.seg_features = fh.seg.features;
                 ri.grain = fh.film_grain.clone();
+                ri.subsampling_x = job.seq.color.subsampling_x;
+                ri.subsampling_y = job.seq.color.subsampling_y;
+                ri.mono_chrome = job.seq.color.mono_chrome;
                 self.ref_frames[i] = Some(job.slot.clone());
             }
         }

crates/av1/src/header.rs

@@ -360,6 +360,10 @@ pub struct RefInfo {
     pub lf_deltas: LoopFilterDeltas,
     pub seg_features: SegmentationFeatures,
     pub grain: FilmGrainParams,
+    /// The colour format the frame was decoded in (a later sequence header may change it).
+    pub subsampling_x: u8,
+    pub subsampling_y: u8,
+    pub mono_chrome: bool,
 }
 
 /// A parsed uncompressed frame header with its derived variables.

crates/engine/src/cmd.rs

@@ -466,22 +466,26 @@ fn ctx_xfrm(doc: &deckcraft_model::Presentation, sel: &crate::Selection, shape:
 
 /// Run `f` on each target shape (copy-on-write), materialising inherited boxes first.
 pub(crate) fn edit_shapes(s: &mut Session, p: &Value, cmd: &str, f: impl Fn(&mut deckcraft_model::Shape) -> Result<()>) -> Result<Value> {
-    let ids = targets(s, p)?;
+    let mut ids = targets(s, p)?;
     if ids.is_empty() {
         return Err(bad(cmd, "no shapes selected"));
     }
+    // A shape named twice is edited once.
+    let mut seen = std::collections::HashSet::new();
+    ids.retain(|id| seen.insert(*id));
     s.edit(|doc, sel| {
-        let boxes: Vec<(ShapeId, Xfrm)> = {
-            let st_shapes: Vec<deckcraft_model::Shape> =
-                ids.iter().filter_map(|id| current_shapes(doc, sel).and_then(|v| deckcraft_model::find_shape(v, *id)).cloned()).collect();
-            st_shapes.iter().map(|sh| (sh.id, xfrm_of(doc, sel, sh))).collect()
-        };
+        // The boxes are read from the shapes in place: no copy of a shape (and its text) per id.
+        let boxes: std::collections::HashMap<ShapeId, Xfrm> = ids
+            .iter()
+            .filter_map(|id| current_shapes(doc, sel).and_then(|v| deckcraft_model::find_shape(v, *id)))
+            .map(|sh| (sh.id, xfrm_of(doc, sel, sh)))
+            .collect();
         let shapes = crate::shapes_mut(doc, sel).ok_or_else(|| bad(cmd, "no slide"))?;
         let mut n = 0;
         for id in &ids {
             if let Some(sh) = deckcraft_model::find_shape_mut(shapes, *id) {
                 if sh.xfrm.is_none() {
-                    sh.xfrm = boxes.iter().find(|(i, _)| i == id).map(|(_, x)| *x);
+                    sh.xfrm = boxes.get(id).copied();
                 }
                 f(sh)?;
                 n += 1;

crates/engine/src/cmd/format/paragraph.rs

@@ -120,13 +120,7 @@ pub(super) fn line_spacing(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 pub(super) fn paragraph(s: &mut Session, p: &Value) -> Result<Value> {
-    let a = str_param(p, "align").map(|a| match a {
-        "center" => Align::Center,
-        "right" => Align::Right,
-        "justify" => Align::Justify,
-        "distributed" => Align::Distributed,
-        _ => Align::Left,
-    });
+    let a = str_param(p, "align").map(|a| parse_align("format.paragraph", a)).transpose()?;
     let ml = f64_param(p, "indentLeft");
     let ind = f64_param(p, "indentFirst");
     let sb = f64_param(p, "spaceBefore");
@@ -182,10 +176,10 @@ pub(super) fn clamp_pt(v: f64) -> f64 {
 fn parse_align(cmd: &str, s: &str) -> Result<Align> {
     Ok(match s {
         "left" | "l" => Align::Left,
-        "center" | "ctr" => Align::Center,
+        "center" | "centre" | "ctr" => Align::Center,
         "right" | "r" => Align::Right,
         "justify" | "just" => Align::Justify,
-        "justLow" => Align::JustLow,
+        "justLow" | "justifyLow" => Align::JustLow,
         "distributed" | "dist" => Align::Distributed,
         "thaiDist" => Align::ThaiDistributed,
         _ => return Err(bad(cmd, "`align` must be left, center, right, justify, justLow, distributed or thaiDist")),

crates/engine/src/cmd/insert/album.rs

@@ -80,6 +80,12 @@ pub(super) fn photo_album_edit(s: &mut Session, p: &Value) -> Result<Value> {
     let opts = album_opts(p)?;
     let items = album_items(p)?;
     let (id, ids) = album_target(s, p)?;
+    // The editor is seeded within the album limits; replacing the album from a trimmed seed would
+    // delete what it left out, so refuse rather than lose it.
+    let st = s.doc()?;
+    if items_from_slides(&st.doc, &album_slides(st, &ids)).1 {
+        return Err(bad("insert.photoAlbumEdit", "this album holds more than the editor can carry; editing it would delete the rest"));
+    }
     commit_album(s, items, opts, Some((id, ids)))
 }
 
@@ -545,6 +551,19 @@ fn album_target(s: &Session, p: &Value) -> Result<(u32, Vec<u64>)> {
     Err(bad("insert.photoAlbumEdit", "this slide is not part of a photo album"))
 }
 
+/// Whether a slide holds anything besides album items: shapes, notes, comments, a background, a
+/// transition, animations, a colour map or tags.
+fn has_slide_content(s: &deckcraft_model::Slide) -> bool {
+    !s.shapes.is_empty()
+        || !s.notes.text().trim().is_empty()
+        || !s.comments.is_empty()
+        || s.background.is_some()
+        || s.transition.is_some()
+        || !s.animations.is_empty()
+        || s.color_map.is_some()
+        || !s.tags.is_empty()
+}
+
 fn pic_count(slide: &deckcraft_model::Slide) -> usize {
     slide.shapes.iter().filter(|sh| matches!(sh.kind, ShapeKind::Picture { .. })).count()
 }
@@ -592,9 +611,16 @@ fn infer_album(slides: &[&deckcraft_model::Slide], theme_now: &str) -> (String,
     (layout, frame.into(), captions, any && gray, theme_now.to_string())
 }
 
-fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_model::Slide]) -> Vec<Value> {
+/// The album's items for the dialog, within the limits `insert.photoAlbum` itself takes (items,
+/// bytes per picture and in all), checked before a picture is encoded: an album slide set can
+/// name one large picture many times.
+///
+/// The flag is true when something was left out for a limit.
+fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_model::Slide]) -> (Vec<Value>, bool) {
     let mut items = Vec::new();
-    for slide in slides {
+    let mut total = 0usize;
+    let mut omitted = false;
+    'slides: for slide in slides {
         let pics: Vec<&deckcraft_model::Shape> = slide.shapes.iter().filter(|sh| matches!(sh.kind, ShapeKind::Picture { .. })).collect();
         if pics.is_empty() {
             let text = slide
@@ -605,13 +631,27 @@ fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_m
                 .find(|t| !t.trim().is_empty())
                 .unwrap_or_default();
             if !text.trim().is_empty() {
+                if items.len() >= ALBUM_MAX_ITEMS {
+                    omitted = true;
+                    break 'slides;
+                }
                 items.push(json!({"text": text.trim()}));
+            } else if items.len() >= ALBUM_MAX_ITEMS && has_slide_content(slide) {
+                // Past the item limit, a slide with other content would be deleted by a replace.
+                omitted = true;
+                break 'slides;
             }
             continue;
         }
         for sh in pics {
             let ShapeKind::Picture { fill } = &sh.kind else { continue };
             let media = doc.media(fill.media);
+            let size = media.map_or(0, |m| m.data.len());
+            if items.len() >= ALBUM_MAX_ITEMS || size > ALBUM_MAX_BYTES || total.saturating_add(size) > ALBUM_MAX_TOTAL {
+                omitted = true;
+                break 'slides;
+            }
+            total += size;
             let name = if !sh.descr.is_empty() {
                 sh.descr.clone()
             } else {
@@ -626,14 +666,19 @@ fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_m
             }));
         }
     }
-    items
+    (items, omitted)
+}
+
+/// The slides of album `ids` as the editor would seed them.
+fn album_slides<'a>(st: &'a crate::DocState, ids: &[u64]) -> Vec<&'a deckcraft_model::Slide> {
+    ids.iter().filter_map(|sid| u32::try_from(*sid).ok()).filter_map(|n| st.doc.slide(deckcraft_model::SlideId(n))).collect()
 }
 
 fn album_seed(s: &Session) -> Result<Value> {
     let (id, ids) = album_target(s, &Value::Null)?;
     let st = s.doc()?;
-    let slides: Vec<&deckcraft_model::Slide> =
-        ids.iter().filter_map(|sid| u32::try_from(*sid).ok()).filter_map(|n| st.doc.slide(deckcraft_model::SlideId(n))).collect();
+    let slides = album_slides(st, &ids);
+    let (items, _) = items_from_slides(&st.doc, &slides);
     let theme_now = st.doc.masters.first().map(|m| m.theme.name.clone()).filter(|n| !n.is_empty()).unwrap_or_else(|| "DeckCraft".into());
     let inferred = infer_album(&slides, &theme_now);
     let mark = slides.first().and_then(|sl| sl.raw_ext.as_deref().and_then(parse_album_mark));
@@ -655,7 +700,7 @@ fn album_seed(s: &Session) -> Result<Value> {
         "captions": captions,
         "grayscale": grayscale,
         "theme": theme,
-        "items": items_from_slides(&st.doc, &slides),
+        "items": items,
     }))
 }
 
@@ -722,3 +767,96 @@ fn insert_album(s: &mut Session, items: Vec<AlbumItem>, opts: &AlbumOpts, at: Op
     s.execute("slide.go", &json!({"index": first}))?;
     Ok(json!({"slides": slides, "first": first, "pictures": pictures, "album": album_id}))
 }
+
+#[cfg(test)]
+mod seed_tests {
+    use std::sync::Arc;
+
+    use deckcraft_model::style::PictureFill;
+    use deckcraft_model::{Shape, ShapeId, defaults};
+
+    use super::*;
+
+    #[test]
+    fn reopening_an_album_seeds_at_most_the_items_an_album_takes() {
+        // One picture named by 500 shapes: the dialog gets 48 items, not 500 encoded copies.
+        let mut p = defaults::new_presentation(None);
+        let img = p.add_media("a.png", "image/png", vec![1; 64 * 1024]).unwrap();
+        let pic = |k: u32| Shape {
+            id: ShapeId(10_000 + k),
+            kind: ShapeKind::Picture { fill: PictureFill { media: img, ..Default::default() } },
+            ..Default::default()
+        };
+        Arc::make_mut(&mut p.slides[0]).shapes = (0..500).map(pic).collect();
+        let slides: Vec<&deckcraft_model::Slide> = p.slides.iter().map(|s| s.as_ref()).collect();
+        let (items, omitted) = items_from_slides(&p, &slides);
+        assert_eq!(items.len(), ALBUM_MAX_ITEMS);
+        assert!(omitted);
+        let few: Vec<&deckcraft_model::Slide> = Vec::new();
+        assert!(!items_from_slides(&p, &few).1);
+    }
+
+    /// An album too big for the editor's seed cannot be replaced from that seed: the replace would
+    /// delete what the seed left out.
+    #[test]
+    fn editing_an_album_the_editor_cannot_hold_is_refused() {
+        let mut s = crate::Session::new();
+        s.execute("file.new", &json!({})).unwrap();
+        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
+        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
+        let st = s.doc_mut().unwrap();
+        let doc = Arc::make_mut(&mut st.doc);
+        let mut extra = doc.slides.last().unwrap().as_ref().clone();
+        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
+        doc.slides.push(Arc::new(extra));
+        let n = doc.slides.len();
+        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
+        assert!(e.contains("delete the rest"), "{e}");
+        assert_eq!(s.doc().unwrap().doc.slides.len(), n);
+    }
+
+    /// Past the item limit, a slide holding only a drawing counts as content the replace would delete.
+    #[test]
+    fn editing_an_album_with_a_drawing_slide_past_the_limit_is_refused() {
+        let mut s = crate::Session::new();
+        s.execute("file.new", &json!({})).unwrap();
+        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
+        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
+        let st = s.doc_mut().unwrap();
+        let doc = Arc::make_mut(&mut st.doc);
+        let mut extra = doc.slides.last().unwrap().as_ref().clone();
+        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
+        extra.shapes = vec![Shape { id: ShapeId(90_000), ..Default::default() }];
+        doc.slides.push(Arc::new(extra));
+        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
+        assert!(e.contains("delete the rest"), "{e}");
+    }
+
+    /// Notes or comments on a shapeless slide past the limit are content a replace would delete.
+    #[test]
+    fn editing_an_album_with_a_notes_only_slide_past_the_limit_is_refused() {
+        let mut s = crate::Session::new();
+        s.execute("file.new", &json!({})).unwrap();
+        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
+        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
+        let st = s.doc_mut().unwrap();
+        let doc = Arc::make_mut(&mut st.doc);
+        let mut extra = doc.slides.last().unwrap().as_ref().clone();
+        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
+        extra.shapes.clear();
+        extra.notes = deckcraft_model::text::TextBody::from_text("speaker notes");
+        doc.slides.push(Arc::new(extra));
+        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
+        assert!(e.contains("delete the rest"), "{e}");
+    }
+
+    /// A shapeless slide with a background, transition, colour map or tags counts as content; a plain empty one does not.
+    #[test]
+    fn slide_level_settings_count_as_slide_content() {
+        use deckcraft_model::Slide;
+        assert!(!has_slide_content(&Slide::default()));
+        assert!(has_slide_content(&Slide { tags: vec![("k".into(), "v".into())], ..Default::default() }));
+        assert!(has_slide_content(&Slide { color_map: Some(vec![("bg1".into(), "lt1".into())]), ..Default::default() }));
+        assert!(has_slide_content(&Slide { transition: Some(Default::default()), ..Default::default() }));
+    }
+}

crates/engine/src/cmd/selection_tests.rs

@@ -135,6 +135,14 @@ fn eye_show_all_and_hide_all() {
     assert!(!flags(&s, a).0 && flags(&s, g).0 && flags(&s, e).0);
 }
 
+#[test]
+fn lock_group_with_its_child_targeted_leaves_child_locked() {
+    let (mut s, ids) = deck();
+    let (d, g) = (ids[3], ids[7]);
+    s.execute("shape.lock", &json!({"ids": [g, d, d]})).unwrap();
+    assert!(flags(&s, g).1 && flags(&s, d).1);
+}
+
 #[test]
 fn lock_cascades_through_groups_and_undoes() {
     let (mut s, ids) = deck();

crates/engine/src/cmd/shape.rs

@@ -10,7 +10,7 @@ use serde_json::{Value, json};
 
 use super::{
     CommandSpec, NO_ID_SPACE, bad, bool_or, bool_param, cmd, color_param, color_value, edit_geometry, edit_shapes, f64_param, has_selection,
-    has_slide, id_param, ok, str_param, targets, usize_param, with_param, xfrm_of,
+    has_slide, id_param, ok, opt_usize_param, str_param, targets, usize_param, with_param, xfrm_of,
 };
 use crate::{Result, Session};
 
@@ -374,6 +374,25 @@ fn visible(s: &mut Session, p: &Value) -> Result<Value> {
 /// (a child can still be unlocked on its own afterwards), as PowerPoint does.
 fn lock(s: &mut Session, p: &Value) -> Result<Value> {
     let v = bool_param(p, "locked");
+    // A targeted shape inside another targeted group is reached through the group: editing it again
+    // would toggle it back.
+    let mut ids = super::targets(s, p)?;
+    if ids.len() > 1 {
+        let doc = s.doc()?;
+        // Walk each distinct group once, however often `ids` repeats it.
+        let mut once = std::collections::HashSet::new();
+        ids.retain(|id| once.insert(*id));
+        let mut inside = std::collections::HashSet::new();
+        for id in &ids {
+            if let Some(g) = doc.shape(*id) {
+                deckcraft_model::walk(g.children(), &mut |c, _| {
+                    inside.insert(c.id);
+                });
+            }
+        }
+        ids.retain(|id| !inside.contains(id));
+    }
+    let p = &json!({"ids": ids, "locked": p.get("locked")});
     edit_shapes(s, p, "shape.lock", |sh| {
         let to = v.unwrap_or(!sh.locked);
         set_locked(sh, to, 0);

crates/engine/src/cmd/shape/appearance.rs

@@ -1,11 +1,11 @@
 use super::{
     ColorRef, ColorTransform, Dash, Effects, Fill, Geom, Glow, Gradient, GradientShape, GradientStop, Line, LineEnd, PictureFill, PictureMode,
     Reflection, Result, Rgba, SchemeSlot, Session, Shadow, ShapeStyle, Value, apply_fill, bad, bool_or, color_param, color_value, edit_geometry,
-    edit_shapes, f64_param, inherited_fills, json, requested_fill, str_param, targets, usize_param,
+    edit_shapes, f64_param, inherited_fills, json, opt_usize_param, requested_fill, str_param, targets,
 };
 
 pub(super) fn adjust(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = usize_param(p, "index").unwrap_or(0).min(16);
+    let i = opt_usize_param(p, "index", "shape.adjust")?.unwrap_or(0).min(16);
     let v = f64_param(p, "value").ok_or_else(|| bad("shape.adjust", "missing `value`"))?;
     edit_geometry(s, p, "shape.adjust", |sh| {
         if let Geom::Preset { name, adj } = &mut sh.geom {
@@ -556,7 +556,7 @@ pub fn quick_style_for(index: usize) -> (ShapeStyle, Option<Fill>, Option<Line>)
 }
 
 pub(super) fn quick_style(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = usize_param(p, "index").unwrap_or(1).min(41);
+    let i = opt_usize_param(p, "index", "shape.quickStyle")?.unwrap_or(1).min(41);
     let (st, f, l) = quick_style_for(i);
     edit_shapes(s, p, "shape.quickStyle", |sh| {
         sh.style = Some(st.clone());

crates/engine/src/cmd/shape/freeform.rs

@@ -104,7 +104,7 @@ pub(super) fn freeform(s: &mut Session, p: &Value) -> Result<Value> {
             a.iter()
                 .filter_map(|v| Some(deckcraft_geom::Point::new(v.get(0)?.as_f64()?, v.get(1)?.as_f64()?)))
                 .filter(|q| q.x.is_finite() && q.y.is_finite())
-                .take(20_000)
+                .take(crate::tools::MAX_GESTURE_POINTS)
                 .collect()
         })
         .unwrap_or_default();

crates/engine/src/file_access.rs

@@ -85,14 +85,20 @@ impl AutomationRoots {
 
     /// May the file or folder at `path` be read (or written)? `Err` says why not.
     pub fn check(&self, path: &str, access: Access) -> Result<(), String> {
+        self.check_path(Path::new(path), access)
+    }
+
+    /// [`Self::check`] for a path that may not be UTF-8: the checked path is the one opened.
+    pub fn check_path(&self, path: &Path, access: Access) -> Result<(), String> {
+        let path_text = path.display();
         let roots = match access {
             Access::Read => &self.read,
             Access::Write => &self.write,
         };
         if roots.is_empty() {
             return match access {
-                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path}")),
-                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path}")),
+                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path_text}")),
+                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path_text}")),
             };
         }
         let resolved = resolve(path)?;
@@ -101,8 +107,8 @@ impl AutomationRoots {
         }
         let roots = roots.iter().map(|root| root.shown.display().to_string()).collect::<Vec<_>>().join(", ");
         match access {
-            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path}")),
-            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path}")),
+            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path_text}")),
+            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path_text}")),
         }
     }
 }
@@ -191,17 +197,23 @@ pub fn check_write(path: &str) -> Result<(), String> {
     current().map_or(Ok(()), |r| r.check(path, Access::Write))
 }
 
+/// May `path` be written here? Always, without roots in force. For a path that may not be UTF-8.
+pub fn check_write_path(path: &Path) -> Result<(), String> {
+    current().map_or(Ok(()), |r| r.check_path(path, Access::Write))
+}
+
 /// `path` made absolute with its links followed; for a path that doesn't exist (yet), its nearest
 /// existing folder's links followed and the rest appended.
-fn resolve(path: &str) -> Result<PathBuf, String> {
-    if path.is_empty() {
+fn resolve(path: &Path) -> Result<PathBuf, String> {
+    if path.as_os_str().is_empty() {
         return Err("automation path rejected: path is empty".into());
     }
+    let shown = path.display();
     // Checked as given: making `…\NUL` absolute gives the device path `\\.\NUL` on Windows.
-    if cfg!(windows) && Path::new(path).components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
-        return Err(format!("automation path rejected: reserved device names are not allowed: {path}"));
+    if cfg!(windows) && path.components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
+        return Err(format!("automation path rejected: reserved device names are not allowed: {shown}"));
     }
-    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {path}: {e}"))?;
+    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {shown}: {e}"))?;
     // The names below the nearest existing folder, last first.
     let mut missing: Vec<OsString> = vec![];
     let mut at = absolute.as_path();
@@ -212,11 +224,11 @@ fn resolve(path: &str) -> Result<PathBuf, String> {
                 return Ok(found);
             }
             Err(e) => match std::fs::symlink_metadata(at) {
-                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {path}")),
+                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {shown}")),
                 // There, yet its real path can't be had (no permission): nothing to compare.
-                Ok(_) => return Err(format!("automation path rejected: cannot resolve {path}: {e}")),
+                Ok(_) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
                 Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-                Err(e) => return Err(format!("automation path rejected: cannot resolve {path}: {e}")),
+                Err(e) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
             },
         }
         let parent = at.parent();
@@ -226,12 +238,12 @@ fn resolve(path: &str) -> Result<PathBuf, String> {
                 at = parent;
             }
             (Some(Component::ParentDir), _) => {
-                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {path}"));
+                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {shown}"));
             }
             // Down to the root (or drive) and it doesn't exist either.
             _ => {
                 let e = std::io::Error::from(std::io::ErrorKind::NotFound);
-                return Err(format!("automation path rejected: cannot resolve {path}: {e}"));
+                return Err(format!("automation path rejected: cannot resolve {shown}: {e}"));
             }
         }
     }

crates/engine/src/fonts.rs

@@ -1,6 +1,8 @@
 //! Fonts a presentation uses that this machine doesn't have, so opening it can say so (its text
 //! draws in a stand-in; see `FontDb::document_face`).
 
+use std::collections::HashSet;
+
 use deckcraft_fonts::FontDb;
 use deckcraft_model::resolve::{self, Ctx};
 use deckcraft_model::text::{Bullet, TextBody};
@@ -12,8 +14,13 @@ use deckcraft_model::{Presentation, Shape, ShapeKind};
 /// font to load and are left for the round trip.
 pub fn install_embedded_fonts(p: &Presentation) {
     let db = FontDb::global();
+    // Faces can name one media item many times; each is copied and enumerated once.
+    let mut seen = HashSet::new();
     for font in &p.embedded_fonts {
         for id in font.faces().into_iter().flatten() {
+            if !seen.insert(id) {
+                continue;
+            }
             let Some(item) = p.media(id) else { continue };
             let Some(sfnt) = deckcraft_fonts::embedded_sfnt(&item.data) else { continue };
             db.add_font(sfnt.to_vec());
@@ -27,12 +34,8 @@ pub fn install_embedded_fonts(p: &Presentation) {
 /// and can't be installed, so they aren't reported.
 pub fn missing_fonts(p: &Presentation) -> Vec<String> {
     let db = FontDb::global();
-    let mut out: Vec<String> = Vec::new();
-    for family in used_fonts(p) {
-        if !family.starts_with('.') && !db.has_family(&family) && !out.iter().any(|f| f.eq_ignore_ascii_case(&family)) {
-            out.push(family);
-        }
-    }
+    // used_fonts is already free of case-insensitive duplicates.
+    let mut out: Vec<String> = used_fonts(p).into_iter().filter(|f| !f.starts_with('.') && !db.has_family(f)).collect();
     out.sort_by_key(|f| f.to_lowercase());
     out
 }
@@ -40,9 +43,10 @@ pub fn missing_fonts(p: &Presentation) -> Vec<String> {
 /// The families the slides' text runs and bullets are drawn in.
 pub fn used_fonts(p: &Presentation) -> Vec<String> {
     let mut out: Vec<String> = Vec::new();
+    let mut seen: HashSet<String> = HashSet::new();
     let mut add = |f: String| {
         let f = f.trim().to_string();
-        if !f.is_empty() && !out.iter().any(|o| o.eq_ignore_ascii_case(&f)) {
+        if !f.is_empty() && seen.insert(f.to_ascii_lowercase()) {
             out.push(f);
         }
     };

crates/engine/src/lib.rs

@@ -824,10 +824,32 @@ fn clamp_selection(st: &mut DocState) {
 /// Default for [`History::byte_limit`].
 pub const UNDO_BYTE_BUDGET: usize = 256 << 20;
 
+/// A rough size of a text body in memory: its paragraphs and runs, at their inline struct sizes.
+fn text_cost(t: &deckcraft_model::text::TextBody) -> usize {
+    use deckcraft_model::text::{Paragraph, Run};
+    let (para, run) = (std::mem::size_of::<Paragraph>(), std::mem::size_of::<Run>());
+    t.paragraphs.iter().map(|p| para + p.runs.iter().map(|r| run + r.text.len()).sum::<usize>()).sum()
+}
+
+/// A rough size of comments in memory, replies included.
+fn comments_cost(cs: &[deckcraft_model::Comment], depth: usize) -> usize {
+    let kids = |c: &deckcraft_model::Comment| if depth < 64 { comments_cost(&c.replies, depth + 1) } else { 0 };
+    cs.iter().map(|c| 256 + c.author.len() + c.initials.len() + c.text.len() + c.date.len() + kids(c)).sum()
+}
+
+/// A rough size of a slide's own data besides its shapes: notes, comments, tags and kept XML,
+/// all copied with the slide when an edit changes it.
+fn slide_extra_cost(s: &deckcraft_model::Slide) -> usize {
+    text_cost(&s.notes)
+        + comments_cost(&s.comments, 0)
+        + s.name.len()
+        + s.tags.iter().map(|(k, v)| 48 + k.len() + v.len()).sum::<usize>()
+        + s.raw_ext.as_ref().map_or(0, String::len)
+}
+
 /// A rough size of a shape in memory: the struct, its text and kept XML, its children.
 fn shape_cost(sh: &deckcraft_model::Shape, depth: usize) -> usize {
-    let text: usize =
-        sh.text.as_ref().map_or(0, |t| t.paragraphs.iter().map(|p| 96 + p.runs.iter().map(|r| 128 + r.text.len()).sum::<usize>()).sum());
+    let text: usize = sh.text.as_ref().map_or(0, text_cost);
     let kids: usize = if depth < 64 { sh.children().iter().map(|c| shape_cost(c, depth + 1)).sum() } else { 0 };
     768 + text + sh.raw_ext.as_ref().map_or(0, String::len) + kids
 }
@@ -845,7 +867,7 @@ pub fn undo_cost(doc: &Presentation, newer: &Presentation) -> usize {
     let media: HashSet<*const Vec<u8>> = newer.media.iter().map(|m| Arc::as_ptr(&m.data)).collect();
     let mut n = 64 * doc.slides.len();
     for s in doc.slides.iter().filter(|s| !slides.contains(&Arc::as_ptr(s))) {
-        n += 512 + shapes_cost(&s.shapes);
+        n += 512 + shapes_cost(&s.shapes) + slide_extra_cost(s);
     }
     for m in doc.masters.iter().filter(|m| !masters.contains(&Arc::as_ptr(m))) {
         n += 4096 + shapes_cost(&m.shapes) + m.layouts.iter().map(|l| 512 + shapes_cost(&l.shapes)).sum::<usize>();

crates/engine/src/spell.rs

@@ -171,7 +171,9 @@ impl Dictionary {
                 ["COMPOUNDWORDMAX", n, ..] => d.compound_max = n.parse().unwrap_or(0),
                 ["REP", n] => {
                     for _ in 0..n.parse::<usize>().unwrap_or(0) {
-                        let r: Vec<&str> = lines.next().unwrap_or("").split_whitespace().collect();
+                        // The count is the file's claim: stop when the records run out.
+                        let Some(line) = lines.next() else { break };
+                        let r: Vec<&str> = line.split_whitespace().collect();
                         if let [_, a, b, ..] = r.as_slice() {
                             d.rep.push((a.replace('_', " "), b.replace('_', " ")));
                         }
@@ -182,7 +184,8 @@ impl Dictionary {
                     let Some(flag) = one_flag(Some(flag), mode) else { continue };
                     let cross = cross.eq_ignore_ascii_case("y");
                     for _ in 0..n.parse::<usize>().unwrap_or(0) {
-                        let r: Vec<&str> = lines.next().unwrap_or("").split_whitespace().collect();
+                        let Some(line) = lines.next() else { break };
+                        let r: Vec<&str> = line.split_whitespace().collect();
                         let [_, _, strip, add, rest @ ..] = r.as_slice() else { continue };
                         let (add, cont) = match add.split_once('/') {
                             Some((a, c)) => (a, parse_flags(c, mode)),
@@ -304,7 +307,12 @@ impl Dictionary {
 
     /// `w` made of dictionary parts allowed in compounds (`COMPOUNDFLAG`, or the begin, middle and
     /// end flags), each at least `COMPOUNDMIN` characters long.
-    fn compounded(&self, w: &[char], index: usize) -> bool {
+    fn compounded(&self, w: &[char], index: usize, failed: &mut HashSet<(usize, usize)>) -> bool {
+        // `w` is always a tail of the checked word, so its length names it: a (tail, part index)
+        // that failed once fails again however the earlier parts were split.
+        if failed.contains(&(w.len(), index)) {
+            return false;
+        }
         if self.compound.is_none() && self.compound_end.is_none() {
             return false;
         }
@@ -322,10 +330,11 @@ impl Dictionary {
             if [self.compound, self.compound_end].into_iter().flatten().any(|f| self.compound_part(rest, f, true)) {
                 return true;
             }
-            if self.compounded(rest, index + 1) {
+            if self.compounded(rest, index + 1, failed) {
                 return true;
             }
         }
+        failed.insert((w.len(), index));
         false
     }
 
@@ -352,7 +361,7 @@ impl Dictionary {
                 return true;
             }
         }
-        self.compounded(&w, 0)
+        self.compounded(&w, 0, &mut HashSet::new())
     }
 
     /// Is `word` spelt correctly? Capitalised and upper-case forms of a lower-case word pass.
@@ -576,6 +585,15 @@ fn cache() -> &'static Cache {
     CACHE.get_or_init(Default::default)
 }
 
+/// Language strings remembered by [`dictionary`]; a string past it is resolved again on each call.
+const MAX_CACHED_LANGS: usize = 256;
+
+/// Parsed dictionaries by their affix file, so aliases of one language share it.
+fn by_files() -> &'static Mutex<HashMap<PathBuf, Arc<Dictionary>>> {
+    static M: OnceLock<Mutex<HashMap<PathBuf, Arc<Dictionary>>>> = OnceLock::new();
+    M.get_or_init(Default::default)
+}
+
 /// The dictionary for `lang` (a BCP-47 tag such as `en-US`), loaded once per process.
 pub fn dictionary(lang: &str) -> Option<Arc<Dictionary>> {
     let cache = cache();
@@ -586,10 +604,23 @@ pub fn dictionary(lang: &str) -> Option<Arc<Dictionary>> {
         return d.clone();
     }
     let loaded = find_in(&search_dirs(), lang).and_then(|(a, d)| {
-        let (a, d) = (std::fs::read(a).ok()?, std::fs::read(d).ok()?);
-        Some(Arc::new(Dictionary::parse(&a, &d)))
+        // Tags that resolve to the same files share one parsed dictionary.
+        if let Ok(m) = by_files().lock()
+            && let Some(dict) = m.get(&a)
+        {
+            return Some(dict.clone());
+        }
+        let (bytes_a, bytes_d) = (std::fs::read(&a).ok()?, std::fs::read(d).ok()?);
+        let dict = Arc::new(Dictionary::parse(&bytes_a, &bytes_d));
+        // A concurrent loader of the same files may have inserted first: share its copy.
+        if let Ok(mut m) = by_files().lock() {
+            return Some(m.entry(a).or_insert(dict).clone());
+        }
+        Some(dict)
     });
-    if let Ok(mut c) = cache.lock() {
+    if let Ok(mut c) = cache.lock()
+        && c.len() < MAX_CACHED_LANGS
+    {
         c.insert(key, loaded.clone());
     }
     loaded
@@ -668,6 +699,8 @@ pub fn add_user_word(word: &str) -> std::io::Result<()> {
         return Ok(());
     }
     let path = user_dictionary_path().ok_or_else(|| std::io::Error::new(std::io::ErrorKind::NotFound, "no folder for the user dictionary"))?;
+    // A confined automation client may write only inside its write roots, this file included.
+    crate::file_access::check_write_path(&path).map_err(|e| std::io::Error::new(std::io::ErrorKind::PermissionDenied, e))?;
     if let Some(d) = path.parent() {
         std::fs::create_dir_all(d)?;
     }
@@ -897,6 +930,14 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
         assert!(d.suggest("workingslides", 5).contains(&"working slides".to_string()));
     }
 
+    /// An affix header can claim billions of records; parsing stops where the file does.
+    #[test]
+    fn a_header_count_past_the_records_ends_with_them() {
+        let aff = b"SFX S Y 4000000000\nSFX S 0 s .\nREP 4000000000\nREP a b\n";
+        let d = Dictionary::parse(aff, b"1\ncat/S\n".as_slice());
+        assert!(d.check("cats"));
+    }
+
     /// #1175: compound splitting is quadratic in the word's length, so a word longer than
     /// `MAX_CHECK_CHARS` is not checked; shorter ones still are.
     #[test]
@@ -931,6 +972,17 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
         }
     }
 
+    #[test]
+    fn overlapping_compound_roots_with_a_failing_ending_stay_cheap() {
+        // Roots a..aaaaaaaa overlap, so many splits of "aaa…ab" reach the same (tail, part) state; unmemoized that is millions of searches.
+        let d = Dictionary::parse(
+            b"COMPOUNDFLAG X\nCOMPOUNDMIN 1\n".as_slice(),
+            b"8\na/X\naa/X\naaa/X\naaaa/X\naaaaa/X\naaaaaa/X\naaaaaaa/X\naaaaaaaa/X\n".as_slice(),
+        );
+        assert!(!d.check(&format!("{}b", "a".repeat(99))));
+        assert!(d.check(&"a".repeat(20)));
+    }
+
     #[test]
     fn runs_give_words_their_language() {
         use deckcraft_model::{Paragraph, Run, RunProps};
@@ -970,6 +1022,20 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
         assert_eq!(w, vec!["check", "done"]);
     }
 
+    #[test]
+    fn a_confined_client_cannot_write_the_user_dictionary_outside_its_roots() {
+        let root = std::env::temp_dir().join(format!("deckcraft-dict-root-{}", std::process::id()));
+        std::fs::create_dir_all(&root).unwrap();
+        let roots = crate::file_access::AutomationRoots::new(std::slice::from_ref(&root), std::slice::from_ref(&root)).unwrap();
+        // The user dictionary is a file of its own outside `root`, not whatever HOME points at.
+        let outside = std::env::temp_dir().join(format!("deckcraft-dict-outside-{}", std::process::id()));
+        set_user_dictionary_path(outside.join("user.dic"));
+        let r = crate::file_access::confine(roots.as_ref(), || add_user_word("zqxconfinedword"));
+        assert_eq!(r.map_err(|e| e.kind()), Err(std::io::ErrorKind::PermissionDenied));
+        assert!(!outside.exists(), "the refused write created nothing");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
     #[test]
     fn a_long_paragraph_with_a_huge_language_is_checked_in_linear_work() {
         use deckcraft_model::{Paragraph, Run, RunProps};

crates/engine/src/tests.rs

@@ -1713,6 +1713,31 @@ fn tab_moves_between_cells_skipping_merged_ones() {
     assert_eq!((cell(&s), table_of(&s, id).n_rows()), (Some((2, 0)), 3), "Tab in the last cell adds a row");
 }
 
+#[test]
+fn format_paragraph_align_names_match_format_align() {
+    use deckcraft_model::text::Align;
+    let mut s = session();
+    let title = s.doc().unwrap().current_slide().unwrap().shapes[0].id.0;
+    s.execute("text.edit", &json!({"id": title})).unwrap();
+    let para = |s: &Session| s.doc().unwrap().current_slide().unwrap().shapes[0].text.as_ref().unwrap().paragraphs[0].props.align;
+    for (name, want) in [
+        ("justLow", Align::JustLow),
+        ("justifyLow", Align::JustLow),
+        ("thaiDist", Align::ThaiDistributed),
+        ("ctr", Align::Center),
+        ("centre", Align::Center),
+        ("r", Align::Right),
+        ("just", Align::Justify),
+        ("dist", Align::Distributed),
+        ("distributed", Align::Distributed),
+        ("left", Align::Left),
+    ] {
+        s.execute("format.paragraph", &json!({"align": name})).unwrap();
+        assert_eq!(para(&s), Some(want), "{name}");
+    }
+    assert!(s.execute("format.paragraph", &json!({"align": "bogus"})).is_err());
+}
+
 #[test]
 fn right_to_left_paragraphs() {
     let mut s = session();
@@ -3720,6 +3745,25 @@ fn undo_history_is_capped_by_memory_as_well_as_steps() {
     assert_eq!(s.doc().unwrap().history.undo.len(), 120);
 }
 
+/// A slide's notes count toward the undo budget: small edits to a slide with large notes keep a
+/// copy of those notes per step, and must not slip past the budget as if the slide were empty.
+#[test]
+fn undo_history_counts_slide_notes() {
+    let mut s = Session::with_new();
+    let notes = "n".repeat(1 << 20);
+    s.edit(|doc, _| {
+        std::sync::Arc::make_mut(&mut doc.slides[0]).notes = deckcraft_model::text::TextBody::from_text(&notes);
+        Ok(())
+    })
+    .unwrap();
+    s.doc_mut().unwrap().history = History { limit: 500, byte_limit: 8 << 20, ..Default::default() };
+    for i in 0..40 {
+        s.execute("slide.rename", &json!({"name": format!("v{i}"), "index": 0})).unwrap();
+    }
+    let n = s.doc().unwrap().history.undo.len();
+    assert!((1..=8).contains(&n), "{n} steps of 1 MB notes kept under an 8 MB budget");
+}
+
 #[test]
 fn picture_styles_replace_each_other_in_one_step() {
     const PNG: &[u8] = &[
@@ -5408,6 +5452,38 @@ fn pen_pressure_is_kept_and_a_mouse_draws_at_full_width() {
     assert_eq!(got, vec![vec![0.2, 1.0, 0.4], vec![1.0, 1.0]]);
 }
 
+#[test]
+fn a_long_ink_stroke_is_extended_in_place_and_capped() {
+    let mut s = session();
+    s.set_tool(tools::ToolKind::Ink { mode: "pen".into(), color: deckcraft_model::Rgba::rgb(20, 20, 20), width: 4.0 });
+    let ev = |kind, x: f64| tools::PointerEvent { kind, x, y: 80.0, mods: Mods::default(), tol: 3.0, pressure: Some(0.5) };
+    s.pointer(ev(PointerKind::Down, 0.0)).unwrap();
+    let n = tools::MAX_GESTURE_POINTS + 5_000;
+    for i in 1..n {
+        s.pointer(ev(PointerKind::Drag, (i % 500) as f64)).unwrap();
+    }
+    assert_eq!(s.tool.ink_preview.len(), tools::MAX_GESTURE_POINTS);
+    s.pointer(ev(PointerKind::Up, 0.0)).unwrap();
+    let kept: usize = ink_pressures(&s).iter().map(Vec::len).sum();
+    assert!((2..=tools::MAX_GESTURE_POINTS).contains(&kept), "{kept}");
+}
+
+#[test]
+fn double_clicking_a_capped_freeform_keeps_its_vertices() {
+    let mut s = session();
+    let ev = |kind, x: f64, y: f64| tools::PointerEvent { kind, x, y, mods: Default::default(), tol: 3.0, pressure: None };
+    s.set_tool(tools::ToolKind::Shape { preset: "freeform".into() });
+    s.pointer(ev(tools::PointerKind::Down, 100.0, 100.0)).unwrap();
+    // Densely clicked vertices, each within the double-click tolerance of the last.
+    for i in 0..tools::MAX_GESTURE_POINTS + 10 {
+        s.pointer(ev(tools::PointerKind::Down, 300.0 + i as f64 * 0.001, 100.0)).unwrap();
+    }
+    s.pointer(ev(tools::PointerKind::DoubleClick, 300.0, 100.0)).unwrap();
+    let st = s.doc().unwrap();
+    let deckcraft_model::Geom::Custom { paths } = &st.shapes().last().unwrap().geom else { panic!("no freeform") };
+    assert_eq!(paths[0].d.matches(" L ").count(), tools::MAX_GESTURE_POINTS - 1);
+}
+
 fn ink_pressures(s: &Session) -> Vec<Vec<f32>> {
     let st = s.doc().unwrap();
     let Some(sh) = st.shapes().iter().rev().find(|sh| matches!(sh.kind, deckcraft_model::ShapeKind::Ink { .. })) else {
@@ -6845,6 +6921,39 @@ fn master_body_placeholder_format_keeps_per_level_formatting() {
     assert_eq!(shown(&s), vec![Some(28.0), Some(24.0)]);
 }
 
+/// A shape named many times in one edit is edited once and not copied per mention.
+#[test]
+fn repeated_target_ids_edit_the_shape_once() {
+    let mut s = session();
+    let r = s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 300, 100], "text": "x".repeat(100_000)})).unwrap();
+    let id = r["id"].as_u64().unwrap();
+    let edited = s.execute("shape.fill", &json!({"ids": vec![id; 50_000], "color": "#ff0000"})).unwrap();
+    assert_eq!(edited, json!(1));
+    let v = s.execute("shape.inspect", &json!({"id": id})).unwrap();
+    assert_eq!(v["shape"]["fill"]["color"]["base"]["rgb"], json!({"a": 255, "b": 0, "g": 0, "r": 255}));
+}
+
+#[test]
+fn many_distinct_fonts_are_listed_once_each_without_a_quadratic_scan() {
+    // 30,000 runs in 15,000 families, each written twice in different case.
+    let mut p = deckcraft_model::Presentation::default();
+    let slide = std::sync::Arc::make_mut(&mut p.slides[0]);
+    let mut body = deckcraft_model::text::TextBody::from_text("x");
+    let run = body.paragraphs[0].runs[0].clone();
+    body.paragraphs[0].runs = (0..30_000)
+        .map(|i| {
+            let mut r = run.clone();
+            let name = format!("Qqq Font {}", i / 2);
+            r.props.font = Some(if i % 2 == 0 { name } else { name.to_uppercase() });
+            r
+        })
+        .collect();
+    slide.shapes[0].text = Some(body);
+    let used = crate::fonts::used_fonts(&p);
+    assert_eq!(used.iter().filter(|f| f.starts_with("Qqq Font ")).count(), 15_000);
+    assert_eq!(crate::fonts::missing_fonts(&p).iter().filter(|f| f.to_ascii_lowercase().starts_with("qqq font ")).count(), 15_000);
+}
+
 #[test]
 fn slide_master_view_rejects_invalid_indices() {
     let mut s = Session::with_new();
@@ -7029,3 +7138,18 @@ fn outline_export_skips_footer_date_and_slide_number() {
     assert!(rtf.contains("Agenda") && rtf.contains("First point"), "{rtf:?}");
     assert!(!rtf.contains("Company Confidential") && !rtf.contains("1 May 2026"), "{rtf:?}");
 }
+
+#[test]
+fn shape_adjust_and_quick_style_reject_invalid_index() {
+    let mut s = session();
+    let r = s.execute("shape.insert", &json!({"preset": "roundRect", "rect": [100, 100, 200, 100]})).unwrap();
+    let id = deckcraft_model::ShapeId(r["id"].as_u64().unwrap() as u32);
+    let before = s.doc().unwrap().shape(id).unwrap().clone();
+    for bad in [json!(-1), json!(1.5)] {
+        assert!(s.execute("shape.adjust", &json!({"index": bad, "value": 0.4})).is_err(), "adjust accepted {bad}");
+        assert!(s.execute("shape.quickStyle", &json!({"index": bad})).is_err(), "quickStyle accepted {bad}");
+    }
+    assert_eq!(s.doc().unwrap().shape(id).unwrap().geom, before.geom);
+    assert_eq!(s.doc().unwrap().shape(id).unwrap().style, before.style);
+    s.execute("shape.adjust", &json!({"value": 0.4})).unwrap();
+}

crates/engine/src/tools.rs

@@ -17,6 +17,7 @@ mod geometry;
 mod hit;
 mod pointer;
 
+pub(crate) use drag::MAX_GESTURE_POINTS;
 pub use hit::{line_xfrm, resize_box, table_rows, text_pos};
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
@@ -275,6 +276,8 @@ pub struct ToolState {
     pub path_preview: Vec<Point>,
     pub path_smooth: bool,
     pub path_closing: bool,
+    /// Whether the last freeform press added a vertex (it adds none at the point cap).
+    pub press_added_vertex: bool,
     /// The shape in Edit Points: its vertices are handles instead of the box's.
     pub edit_points: Option<ShapeId>,
     /// The vertex (path, index) whose control handles show in Edit Points.

crates/engine/src/tools/click.rs

@@ -4,8 +4,12 @@ use super::{Drag, Hit, Point, Result, Session, ShapeId, ShapeKind, TextSel, Tool
 impl Session {
     pub(super) fn double_click(&mut self, p: Point, tol: f64) -> Result<Value> {
         if let Some(Drag::Freeform { mode, mut points, .. }) = self.tool.drag.clone() {
-            // The double-click's own click added a duplicate vertex.
-            while points.len() > 2 && points.last().zip(points.get(points.len() - 2)).is_some_and(|(a, b)| (*a - *b).hypot() <= tol) {
+            // The double-click's own click added a duplicate vertex (none at the point cap, where
+            // the existing vertices are all kept).
+            while self.tool.press_added_vertex
+                && points.len() > 2
+                && points.last().zip(points.get(points.len() - 2)).is_some_and(|(a, b)| (*a - *b).hypot() <= tol)
+            {
                 points.pop();
             }
             self.tool.drag = Some(Drag::Freeform { mode, points, pressed: false });

crates/engine/src/tools/drag.rs

@@ -12,9 +12,16 @@ struct MoveDrag {
     enter_text: Option<(ShapeId, Point)>,
 }
 
+/// Samples one ink or freeform gesture keeps; later pointer moves extend it no further.
+pub(crate) const MAX_GESTURE_POINTS: usize = 100_000;
+
 impl Session {
     /// Update the active drag interaction using the pointer position and modifiers.
     pub(super) fn drag(&mut self, p: Point, mods: Mods, tol: f64) -> Result<Value> {
+        if matches!(self.tool.drag, Some(Drag::Ink { .. })) {
+            self.extend_ink(p);
+            return Ok(Value::Null);
+        }
         let Some(drag) = self.tool.drag.clone() else { return Ok(Value::Null) };
         match drag {
             Drag::Guide { index } => {
@@ -181,7 +188,7 @@ impl Session {
             }
             Drag::Freeform { mode, mut points, pressed } => {
                 // Dragging scribbles (except for curves, which only take clicked points).
-                if pressed && mode != "curve" && points.last().is_none_or(|l| (*l - p).hypot() >= 1.5) {
+                if pressed && mode != "curve" && points.len() < MAX_GESTURE_POINTS && points.last().is_none_or(|l| (*l - p).hypot() >= 1.5) {
                     points.push(p);
                 }
                 let mut v = points.clone();
@@ -191,15 +198,24 @@ impl Session {
                 self.tool.path_preview = v;
                 self.tool.drag = Some(Drag::Freeform { mode, points, pressed });
             }
-            Drag::Ink { mut points } => {
-                points.push(self.ink_sample(p));
-                self.tool.ink_preview = points.clone();
-                self.tool.drag = Some(Drag::Ink { points });
-            }
+            // Handled above.
+            Drag::Ink { .. } => {}
         }
         Ok(Value::Null)
     }
 
+    /// Ink grows by one sample per move: extend it (and its preview) in place rather than
+    /// copying the whole stroke twice per event, up to [`MAX_GESTURE_POINTS`].
+    fn extend_ink(&mut self, p: Point) {
+        let sample = self.ink_sample(p);
+        if let Some(Drag::Ink { points }) = self.tool.drag.as_mut()
+            && points.len() < MAX_GESTURE_POINTS
+        {
+            points.push(sample);
+            self.tool.ink_preview.push(sample);
+        }
+    }
+
     fn drag_move(&mut self, drag: MoveDrag, p: Point, mods: Mods, tol: f64) -> Result<Value> {
         let MoveDrag { ids, start, origs, moved, duplicate, enter_text } = drag;
         let mut d = p - start;

crates/engine/src/tools/pointer.rs

@@ -228,7 +228,10 @@ impl Session {
                 self.tool.drag = Some(Drag::Freeform { mode, points, pressed: false });
                 return self.finish_freeform(true);
             }
-            points.push(p);
+            self.tool.press_added_vertex = points.len() < super::MAX_GESTURE_POINTS;
+            if self.tool.press_added_vertex {
+                points.push(p);
+            }
             self.tool.path_preview = points.clone();
             self.tool.drag = Some(Drag::Freeform { mode, points, pressed: true });
             return Ok(Value::Null);

crates/fonts/src/fallback.rs

@@ -169,8 +169,14 @@ impl FontDb {
                 if bundled.contains(fam) {
                     continue;
                 }
-                if self.is_loaded(fam) || self.has_family(fam) {
-                    let f = self.face(fam, style);
+                if self.is_loaded(fam) || (self.system_fallback_enabled() && self.has_family(fam)) {
+                    // With system fallback off, only a face that is already loaded: `face` could load more catalog files.
+                    let f = if self.system_fallback_enabled() {
+                        self.face(fam, style)
+                    } else {
+                        let Some(f) = self.find(fam, style) else { continue };
+                        f
+                    };
                     if f.family.eq_ignore_ascii_case(fam) && covers_cluster(&f, cluster) {
                         return f;
                     }
@@ -311,4 +317,21 @@ mod tests {
             assert!(c.windows(2).all(|w| w[0] <= w[1]));
         }
     }
+
+    /// With system fallback off, the automatic cascades (script families and symbol faces) load no
+    /// installed family: the result comes from what is already loaded.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn cascades_load_no_installed_family_when_system_fallback_is_off() {
+        let db = FontDb::with_font_dirs(Vec::new());
+        db.set_system_fallback(false);
+        let base = db.face(crate::DEFAULT_FAMILY, "Regular");
+        let loaded = |db: &FontDb| [b"Arab", b"Hebr", b"Thai", b"Deva"].into_iter().flat_map(|s| os_families(*s)).filter(|f| db.is_loaded(f)).count();
+        let before = loaded(&db);
+        for c in ['\u{0628}', '\u{05D0}', '\u{0E01}', '\u{0905}', '\u{2211}', '\u{2603}'] {
+            let f = db.cascade(&[c], std::slice::from_ref(&base), "Regular");
+            assert!(!f.family.is_empty());
+        }
+        assert_eq!(loaded(&db), before, "no installed family was loaded");
+    }
 }

crates/fonts/src/fontdb.rs

@@ -976,6 +976,17 @@ impl FontDb {
         let _ = on;
     }
 
+    /// Whether automatic system-font lookups (fallback by character, symbol and script families)
+    /// may touch installed fonts. Lookups of a family the document or host names are not gated.
+    pub(crate) fn system_fallback_enabled(&self) -> bool {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).enabled
+        }
+        #[cfg(target_arch = "wasm32")]
+        false
+    }
+
     /// Process-wide database: the bundled fonts, then the installed system fonts, cataloged the
     /// first time a lookup by family name needs them (or ahead of time by
     /// [`FontDb::scan_in_background`]).
@@ -1287,7 +1298,7 @@ impl FontDb {
         Some(f)
     }
 
-    fn find(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
+    pub(crate) fn find(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
         if style.contains('{') {
             {
                 let faces = self.read_faces();
@@ -1473,7 +1484,8 @@ impl FontDb {
         };
         #[cfg(not(target_arch = "wasm32"))]
         {
-            let cataloged: Vec<String> = self.read_catalog().iter().map(|e| e.family.clone()).collect();
+            let cataloged: Vec<String> =
+                if self.system_fallback_enabled() { self.read_catalog().iter().map(|e| e.family.clone()).collect() } else { Vec::new() };
             for fam in SYSTEM_FALLBACKS.iter().filter(|f| f.contains("Symbol")) {
                 if !self.is_loaded(fam) && cataloged.iter().any(|f| f.eq_ignore_ascii_case(fam)) {
                     self.load_cataloged(fam);

crates/fonts/src/tests.rs

@@ -425,3 +425,11 @@ fn the_font_scan_skips_fifos_folders_and_link_loops() {
     assert!(fifo || n >= 1);
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+#[test]
+fn disabling_system_fallback_gates_automatic_family_loads() {
+    let db = FontDb::with_font_dirs(Vec::new());
+    assert!(cfg!(target_arch = "wasm32") || db.system_fallback_enabled());
+    db.set_system_fallback(false);
+    assert!(!db.system_fallback_enabled());
+}

crates/h264/src/cabac_mb.rs

@@ -48,7 +48,7 @@ impl SliceDecoder<'_> {
         let intra_slice = self.sh.slice_type.is_intra();
         loop {
             ensure!(addr < total, "macroblock address {addr} out of range");
-            self.start_mb(addr);
+            self.start_mb(addr)?;
             let skip = !intra_slice && self.decode_skip_flag(&mut c);
             if skip {
                 self.decode_skip()?;

crates/h264/src/decoder.rs

@@ -15,7 +15,7 @@ use crate::slicedec::{PicState, SliceDecoder};
 use crate::transform::LevelScale;
 use crate::{ColorInfo, Picture};
 use deckcraft_bitstream::{BitReader, annexb_nals, length_prefixed_nals, unescape_rbsp};
-use std::collections::VecDeque;
+use std::collections::{HashMap, VecDeque};
 use std::sync::{Arc, Mutex};
 
 /// One slice of a picture job.
@@ -90,6 +90,10 @@ pub struct Decoder {
     ls_cache: Vec<(Arc<Pps>, Arc<LevelScale>)>,
     /// Pictures leaving the DPB, converted once their decoding job has finished.
     out_queue: VecDeque<Output>,
+    /// Queued entries per frame id and their summed bytes, kept in step with `out_queue` so the
+    /// budget check does not rescan it.
+    queued_ids: HashMap<u32, u64>,
+    queued_bytes: u64,
     shared: Arc<Shared>,
     #[cfg(feature = "threads")]
     pool: Option<rayon::ThreadPool>,
@@ -175,6 +179,8 @@ impl Decoder {
             active_sps: None,
             ls_cache: Vec::new(),
             out_queue: VecDeque::new(),
+            queued_ids: HashMap::new(),
+            queued_bytes: 0,
             shared: Arc::new(Shared::default()),
             #[cfg(feature = "threads")]
             pool,
@@ -283,7 +289,7 @@ impl Decoder {
             if !o.frame.is_published(o.frame.mb_h() - 1) && self.out_queue.len() <= max_queue {
                 break;
             }
-            let Some(o) = self.out_queue.pop_front() else { break };
+            let Some(o) = self.pop_out() else { break };
             pics.push(make_picture(&o));
         }
         Ok(pics)
@@ -295,7 +301,7 @@ impl Decoder {
         let mut outs = Vec::new();
         self.dpb.flush(&mut outs);
         self.emit(outs);
-        let pics = self.out_queue.drain(..).map(|o| make_picture(&o)).collect();
+        let pics = std::iter::from_fn(|| self.pop_out()).map(|o| make_picture(&o)).collect();
         while let Some(f) = self.in_flight.pop_front() {
             f.wait_complete();
         }
@@ -451,13 +457,24 @@ impl Decoder {
             chroma_planes: if chroma == 0 { 0 } else { 2 },
             bytes_per_sample: 1,
         };
-        let pictures = (sps.max_dpb_frames() + 1 + self.max_in_flight) as u64;
-        ensure!(
-            shape.fits(pictures, self.memory_budget),
-            "{}x{} pictures with {pictures} in the decoder exceed the memory budget",
-            sps.width(),
-            sps.height()
-        );
+        // Pictures already held count at their own size, not the incoming SPS's: after a
+        // resolution change, larger pictures of the old size can still be in the DPB or waiting
+        // for output (one decode call may carry many access units). A buffer shared with a DPB
+        // entry is counted once.
+        let pic = shape.bytes().unwrap_or(u64::MAX);
+        let held = |frames: &mut dyn Iterator<Item = &Arc<Frame>>| frames.fold(0u64, |n, f| n.saturating_add(f.bytes()));
+        // Queued bytes minus the queue entries that share a DPB frame (each distinct DPB frame once).
+        let mut ids: Vec<(u32, u64)> = self.dpb.entries.iter().map(|e| (e.frame.id, e.frame.bytes())).collect();
+        ids.sort_unstable();
+        ids.dedup();
+        let shared = ids.iter().fold(0u64, |n, (id, b)| n.saturating_add(self.queued_ids.get(id).copied().unwrap_or(0).saturating_mul(*b)));
+        let queued = self.queued_bytes.saturating_sub(shared);
+        let in_dpb = held(&mut self.dpb.entries.iter().map(|e| &e.frame));
+        let dpb = sps.max_dpb_frames().max(self.dpb.entries.len()) as u64;
+        // The DPB (the larger of its new slots and what it holds now), the picture being decoded,
+        // and what is in flight or queued.
+        let bytes = pic.saturating_mul(dpb).max(in_dpb).saturating_add(pic).saturating_add(pic.saturating_mul(self.max_in_flight as u64).max(queued));
+        ensure!(bytes <= self.memory_budget, "{}x{} pictures with {bytes} bytes in the decoder exceed the memory budget", sps.width(), sps.height());
         Ok(())
     }
 
@@ -562,8 +579,24 @@ impl Decoder {
     }
 
     fn emit(&mut self, outs: Vec<Output>) {
+        for o in &outs {
+            *self.queued_ids.entry(o.frame.id).or_insert(0) += 1;
+            self.queued_bytes = self.queued_bytes.saturating_add(o.frame.bytes());
+        }
         self.out_queue.extend(outs);
     }
+
+    fn pop_out(&mut self) -> Option<Output> {
+        let o = self.out_queue.pop_front()?;
+        if let Some(n) = self.queued_ids.get_mut(&o.frame.id) {
+            *n -= 1;
+            if *n == 0 {
+                self.queued_ids.remove(&o.frame.id);
+            }
+        }
+        self.queued_bytes = self.queued_bytes.saturating_sub(o.frame.bytes());
+        Some(o)
+    }
 }
 
 /// Decode all slices of one picture and publish its rows.

crates/h264/src/dpb.rs

@@ -139,8 +139,9 @@ impl Dpb {
         let mut unused = (prev_ref_frame_num + 1) % max_frame_num;
         // Only the last `max_num_ref_frames` "non-existing" frames can survive the sliding window, and
         // inserting more than that evicts every earlier short-term reference. Skip straight to that tail
-        // (keeping the POC state walk for every missing frame_num) so a hostile gap of up to 65535
-        // frames costs at most `max_num_ref_frames` frame allocations instead of one per missing frame.
+        // (advancing the POC state across the skipped run in constant time) so a hostile gap of up to
+        // 65535 frames costs at most `max_num_ref_frames` frame allocations and POC updates instead of
+        // one per missing frame.
         let gap = frame_num.wrapping_add(max_frame_num).wrapping_sub(unused) % max_frame_num;
         let keep = u32::try_from(max_num_ref_frames.max(1)).unwrap_or(u32::MAX);
         let skip = gap.saturating_sub(keep);
@@ -149,10 +150,17 @@ impl Dpb {
                 e.mark = RefMark::Unused;
             }
             self.prune();
-            for _ in 0..skip {
-                poc_state(unused);
-                unused = (unused + 1) % max_frame_num;
+            // The POC state only advances FrameNumOffset where frame_num decreases, so walking the
+            // skipped run is the same as visiting its first value, the wrap (if the run crosses
+            // it) and its last value: constant work however long the gap.
+            let last = (unused + (skip - 1) % max_frame_num) % max_frame_num;
+            poc_state(unused);
+            if last < unused {
+                poc_state(max_frame_num - 1);
+                poc_state(0);
             }
+            poc_state(last);
+            unused = (last + 1) % max_frame_num;
         }
         let mut guard = 0;
         while unused != frame_num && guard < max_frame_num {
@@ -438,14 +446,15 @@ impl Dpb {
                 }
             }
         } else {
-            while self.entries.len() >= self.capacity {
+            // Evict until there is room (frame_num gap concealment can leave the DPB over-full), so
+            // the store never holds more pictures than the memory budget was checked for.
+            while self.entries.len() >= self.capacity.max(1) {
                 if !self.bump(out) {
                     if let Some(pos) = self.entries.iter().position(|e| !e.needed_for_output) {
                         self.entries.remove(pos);
                     } else {
                         self.entries.remove(0);
                     }
-                    break;
                 }
             }
         }
@@ -546,6 +555,37 @@ mod tests {
         (made, walk, left)
     }
 
+    /// (FrameNumOffset, prev frame_num) after `walk`, by the rule of `PocState::update_gap_frame`.
+    fn poc_after(walk: &[u32], prev: u32, max: u32) -> (u64, u32) {
+        walk.iter().fold((0, prev), |(off, prev), &f| (if prev > f { off + u64::from(max) } else { off }, f))
+    }
+
+    #[test]
+    fn gap_walk_matches_every_frame_num_for_any_skip() {
+        for (prev, cur) in [(1, 9), (10, 3), (14, 0), (15, 14), (0, 15), (7, 6)] {
+            for refs in 1..4 {
+                let mut dpb = Dpb::new();
+                let (_, walk, _) = fill(&mut dpb, prev, cur, 16, refs);
+                let every: Vec<u32> = (1..16).map(|i| (prev + i) % 16).take_while(|&f| f != cur).collect();
+                assert_eq!(poc_after(&walk, prev, 16), poc_after(&every, prev, 16), "{prev} -> {cur}, {refs} refs");
+                assert_eq!(walk.last(), every.last(), "{prev} -> {cur}, {refs} refs");
+            }
+        }
+    }
+
+    #[test]
+    fn reference_store_evicts_down_to_capacity() {
+        let mut dpb = Dpb::new();
+        dpb.capacity = 2;
+        // Gap concealment can leave more non-output references than the capacity.
+        for i in 0..5 {
+            short(&mut dpb, i, i);
+        }
+        let mut out = Vec::new();
+        assert!(!dpb.bump_for_space(RefMark::Short, 0, &mut out));
+        assert!(dpb.entries.len() < 2, "{} pictures left before storing into a 2-picture DPB", dpb.entries.len());
+    }
+
     #[test]
     fn huge_gap_makes_only_the_frames_that_stay_referenced() {
         let mut dpb = Dpb::new();
@@ -553,8 +593,9 @@ mod tests {
         short(&mut dpb, 2, 1);
         let (made, walk, left) = fill(&mut dpb, 1, 65535, 65536, 4);
         assert_eq!(made, 4);
-        // The POC state still walks every missing frame_num, in order.
-        assert_eq!(walk.len(), 65533);
+        // The POC state ends where walking every missing frame_num would leave it, in a few steps.
+        assert_eq!(poc_after(&walk, 1, 65536), poc_after(&(2..65535).collect::<Vec<_>>(), 1, 65536));
+        assert!(walk.len() <= 8, "{} POC updates", walk.len());
         assert_eq!(walk.first(), Some(&2));
         assert_eq!(walk.last(), Some(&65534));
         assert_eq!(left, vec![(65531, true), (65532, true), (65533, true), (65534, true)]);
@@ -566,7 +607,9 @@ mod tests {
         short(&mut dpb, 1, 65000);
         let (made, walk, left) = fill(&mut dpb, 65000, 3, 65536, 2);
         assert_eq!(made, 2);
-        assert_eq!(walk.len(), 538);
+        let every: Vec<u32> = (65001..65536).chain(0..3).collect();
+        assert_eq!(poc_after(&walk, 65000, 65536), poc_after(&every, 65000, 65536));
+        assert!(walk.len() <= 6, "{} POC updates", walk.len());
         assert_eq!(walk.first(), Some(&65001));
         assert_eq!(walk.last(), Some(&2));
         assert_eq!(left, vec![(1, true), (2, true)]);

crates/h264/src/picture.rs

@@ -160,6 +160,14 @@ impl Frame {
         self.rows.len()
     }
 
+    /// Sample bytes this picture holds (luma and both chroma planes), as the decoder's memory
+    /// budget counts a picture.
+    pub fn bytes(&self) -> u64 {
+        (self.width as u64)
+            .saturating_mul(self.height as u64)
+            .saturating_add((self.cwidth as u64).saturating_mul(self.cheight as u64).saturating_mul(2))
+    }
+
     /// Publish MB row `r` (ignored if already published).
     pub fn publish(&self, r: usize, row: FrameRow) {
         let _ = self.rows[r].set(row);

crates/h264/src/slicedec.rs

@@ -346,8 +346,11 @@ impl<'a> SliceDecoder<'a> {
     // Neighbour helpers
     // ------------------------------------------------------------------------------------------
 
-    /// Set up the current macroblock address and neighbour availability.
-    pub fn start_mb(&mut self, addr: usize) {
+    /// Set up the current macroblock address and neighbour availability. A macroblock an earlier
+    /// slice of this picture already decoded is refused: overlapping slices would otherwise redo
+    /// the picture's reconstruction once per slice.
+    pub fn start_mb(&mut self, addr: usize) -> Result<()> {
+        ensure!(self.pic.mbs[addr].slice_num == u32::MAX, "macroblock {addr} overlaps an earlier slice");
         self.mb_addr = addr;
         self.mb_x = addr % self.mb_w;
         self.mb_y = addr / self.mb_w;
@@ -364,6 +367,7 @@ impl<'a> SliceDecoder<'a> {
         ];
         self.mv_done = 0;
         self.pic.mbs[addr] = MbState { slice_num: sn, ..MbState::default() };
+        Ok(())
     }
 
     #[inline]
@@ -1467,7 +1471,7 @@ impl<'a> SliceDecoder<'a> {
                 let run = r.read_ue()? as usize;
                 ensure!(addr + run <= total, "mb_skip_run out of range");
                 for _ in 0..run {
-                    self.start_mb(addr);
+                    self.start_mb(addr)?;
                     self.decode_skip()?;
                     self.pic.mb_done(addr);
                     addr += 1;
@@ -1477,7 +1481,7 @@ impl<'a> SliceDecoder<'a> {
                 }
                 ensure!(addr < total, "macroblock address {addr} out of range");
             }
-            self.start_mb(addr);
+            self.start_mb(addr)?;
             self.decode_mb_cavlc(r)?;
             self.pic.mb_done(addr);
             addr += 1;

crates/h264/src/synth_tests.rs

@@ -113,6 +113,7 @@ fn avcc_rejects_a_valid_picture_slice_without_starting_a_picture() {
             poc_lsb: Some(0),
             poc_delta: None,
             wt: None,
+            first_mb: 0,
         },
         false,
     );
@@ -153,6 +154,8 @@ struct Pic {
     /// Explicit weights (luma, cb, cr) as (weight, offset) for refIdx 0 of list 0 and list 1;
     /// log2 denominators are 5 (luma) and 3 (chroma).
     wt: Option<[[(i32, i32); 3]; 2]>,
+    /// first_mb_in_slice (`mbs` then lists the slice's macroblocks from there).
+    first_mb: u32,
 }
 
 impl Pic {
@@ -165,7 +168,7 @@ impl Pic {
 }
 
 fn slice_header(w: &mut BitWriter, p: &Pic, cabac: bool) {
-    w.write_ue(0); // first_mb
+    w.write_ue(p.first_mb);
     w.write_ue(if p.b {
         6
     } else if p.is_p() {
@@ -660,3 +663,63 @@ fn frame_num_gap_is_filled_when_the_sps_allows_gaps() {
     assert_eq!(out.len(), 2);
     assert_eq!(dec.stats().frame_num_gaps, 1);
 }
+
+/// An IDR picture followed by `pictures` reference P pictures of P_Skip macroblocks.
+fn skip_stream(pictures: u32) -> (Vec<u8>, Vec<Vec<u8>>) {
+    let mut seed = 11u32;
+    let a: Vec<Option<Vec<u8>>> = (0..NMB).map(|_| Some(random_mb(&mut seed))).collect();
+    let mut head = sps(66, 2, false, PocType::T2);
+    head.extend(pps(false, false));
+    head.extend(slice_nal(&Pic { idr: true, frame_num: 0, ref_idc: 3, mbs: a, ..Default::default() }, false));
+    let ps = (1..=pictures).map(|k| slice_nal(&Pic { frame_num: k % 16, ref_idc: 2, mbs: vec![None; NMB], ..Default::default() }, false)).collect();
+    (head, ps)
+}
+
+#[test]
+fn overlapping_slices_are_not_reconstructed_twice() {
+    let (head, ps) = skip_stream(1);
+    let mut once = Decoder::with_threads(1);
+    let mut out = once.decode(&[head.clone(), ps[0].clone()].concat(), 0).unwrap();
+    out.extend(once.flush());
+    assert!(once.take_error().is_none());
+    assert_eq!(out.len(), 2);
+    // A second slice of the same picture starting at macroblock 1 covers those macroblocks again.
+    let again = slice_nal(&Pic { frame_num: 1, ref_idc: 2, mbs: vec![None; NMB - 1], first_mb: 1, ..Default::default() }, false);
+    let mut twice = Decoder::with_threads(1);
+    let result = twice.decode(&[head, ps[0].clone(), again].concat(), 0);
+    twice.flush();
+    let err = result.err().or_else(|| twice.take_error()).expect("overlapping slice refused");
+    assert!(err.to_string().contains("overlaps"), "{err}");
+}
+
+#[test]
+fn output_queue_counts_against_the_memory_budget() {
+    let (head, ps) = skip_stream(40);
+    let sps_nal = sps(66, 2, false, PocType::T2);
+    let parsed = crate::params::Sps::parse(&deckcraft_bitstream::unescape_rbsp(&sps_nal[5..])).unwrap();
+    let one = (NMB * 256 + 2 * NMB * 64) as u64;
+    let budget = (parsed.max_dpb_frames() + 1 + 3) as u64 * one;
+    // One access unit per call: output drains as it goes, and the stream fits.
+    let mut dec = Decoder::with_threads(1);
+    dec.set_memory_budget(budget);
+    let mut out = dec.decode(&head, 0).unwrap();
+    for (i, p) in ps.iter().enumerate() {
+        out.extend(dec.decode(p, i as i64 + 1).unwrap());
+    }
+    out.extend(dec.flush());
+    assert!(dec.take_error().is_none());
+    assert_eq!(out.len(), 41);
+    // Every access unit in one call: the pictures held for output stop fitting the budget.
+    let mut dec = Decoder::with_threads(1);
+    dec.set_memory_budget(budget);
+    let err = dec.decode(&[head, ps.concat()].concat(), 0).expect_err("output queue is over budget");
+    assert!(err.to_string().contains("memory budget"), "{err}");
+}
+
+/// A held picture is charged at its own size (luma and both 4:2:0 chroma planes), the same
+/// count the budget uses for the incoming SPS's pictures.
+#[test]
+fn a_held_frame_is_charged_at_its_own_size() {
+    let f = crate::picture::Frame::new(0, 0, 2, 3);
+    assert_eq!(f.bytes(), (2 * 3 * 256 + 2 * 2 * 3 * 64) as u64);
+}

crates/hevc/src/decoder.rs

@@ -404,10 +404,36 @@ impl Decoder {
             chroma_planes: if chroma == 0 { 0 } else { 2 },
             bytes_per_sample: 2,
         };
+        let frame_bytes = |f: &crate::picture::Frame| {
+            (f.width as u64)
+                .saturating_mul(f.height as u64)
+                .saturating_add((f.cwidth as u64).saturating_mul(f.cheight as u64).saturating_mul(2))
+                .saturating_mul(2)
+        };
+        // Output frames waiting to be returned stay allocated after they leave the DPB, at their
+        // own size: a resolution change in this call can leave pictures of the previous SPS.
+        let queued: u64 = self
+            .out_queue
+            .iter()
+            .filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame)) && !self.in_flight.iter().any(|f| Arc::ptr_eq(f, &o.frame)))
+            .map(|o| frame_bytes(&o.frame))
+            .fold(0, u64::saturating_add);
+        // Frames the DPB holds now count at their own size too (an SPS change flushes them into the
+        // queue before the new pictures are made): the DPB part is the larger of its new slots and that.
+        let held: u64 = self.dpb.entries.iter().map(|e| frame_bytes(&e.frame)).fold(0, u64::saturating_add);
+        // A queued frame still being decoded is one of the in-flight pictures already reserved, so the
+        // queue and the in-flight reservation overlap: charge the larger, not both.
         let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64;
+        let slots = shape.store_bytes(u64::from(sps.max_dec_pic_buffering));
+        let flight = shape.store_bytes(self.max_in_flight as u64);
+        let total = shape
+            .store_bytes(1)
+            .zip(slots)
+            .zip(flight)
+            .map(|((one, slots), flight)| slots.max(held).saturating_add(one).saturating_add(flight).saturating_add(queued));
         ensure!(
-            shape.fits(pictures, self.memory_budget),
-            "{}x{} pictures with {pictures} in the decoder exceed the memory budget",
+            total.is_some_and(|b| b <= self.memory_budget),
+            "{}x{} pictures with {pictures} in the decoder and {queued} bytes queued exceed the memory budget",
             sps.width,
             sps.height
         );

crates/isobmff/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "deckcraft-isobmff"
-description = "Clean-room ISO BMFF (MP4) and QuickTime (MOV) demuxer and muxer"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
-
-[lints]
-workspace = true
-
-[dependencies]
-craft-media = { workspace = true, features = ["isobmff"] }

crates/isobmff/src/lib.rs

@@ -1,6 +0,0 @@
-//! ISO BMFF (MP4) and QuickTime (MOV) demuxer and muxer: a re-export of [`craft_media::isobmff`]
-//! from craft-libs. Supported boxes and limitations are in the craft-media README.
-
-#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
-
-pub use craft_media::isobmff::*;

crates/matroska/Cargo.toml

@@ -1,13 +0,0 @@
-[package]
-name = "deckcraft-matroska"
-description = "Clean-room Matroska (MKV) and WebM demuxer and muxer"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
-
-[lints]
-workspace = true
-
-[dependencies]
-craft-media = { workspace = true, features = ["matroska"] }

crates/matroska/src/lib.rs

@@ -1,6 +0,0 @@
-//! Matroska (MKV) and WebM demuxer and muxer: a re-export of [`craft_media::matroska`] from
-//! craft-libs. Supported elements and limitations are in the craft-media README.
-
-#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
-
-pub use craft_media::matroska::*;

crates/mcp/src/server.rs

@@ -16,6 +16,12 @@ const INVALID_REQUEST: i64 = -32600;
 const METHOD_NOT_FOUND: i64 = -32601;
 const INVALID_PARAMS: i64 = -32602;
 const INTERNAL_ERROR: i64 = -32603;
+
+/// Entries one batch (a JSON-RPC batch, or the `batch` tool's commands) may hold.
+pub(crate) const MAX_BATCH_ITEMS: usize = 1000;
+/// Bytes of results one batch may gather before the rest of it is refused: each result can copy
+/// much of the document (an inspection holds every note), so a batch holds at most this much.
+pub(crate) const MAX_BATCH_BYTES: usize = 64 << 20;
 const RESOURCE_NOT_FOUND: i64 = -32002;
 /// Keep request frames in step with the connected backend's reply limit.
 const MAX_FRAME_BYTES: usize = 16 * 1024 * 1024;
@@ -93,8 +99,28 @@ impl Server {
                 // Batches were removed in 2025-06-18; still answer older clients sensibly.
                 if batch.is_empty() {
                     Some(error(Value::Null, INVALID_REQUEST, "empty batch"))
+                } else if batch.len() > MAX_BATCH_ITEMS {
+                    Some(error(Value::Null, INVALID_REQUEST, format!("a batch holds at most {MAX_BATCH_ITEMS} messages")))
                 } else {
-                    let replies: Vec<Value> = batch.into_iter().filter_map(|m| self.handle(m)).collect();
+                    let mut used = 0usize;
+                    let mut replies: Vec<Value> = Vec::new();
+                    for m in batch {
+                        if used > MAX_BATCH_BYTES {
+                            // Not run: answer each remaining request with a short error.
+                            if let Some(id) = m.get("id").filter(|id| id.is_string() || id.is_number()) {
+                                replies.push(error(id.clone(), INTERNAL_ERROR, "the batch's replies passed 64 MiB; not run"));
+                            }
+                            continue;
+                        }
+                        if let Some(r) = self.handle(m) {
+                            used = used.saturating_add(r.to_string().len());
+                            replies.push(if used > MAX_BATCH_BYTES {
+                                error(r.get("id").cloned().unwrap_or(Value::Null), INTERNAL_ERROR, "the batch's replies passed 64 MiB; reply dropped")
+                            } else {
+                                r
+                            });
+                        }
+                    }
                     (!replies.is_empty()).then_some(Value::Array(replies))
                 }
             }

crates/mcp/src/tools.rs

@@ -357,21 +357,40 @@ pub fn call_tool(b: &mut dyn Backend, name: &str, a: &Value) -> ToolResult {
             wrap(exec(b, c, a.get("params").cloned().unwrap_or(json!({}))))
         }
         "batch" => {
+            use crate::server::{MAX_BATCH_BYTES, MAX_BATCH_ITEMS};
             let keep = a.get("keepGoing").and_then(Value::as_bool).unwrap_or(false);
+            let commands = a.get("commands").and_then(Value::as_array).map(Vec::as_slice).unwrap_or_default();
+            if commands.len() > MAX_BATCH_ITEMS {
+                return ToolResult::error(format!("a batch holds at most {MAX_BATCH_ITEMS} commands"));
+            }
             let mut out = vec![];
-            for c in a.get("commands").and_then(Value::as_array).cloned().unwrap_or_default() {
+            let mut used = 0usize;
+            for c in commands {
                 let id = c.get("command").and_then(Value::as_str).unwrap_or("");
-                match exec(b, id, c.get("params").cloned().unwrap_or(json!({}))) {
-                    Ok(v) => out.push(json!({"command": id, "ok": true, "result": v})),
-                    Err(e) => {
-                        out.push(json!({"command": id, "ok": false, "error": e}));
-                        if !keep {
-                            return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
-                        }
-                    }
+                let (entry, failed) = match exec(b, id, c.get("params").cloned().unwrap_or(json!({}))) {
+                    Ok(v) => (json!({"command": id, "ok": true, "result": v}), false),
+                    Err(e) => (json!({"command": id, "ok": false, "error": e}), true),
+                };
+                // What the reply carries: the entry as text, escaped again inside the JSON-RPC reply.
+                // Failures count too: with keepGoing, a remote backend's large errors add up.
+                used = used.saturating_add(json!(entry.to_string()).to_string().len());
+                if used > MAX_BATCH_BYTES {
+                    let shown: String = id.chars().take(128).collect();
+                    out.push(json!({"command": shown, "ok": false, "error": "the batch's results passed 64 MiB; stopped here"}));
+                    return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
+                }
+                out.push(entry);
+                if failed && !keep {
+                    return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
                 }
             }
-            ToolResult::json(&Value::Array(out))
+            // The reply is pretty-printed, which is longer than the compact entries counted above.
+            let reply = ToolResult::json(&Value::Array(out));
+            let text = reply.content[0]["text"].as_str().unwrap_or_default();
+            if json!(text).to_string().len() > MAX_BATCH_BYTES {
+                return ToolResult::error("the batch's results passed 64 MiB; nothing is returned");
+            }
+            reply
         }
         "new_presentation" => wrap(exec(b, "file.new", a)),
         "open_presentation" => wrap(exec(b, "file.open", a)),

crates/mcp/tests/it/batch_budget.rs

@@ -0,0 +1,70 @@
+//! A batch (JSON-RPC or the `batch` tool) is bounded in entries and in the bytes of results it
+//! gathers, so a short request cannot copy a large document into memory hundreds of times.
+
+use deckcraft_mcp::{Headless, Server};
+use serde_json::{Value, json};
+
+fn server_with_notes(bytes: usize) -> Server {
+    let mut server = Server::new(Box::new(Headless::with_document()));
+    let line = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "run_command", "arguments": {"command": "slide.notes", "params": {"text": "n".repeat(bytes)}}}});
+    let reply: Value = serde_json::from_str(&server.handle_line(&line.to_string()).unwrap()).unwrap();
+    assert_ne!(reply["result"]["isError"], true, "{reply}");
+    server
+}
+
+#[test]
+fn json_rpc_batches_are_bounded_in_entries_and_reply_bytes() {
+    let mut server = server_with_notes(1 << 20);
+    let ping = |i: usize| json!({"jsonrpc": "2.0", "id": i, "method": "ping"});
+    let too_many: Vec<Value> = (0..1001).map(ping).collect();
+    let reply: Value = serde_json::from_str(&server.handle_line(&Value::Array(too_many).to_string()).unwrap()).unwrap();
+    assert_eq!(reply["error"]["code"], -32600, "{reply}");
+    // 100 inspections of a slide with 1 MB of notes: about 64 are answered, the rest refused.
+    let inspect = |i: usize| json!({"jsonrpc": "2.0", "id": i, "method": "tools/call", "params": {"name": "inspect_slide", "arguments": {}}});
+    let line = Value::Array((0..100).map(inspect).collect()).to_string();
+    let reply = server.handle_line(&line).unwrap();
+    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
+    let replies: Vec<Value> = serde_json::from_str(&reply).unwrap();
+    assert_eq!(replies.len(), 100, "every request is answered");
+    assert!(replies.last().unwrap()["error"]["message"].as_str().unwrap().contains("64 MiB"));
+}
+
+#[test]
+fn the_batch_tool_is_bounded_in_commands_and_result_bytes() {
+    let mut server = server_with_notes(1 << 20);
+    let call = |server: &mut Server, commands: Vec<Value>| {
+        let line = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
+        let reply: Value = serde_json::from_str(&server.handle_line(&line.to_string()).unwrap()).unwrap();
+        (reply["result"]["isError"] == true, reply["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string())
+    };
+    let (err, text) = call(&mut server, vec![json!({"command": "document.inspect"}); 1001]);
+    assert!(err && text.contains("at most 1000"), "{text}");
+    let (err, text) = call(&mut server, vec![json!({"command": "slide.inspect"}); 100]);
+    assert!(err && text.contains("64 MiB"), "{}", &text[text.len().saturating_sub(200)..]);
+    assert!(text.len() < (64 << 20) + (4 << 20));
+}
+
+#[test]
+fn the_batch_tool_charges_the_escaped_reply() {
+    // Quotes escape twice on the way out (`\\\"`), so 30 results of ~2 MiB serialize to ~120 MiB.
+    let mut server = Server::new(Box::new(Headless::with_document()));
+    let notes = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "run_command", "arguments": {"command": "slide.notes", "params": {"text": "\"".repeat(1 << 20)}}}});
+    server.handle_line(&notes.to_string()).unwrap();
+    let commands = vec![json!({"command": "slide.inspect"}); 30];
+    let line = json!({"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
+    let reply = server.handle_line(&line.to_string()).unwrap();
+    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
+    assert!(reply.contains("64 MiB"));
+}
+
+#[test]
+fn the_batch_tool_charges_failures_too() {
+    // Each unknown command's error echoes its ~1 MiB id; with keepGoing none of them is a result.
+    let mut server = Server::new(Box::new(Headless::with_document()));
+    let id = "x".repeat(1 << 20);
+    let commands = vec![json!({"command": id}); 70];
+    let line = json!({"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
+    let reply = server.handle_line(&line.to_string()).unwrap();
+    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
+    assert!(reply.contains("64 MiB"));
+}

crates/mcp/tests/it/main.rs

@@ -1,3 +1,5 @@
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md).
 #[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 mod automation_roots;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod batch_budget;

crates/media/Cargo.toml

@@ -9,10 +9,9 @@ description = "DeckCraft media: probing, audio decoding (MP3, AAC/M4A, WAV, AIFF
 workspace = true
 
 [dependencies]
-deckcraft-isobmff = { workspace = true }
-deckcraft-matroska = { workspace = true }
-deckcraft-ogg = { workspace = true }
-deckcraft-opus = { workspace = true }
+# Containers (MP4/MOV, Matroska/WebM, Ogg) and the Opus decoder, shared with the other Craft apps.
+craft-media = { workspace = true, features = ["isobmff", "matroska", "ogg"] }
+craft-audio = { workspace = true }
 deckcraft-h264 = { workspace = true }
 deckcraft-hevc = { workspace = true }
 deckcraft-vp9 = { workspace = true }

crates/media/src/audio.rs

@@ -81,7 +81,9 @@ pub fn decode(bytes: &Bytes) -> Result<Pcm> {
             Some(r) => r,
             None => contained(|| decode_symphonia(bytes, "mkv")),
         },
-        Container::Mp4 if !crate::mp4guard::tables_fit(bytes) => Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into())),
+        Container::Mp4 | Container::Unknown | Container::Mp3 if !crate::mp4guard::probe_fits(bytes) => {
+            Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into()))
+        }
         c => contained(|| decode_symphonia(bytes, c.name())),
     }
 }
@@ -89,15 +91,15 @@ pub fn decode(bytes: &Bytes) -> Result<Pcm> {
 /// Ogg Opus with our decoder; `None` when the file holds no Opus stream.
 fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
     let src: &[u8] = bytes;
-    let file = deckcraft_ogg::open(src).ok()?;
-    let s = file.stream_of(deckcraft_ogg::Codec::Opus)?;
+    let file = craft_media::ogg::open(src).ok()?;
+    let s = file.stream_of(craft_media::ogg::Codec::Opus)?;
     let stream = file.streams.get(s)?;
     Some((|| {
         let head = stream.headers.first().ok_or(MediaError::Corrupt("Opus header missing".into()))?;
-        let mut dec = deckcraft_opus::Decoder::new(head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+        let mut dec = craft_audio::opus::Decoder::new(head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
         dec.set_trim_pre_skip(true);
         let channels = dec.channels() as u16;
-        let timing = deckcraft_ogg::OpusTiming::of(stream, dec.pre_skip() as u32).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+        let timing = craft_media::ogg::OpusTiming::of(stream, dec.pre_skip() as u32);
         let mut out = Vec::new();
         for i in 0..stream.packets.len() {
             if MAX_PCM_SAMPLES.saturating_sub(out.len()) < channels.max(1) as usize {
@@ -113,7 +115,8 @@ fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
             }
         }
         // End trimming (RFC 7845 §4.5).
-        let total = timing.total.max(0) as usize * channels.max(1) as usize;
+        // the timing saturates on a hostile granule, so this product must too
+        let total = usize::try_from(timing.total).unwrap_or(0).saturating_mul(channels.max(1) as usize);
         if total > 0 && total < out.len() {
             out.truncate(total);
         }
@@ -124,13 +127,13 @@ fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
 /// WebM / Matroska Opus with our decoder; `None` when there is no Opus track.
 fn decode_mkv_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
     let src: &[u8] = bytes;
-    let file = deckcraft_matroska::open(src).ok()?;
+    let file = craft_media::matroska::open(src).ok()?;
     let (ti, head) = file.tracks.iter().enumerate().find_map(|(i, t)| match &t.codec {
-        deckcraft_matroska::Codec::Opus { head } => Some((i, head.clone())),
+        craft_media::matroska::Codec::Opus { head } => Some((i, head.clone())),
         _ => None,
     })?;
     Some((|| {
-        let mut dec = deckcraft_opus::Decoder::new(&head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+        let mut dec = craft_audio::opus::Decoder::new(&head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
         dec.set_trim_pre_skip(true);
         let channels = dec.channels() as u16;
         let mut out = Vec::new();

crates/media/src/mp4guard.rs

@@ -12,6 +12,29 @@ pub(crate) fn tables_fit(b: &[u8]) -> bool {
     boxes_fit(b, b.len() as u64, 0)
 }
 
+/// Bytes symphonia's probe scans for a format marker before giving up.
+const PROBE_SEARCH_LIMIT: usize = 1024 * 1024;
+
+/// Whether symphonia can be given `b`, whatever the sniffer made of it: its probe takes the first
+/// `ftyp` within its search window as the start of an MP4 (the size field 4 bytes before it), so
+/// the table check must start where that parser will, not at offset 0.
+pub(crate) fn probe_fits(b: &[u8]) -> bool {
+    if crate::Container::sniff(b) == crate::Container::Mp4 && !tables_fit(b) {
+        return false;
+    }
+    // The probe reads leading ID3v2 tags as metadata and searches again after the last one.
+    let mut rest = b;
+    while rest.starts_with(b"ID3") {
+        let size = rest.get(6..10).map(|s| s.iter().fold(0usize, |a, &x| (a << 7) | (x & 0x7f) as usize)).unwrap_or(0);
+        rest = rest.get(10 + size..).unwrap_or(&[]);
+    }
+    let head = &rest[..rest.len().min(PROBE_SEARCH_LIMIT + 16)];
+    match head.windows(4).position(|w| w == b"ftyp") {
+        Some(p) => tables_fit(&rest[p.saturating_sub(4)..]),
+        None => true,
+    }
+}
+
 fn be32(b: &[u8], at: usize) -> Option<u64> {
     b.get(at..at.checked_add(4)?).map(|s| u32::from_be_bytes([s[0], s[1], s[2], s[3]]) as u64)
 }
@@ -74,3 +97,29 @@ fn table_fits(kind: &[u8], body: &[u8], file_len: u64) -> bool {
     };
     be32(body, 4).is_some_and(|count| count <= body.len().saturating_sub(8) as u64 / entry)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// An MP4 whose `stsc` count asks for far more entries than the file holds.
+    fn mp4_with_huge_stsc() -> Vec<u8> {
+        let stsc = [&24u32.to_be_bytes()[..], b"stsc", &[0, 0, 0, 0], &u32::MAX.to_be_bytes(), &[0; 8]].concat();
+        let stbl = [&(stsc.len() as u32 + 8).to_be_bytes()[..], b"stbl", &stsc].concat();
+        let moov = [&(stbl.len() as u32 + 8).to_be_bytes()[..], b"moov", &stbl].concat();
+        [&16u32.to_be_bytes()[..], b"ftyp", b"isom", &[0; 4], &moov].concat()
+    }
+
+    #[test]
+    fn a_prefixed_mp4_is_checked_where_symphonia_starts_it() {
+        let mp4 = mp4_with_huge_stsc();
+        assert!(!tables_fit(&mp4));
+        assert!(!probe_fits(&mp4));
+        let prefixed = [&b"junk before the file "[..], &mp4].concat();
+        assert_eq!(crate::Container::sniff(&prefixed), crate::Container::Unknown);
+        assert!(tables_fit(&prefixed), "offset 0 sees no MP4 boxes");
+        assert!(!probe_fits(&prefixed));
+        let far = [&vec![0u8; PROBE_SEARCH_LIMIT + 16][..], &mp4].concat();
+        assert!(probe_fits(&far), "past the probe window symphonia never reads it as an MP4");
+    }
+}

crates/media/src/probe.rs

@@ -71,7 +71,8 @@ pub fn probe_headers(bytes: &Bytes) -> Result<MediaInfo> {
     };
     if info.audio.is_none() && info.video.is_none() || info.audio.as_ref().is_some_and(|a| a.sample_rate == 0) {
         // Plain audio files (and anything our demuxers didn't describe): symphonia's probe.
-        if c == Container::Mp4 && !crate::mp4guard::tables_fit(bytes) {
+        // Symphonia opens an MP4 wherever its probe finds an `ftyp` (after leading ID3v2 tags too); other known containers (a WAV's audio bytes can spell an `ftyp`) skip the check.
+        if matches!(c, Container::Mp4 | Container::Unknown | Container::Mp3) && !crate::mp4guard::probe_fits(bytes) {
             return Err(MediaError::Corrupt("the MP4's sample tables do not fit the file".into()));
         }
         let (codec, rate, channels, frames) = std::panic::catch_unwind(|| crate::audio::probe_symphonia(bytes, c.name()))
@@ -105,9 +106,9 @@ fn codec_label(short: &str) -> String {
 }
 
 fn probe_mp4(bytes: &Bytes) -> Result<MediaInfo> {
-    use deckcraft_isobmff::{CodecConfig, TrackKind};
+    use craft_media::isobmff::{CodecConfig, TrackKind};
     let src: &[u8] = bytes;
-    let f = deckcraft_isobmff::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+    let f = craft_media::isobmff::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
     let mut info = MediaInfo { container: if f.is_quicktime { "mov" } else { "mp4" }, ..Default::default() };
     let mut dur = if f.timescale > 0 { f.duration as f64 / f.timescale as f64 } else { 0.0 };
     if let Some(ti) = f.track_of_kind(TrackKind::Video) {
@@ -145,9 +146,9 @@ fn probe_mp4(bytes: &Bytes) -> Result<MediaInfo> {
 }
 
 fn probe_mkv(bytes: &Bytes) -> Result<MediaInfo> {
-    use deckcraft_matroska::{Codec, TrackKind};
+    use craft_media::matroska::{Codec, TrackKind};
     let src: &[u8] = bytes;
-    let f = deckcraft_matroska::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+    let f = craft_media::matroska::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
     let mut info = MediaInfo { container: if f.is_webm() { "webm" } else { "matroska" }, ..Default::default() };
     let dur = f.duration_ns().map(|n| n as f64 / 1e9).unwrap_or(0.0);
     info.duration_ms = ms(dur);
@@ -178,11 +179,11 @@ fn probe_mkv(bytes: &Bytes) -> Result<MediaInfo> {
 
 fn probe_ogg(bytes: &Bytes) -> Option<MediaInfo> {
     let src: &[u8] = bytes;
-    let f = deckcraft_ogg::open(src).ok()?;
-    let s = f.stream_of(deckcraft_ogg::Codec::Opus)?;
+    let f = craft_media::ogg::open(src).ok()?;
+    let s = f.stream_of(craft_media::ogg::Codec::Opus)?;
     let st = f.streams.get(s)?;
-    let head = deckcraft_opus::OpusHead::parse(st.headers.first()?).ok()?;
-    let timing = deckcraft_ogg::OpusTiming::of(st, head.pre_skip as u32).ok()?;
+    let head = craft_audio::opus::OpusHead::parse(st.headers.first()?).ok()?;
+    let timing = craft_media::ogg::OpusTiming::of(st, head.pre_skip as u32);
     Some(MediaInfo {
         container: "ogg",
         duration_ms: ms(timing.total as f64 / 48_000.0),

crates/media/src/video.rs

@@ -3,8 +3,8 @@
 
 use std::collections::VecDeque;
 
-use deckcraft_isobmff::CodecConfig;
-use deckcraft_matroska::Codec as MkvCodec;
+use craft_media::isobmff::CodecConfig;
+use craft_media::matroska::Codec as MkvCodec;
 
 use crate::yuv::{self, Matrix, Planes};
 use crate::{Bytes, Container, MediaError, Result};
@@ -257,8 +257,8 @@ struct Track {
 }
 
 enum Demux {
-    Mp4(Box<deckcraft_isobmff::Mp4File>, usize),
-    Mkv(Box<deckcraft_matroska::MkvFile>, usize),
+    Mp4(Box<craft_media::isobmff::Mp4File>, usize),
+    Mkv(Box<craft_media::matroska::MkvFile>, usize),
 }
 
 impl Demux {
@@ -273,8 +273,8 @@ impl Demux {
 fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
     match Container::sniff(bytes) {
         Container::Mp4 => {
-            let f = deckcraft_isobmff::open(bytes).map_err(dec_err)?;
-            let ti = f.track_of_kind(deckcraft_isobmff::TrackKind::Video).ok_or(MediaError::Missing("video track"))?;
+            let f = craft_media::isobmff::open(bytes).map_err(dec_err)?;
+            let ti = f.track_of_kind(craft_media::isobmff::TrackKind::Video).ok_or(MediaError::Missing("video track"))?;
             let t = &f.tracks[ti];
             let entry = t.entries.first().ok_or(MediaError::Missing("video track"))?;
             let codec: Box<dyn Codec> = match &entry.codec {
@@ -290,11 +290,11 @@ fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
             Ok((Demux::Mp4(Box::new(f), ti), track, codec))
         }
         Container::Matroska => {
-            let f = deckcraft_matroska::open(bytes).map_err(dec_err)?;
+            let f = craft_media::matroska::open(bytes).map_err(dec_err)?;
             let ti = f
                 .tracks
                 .iter()
-                .position(|t| t.kind == deckcraft_matroska::TrackKind::Video && !t.samples.is_empty())
+                .position(|t| t.kind == craft_media::matroska::TrackKind::Video && !t.samples.is_empty())
                 .ok_or(MediaError::Missing("video track"))?;
             let t = &f.tracks[ti];
             let codec: Box<dyn Codec> = match &t.codec {
@@ -303,7 +303,7 @@ fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
                 MkvCodec::Vp9 { .. } => Box::new(Vp9 { dec: deckcraft_vp9::Decoder::new() }),
                 MkvCodec::Av1 { av1c } => Box::new(Av1 {
                     dec: deckcraft_av1::Decoder::new(),
-                    config_obus: deckcraft_isobmff::Av1Config::parse(av1c).map(|c| c.config_obus).unwrap_or_default(),
+                    config_obus: craft_media::isobmff::Av1Config::parse(av1c).map(|c| c.config_obus).unwrap_or_default(),
                     primed: false,
                 }),
                 other => return Err(MediaError::Unsupported(format!("{} video", mkv_codec_name(other)))),

crates/media/tests/it/decode.rs

@@ -166,6 +166,52 @@ fn ogg_opus() {
     check_tone("opus", &fixture("tone.opus"), 48_000, 1);
 }
 
+/// Ogg Opus timing saturates on a hostile granule position instead of failing, so the end-trim
+/// arithmetic on its total must not overflow either: a three-channel file that ends with a page
+/// carrying the largest granule still probes and decodes.
+#[test]
+fn ogg_opus_with_a_huge_granule_does_not_overflow() {
+    fn seal(mut page: Vec<u8>) -> Vec<u8> {
+        page[22..26].fill(0);
+        let crc = craft_media::ogg::crc32(&page);
+        page[22..26].copy_from_slice(&crc.to_le_bytes());
+        page
+    }
+    let f = fixture("tone.opus");
+    let mut pages: Vec<Vec<u8>> = Vec::new();
+    let mut at = 0;
+    while at + 27 <= f.len() && &f[at..at + 4] == b"OggS" {
+        let nseg = f[at + 26] as usize;
+        let end = at + 27 + nseg + f[at + 27..at + 27 + nseg].iter().map(|&b| b as usize).sum::<usize>();
+        pages.push(f[at..end].to_vec());
+        at = end;
+    }
+    assert_eq!(at, f.len(), "the fixture is whole pages");
+    // an OpusHead for three channels (mapping family 1), each playing the one mono stream
+    let head = pages[0][28..].to_vec();
+    let mut first = pages[0][..26].to_vec();
+    first.extend_from_slice(&[1, 24]);
+    first.extend_from_slice(&head[..9]);
+    first.push(3);
+    first.extend_from_slice(&head[10..18]);
+    first.extend_from_slice(&[1, 1, 0, 0, 0, 0]);
+    pages[0] = seal(first);
+    // the last page once more, as the next page of the stream, with the largest granule
+    let last = pages.len() - 1;
+    let mut extra = pages[last].clone();
+    pages[last][5] &= !0x04;
+    pages[last] = seal(pages[last].clone());
+    extra[6..14].copy_from_slice(&i64::MAX.to_le_bytes());
+    let seq = u32::from_le_bytes([extra[18], extra[19], extra[20], extra[21]]) + 1;
+    extra[18..22].copy_from_slice(&seq.to_le_bytes());
+    pages.push(seal(extra));
+    let b: Bytes = Arc::new(pages.concat());
+    assert!(probe(&b).is_ok_and(|i| i.duration_ms > 1 << 40), "the granule is taken at its word");
+    let p = audio::decode(&b).expect("decode");
+    assert_eq!(p.channels, 3);
+    assert!(!p.samples.is_empty());
+}
+
 #[test]
 fn wma_is_probed_but_not_decoded() {
     let b = fixture("tone.wma");

crates/metafile/src/canvas.rs

@@ -313,6 +313,8 @@ pub(crate) struct Canvas {
     saved: Vec<Saved>,
     /// Bytes held by the items so far (path ops and pixels), capped at [`MAX_BYTES`].
     used: usize,
+    /// Bytes retained outside the canvas (EMF+ objects) that count against the same cap.
+    held: usize,
     objects: Vec<Option<Obj>>,
     pen: Pen,
     brush: Brush,
@@ -345,6 +347,7 @@ impl Canvas {
             viewport_set: false,
             saved: Vec::new(),
             used: 0,
+            held: 0,
             objects: Vec::new(),
             pen: Pen { style: 0, width: 0.0, color: [0, 0, 0, 255] },
             brush: Brush::new(BS_SOLID, [255, 255, 255, 255]),
@@ -368,6 +371,17 @@ impl Canvas {
         self.surface = clip::normalize(rect);
     }
 
+    /// Bytes retained outside the canvas that share its budget (see [`Canvas::hold`]).
+    #[cfg(test)]
+    pub(crate) fn held(&self) -> usize {
+        self.held
+    }
+
+    /// Bytes the canvas has retained so far.
+    pub fn used(&self) -> usize {
+        self.used
+    }
+
     /// True once the item cap is hit; the readers stop there and keep what they have.
     pub fn full(&self) -> bool {
         self.full
@@ -385,6 +399,12 @@ impl Canvas {
         }
     }
 
+    /// Records the bytes another part of the player retains, so the items and they stay within
+    /// [`MAX_BYTES`] together.
+    pub fn hold(&mut self, bytes: usize) {
+        self.held = bytes;
+    }
+
     fn push_raw(&mut self, mut raw: Raw) {
         if self.clip.as_ref().is_some_and(Vec::is_empty) {
             return;
@@ -402,7 +422,7 @@ impl Canvas {
             Raw::Bitmap { img, .. } => img.px.len(),
             Raw::Text { text: t, .. } => t.text.len() + t.dx.len() * 4 + t.font.family.len() + 128,
         } + region_cost;
-        if self.items.len() >= MAX_ITEMS || self.used.saturating_add(cost) > MAX_BYTES {
+        if self.items.len() >= MAX_ITEMS || self.used.saturating_add(self.held).saturating_add(cost) > MAX_BYTES {
             self.full = true;
         } else {
             self.used += cost;
@@ -551,6 +571,10 @@ impl Canvas {
     /// of at most [`SHADE_RES`] cells on the longer side, laid out so that its one repeat covers
     /// the shape.
     pub fn shade_shape(&mut self, ops: &[Op], shade: &dyn Fn(P) -> [u8; 4]) {
+        // A full canvas or an empty clip keeps nothing more, so do not sample a tile for it.
+        if self.full || self.clip.as_ref().is_some_and(Vec::is_empty) {
+            return;
+        }
         let dev: Vec<Op> = ops.iter().map(|o| self.map_op(*o)).collect();
         let Some([l, t, r, b]) = crate::cliprect::ops_bbox(&dev) else { return };
         let side = (r - l).max(b - t);
@@ -666,7 +690,7 @@ impl Canvas {
         // A pattern brush's pixels count against the byte budget like drawn items.
         if let Obj::Brush(Brush { pattern: Some(p), .. }) = &obj {
             let cost = p.px.len();
-            if self.used.saturating_add(cost) > MAX_BYTES {
+            if self.used.saturating_add(self.held).saturating_add(cost) > MAX_BYTES {
                 self.full = true;
                 return;
             }

crates/metafile/src/cliprect.rs

@@ -11,6 +11,14 @@ use crate::geom::{Op, P};
 /// Line segments per Bézier when a crossing shape is flattened.
 const CURVE_STEPS: usize = 16;
 
+/// Point-against-edge tests one clipped item may cost (all its subpaths together); an item over
+/// it is dropped, as a single polygon over it already was.
+const MAX_CLIP_WORK: usize = 1_000_000;
+
+/// The same allowance for intersecting two clip regions, a budget of its own: two convex
+/// 1,000-gons cost about 1.5 million tests once the cut polygon has grown.
+pub(crate) const MAX_AREA_CLIP_WORK: usize = 4 * MAX_CLIP_WORK;
+
 /// The bounding box `[l, t, r, b]` of the points in `ops` (control points included).
 pub(crate) fn ops_bbox(ops: &[Op]) -> Option<[f64; 4]> {
     let mut b: Option<[f64; 4]> = None;
@@ -98,16 +106,18 @@ fn is_rect(clip: &[P]) -> bool {
     pts_bbox(clip).is_some_and(|b| clip.len() == 4 && clip.iter().all(|p| (p.0 == b[0] || p.0 == b[2]) && (p.1 == b[1] || p.1 == b[3])))
 }
 
-/// Sutherland–Hodgman: `poly` cut by convex `clip`.
-pub(crate) fn clip_polygon(poly: &[P], clip: &[P]) -> Vec<P> {
-    if poly.len().saturating_mul(clip.len()) > 1_000_000 {
-        return Vec::new();
-    }
+/// Sutherland–Hodgman: `poly` cut by convex `clip`, charging each point visited against each clip
+/// edge to `budget`: the polygon
+/// can gain a vertex at every edge, so its cost isn't known from its input size alone. `None`
+/// once the budget is spent.
+pub(crate) fn clip_polygon_within(poly: &[P], clip: &[P], budget: &mut usize) -> Option<Vec<P>> {
     let mut poly = poly.to_vec();
     for i in 0..clip.len() {
-        if poly.len().saturating_mul(clip.len() - i) > 1_000_000 {
-            return Vec::new();
+        // The work actually done: this edge visits the polygon as it now stands.
+        if poly.len() > *budget {
+            return None;
         }
+        *budget -= poly.len();
         let (a, b) = (clip[i], clip[(i + 1) % clip.len()]);
         let keep = |p: P| cross(a, b, p) >= 0.0;
         let cut = |p: P, q: P| {
@@ -133,7 +143,7 @@ pub(crate) fn clip_polygon(poly: &[P], clip: &[P]) -> Vec<P> {
             break;
         }
     }
-    poly
+    Some(poly)
 }
 
 fn disjoint(b: [f64; 4], c: [f64; 4]) -> bool {
@@ -158,15 +168,17 @@ pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
                 return Vec::new();
             }
             let subs = flatten(&ops);
+            // One allowance for the fill and the stroke together; the item goes once it is spent.
+            let mut budget = MAX_CLIP_WORK;
             let mut out = Vec::new();
             if fill.is_some() {
-                let f = clip_fill(&subs, clip);
+                let Some(f) = clip_fill(&subs, clip, &mut budget) else { return Vec::new() };
                 if !f.is_empty() {
                     out.push(Raw::Path { ops: f, fill, stroke: None, even_odd, region: region.clone() });
                 }
             }
             if stroke.is_some() {
-                let s = clip_stroke(&subs, clip);
+                let Some(s) = clip_stroke(&subs, clip, &mut budget) else { return Vec::new() };
                 if !s.is_empty() {
                     out.push(Raw::Path { ops: s, fill: None, stroke, even_odd, region });
                 }
@@ -181,7 +193,8 @@ pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
             if disjoint(b, cb) {
                 return Vec::new();
             }
-            let f = clip_fill(&flatten(&ops), clip);
+            let subs = flatten(&ops);
+            let f = clip_fill(&subs, clip, &mut { MAX_CLIP_WORK }).unwrap_or_default();
             if f.is_empty() { Vec::new() } else { vec![Raw::Pattern { ops: f, even_odd, tile, region }] }
         }
         Raw::Bitmap { rect, img, region } => crop(rect, img, clip).map(|(rect, img)| vec![Raw::Bitmap { rect, img, region }]).unwrap_or_default(),
@@ -230,20 +243,23 @@ pub(crate) fn flatten(ops: &[Op]) -> Vec<(Vec<P>, bool)> {
     subs
 }
 
-fn clip_fill(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {
+/// The clipped fill of every subpath, its clipping work charged to `budget` with that of the
+/// stroke: `None` (the whole item goes) once it is spent.
+fn clip_fill(subs: &[(Vec<P>, bool)], clip: &[P], budget: &mut usize) -> Option<Vec<Op>> {
     let mut ops = Vec::new();
     for (pts, _) in subs {
-        let poly = clip_polygon(pts, clip);
+        let poly = clip_polygon_within(pts, clip, budget)?;
         if poly.len() >= 3 {
             ops.push(Op::M(poly[0]));
             ops.extend(poly[1..].iter().map(|p| Op::L(*p)));
             ops.push(Op::Z);
         }
     }
-    ops
+    Some(ops)
 }
 
-fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {
+/// The clipped outline of every subpath; `None` once `budget` is spent.
+fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P], budget: &mut usize) -> Option<Vec<Op>> {
     let mut ops = Vec::new();
     for (pts, closed) in subs {
         let mut pts = pts.clone();
@@ -252,7 +268,7 @@ fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {
         }
         let mut last: Option<P> = None;
         for w in pts.windows(2) {
-            let Some((a, b)) = segment(w[0], w[1], clip) else {
+            let Some((a, b)) = segment(w[0], w[1], clip, budget)? else {
                 last = None;
                 continue;
             };
@@ -263,21 +279,23 @@ fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {
             last = Some(b);
         }
     }
-    ops
+    Some(ops)
 }
 
-/// Cyrus–Beck: the part of segment `a`–`b` inside convex `clip`.
-fn segment(a: P, b: P, clip: &[P]) -> Option<(P, P)> {
+/// Cyrus–Beck: the part of segment `a`–`b` inside convex `clip`, one unit of `budget` per clip edge
+/// visited; the outer `None` is a spent budget.
+fn segment(a: P, b: P, clip: &[P], budget: &mut usize) -> Option<Option<(P, P)>> {
     let d = (b.0 - a.0, b.1 - a.1);
     let (mut t0, mut t1) = (0.0f64, 1.0f64);
     for i in 0..clip.len() {
+        *budget = budget.checked_sub(1)?;
         let (e0, e1) = (clip[i], clip[(i + 1) % clip.len()]);
         // Inside is cross(e0, e1, p) >= 0, linear in t along the segment.
         let f0 = cross(e0, e1, a);
         let df = (e1.0 - e0.0) * d.1 - (e1.1 - e0.1) * d.0;
         if df == 0.0 {
             if f0 < 0.0 {
-                return None;
+                return Some(None);
             }
         } else {
             let t = -f0 / df;
@@ -288,7 +306,7 @@ fn segment(a: P, b: P, clip: &[P]) -> Option<(P, P)> {
             }
         }
     }
-    (t0 <= t1).then_some(((a.0 + d.0 * t0, a.1 + d.1 * t0), (a.0 + d.0 * t1, a.1 + d.1 * t1)))
+    Some((t0 <= t1).then_some(((a.0 + d.0 * t0, a.1 + d.1 * t0), (a.0 + d.0 * t1, a.1 + d.1 * t1))))
 }
 
 /// Crops a bitmap drawn into `rect` = `[x, y, w, h]` (device, positive extents) to the clip

crates/metafile/src/emfplus.rs

@@ -28,7 +28,7 @@ use std::sync::Arc;
 use crate::bytes::Bytes;
 use crate::canvas::Raw;
 use crate::canvas::{BS_NULL, BS_SOLID, Brush, Canvas, LogFont, PS_NULL, Pen, RawTile, Xform, hatch_tile, mul};
-use crate::cliprect::{clip_polygon, convex, flatten, ops_bbox, pts_bbox, rect_poly};
+use crate::cliprect::{MAX_AREA_CLIP_WORK, clip_polygon_within, convex, flatten, ops_bbox, pts_bbox, rect_poly};
 use crate::dib::Rgba;
 use crate::geom::{Op, P};
 use crate::text::{ETO_CLIPPED, Font};
@@ -288,13 +288,23 @@ impl Plus {
         if !self.active {
             return None;
         }
-        match typ {
-            0x4008 => self.object(flags, r),
+        let done = match typ {
+            0x4008 => self.object(flags, r, cv.used().saturating_add(self.clip_bytes())),
             0x4009 | 0x4013 | 0x401A..=0x401C | 0x4036 => self.record_image_text_region(cv, typ, flags, r),
             0x4025..=0x4035 => self.record_state(cv, typ, flags, r),
             0x4010..=0x4012 | 0x4016..=0x4019 => self.record_curve(cv, typ, flags, r),
             _ => self.record_shape(cv, typ, flags, r),
-        }
+        };
+        // What this player retains (objects, a continued object's pieces, the current and saved
+        // clips) shares the canvas's byte budget; clip changes are charged as they happen.
+        cv.hold(self.object_bytes.saturating_add(self.partial.as_ref().map_or(0, |p| p.data.len())).saturating_add(self.clip_bytes()));
+        done
+    }
+
+    /// Bytes of the current clip and of every saved one.
+    fn clip_bytes(&self) -> usize {
+        let area = |a: &Area| a.as_ref().map_or(0, |v| v.len().saturating_mul(std::mem::size_of::<P>()));
+        self.stack.iter().map(|s| area(&s.clip)).fold(area(&self.clip), usize::saturating_add)
     }
 
     /// Rectangle, polygon, ellipse and path records.
@@ -559,7 +569,7 @@ impl Plus {
         Some(())
     }
 
-    fn object(&mut self, flags: u16, r: Bytes) -> Option<()> {
+    fn object(&mut self, flags: u16, r: Bytes, canvas_used: usize) -> Option<()> {
         let id = usize::from(flags & 0xFF);
         let kind = (flags >> 8) & 0x7F;
         if flags & 0x8000 != 0 {
@@ -575,7 +585,7 @@ impl Plus {
             p.data.extend_from_slice(&chunk[..chunk.len().min(room)]);
             if p.data.len() >= p.total {
                 let obj = parse_object(p.kind, Bytes(&p.data));
-                self.store(p.id, obj);
+                self.store(p.id, obj, canvas_used);
             } else {
                 self.partial = Some(p);
             }
@@ -589,22 +599,23 @@ impl Plus {
             let room = p.total.saturating_sub(p.data.len());
             p.data.extend_from_slice(&r.0[..r.0.len().min(room)]);
             let obj = parse_object(kind, Bytes(&p.data));
-            self.store(id, obj);
+            self.store(id, obj, canvas_used);
             return Some(());
         }
         let obj = parse_object(kind, r);
-        self.store(id, obj);
+        self.store(id, obj, canvas_used);
         Some(())
     }
 
-    fn store(&mut self, id: usize, obj: Option<Obj>) {
+    /// `canvas_used` is what the canvas already retains: objects and items share one budget.
+    fn store(&mut self, id: usize, obj: Option<Obj>, canvas_used: usize) {
         let Some(slot) = self.objects.get_mut(id) else { return };
         if let Some(old) = slot.take() {
             self.object_bytes = self.object_bytes.saturating_sub(Self::obj_cost(&old));
         }
         if let Some(new_obj) = obj {
             let cost = Self::obj_cost(&new_obj);
-            if self.object_bytes.saturating_add(cost) <= crate::MAX_BYTES {
+            if self.object_bytes.saturating_add(cost).saturating_add(canvas_used) <= crate::MAX_BYTES {
                 self.object_bytes += cost;
                 *slot = Some(new_obj);
             }
@@ -615,7 +626,7 @@ impl Plus {
         match obj {
             Obj::Image(img) => match img.as_ref() {
                 ImageData::Bitmap(rgba) => rgba.px.len(),
-                ImageData::Meta(pic) => pic.items.len().saturating_mul(128),
+                ImageData::Meta(pic) => picture_cost(&pic.items),
             },
             Obj::Brush(Fill::Texture { img, .. }) => img.px.len(),
             Obj::Path(ops) => ops.len().saturating_mul(std::mem::size_of::<Op>()),
@@ -1170,7 +1181,13 @@ fn area_of_ops(ops: &[Op]) -> Vec<P> {
 fn area_intersect(a: Area, b: Area) -> Area {
     match (a, b) {
         (None, x) | (x, None) => x,
-        (Some(a), Some(b)) if a.len() >= 3 && b.len() >= 3 => Some(convex(&clip_polygon(&a, &b)).unwrap_or_default()),
+        (Some(a), Some(b)) if a.len() >= 3 && b.len() >= 3 => {
+            // Out of work: keep the area so far rather than call the region empty.
+            match clip_polygon_within(&a, &b, &mut { MAX_AREA_CLIP_WORK }) {
+                Some(p) => Some(convex(&p).unwrap_or_default()),
+                None => Some(a),
+            }
+        }
         _ => Some(Vec::new()),
     }
 }
@@ -1276,6 +1293,33 @@ fn metafile(r: Bytes) -> Option<Picture> {
     pic.filter(|p| p.width > 0.0 && p.height > 0.0)
 }
 
+/// Bytes the items of a nested picture own: path segments, clip rectangles, pixels and text, with
+/// each shared pattern tile counted once.
+fn picture_cost(items: &[crate::Item]) -> usize {
+    use crate::Item;
+    let region = |r: &Option<Vec<[f32; 4]>>| r.as_ref().map_or(0, |v| v.len().saturating_mul(16));
+    let mut tiles = std::collections::HashSet::new();
+    let mut total = 0usize;
+    for item in items {
+        let own = match item {
+            Item::Path { segs, region: r, .. } => segs.len().saturating_mul(std::mem::size_of::<crate::Seg>()).saturating_add(region(r)),
+            Item::Bitmap { rgba, region: r, .. } => rgba.len().saturating_add(region(r)),
+            Item::Pattern { segs, tile, region: r, .. } => {
+                let tile_bytes = if tiles.insert(Arc::as_ptr(tile)) { tile.rgba.len() } else { 0 };
+                segs.len().saturating_mul(std::mem::size_of::<crate::Seg>()).saturating_add(tile_bytes).saturating_add(region(r))
+            }
+            Item::Text(t) => t
+                .text
+                .len()
+                .saturating_add(t.dx.len().saturating_mul(std::mem::size_of::<f32>()))
+                .saturating_add(t.font.family.len())
+                .saturating_add(region(&t.region)),
+        };
+        total = total.saturating_add(128).saturating_add(own);
+    }
+    total
+}
+
 fn bitmap(r: Bytes) -> Option<Rgba> {
     let (w, h, stride) = (r.u32(8)? as i32, r.u32(12)? as i32, r.u32(16)? as i32);
     let format = r.u32(20)?;
@@ -1553,3 +1597,45 @@ fn wrap_line(line: &[u16], width: f64, em: f64) -> Vec<Vec<u16>> {
     out.push(cur);
     out
 }
+
+#[cfg(test)]
+mod cost_tests {
+    use super::*;
+    use crate::{Item, Seg, Tile};
+
+    #[test]
+    fn a_shared_pattern_tile_is_charged_once() {
+        let tile = Arc::new(Tile { width: 512, height: 512, rgba: vec![0; 1 << 20], cell: [1.0, 1.0], origin: [0.0, 0.0] });
+        let item = || Item::Pattern { segs: vec![Seg::Move(0.0, 0.0), Seg::Line(1.0, 1.0)], even_odd: false, tile: tile.clone(), region: None };
+        let items: Vec<Item> = (0..257).map(|_| item()).collect();
+        assert!(picture_cost(&items) < 2 << 20, "{}", picture_cost(&items));
+    }
+
+    #[test]
+    fn pieces_of_a_continued_object_count_against_the_shared_budget() {
+        let (mut plus, mut cv) = (Plus::new(), Canvas::new());
+        plus.active = true;
+        // Image object (kind 5), id 0, continued: 1000 bytes announced, 100 delivered.
+        let mut rec = 1000u32.to_le_bytes().to_vec();
+        rec.extend([0u8; 100]);
+        plus.record(&mut cv, 0x4008, 0x8000 | (5 << 8), Bytes(&rec));
+        assert_eq!(cv.held(), 100);
+    }
+
+    #[test]
+    fn current_and_saved_clips_count_against_the_shared_budget() {
+        let (mut plus, mut cv) = (Plus::new(), Canvas::new());
+        plus.active = true;
+        let pts = vec![(0.0, 0.0); 1000];
+        plus.clip = Some(pts.clone());
+        plus.stack.push(Saved { id: 1, world: IDENTITY, page: 1.0, clip: Some(pts) });
+        // Any record refreshes the held count (an unknown record draws nothing).
+        plus.record(&mut cv, 0x40FF, 0, Bytes(&[]));
+        assert_eq!(cv.held(), 2 * 1000 * std::mem::size_of::<P>());
+        // Restoring the saved state releases the charge of what it dropped.
+        plus.stack.clear();
+        plus.clip = None;
+        plus.record(&mut cv, 0x40FF, 0, Bytes(&[]));
+        assert_eq!(cv.held(), 0);
+    }
+}

crates/metafile/src/place.rs

@@ -58,6 +58,7 @@ impl Picture {
         let k = (c[0].abs() + c[3].abs()) / 2.0;
         let mut out = Vec::with_capacity(self.items.len());
         let mut total_elements = 0usize;
+        let region_elements = std::cell::Cell::new(0usize);
         let mut cached_region: Option<(*const [f32; 4], usize, Option<Option<Arc<BezPath>>>)> = None;
         let mut get_region = |reg: &Option<Vec<[f32; 4]>>| -> Option<Option<Arc<BezPath>>> {
             let (ptr, len) = match reg {
@@ -71,12 +72,15 @@ impl Picture {
                 return res.clone();
             }
             let res = placed_region(&tf, reg);
+            // Each distinct clip region is expanded once; its elements count against the placement budget.
+            let n = res.as_ref().and_then(Option::as_ref).map_or(0, |p| p.elements().len());
+            region_elements.set(region_elements.get().saturating_add(n));
             cached_region = Some((ptr, len, res.clone()));
             res
         };
 
         for (index, item) in self.items.iter().enumerate() {
-            if total_elements >= MAX_PLACED_ELEMENTS {
+            if total_elements.saturating_add(region_elements.get()) >= MAX_PLACED_ELEMENTS {
                 break;
             }
             match item {
@@ -84,6 +88,10 @@ impl Picture {
                     let path = tf * bez(segs);
                     let Some(region) = get_region(region) else { continue };
                     if in_range(path.bounding_box()) {
+                        // This item's own region is expanded by now: it counts before it is kept.
+                        if total_elements.saturating_add(path.elements().len()).saturating_add(region_elements.get()) > MAX_PLACED_ELEMENTS {
+                            break;
+                        }
                         total_elements = total_elements.saturating_add(path.elements().len());
                         let stroke = stroke.map(|(c, w)| (c, f64::from(w) * k));
                         out.push(PlacedItem::Path { path, fill: *fill, stroke, even_odd: *even_odd, region });
@@ -97,6 +105,9 @@ impl Picture {
                         * Affine::scale_non_uniform(f64::from(t.cell[0]), f64::from(t.cell[1]));
                     let det = tile.determinant();
                     if in_range(path.bounding_box()) && det.is_finite() && det.abs() > 1e-12 {
+                        if total_elements.saturating_add(path.elements().len()).saturating_add(region_elements.get()) > MAX_PLACED_ELEMENTS {
+                            break;
+                        }
                         total_elements = total_elements.saturating_add(path.elements().len());
                         out.push(PlacedItem::Pattern { index, path, even_odd: *even_odd, tile, region });
                     }

crates/metafile/src/tests.rs

@@ -897,6 +897,24 @@ fn place_fits_the_frame_scales_strokes_and_drops_far_paths() {
     assert_eq!(stroke.map(|s| s.1), Some(8.0));
 }
 
+#[test]
+fn place_counts_the_items_own_clip_region_before_keeping_it() {
+    // A path of 499,998 elements nearly fills the 500,000 budget; a second one whose new clip
+    // region adds elements goes past it and is left out.
+    let mut segs = vec![Seg::Move(0.0, 0.0)];
+    segs.extend((0..499_997).map(|i| Seg::Line(1.0 + (i % 50) as f32, 1.0)));
+    let big = Item::Path { segs, fill: None, stroke: None, even_odd: false, region: None };
+    let small = Item::Path {
+        segs: vec![Seg::Move(0.0, 0.0), Seg::Line(1.0, 1.0)],
+        fill: None,
+        stroke: None,
+        even_odd: false,
+        region: Some(vec![[0.0, 0.0, 50.0, 25.0], [10.0, 10.0, 20.0, 20.0]]),
+    };
+    let pic = crate::Picture { width: 100.0, height: 50.0, items: vec![big, small] };
+    assert_eq!(pic.place(kurbo::Rect::new(0.0, 0.0, 100.0, 50.0), [0.0; 4]).len(), 1);
+}
+
 #[test]
 fn place_keeps_only_finite_bounded_bitmaps_with_area() {
     let bitmap = |rect: [f32; 4]| Item::Bitmap { rect, width: 1, height: 1, rgba: vec![0; 4], region: None };
@@ -2071,6 +2089,108 @@ fn emfplus_wrap_line_linear_performance() {
 fn clip_polygon_work_bound() {
     let poly: Vec<(f64, f64)> = (0..2000).map(|i| (i as f64, i as f64)).collect();
     let clip: Vec<(f64, f64)> = (0..2000).map(|i| (i as f64, i as f64)).collect();
-    let clipped = crate::cliprect::clip_polygon(&poly, &clip);
-    assert!(clipped.is_empty(), "excessive polygon clip product rejected");
+    assert!(crate::cliprect::clip_polygon_within(&poly, &clip, &mut 1_000_000).is_none(), "excessive polygon clip product rejected");
+}
+
+#[test]
+fn clip_polygon_charges_actual_work_not_projected_growth() {
+    // Two convex 1,000-gons: the product is exactly the budget, and a cut that adds a vertex must
+    // not make a later step look over budget.
+    let gon = |cx: f64| -> Vec<(f64, f64)> {
+        (0..1000).map(|i| (i as f64 / 1000.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (cx + 100.0 * c, 100.0 * s)).collect()
+    };
+    let clipped = crate::cliprect::clip_polygon_within(&gon(0.0), &gon(30.0), &mut 4_000_000).unwrap();
+    assert!(clipped.len() > 100, "the intersection is kept: {}", clipped.len());
+}
+
+#[test]
+fn clip_work_is_shared_by_fill_and_stroke() {
+    use crate::canvas::Raw;
+    use crate::geom::Op;
+    // One zigzag subpath crossing a 512-gon's edge: about 510k point-edge tests per pass, so a
+    // fill alone fits the allowance but a fill plus a stroke would spend it twice.
+    let clip: Vec<(f64, f64)> =
+        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
+    let mut ops = vec![Op::M((0.0, 95.0))];
+    ops.extend((1..1000).map(|i| Op::L((i as f64 * 0.19, if i % 2 == 0 { 95.0 } else { 300.0 }))));
+    ops.push(Op::Z);
+    let raw = |fill, stroke| Raw::Path { ops: ops.clone(), fill, stroke, even_odd: false, region: None };
+    let black = [0, 0, 0, 255];
+    assert!(!crate::cliprect::clip_raw(raw(Some(black), None), &clip).is_empty(), "a fill alone is within the allowance");
+    assert!(crate::cliprect::clip_raw(raw(Some(black), Some((black, 1.0))), &clip).is_empty(), "fill and stroke share one allowance");
+}
+
+#[test]
+fn clip_work_is_bounded_across_subpaths() {
+    use crate::canvas::Raw;
+    use crate::geom::Op;
+    // 512-gon clip; 4,000 small triangles crossing its edge: each under the per-polygon cap, together
+    // far over it, for both the fill and the stroke.
+    let clip: Vec<(f64, f64)> =
+        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
+    let tri = |x: f64| [Op::M((x, 95.0)), Op::L((x + 1.0, 95.0)), Op::L((x, 300.0)), Op::Z];
+    let many: Vec<Op> = (0..4000).flat_map(|i| tri(i as f64 % 200.0)).collect();
+    let raw = |ops| Raw::Path { ops, fill: Some([0, 0, 0, 255]), stroke: Some(([0, 0, 0, 255], 1.0)), even_odd: false, region: None };
+    assert!(crate::cliprect::clip_raw(raw(many), &clip).is_empty(), "the whole item's clipping work is bounded");
+    assert_eq!(crate::cliprect::clip_raw(raw(tri(100.0).to_vec()), &clip).len(), 2, "a small crossing shape is still clipped");
+}
+
+/// Clipping a fill can add a vertex at every clip edge, so a polygon's work isn't its input size:
+/// shapes that pass the up-front estimate but grow while clipped are charged as they grow, against
+/// one budget for the whole item.
+#[test]
+fn growing_fill_clips_share_one_budget() {
+    use crate::canvas::Raw;
+    use crate::geom::Op;
+    let clip: Vec<(f64, f64)> =
+        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
+    // A triangle around the whole circle: clipped, it becomes the 512-gon, about 130,000 steps.
+    let tri = [Op::M((-1000.0, -1000.0)), Op::L((1000.0, -1000.0)), Op::L((100.0, 1000.0)), Op::Z];
+    let raw = |n: usize| Raw::Path { ops: tri.repeat(n), fill: Some([0, 0, 0, 255]), stroke: None, even_odd: false, region: None };
+    // 400 of them pass the estimate (400 x 4 x 512 is under a million) but cost about 52 million.
+    assert!(crate::cliprect::clip_raw(raw(400), &clip).is_empty(), "the growing work is charged");
+    assert_eq!(crate::cliprect::clip_raw(raw(2), &clip).len(), 1, "a couple of them are still clipped");
+}
+
+#[test]
+fn stroke_work_is_charged_and_outside_items_are_cheap() {
+    use crate::canvas::Raw;
+    use crate::geom::Op;
+    let clip: Vec<(f64, f64)> =
+        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
+    // A stroke-only zigzag of 4,000 segments across the edge: 4,000 x 512 tests, over the allowance.
+    let mut ops = vec![Op::M((0.0, 95.0))];
+    ops.extend((1..4000).map(|i| Op::L((i as f64 * 0.05, if i % 2 == 0 { 95.0 } else { 300.0 }))));
+    let raw = Raw::Path { ops, fill: None, stroke: Some(([0, 0, 0, 255], 1.0)), even_odd: false, region: None };
+    assert!(crate::cliprect::clip_raw(raw, &clip).is_empty(), "stroke work is bounded");
+}
+
+#[test]
+fn region_intersection_over_budget_keeps_the_previous_area() {
+    let gon = |cx: f64| -> Vec<(f64, f64)> {
+        (0..1000).map(|i| (i as f64 / 1000.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (cx + 100.0 * c, 100.0 * s)).collect()
+    };
+    assert!(crate::cliprect::clip_polygon_within(&gon(0.0), &gon(30.0), &mut 10).is_none());
+    assert!(crate::cliprect::clip_polygon_within(&gon(0.0), &gon(30.0), &mut crate::cliprect::MAX_AREA_CLIP_WORK.clone()).is_some());
+}
+
+#[test]
+fn full_canvas_does_not_sample_gradient_tiles() {
+    let mut cv = Canvas::new();
+    let big = || Rgba { w: 1, h: 1, bottom_up: false, px: vec![0u8; MAX_BYTES / 2] };
+    for _ in 0..3 {
+        cv.bitmap([0.0, 0.0, 1.0, 1.0], big());
+    }
+    assert!(cv.full());
+    cv.shade_shape(&crate::geom::rect(0.0, 0.0, 10.0, 10.0), &|_| panic!("sampled a full canvas"));
+    assert_eq!(cv.items.len(), 2);
+}
+
+#[test]
+fn canvas_budget_counts_bytes_held_elsewhere() {
+    let mut cv = Canvas::new();
+    cv.hold(MAX_BYTES - 100);
+    cv.bitmap([0.0, 0.0, 1.0, 1.0], Rgba { w: 1, h: 1, bottom_up: false, px: vec![0u8; 200] });
+    assert!(cv.full());
+    assert!(cv.items.is_empty());
 }

crates/model/src/chart.rs

@@ -392,6 +392,9 @@ pub struct Chart {
     /// Original chart XML part kept for round-trip of unmodelled options.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub raw: Option<String>,
+    /// The chart was too large to model: `raw` and `kept` are written back unchanged on save.
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    pub verbatim: bool,
     /// Package parts the original chart still points at (embedded workbook, styles, drawings).
     /// The PPTX writer clears this before comparing modelled state. Native saves keep it too.
     #[serde(skip_serializing_if = "ChartKept::is_empty")]
@@ -485,6 +488,7 @@ impl Default for Chart {
             bin_count: None,
             bin_size: None,
             raw: None,
+            verbatim: false,
             kept: ChartKept::default(),
         }
     }
@@ -1311,6 +1315,7 @@ impl Chart {
             series: vec![],
             gap_width: 0.0,
             raw: None,
+            verbatim: false,
             subtotals: vec![],
             ..self.clone()
         };

crates/model/src/edit.rs

@@ -498,6 +498,11 @@ pub fn next_case(s: &str) -> &'static str {
     }
 }
 
+/// Whether the `.` at `i` sits between two ASCII digits (a decimal point or version number).
+fn is_decimal_point(all: &[char], i: usize) -> bool {
+    i > 0 && all[i - 1].is_ascii_digit() && all.get(i + 1).is_some_and(|n| n.is_ascii_digit())
+}
+
 /// Change case: `upper`, `lower`, `sentence`, `title`, `toggle`.
 pub fn change_case(s: &str, mode: &str) -> String {
     change_case_parts(&[s], mode).concat()
@@ -532,7 +537,7 @@ pub fn change_case_parts(parts: &[&str], mode: &str) -> Vec<String> {
                     } else {
                         out.extend(c.to_lowercase());
                     }
-                    if (title && c.is_whitespace()) || (!title && matches!(c, '.' | '!' | '?')) {
+                    if (title && c.is_whitespace()) || (!title && matches!(c, '.' | '!' | '?') && !(c == '.' && is_decimal_point(&all, i))) {
                         start = true;
                     }
                 }
@@ -558,6 +563,13 @@ mod tests {
         assert_eq!(change_case("ΟΔΟΣ", "lower"), "οδος");
     }
 
+    #[test]
+    fn sentence_case_decimal_point_is_not_a_boundary() {
+        assert_eq!(change_case("I HAVE 3.5 APPLES", "sentence"), "I have 3.5 apples");
+        assert_eq!(change_case_parts(&["V 1.", "2 BETA"], "sentence").concat(), "V 1.2 beta");
+        assert_eq!(change_case("HELLO. WORLD", "sentence"), "Hello. World");
+    }
+
     #[test]
     fn title_sigma_across_runs_is_not_final() {
         assert_eq!(change_case_parts(&["ΟΔΟΣ", "ΑΣ"], "title"), ["Οδοσ", "ας"]);

crates/model/src/resolve.rs

@@ -314,6 +314,7 @@ pub fn body(ctx: &Ctx, shape: &Shape) -> BodyProps {
         compat_ln_spc: None,
         vert_overflow: None,
         horz_overflow: None,
+        raw3d: None,
     });
     b
 }

crates/model/src/text.rs

@@ -124,6 +124,9 @@ pub struct BodyProps {
     pub compat_ln_spc: Option<bool>,
     pub vert_overflow: Option<TextOverflow>,
     pub horz_overflow: Option<TextOverflow>,
+    /// Unmodelled 3-D XML on the text body (`a:scene3d`, `a:sp3d`, `a:flatTx`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub raw3d: Option<String>,
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -187,6 +190,9 @@ impl BodyProps {
         self.compat_ln_spc = self.compat_ln_spc.or(p.compat_ln_spc);
         self.vert_overflow = self.vert_overflow.or(p.vert_overflow);
         self.horz_overflow = self.horz_overflow.or(p.horz_overflow);
+        if self.raw3d.is_none() {
+            self.raw3d.clone_from(&p.raw3d);
+        }
     }
 }
 

crates/model/src/trendline.rs

@@ -337,16 +337,31 @@ fn fit_moving_avg(pairs: &[(f64, f64)], period: usize) -> Option<(Model, Vec<f64
 
 #[allow(clippy::needless_range_loop)]
 fn polyfit_with_intercept(xs: &[f64], ys: &[f64], order: usize, b0: f64) -> Option<Vec<f64>> {
+    // Fit `y - b0 = (x / sx) * q(u)` with `u = (x - xm) / su` and `q` of degree `order - 1`. The
+    // basis `(x / sx) * u^j` spans the same polynomials as `x^(j + 1)`, but keeps the pivots in
+    // `solve` independent of the units and the offset of x.
+    let n = xs.len() as f64;
+    let sx = xs.iter().fold(0.0_f64, |acc, x| acc.max(x.abs()));
+    if sx <= 0.0 || !sx.is_finite() {
+        return None;
+    }
+    let xm = xs.iter().sum::<f64>() / n;
+    let su = match xs.iter().fold(0.0_f64, |acc, x| acc.max((x - xm).abs())) {
+        s if s > 0.0 && s.is_finite() => s,
+        _ => 1.0,
+    };
     let m = order;
     let mut ata = vec![vec![0.0; m]; m];
     let mut atb = vec![0.0; m];
     for (x, y) in xs.iter().zip(ys) {
+        let v = x / sx;
+        let u = (x - xm) / su;
         let dy = y - b0;
         for i in 0..m {
-            let xi = x.powi((i + 1) as i32);
+            let xi = v * u.powi(i as i32);
             atb[i] += dy * xi;
             for j in i..m {
-                ata[i][j] += xi * x.powi((j + 1) as i32);
+                ata[i][j] += xi * v * u.powi(j as i32);
             }
         }
     }
@@ -355,10 +370,11 @@ fn polyfit_with_intercept(xs: &[f64], ys: &[f64], order: usize, b0: f64) -> Opti
             ata[i][j] = ata[j][i];
         }
     }
-    let solved = solve(ata, atb)?;
+    let centred: Vec<f64> = solve(ata, atb)?.iter().enumerate().map(|(k, c)| c / su.powi(k as i32)).collect();
+    let q = expand_shift(&centred, xm);
     let mut coeff = Vec::with_capacity(order + 1);
     coeff.push(b0);
-    coeff.extend(solved);
+    coeff.extend(q.iter().map(|c| c / sx));
     coeff.iter().all(|v| v.is_finite()).then_some(coeff)
 }
 
@@ -374,7 +390,13 @@ fn polyfit(xs: &[f64], ys: &[f64], order: usize, intercept: Option<f64>) -> Opti
         return polyfit_with_intercept(xs, ys, order, b0);
     }
     let xm = xs.iter().sum::<f64>() / n as f64;
-    let us: Vec<f64> = xs.iter().map(|x| x - xm).collect();
+    // Scale the centred x to unit range so the pivot threshold in `solve` does not depend on the
+    // units of x.
+    let s = xs.iter().fold(0.0_f64, |acc, x| acc.max((x - xm).abs()));
+    if s <= 0.0 || !s.is_finite() {
+        return None;
+    }
+    let us: Vec<f64> = xs.iter().map(|x| (x - xm) / s).collect();
     let m = order + 1;
     let mut ata = vec![vec![0.0; m]; m];
     let mut atb = vec![0.0; m];
@@ -393,7 +415,7 @@ fn polyfit(xs: &[f64], ys: &[f64], order: usize, intercept: Option<f64>) -> Opti
             ata[i][j] = ata[j][i];
         }
     }
-    let centred = solve(ata, atb)?;
+    let centred: Vec<f64> = solve(ata, atb)?.iter().enumerate().map(|(k, c)| c / s.powi(k as i32)).collect();
     let coeff = expand_shift(&centred, xm);
     coeff.iter().all(|v| v.is_finite()).then_some(coeff)
 }
@@ -571,6 +593,49 @@ mod tests {
         assert!((fit.y(3e-10).unwrap() - 3.0).abs() < 1e-6);
     }
 
+    #[test]
+    fn poly_fits_tiny_x_values() {
+        let xs = [1e-5, 2e-5, 3e-5, 4e-5, 5e-5];
+        let f = |x: f64| 1.0 + 2.0 * x + 3.0 * x * x;
+        let ys: Vec<f64> = xs.iter().map(|x| f(*x)).collect();
+        let fit = line(TrendlineType::Poly).fit(&xs, &ys).expect("poly fit of tiny x values");
+        assert!((fit.y(3e-5).unwrap() - f(3e-5)).abs() < 1e-9);
+        let big: Vec<f64> = xs.iter().map(|x| x * 1e5).collect();
+        let scaled = line(TrendlineType::Poly).fit(&big, &ys).expect("poly fit of scaled x values");
+        for x in xs {
+            assert!((fit.y(x).unwrap() - scaled.y(x * 1e5).unwrap()).abs() < 1e-9, "{x}");
+        }
+    }
+
+    #[test]
+    fn poly_with_intercept_fits_tiny_x_values() {
+        let xs = [1e-5, 2e-5, 3e-5, 4e-5, 5e-5];
+        let f = |x: f64| 1.0 + 2.0 * x + 3.0 * x * x;
+        let ys: Vec<f64> = xs.iter().map(|x| f(*x)).collect();
+        let mut poly = line(TrendlineType::Poly);
+        poly.intercept = Some(1.0);
+        let fit = poly.fit(&xs, &ys).expect("poly fit with intercept of tiny x values");
+        assert!((fit.y(3e-5).unwrap() - f(3e-5)).abs() < 1e-9);
+        let big: Vec<f64> = xs.iter().map(|x| x * 1e5).collect();
+        let scaled = poly.fit(&big, &ys).expect("poly fit with intercept of scaled x values");
+        for x in xs {
+            assert!((fit.y(x).unwrap() - scaled.y(x * 1e5).unwrap()).abs() < 1e-9, "{x}");
+        }
+    }
+
+    #[test]
+    fn poly_with_intercept_fits_offset_but_narrow_x_range() {
+        let xs = [45000.00, 45000.01, 45000.02, 45000.03, 45000.04];
+        let f = |x: f64| 1.0 + x * (1.0 + 100.0 * (x - 45000.02));
+        let ys: Vec<f64> = xs.iter().map(|x| f(*x)).collect();
+        let mut poly = line(TrendlineType::Poly);
+        poly.intercept = Some(1.0);
+        let fit = poly.fit(&xs, &ys).expect("poly fit with intercept of offset x values");
+        for x in xs {
+            assert!((fit.y(x).unwrap() - f(x)).abs() < 1e-2, "{x}");
+        }
+    }
+
     #[test]
     fn linear_fits_offset_but_narrow_x_range() {
         let xs = [45000.00, 45000.01, 45000.02, 45000.03, 45000.04];

crates/ogg/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "deckcraft-ogg"
-description = "Clean-room Ogg (RFC 3533) demuxer with Ogg Opus (RFC 7845) and Ogg Vorbis stream mapping"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
-
-[lints]
-workspace = true
-
-[dependencies]

crates/ogg/src/lib.rs

@@ -1,581 +0,0 @@
-//! Clean-room Ogg demuxer, written from RFC 3533 (the Ogg encapsulation format), RFC 7845 (Ogg
-//! Opus) and the Vorbis I specification's Ogg mapping (section A).
-//!
-//! [`open`] reads every page (capture pattern, header, lacing values, CRC-32 checked; damaged
-//! regions are skipped by searching for the next `OggS`), groups them by logical bitstream and
-//! assembles packets — including packets that continue across pages — as lists of byte ranges,
-//! with the granule position of the page each packet completes on. Codec headers (Opus:
-//! `OpusHead` + `OpusTags`; Vorbis: identification, comment, setup) are collected separately from
-//! the audio packets.
-//!
-//! [`OpusTiming`] implements RFC 7845 §4: packet start positions from granule positions and
-//! TOC-derived durations, the pre-skip, and end trimming of the final page, so a player can seek
-//! to any 48 kHz sample.
-//!
-//! Layer L0: no dependencies beyond `std`, no `unsafe`, builds for `wasm32-unknown-unknown`.
-
-#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
-
-use std::collections::HashMap;
-use std::fmt;
-use std::io;
-
-/// Random-access, read-only byte source (same shape as the other FilmCraft demuxers').
-pub trait ByteSource {
-    fn len(&self) -> u64;
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()>;
-    fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-}
-
-impl ByteSource for [u8] {
-    fn len(&self) -> u64 {
-        <[u8]>::len(self) as u64
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        let eof = || io::Error::new(io::ErrorKind::UnexpectedEof, "read past end");
-        let a = usize::try_from(offset).map_err(|_| eof())?;
-        buf.copy_from_slice(self.get(a..a.checked_add(buf.len()).ok_or_else(eof)?).ok_or_else(eof)?);
-        Ok(())
-    }
-}
-
-impl ByteSource for Vec<u8> {
-    fn len(&self) -> u64 {
-        self.as_slice().len() as u64
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        self.as_slice().read_at(offset, buf)
-    }
-}
-
-impl<T: ByteSource + ?Sized> ByteSource for &T {
-    fn len(&self) -> u64 {
-        (**self).len()
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        (**self).read_at(offset, buf)
-    }
-}
-
-#[derive(Debug)]
-pub enum Error {
-    Io(io::Error),
-    /// No Ogg page found.
-    NotOgg,
-    Invalid(String),
-}
-
-impl fmt::Display for Error {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Error::Io(e) => write!(f, "I/O error: {e}"),
-            Error::NotOgg => write!(f, "not an Ogg file"),
-            Error::Invalid(s) => write!(f, "invalid Ogg: {s}"),
-        }
-    }
-}
-
-impl std::error::Error for Error {}
-
-impl From<io::Error> for Error {
-    fn from(e: io::Error) -> Self {
-        Error::Io(e)
-    }
-}
-
-pub type Result<T> = std::result::Result<T, Error>;
-
-/// The capture pattern at the start of a file.
-pub fn sniff(head: &[u8]) -> bool {
-    head.len() >= 27 && &head[..4] == b"OggS" && head[4] == 0
-}
-
-/// CRC-32 of RFC 3533 §6: polynomial 0x04C11DB7, initial value 0, no reflection, no final XOR.
-pub fn crc32(data: &[u8]) -> u32 {
-    static TABLE: std::sync::OnceLock<[u32; 256]> = std::sync::OnceLock::new();
-    let t = TABLE.get_or_init(|| {
-        let mut t = [0u32; 256];
-        for (i, e) in t.iter_mut().enumerate() {
-            let mut r = (i as u32) << 24;
-            for _ in 0..8 {
-                r = if r & 0x8000_0000 != 0 { (r << 1) ^ 0x04C1_1DB7 } else { r << 1 };
-            }
-            *e = r;
-        }
-        t
-    });
-    data.iter().fold(0u32, |c, &b| (c << 8) ^ t[((c >> 24) as u8 ^ b) as usize])
-}
-
-/// The codec of a logical bitstream (from its first packet).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Codec {
-    Opus,
-    Vorbis,
-    Flac,
-    Theora,
-    Speex,
-    Unknown,
-}
-
-impl Codec {
-    fn of(first: &[u8]) -> Codec {
-        if first.starts_with(b"OpusHead") {
-            Codec::Opus
-        } else if first.starts_with(b"\x01vorbis") {
-            Codec::Vorbis
-        } else if first.starts_with(b"\x7fFLAC") {
-            Codec::Flac
-        } else if first.starts_with(b"\x80theora") {
-            Codec::Theora
-        } else if first.starts_with(b"Speex   ") {
-            Codec::Speex
-        } else {
-            Codec::Unknown
-        }
-    }
-    /// Header packets before the audio packets.
-    fn header_count(self) -> usize {
-        match self {
-            Codec::Opus => 2,
-            Codec::Vorbis | Codec::Theora => 3,
-            Codec::Speex => 2,
-            Codec::Flac | Codec::Unknown => 1,
-        }
-    }
-    pub fn name(self) -> &'static str {
-        match self {
-            Codec::Opus => "Opus",
-            Codec::Vorbis => "Vorbis",
-            Codec::Flac => "FLAC",
-            Codec::Theora => "Theora",
-            Codec::Speex => "Speex",
-            Codec::Unknown => "unknown",
-        }
-    }
-}
-
-/// A packet: its byte ranges (a packet may span pages) and the granule position of the page it
-/// completes on when it is that page's last completed packet.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct Packet {
-    pub parts: Vec<(u64, u32)>,
-    pub size: u32,
-    /// Granule position of the completing page if this is the last packet completed on it.
-    pub granule: Option<i64>,
-    /// Index of the page (within the stream) the packet completes on.
-    pub page: u32,
-    /// The packet completes on the stream's end-of-stream page.
-    pub eos: bool,
-    /// The first bytes of the packet (TOC for Opus, packet type for Vorbis).
-    pub prefix: [u8; 2],
-}
-
-/// A logical bitstream.
-#[derive(Clone, Debug)]
-pub struct Stream {
-    pub serial: u32,
-    pub codec: Codec,
-    /// Codec header packets (contents).
-    pub headers: Vec<Vec<u8>>,
-    /// Data packets after the headers.
-    pub packets: Vec<Packet>,
-    pub pages: u32,
-    /// Granule position of the last page with one.
-    pub last_granule: Option<i64>,
-    pub saw_eos: bool,
-}
-
-/// An opened Ogg file.
-#[derive(Clone, Debug)]
-pub struct OggFile {
-    pub streams: Vec<Stream>,
-    /// Pages dropped for a bad CRC, lost sync, truncation…
-    pub warnings: Vec<String>,
-}
-
-/// Source bytes damage recovery may read per file: the windows the scan for the next capture
-/// pattern fills and the pages read only to find their CRC wrong.
-const RECOVERY_BUDGET: u64 = 32 << 20;
-/// Warnings kept per file (not counting the one about the budget); the rest are counted in one last entry.
-const MAX_WARNINGS: usize = 256;
-
-/// Record a warning, keeping at most `MAX_WARNINGS` and one entry saying the rest were dropped.
-fn warn(warnings: &mut Vec<String>, msg: String) {
-    match warnings.len().cmp(&MAX_WARNINGS) {
-        std::cmp::Ordering::Less => warnings.push(msg),
-        std::cmp::Ordering::Equal => warnings.push("further warnings omitted".into()),
-        std::cmp::Ordering::Greater => {}
-    }
-}
-
-struct Partial {
-    parts: Vec<(u64, u32)>,
-    size: u32,
-    prefix: Vec<u8>,
-}
-
-/// Read every page and assemble the packets of every logical bitstream.
-pub fn open(src: &(impl ByteSource + ?Sized)) -> Result<OggFile> {
-    let len = src.len();
-    let mut streams: Vec<Stream> = Vec::new();
-    let mut by_serial: HashMap<u32, usize> = HashMap::new();
-    let mut partial: HashMap<u32, Partial> = HashMap::new();
-    let mut warnings = Vec::new();
-    let mut pos = 0u64;
-    let mut found_any = false;
-    let mut hdr = [0u8; 27 + 255];
-    let mut scanner = CaptureScanner::new();
-    while pos + 27 <= len {
-        src.read_at(pos, &mut hdr[..27])?;
-        if &hdr[..4] != b"OggS" || hdr[4] != 0 {
-            match scanner.find(src, pos + 1, len)? {
-                Some(p) => {
-                    if found_any {
-                        warn(&mut warnings, format!("lost sync at byte {pos}; resumed at {p}"));
-                    }
-                    pos = p;
-                    continue;
-                }
-                None => break,
-            }
-        }
-        let nseg = hdr[26] as usize;
-        if pos + 27 + nseg as u64 > len {
-            warn(&mut warnings, format!("truncated page header at byte {pos}"));
-            break;
-        }
-        src.read_at(pos + 27, &mut hdr[27..27 + nseg])?;
-        let body_len: u64 = hdr[27..27 + nseg].iter().map(|&b| b as u64).sum();
-        let page_len = 27 + nseg as u64 + body_len;
-        if pos + page_len > len {
-            warn(&mut warnings, format!("truncated page at byte {pos}"));
-            break;
-        }
-        let mut page = vec![0u8; page_len as usize];
-        src.read_at(pos, &mut page)?;
-        let stored_crc = u32::from_le_bytes([page[22], page[23], page[24], page[25]]);
-        page[22..26].fill(0);
-        if crc32(&page) != stored_crc {
-            warn(&mut warnings, format!("bad CRC on page at byte {pos}"));
-            // a page read only to find it damaged is recovery work, charged like the scan's windows
-            if scanner.charge(page_len) {
-                break;
-            }
-            pos += 1;
-            continue;
-        }
-        found_any = true;
-        let flags = page[5];
-        let granule = i64::from_le_bytes(page[6..14].try_into().unwrap_or([0; 8]));
-        let serial = u32::from_le_bytes([page[14], page[15], page[16], page[17]]);
-        let lacing = page[27..27 + nseg].to_vec();
-        let body_off = pos + 27 + nseg as u64;
-        let si = *by_serial.entry(serial).or_insert_with(|| {
-            streams.push(Stream {
-                serial,
-                codec: Codec::Unknown,
-                headers: Vec::new(),
-                packets: Vec::new(),
-                pages: 0,
-                last_granule: None,
-                saw_eos: false,
-            });
-            streams.len() - 1
-        });
-        let st = &mut streams[si];
-        let page_index = st.pages;
-        st.pages += 1;
-        if flags & 0x04 != 0 {
-            st.saw_eos = true;
-        }
-        // a continued page without a pending packet (lost a page): drop the fragment
-        let continued = flags & 0x01 != 0;
-        if !continued && partial.remove(&serial).is_some() {
-            warn(&mut warnings, format!("incomplete packet before page at byte {pos}"));
-        }
-        let mut completed: Vec<Packet> = Vec::new();
-        let mut off = 0u64;
-        let mut seg_start = 0u64;
-        let mut skip_fragment = continued && !partial.contains_key(&serial);
-        for (k, &l) in lacing.iter().enumerate() {
-            off += l as u64;
-            if l < 255 || k + 1 == nseg {
-                let (a, n) = (seg_start, off - seg_start);
-                seg_start = off;
-                if skip_fragment {
-                    if l < 255 {
-                        skip_fragment = false;
-                    }
-                    continue;
-                }
-                let p = partial.entry(serial).or_insert_with(|| Partial { parts: Vec::new(), size: 0, prefix: Vec::new() });
-                if n > 0 {
-                    p.parts.push((body_off + a, n as u32));
-                    p.size += n as u32;
-                    let s = (body_off - pos + a) as usize;
-                    let need = 2usize.saturating_sub(p.prefix.len()).min(n as usize);
-                    p.prefix.extend_from_slice(&page[s..s + need]);
-                }
-                if l < 255
-                    && let Some(p) = partial.remove(&serial)
-                {
-                    let mut prefix = [0u8; 2];
-                    prefix[..p.prefix.len().min(2)].copy_from_slice(&p.prefix[..p.prefix.len().min(2)]);
-                    completed.push(Packet { parts: p.parts, size: p.size, granule: None, page: page_index, eos: flags & 0x04 != 0, prefix });
-                }
-            }
-        }
-        if granule != -1 {
-            st.last_granule = Some(granule);
-            if let Some(last) = completed.last_mut() {
-                last.granule = Some(granule);
-            }
-        }
-        for pk in completed {
-            if st.headers.is_empty() && st.packets.is_empty() {
-                let data = read_parts(src, &pk.parts)?;
-                st.codec = Codec::of(&data);
-            }
-            if st.headers.len() < st.codec.header_count() && st.packets.is_empty() {
-                st.headers.push(read_parts(src, &pk.parts)?);
-            } else {
-                st.packets.push(pk);
-            }
-        }
-        pos += page_len;
-    }
-    if !found_any {
-        return Err(Error::NotOgg);
-    }
-    if !partial.is_empty() {
-        warn(&mut warnings, "file ends inside a packet".into());
-    }
-    if scanner.spent() {
-        // once per file and last, so it is not subject to the cap on the others
-        warnings.push("recovery budget spent; the rest of the damaged data was not searched".into());
-    }
-    Ok(OggFile { streams, warnings })
-}
-
-struct CaptureScanner {
-    buf: Vec<u8>,
-    buf_start: u64,
-    budget: u64,
-}
-
-impl CaptureScanner {
-    fn new() -> Self {
-        Self { buf: Vec::new(), buf_start: 0, budget: RECOVERY_BUDGET }
-    }
-
-    /// Charge `bytes` of recovery work; true once the budget is spent.
-    fn charge(&mut self, bytes: u64) -> bool {
-        self.budget = self.budget.saturating_sub(bytes);
-        self.spent()
-    }
-
-    /// Nothing left to search with: fewer bytes than a capture pattern can still be charged for.
-    fn spent(&self) -> bool {
-        self.budget < 4
-    }
-
-    fn find(&mut self, src: &(impl ByteSource + ?Sized), from: u64, len: u64) -> Result<Option<u64>> {
-        let mut at = from;
-        while at + 4 <= len {
-            let buf_end = self.buf_start + self.buf.len() as u64;
-            if at >= self.buf_start && at + 4 <= buf_end {
-                let off = (at - self.buf_start) as usize;
-                if let Some(i) = self.buf[off..].windows(4).position(|w| w == b"OggS") {
-                    return Ok(Some(at + i as u64));
-                }
-                at = buf_end.saturating_sub(3);
-                continue;
-            }
-            if self.spent() {
-                return Ok(None);
-            }
-            let n = ((len - at) as usize).min(64 * 1024).min(usize::try_from(self.budget).unwrap_or(usize::MAX));
-            if n < 4 {
-                break;
-            }
-            self.buf.resize(n, 0);
-            src.read_at(at, &mut self.buf)?;
-            self.buf_start = at;
-            self.budget = self.budget.saturating_sub(n as u64);
-            if let Some(i) = self.buf.windows(4).position(|w| w == b"OggS") {
-                return Ok(Some(at + i as u64));
-            }
-            at += (n - 3) as u64;
-        }
-        Ok(None)
-    }
-}
-
-fn read_parts(src: &(impl ByteSource + ?Sized), parts: &[(u64, u32)]) -> Result<Vec<u8>> {
-    // Ranges come from a scan of some source; check them against this one before sizing a buffer.
-    let len = src.len();
-    if parts.iter().any(|&(o, n)| o.checked_add(u64::from(n)).is_none_or(|end| end > len)) {
-        return Err(Error::Invalid("packet range lies outside the source".into()));
-    }
-    let mut v = Vec::with_capacity(parts.iter().map(|p| p.1 as usize).sum());
-    for &(o, n) in parts {
-        let a = v.len();
-        v.resize(a + n as usize, 0);
-        src.read_at(o, &mut v[a..])?;
-    }
-    Ok(v)
-}
-
-impl OggFile {
-    /// The first stream of `codec`.
-    pub fn stream_of(&self, codec: Codec) -> Option<usize> {
-        self.streams.iter().position(|s| s.codec == codec)
-    }
-    /// The bytes of packet `i` of stream `s`.
-    pub fn read_packet(&self, src: &(impl ByteSource + ?Sized), s: usize, i: usize) -> Result<Vec<u8>> {
-        let p = self.streams.get(s).and_then(|st| st.packets.get(i)).ok_or_else(|| Error::Invalid(format!("no packet {i} in stream {s}")))?;
-        read_parts(src, &p.parts)
-    }
-}
-
-/// Duration of an Opus packet in 48 kHz samples from its TOC (RFC 6716 §3.1); `None` if invalid.
-pub fn opus_packet_samples(prefix: [u8; 2], size: u32) -> Option<u32> {
-    if size == 0 {
-        return None;
-    }
-    let toc = prefix[0];
-    let config = toc >> 3;
-    let frame = match config {
-        0..=11 => [480, 960, 1920, 2880][(config & 3) as usize],
-        12..=15 => [480, 960][(config & 1) as usize],
-        _ => [120, 240, 480, 960][(config & 3) as usize],
-    };
-    let frames = match toc & 3 {
-        0 => 1,
-        1 | 2 => 2,
-        _ => {
-            if size < 2 {
-                return None;
-            }
-            (prefix[1] & 0x3F) as u32
-        }
-    };
-    let n = frame * frames;
-    (n > 0 && n <= 5760).then_some(n)
-}
-
-/// RFC 7845 §4 timing of an Opus stream.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct OpusTiming {
-    pub pre_skip: u32,
-    /// Start of each packet's decoded output in output samples (48 kHz): 0 is the first sample
-    /// after the pre-skip; the pre-skip samples have negative positions.
-    pub starts: Vec<i64>,
-    /// Decoded samples of each packet.
-    pub durations: Vec<u32>,
-    /// Playable samples (end trimming applied).
-    pub total: i64,
-}
-
-fn timing_add(a: i64, b: i64) -> Result<i64> {
-    a.checked_add(b).ok_or_else(|| Error::Invalid("opus timing overflow".into()))
-}
-
-fn timing_sub(a: i64, b: i64) -> Result<i64> {
-    a.checked_sub(b).ok_or_else(|| Error::Invalid("opus timing overflow".into()))
-}
-
-impl OpusTiming {
-    /// Timing of the Opus stream `s` (`pre_skip` from its `OpusHead`).
-    ///
-    /// A granule or a run of packet durations that does not fit in `i64` is an error. Ordinary
-    /// files, including a truncated tail and end trimming, are unchanged.
-    pub fn of(stream: &Stream, pre_skip: u32) -> Result<OpusTiming> {
-        let durations: Vec<u32> = stream.packets.iter().map(|p| opus_packet_samples(p.prefix, p.size).unwrap_or(0)).collect();
-        let n = durations.len();
-        let mut ends: Vec<Option<i64>> = vec![None; n];
-        let mut i = 0;
-        let mut cursor: Option<i64> = None;
-        let mut trimmed_end: Option<i64> = None;
-        while i < n {
-            // packets completing on the same page: i..j, the last carries the page granule
-            let mut j = i;
-            while j < n && stream.packets[j].granule.is_none() {
-                j += 1;
-            }
-            if j == n {
-                // trailing packets without a granule (truncated file): continue from the cursor
-                let mut c = cursor.unwrap_or(0);
-                for k in i..n {
-                    c = timing_add(c, i64::from(durations[k]))?;
-                    ends[k] = Some(c);
-                }
-                cursor = Some(c);
-                break;
-            }
-            let Some(g) = stream.packets[j].granule else { break };
-            let sum = durations[i..=j].iter().try_fold(0i64, |a, &d| timing_add(a, i64::from(d)))?;
-            let forward = match cursor {
-                Some(c) => Some(timing_add(c, sum)?),
-                None => None,
-            };
-            let end = match forward {
-                // end trimming on the last page (RFC 7845 §4.5): keep the forward positions
-                Some(f) if stream.packets[j].eos && g < f => {
-                    trimmed_end = Some(g);
-                    f
-                }
-                Some(f) if f == g => f,
-                // first page, or a discontinuity: trust the granule
-                _ => g,
-            };
-            let mut e = end;
-            for k in (i..=j).rev() {
-                ends[k] = Some(e);
-                e = timing_sub(e, i64::from(durations[k]))?;
-            }
-            cursor = Some(end);
-            i = j + 1;
-        }
-        let mut raw_starts = Vec::with_capacity(n);
-        for (e, &d) in ends.iter().zip(&durations) {
-            raw_starts.push(timing_sub(e.unwrap_or(0), i64::from(d))?);
-        }
-        let base = raw_starts.first().copied().unwrap_or(0).max(0);
-        let shift = timing_add(base, i64::from(pre_skip))?;
-        let mut starts = Vec::with_capacity(n);
-        for s in &raw_starts {
-            starts.push(timing_sub(*s, shift)?);
-        }
-        let end_all = trimmed_end.or(cursor).unwrap_or(0);
-        let total = timing_sub(end_all, shift)?.max(0);
-        Ok(OpusTiming { pre_skip, starts, durations, total })
-    }
-}
-
-/// Vorbis identification header fields (Vorbis I §4.2.2).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct VorbisInfo {
-    pub channels: u8,
-    pub sample_rate: u32,
-    pub bitrate_nominal: i32,
-}
-
-impl VorbisInfo {
-    pub fn parse(h: &[u8]) -> Option<VorbisInfo> {
-        if h.len() < 30 || !h.starts_with(b"\x01vorbis") {
-            return None;
-        }
-        Some(VorbisInfo {
-            channels: h[11],
-            sample_rate: u32::from_le_bytes([h[12], h[13], h[14], h[15]]),
-            bitrate_nominal: i32::from_le_bytes([h[20], h[21], h[22], h[23]]),
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests;

crates/ogg/src/tests.rs

@@ -1,307 +0,0 @@
-//! Synthetic Ogg streams: a small page writer (RFC 3533) and Opus-like packets.
-
-use std::cell::Cell;
-use std::io;
-
-use super::{ByteSource, CaptureScanner, Codec, Error, OpusTiming, Packet, Stream, crc32, open, opus_packet_samples, sniff};
-
-/// Write one page holding `segments` (lacing already computed by `lace`).
-fn page(out: &mut Vec<u8>, flags: u8, granule: i64, serial: u32, seq: u32, lacing: &[u8], body: &[u8]) {
-    let start = out.len();
-    out.extend_from_slice(b"OggS");
-    out.push(0);
-    out.push(flags);
-    out.extend_from_slice(&granule.to_le_bytes());
-    out.extend_from_slice(&serial.to_le_bytes());
-    out.extend_from_slice(&seq.to_le_bytes());
-    out.extend_from_slice(&[0; 4]);
-    out.push(lacing.len() as u8);
-    out.extend_from_slice(lacing);
-    out.extend_from_slice(body);
-    let crc = crc32(&out[start..]);
-    out[start + 22..start + 26].copy_from_slice(&crc.to_le_bytes());
-}
-
-fn lace(packets: &[&[u8]], last_continues: bool) -> (Vec<u8>, Vec<u8>) {
-    let mut l = Vec::new();
-    let mut b = Vec::new();
-    for (i, p) in packets.iter().enumerate() {
-        let mut n = p.len();
-        while n >= 255 {
-            l.push(255);
-            n -= 255;
-        }
-        if !(last_continues && i + 1 == packets.len()) {
-            l.push(n as u8);
-        }
-        b.extend_from_slice(p);
-    }
-    (l, b)
-}
-
-fn opus_head(pre_skip: u16) -> Vec<u8> {
-    let mut h = b"OpusHead".to_vec();
-    h.push(1);
-    h.push(2);
-    h.extend_from_slice(&pre_skip.to_le_bytes());
-    h.extend_from_slice(&48_000u32.to_le_bytes());
-    h.extend_from_slice(&0i16.to_le_bytes());
-    h.push(0);
-    h
-}
-
-/// A CELT 20 ms packet (960 samples): TOC config 31, code 0.
-fn pkt(i: usize, len: usize) -> Vec<u8> {
-    let mut p = vec![0xF8];
-    p.extend((0..len.saturating_sub(1)).map(|k| (i * 7 + k) as u8));
-    p
-}
-
-/// Header pages, then pages of 3 packets each; the last page's granule trims `trim` samples.
-fn opus_file(npk: usize, pre_skip: u16, trim: i64) -> Vec<u8> {
-    let mut f = Vec::new();
-    let head = opus_head(pre_skip);
-    let (l, b) = lace(&[&head], false);
-    page(&mut f, 0x02, 0, 9, 0, &l, &b);
-    let tags = b"OpusTags\x00\x00\x00\x00\x00\x00\x00\x00".to_vec();
-    let (l, b) = lace(&[&tags], false);
-    page(&mut f, 0, 0, 9, 1, &l, &b);
-    let pkts: Vec<Vec<u8>> = (0..npk).map(|i| pkt(i, 40 + i % 5)).collect();
-    let mut done = 0;
-    for (seq, chunk) in (2..).zip(pkts.chunks(3)) {
-        done += chunk.len();
-        let last = done == npk;
-        let mut g = done as i64 * 960;
-        if last {
-            g -= trim;
-        }
-        let refs: Vec<&[u8]> = chunk.iter().map(Vec::as_slice).collect();
-        let (l, b) = lace(&refs, false);
-        page(&mut f, if last { 0x04 } else { 0 }, g, 9, seq, &l, &b);
-    }
-    f
-}
-
-#[test]
-fn crc_matches_known_value() {
-    // CRC-32/CKSUM parameters without its final XOR (check value 0x765E7680 ^ 0xFFFFFFFF)
-    assert_eq!(crc32(b"123456789"), 0x89A1_897F);
-    assert_eq!(crc32(b""), 0);
-    assert_ne!(crc32(b"OggS"), crc32(b"OggT"));
-}
-
-#[test]
-fn opus_pages_packets_and_timing() {
-    let f = opus_file(10, 312, 500);
-    assert!(sniff(&f));
-    let o = open(&f).unwrap();
-    assert!(o.warnings.is_empty(), "{:?}", o.warnings);
-    let s = o.stream_of(Codec::Opus).unwrap();
-    let st = &o.streams[s];
-    assert_eq!(st.headers.len(), 2);
-    assert_eq!(st.packets.len(), 10);
-    assert!(st.saw_eos);
-    assert_eq!(o.read_packet(&f, s, 4).unwrap(), pkt(4, 44));
-    let t = OpusTiming::of(st, 312).unwrap();
-    assert_eq!(t.durations, vec![960; 10]);
-    assert_eq!(t.starts[0], -312);
-    assert_eq!(t.starts[9], 9 * 960 - 312);
-    // end trimming: the last page granule is 500 short
-    assert_eq!(t.total, 10 * 960 - 500 - 312);
-}
-
-#[test]
-fn packets_spanning_pages() {
-    let mut f = Vec::new();
-    let head = opus_head(0);
-    let (l, b) = lace(&[&head], false);
-    page(&mut f, 0x02, 0, 1, 0, &l, &b);
-    let (l, b) = lace(&[b"OpusTags"], false);
-    page(&mut f, 0, 0, 1, 1, &l, &b);
-    let big = pkt(0, 700);
-    // first 510 bytes on one page (two 255 lacing values, packet continues), rest on the next
-    let (l, b) = (vec![255, 255], big[..510].to_vec());
-    page(&mut f, 0, -1, 1, 2, &l, &b);
-    let rest = &big[510..];
-    let small = pkt(1, 30);
-    let (l, b) = lace(&[rest, &small], false);
-    page(&mut f, 0x01 | 0x04, 1920, 1, 3, &l, &b);
-    let o = open(&f).unwrap();
-    let st = &o.streams[0];
-    assert_eq!(st.packets.len(), 2);
-    assert_eq!(st.packets[0].parts.len(), 2);
-    assert_eq!(o.read_packet(&f, 0, 0).unwrap(), big);
-    assert_eq!(o.read_packet(&f, 0, 1).unwrap(), small);
-    let t = OpusTiming::of(st, 0).unwrap();
-    assert_eq!(t.starts, vec![0, 960]);
-    assert_eq!(t.total, 1920);
-}
-
-#[test]
-fn corrupt_pages_are_skipped_and_truncation_is_safe() {
-    let f = opus_file(12, 312, 0);
-    // flip a byte inside the third data page's body: that page fails its CRC and is dropped
-    let mut g = f.clone();
-    let third = g.windows(4).enumerate().filter(|(_, w)| *w == b"OggS").map(|(i, _)| i).nth(4).unwrap();
-    g[third + 40] ^= 0xFF;
-    let o = open(&g).unwrap();
-    assert!(o.warnings.iter().any(|w| w.contains("CRC")), "{:?}", o.warnings);
-    assert_eq!(o.streams[0].packets.len(), 9);
-    let t = OpusTiming::of(&o.streams[0], 312).unwrap();
-    // the granules after the gap put the later packets at their true positions
-    assert_eq!(*t.starts.last().unwrap(), 11 * 960 - 312);
-    for cut in 0..f.len() {
-        if let Ok(o) = open(&f[..cut].to_vec()) {
-            for st in &o.streams {
-                let t = OpusTiming::of(st, 312).unwrap();
-                assert_eq!(t.starts.len(), st.packets.len());
-            }
-        }
-    }
-    let mut seed = 99u64;
-    for _ in 0..300 {
-        let mut g = f.clone();
-        seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
-        let at = (seed >> 33) as usize % g.len();
-        g[at] = (seed >> 20) as u8;
-        if let Ok(o) = open(&g) {
-            for st in &o.streams {
-                let _ = OpusTiming::of(st, 312);
-            }
-        }
-    }
-    assert!(matches!(open(&b"not ogg at all, no capture pattern".to_vec()), Err(Error::NotOgg)));
-}
-
-#[test]
-fn opus_toc_durations() {
-    assert_eq!(opus_packet_samples([0x00, 0], 10), Some(480)); // SILK NB 10 ms
-    assert_eq!(opus_packet_samples([0x18, 0], 10), Some(2880)); // SILK NB 60 ms
-    assert_eq!(opus_packet_samples([0x78 | 1, 0], 10), Some(1920)); // hybrid 20 ms × 2
-    assert_eq!(opus_packet_samples([0x80 | 3, 6], 10), Some(720)); // CELT 2.5 ms × 6
-    assert_eq!(opus_packet_samples([0xF8 | 3, 7], 10), None); // 140 ms: invalid
-    assert_eq!(opus_packet_samples([0xF8, 0], 0), None);
-}
-
-#[test]
-fn opus_timing_includes_packets_after_the_last_known_granule() {
-    let f = opus_file(6, 312, 0);
-    let o = open(&f).unwrap();
-    let mut stream = o.streams[0].clone();
-    // Missing granules on complete-packet pages are non-conforming. The existing recovery
-    // fallback still assigns their packet positions; total must include the same samples.
-    stream.packets.last_mut().unwrap().granule = None;
-    let timing = OpusTiming::of(&stream, 312).unwrap();
-    assert_eq!(timing.starts, vec![-312, 648, 1608, 2568, 3528, 4488]);
-    assert_eq!(timing.total, 6 * 960 - 312);
-
-    // With no usable granule, every complete packet still contributes its TOC duration.
-    for packet in &mut stream.packets {
-        packet.granule = None;
-    }
-    let timing = OpusTiming::of(&stream, 312).unwrap();
-    assert_eq!(timing.starts, vec![-312, 648, 1608, 2568, 3528, 4488]);
-    assert_eq!(timing.total, 6 * 960 - 312);
-}
-
-#[test]
-fn opus_timing_rejects_a_granule_that_overflows() {
-    let packet = |granule: i64| Stream {
-        serial: 1,
-        codec: Codec::Opus,
-        headers: vec![],
-        packets: vec![Packet { parts: vec![], size: 10, granule: Some(granule), page: 0, eos: true, prefix: [0x00, 0] }],
-        pages: 1,
-        last_granule: Some(granule),
-        saw_eos: true,
-    };
-    let ok = OpusTiming::of(&packet(480), 0).unwrap();
-    assert_eq!(ok.starts, vec![0]);
-    assert_eq!(ok.total, 480);
-    assert!(OpusTiming::of(&packet(i64::MIN), 0).is_err());
-}
-
-/// A source that counts the bytes read from it.
-struct Counting<'a> {
-    data: &'a [u8],
-    read: Cell<u64>,
-}
-
-impl ByteSource for Counting<'_> {
-    fn len(&self) -> u64 {
-        self.data.len() as u64
-    }
-    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
-        self.read.set(self.read.get() + buf.len() as u64);
-        self.data.read_at(offset, buf)
-    }
-}
-
-/// A valid file followed by `len` bytes of 0xFF with a capture pattern every 64 bytes. Each one
-/// claims 255 full lacing values, so it reads as a page of about 64 KiB that fails its CRC.
-fn dense_fake_pages(len: usize) -> Vec<u8> {
-    let mut f = opus_file(6, 312, 0);
-    let start = f.len();
-    f.resize(start + len, 0xFF);
-    for at in (start..start + len - 64).step_by(64) {
-        f[at..at + 5].copy_from_slice(b"OggS\0");
-        f[at + 26] = 255;
-    }
-    f
-}
-
-#[test]
-fn recovery_reads_a_bounded_amount_of_a_damaged_file() {
-    let f = dense_fake_pages(1 << 20);
-    let src = Counting { data: &f, read: Cell::new(0) };
-    let o = open(&src).unwrap();
-    assert_eq!(o.streams[0].packets.len(), 6, "the good pages are kept");
-    let read = src.read.get();
-    assert!(read <= 40 << 20, "read {read} bytes of a {} byte file", f.len());
-    assert!(o.warnings.iter().any(|w| w.contains("recovery budget")), "{:?}", o.warnings);
-}
-
-#[test]
-fn warnings_are_capped() {
-    // 100,000 pages with no segments and a wrong CRC, 27 bytes each
-    let mut f = opus_file(6, 312, 0);
-    for _ in 0..100_000 {
-        let at = f.len();
-        f.extend_from_slice(b"OggS\0\0");
-        f.resize(at + 27, 0);
-        f[at + 22] = 1;
-    }
-    let o = open(&f).unwrap();
-    assert!(o.warnings.len() <= 257, "{} warnings", o.warnings.len());
-    assert!(o.warnings.iter().any(|w| w.contains("omitted")), "{:?}", o.warnings.last());
-}
-
-#[test]
-fn a_file_of_good_pages_is_not_charged_for_recovery() {
-    let f = opus_file(2000, 312, 0);
-    let src = Counting { data: &f, read: Cell::new(0) };
-    let o = open(&src).unwrap();
-    assert_eq!(o.streams[0].packets.len(), 2000);
-    assert!(o.warnings.is_empty(), "{:?}", o.warnings);
-}
-
-#[test]
-fn a_budget_too_small_to_search_is_spent() {
-    // 1 to 3 bytes left cannot hold a capture pattern: the scan would stop without saying why
-    let mut scanner = CaptureScanner::new();
-    assert!(!scanner.spent());
-    assert!(scanner.charge(super::RECOVERY_BUDGET - 3));
-    assert!(scanner.spent());
-    let f = opus_file(6, 312, 0);
-    assert_eq!(scanner.find(&f, 0, f.len() as u64).unwrap(), None);
-}
-
-#[test]
-fn read_packet_checks_its_ranges_against_the_source_before_allocating() {
-    let f = opus_file(10, 312, 500);
-    let o = open(&f).unwrap();
-    let s = o.stream_of(Codec::Opus).unwrap();
-    // The last packet lies past the end of a source cut short: an error, not a read of missing bytes.
-    let short = &f[..f.len() / 2];
-    assert!(matches!(o.read_packet(&short, s, 9), Err(Error::Invalid(_))));
-}

crates/opus/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "deckcraft-opus"
-description = "Clean-room pure-Rust Opus decoder (RFC 6716 / RFC 8251; OpusHead, multistream surround)"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
-
-[lints]
-workspace = true
-
-[dependencies]

crates/opus/src/celt.rs

@@ -1,678 +0,0 @@
-//! CELT layer decoder (RFC 6716 §4.3).
-
-pub(crate) mod bands;
-pub(crate) mod energy;
-pub(crate) mod mdct;
-pub(crate) mod rate;
-pub(crate) mod tables;
-
-use std::sync::OnceLock;
-
-use bands::{anti_collapse, denormalise_bands, quant_all_bands, renormalise_vector};
-use energy::{unquant_coarse_energy, unquant_energy_finalise, unquant_fine_energy};
-use mdct::ImdctScratch;
-use rate::{Mode, compute_allocation};
-use tables::{COMB_GAINS, EBANDS, MAX_LM, NB_EBANDS, OVERLAP, PREEMPH, SHORT_MDCT, SPREAD_ICDF, TAPSET_ICDF, TF_SELECT_TABLE, TRIM_ICDF};
-
-use crate::range::{BITRES, RangeDecoder};
-
-const DECODE_BUFFER_SIZE: usize = 2048;
-const COMBFILTER_MINPERIOD: i32 = 15;
-const PLC_PITCH_LAG_MAX: usize = 720;
-const PLC_PITCH_LAG_MIN: usize = 100;
-
-pub(crate) fn mode() -> &'static Mode {
-    static MODE: OnceLock<Mode> = OnceLock::new();
-    MODE.get_or_init(Mode::new)
-}
-
-/// CELT decoder state for one (mono or stereo) stream.
-pub struct CeltDecoder {
-    m: &'static Mode,
-    /// Output channels.
-    channels: usize,
-    /// Channels coded in the stream.
-    pub stream_channels: usize,
-    downsample: usize,
-    pub start: usize,
-    pub end: usize,
-    pub disable_inv: bool,
-    pub rng: u32,
-    loss_count: u32,
-    skip_plc: bool,
-    postfilter_period: i32,
-    postfilter_period_old: i32,
-    postfilter_gain: f32,
-    postfilter_gain_old: f32,
-    postfilter_tapset: usize,
-    postfilter_tapset_old: usize,
-    preemph_mem: [f32; 2],
-    decode_mem: Vec<f32>,
-    old_band_e: [f32; 2 * NB_EBANDS],
-    old_log_e: [f32; 2 * NB_EBANDS],
-    old_log_e2: [f32; 2 * NB_EBANDS],
-    background_log_e: [f32; 2 * NB_EBANDS],
-    // scratch
-    x: Vec<f32>,
-    freq: Vec<f32>,
-    imdct: ImdctScratch,
-    pcm_scratch: Vec<f32>,
-}
-
-/// Detects the silence flag, advancing the decoder to the end of the frame when set. Returns the flag and the new bit position.
-fn read_silence(dec: &mut RangeDecoder, total_bits_raw: i32) -> (bool, i32) {
-    let tell = dec.tell();
-    let silence = tell >= total_bits_raw || (tell == 1 && dec.bit_logp(15));
-    if silence {
-        // Pretend we've read all the remaining bits.
-        dec.skip_to_end(total_bits_raw);
-        return (true, total_bits_raw);
-    }
-    (false, tell)
-}
-
-struct PostfilterParams {
-    gain: f32,
-    pitch: i32,
-    tapset: usize,
-    tell: i32,
-}
-
-/// Reads the optional post-filter header (pitch, gain, tapset) at the start of a frame.
-fn read_postfilter_params(dec: &mut RangeDecoder, start: usize, tell: i32, total_bits_raw: i32) -> PostfilterParams {
-    let mut p = PostfilterParams { gain: 0.0, pitch: 0, tapset: 0, tell };
-    if start == 0 && tell + 16 <= total_bits_raw {
-        if dec.bit_logp(1) {
-            let octave = dec.uint(6);
-            p.pitch = ((16 << octave) + dec.bits(4 + octave)) as i32 - 1;
-            let qg = dec.bits(3);
-            if dec.tell() + 2 <= total_bits_raw {
-                p.tapset = dec.icdf(&TAPSET_ICDF, 2);
-            }
-            p.gain = 0.09375 * (qg + 1) as f32;
-        }
-        p.tell = dec.tell();
-    }
-    p
-}
-
-/// Decodes per-band dynamic allocation boosts. Returns the offsets, the fractional bit position and the remaining bit budget.
-fn decode_dynalloc(
-    dec: &mut RangeDecoder,
-    start: usize,
-    end: usize,
-    c: usize,
-    lm: usize,
-    cap: &[i32],
-    total_bits_raw: i32,
-) -> ([i32; NB_EBANDS], i32, i32) {
-    let mut offsets = [0i32; NB_EBANDS];
-    let mut dynalloc_logp = 6;
-    let mut total_bits = total_bits_raw << BITRES;
-    let mut tellf = dec.tell_frac() as i32;
-    for i in start..end {
-        let width = (c as i32 * (EBANDS[i + 1] - EBANDS[i])) << lm;
-        let quanta = (width << BITRES).min((6 << BITRES).max(width));
-        let mut loop_logp = dynalloc_logp;
-        let mut boost = 0;
-        while tellf + (loop_logp << BITRES) < total_bits && boost < cap[i] {
-            let flag = dec.bit_logp(loop_logp as u32);
-            tellf = dec.tell_frac() as i32;
-            if !flag {
-                break;
-            }
-            boost += quanta;
-            total_bits -= quanta;
-            loop_logp = 1;
-        }
-        offsets[i] = boost;
-        if boost > 0 {
-            dynalloc_logp = 2.max(dynalloc_logp - 1);
-        }
-    }
-    (offsets, tellf, total_bits)
-}
-
-impl CeltDecoder {
-    /// `sample_rate` is the output rate (48000, 24000, 16000, 12000 or 8000).
-    pub fn new(sample_rate: u32, channels: usize) -> CeltDecoder {
-        let downsample = (48000 / sample_rate) as usize;
-        let mut d = CeltDecoder {
-            m: mode(),
-            channels,
-            stream_channels: channels,
-            downsample,
-            start: 0,
-            end: NB_EBANDS,
-            disable_inv: channels == 1,
-            rng: 0,
-            loss_count: 0,
-            skip_plc: true,
-            postfilter_period: 0,
-            postfilter_period_old: 0,
-            postfilter_gain: 0.0,
-            postfilter_gain_old: 0.0,
-            postfilter_tapset: 0,
-            postfilter_tapset_old: 0,
-            preemph_mem: [0.0; 2],
-            decode_mem: vec![0.0; channels * (DECODE_BUFFER_SIZE + OVERLAP)],
-            old_band_e: [0.0; 2 * NB_EBANDS],
-            old_log_e: [0.0; 2 * NB_EBANDS],
-            old_log_e2: [0.0; 2 * NB_EBANDS],
-            background_log_e: [0.0; 2 * NB_EBANDS],
-            x: Vec::new(),
-            freq: Vec::new(),
-            imdct: ImdctScratch::default(),
-            pcm_scratch: Vec::new(),
-        };
-        d.reset();
-        d
-    }
-
-    /// `OPUS_RESET_STATE`.
-    pub fn reset(&mut self) {
-        self.rng = 0;
-        self.loss_count = 0;
-        self.skip_plc = true;
-        self.postfilter_period = 0;
-        self.postfilter_period_old = 0;
-        self.postfilter_gain = 0.0;
-        self.postfilter_gain_old = 0.0;
-        self.postfilter_tapset = 0;
-        self.postfilter_tapset_old = 0;
-        self.preemph_mem = [0.0; 2];
-        self.decode_mem.fill(0.0);
-        self.old_band_e = [0.0; 2 * NB_EBANDS];
-        self.old_log_e = [-28.0; 2 * NB_EBANDS];
-        self.old_log_e2 = [-28.0; 2 * NB_EBANDS];
-        self.background_log_e = [0.0; 2 * NB_EBANDS];
-    }
-
-    fn mem_len(&self) -> usize {
-        DECODE_BUFFER_SIZE + OVERLAP
-    }
-
-    /// Decodes one CELT frame of `frame_size` samples (at the output rate) into interleaved `pcm`
-    /// (`channels` wide). With `accum`, the output is added to `pcm`. `data = None` (or fewer than
-    /// two bytes) runs the packet-loss concealment.
-    pub fn decode(
-        &mut self,
-        data: Option<&[u8]>,
-        frame_size: usize,
-        pcm: &mut [f32],
-        accum: bool,
-        dec: Option<&mut RangeDecoder>,
-    ) -> Result<usize, crate::Error> {
-        let n_full = frame_size * self.downsample;
-        let lm = match n_full {
-            120 => 0,
-            240 => 1,
-            480 => 2,
-            960 => 3,
-            _ => return Err(crate::Error::InvalidArgument("CELT frame size")),
-        };
-        let data = match data {
-            Some(d) if d.len() > 1 => d,
-            _ => {
-                self.decode_lost(n_full, lm);
-                self.deemphasis(n_full, pcm, accum);
-                return Ok(frame_size);
-            }
-        };
-        if data.len() > 1275 {
-            return Err(crate::Error::InvalidPacket("CELT frame too long"));
-        }
-        match dec {
-            Some(d) => self.decode_frame(d, data.len(), n_full, lm),
-            None => {
-                let mut own = RangeDecoder::new(data);
-                self.decode_frame(&mut own, data.len(), n_full, lm)
-            }
-        }
-        self.deemphasis(n_full, pcm, accum);
-        Ok(frame_size)
-    }
-
-    fn decode_frame(&mut self, dec: &mut RangeDecoder, len: usize, n: usize, lm: usize) {
-        let cc = self.channels;
-        let c = self.stream_channels;
-        let m = self.m;
-        let mm = 1usize << lm;
-        let start = self.start;
-        let end = self.end;
-        let eff_end = end.min(NB_EBANDS);
-        if self.loss_count == 0 {
-            self.skip_plc = false;
-        }
-        if c == 1 {
-            for i in 0..NB_EBANDS {
-                self.old_band_e[i] = self.old_band_e[i].max(self.old_band_e[NB_EBANDS + i]);
-            }
-        }
-        let total_bits_raw = len as i32 * 8;
-        let (silence, mut tell) = read_silence(dec, total_bits_raw);
-        let pf = read_postfilter_params(dec, start, tell, total_bits_raw);
-        tell = pf.tell;
-        let (postfilter_gain, postfilter_pitch, postfilter_tapset) = (pf.gain, pf.pitch, pf.tapset);
-        let is_transient = if lm > 0 && tell + 3 <= total_bits_raw {
-            let t = dec.bit_logp(3);
-            tell = dec.tell();
-            t
-        } else {
-            false
-        };
-        let short_blocks = is_transient;
-        let intra = if tell + 3 <= total_bits_raw { dec.bit_logp(3) } else { false };
-        unquant_coarse_energy(start, end, &mut self.old_band_e, intra, dec, c, lm);
-        let mut tf_res = [0i32; NB_EBANDS];
-        tf_decode(start, end, is_transient, &mut tf_res, lm, dec);
-        tell = dec.tell();
-        let mut spread = 2usize;
-        if tell + 4 <= total_bits_raw {
-            spread = dec.icdf(&SPREAD_ICDF, 5);
-        }
-        let cap = m.init_caps(lm, c);
-        let (offsets, tellf, total_bits) = decode_dynalloc(dec, start, end, c, lm, &cap, total_bits_raw);
-        let alloc_trim = if tellf + (6 << BITRES) <= total_bits { dec.icdf(&TRIM_ICDF, 7) as i32 } else { 5 };
-        let mut bits = ((len as i32 * 8) << BITRES) - dec.tell_frac() as i32 - 1;
-        let anti_collapse_rsv = if is_transient && lm >= 2 && bits >= ((lm as i32 + 2) << BITRES) { 1 << BITRES } else { 0 };
-        bits -= anti_collapse_rsv;
-        let alloc = compute_allocation(m, start, end, &offsets, &cap, alloc_trim, bits, c, lm, dec);
-        unquant_fine_energy(start, end, &mut self.old_band_e, &alloc.fine_quant, dec, c);
-
-        // Shift the decode memory by one frame.
-        let ml = self.mem_len();
-        for ch in 0..cc {
-            let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
-            mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
-        }
-
-        let mut collapse_masks = vec![0u32; c * NB_EBANDS];
-        let mut x = std::mem::take(&mut self.x);
-        x.clear();
-        x.resize(c * n, 0.0);
-        {
-            let (xa, xb) = x.split_at_mut(n);
-            let yb = if c == 2 { Some(xb) } else { None };
-            let mut seed = self.rng;
-            quant_all_bands(
-                m,
-                start,
-                end,
-                xa,
-                yb,
-                &mut collapse_masks,
-                &alloc.pulses,
-                short_blocks,
-                spread,
-                alloc.dual_stereo,
-                alloc.intensity,
-                &tf_res,
-                ((len as i32) * (8 << BITRES)) - anti_collapse_rsv,
-                alloc.balance,
-                dec,
-                lm,
-                alloc.coded_bands,
-                &mut seed,
-                self.disable_inv,
-            );
-            self.rng = seed;
-        }
-        let mut anti_collapse_on = false;
-        if anti_collapse_rsv > 0 {
-            anti_collapse_on = dec.bits(1) != 0;
-        }
-        let bits_left = len as i32 * 8 - dec.tell();
-        unquant_energy_finalise(start, end, &mut self.old_band_e, &alloc.fine_quant, &alloc.fine_priority, bits_left, dec, c);
-        if anti_collapse_on {
-            anti_collapse(
-                &mut x,
-                &collapse_masks,
-                lm,
-                c,
-                n,
-                start,
-                end,
-                &self.old_band_e,
-                &self.old_log_e,
-                &self.old_log_e2,
-                &alloc.pulses,
-                self.rng,
-            );
-        }
-        if silence {
-            for v in self.old_band_e[..c * NB_EBANDS].iter_mut() {
-                *v = -28.0;
-            }
-        }
-        self.synthesis(&x, n, start, eff_end, c, is_transient, lm, silence);
-        self.x = x;
-
-        // Post-filter.
-        for ch in 0..cc {
-            self.postfilter_period = self.postfilter_period.max(COMBFILTER_MINPERIOD);
-            self.postfilter_period_old = self.postfilter_period_old.max(COMBFILTER_MINPERIOD);
-            let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
-            let off = DECODE_BUFFER_SIZE - n;
-            comb_filter(
-                mem,
-                off,
-                self.postfilter_period_old,
-                self.postfilter_period,
-                SHORT_MDCT,
-                self.postfilter_gain_old,
-                self.postfilter_gain,
-                self.postfilter_tapset_old,
-                self.postfilter_tapset,
-                &m.window,
-            );
-            if lm != 0 {
-                comb_filter(
-                    mem,
-                    off + SHORT_MDCT,
-                    self.postfilter_period,
-                    postfilter_pitch,
-                    n - SHORT_MDCT,
-                    self.postfilter_gain,
-                    postfilter_gain,
-                    self.postfilter_tapset,
-                    postfilter_tapset,
-                    &m.window,
-                );
-            }
-        }
-        self.postfilter_period_old = self.postfilter_period;
-        self.postfilter_gain_old = self.postfilter_gain;
-        self.postfilter_tapset_old = self.postfilter_tapset;
-        self.postfilter_period = postfilter_pitch;
-        self.postfilter_gain = postfilter_gain;
-        self.postfilter_tapset = postfilter_tapset;
-        if lm != 0 {
-            self.postfilter_period_old = self.postfilter_period;
-            self.postfilter_gain_old = self.postfilter_gain;
-            self.postfilter_tapset_old = self.postfilter_tapset;
-        }
-
-        if c == 1 {
-            let (a, b) = self.old_band_e.split_at_mut(NB_EBANDS);
-            b.copy_from_slice(a);
-        }
-        if !is_transient {
-            self.old_log_e2 = self.old_log_e;
-            self.old_log_e = self.old_band_e;
-            for i in 0..2 * NB_EBANDS {
-                self.background_log_e[i] = (self.background_log_e[i] + mm as f32 * 0.001).min(self.old_band_e[i]);
-            }
-        } else {
-            for i in 0..2 * NB_EBANDS {
-                self.old_log_e[i] = self.old_log_e[i].min(self.old_band_e[i]);
-            }
-        }
-        for ch in 0..2 {
-            for i in (0..start).chain(end..NB_EBANDS) {
-                self.old_band_e[ch * NB_EBANDS + i] = 0.0;
-                self.old_log_e[ch * NB_EBANDS + i] = -28.0;
-                self.old_log_e2[ch * NB_EBANDS + i] = -28.0;
-            }
-        }
-        self.rng = dec.rng();
-        self.loss_count = 0;
-    }
-
-    /// Denormalisation + IMDCT into the decode memory (`celt_synthesis`).
-    #[allow(clippy::too_many_arguments)]
-    fn synthesis(&mut self, x: &[f32], n: usize, start: usize, eff_end: usize, c: usize, is_transient: bool, lm: usize, silence: bool) {
-        let cc = self.channels;
-        let m = self.m;
-        let mm = 1usize << lm;
-        let (bcount, nb, shift) = if is_transient { (mm, SHORT_MDCT, MAX_LM) } else { (1, SHORT_MDCT << lm, MAX_LM - lm) };
-        let ml = self.mem_len();
-        let mut freq = std::mem::take(&mut self.freq);
-        freq.clear();
-        freq.resize(2 * n, 0.0);
-        let (f0, f1) = freq.split_at_mut(n);
-        let out_off = DECODE_BUFFER_SIZE - n;
-        if cc == 2 && c == 1 {
-            denormalise_bands(x, f0, &self.old_band_e, start, eff_end, mm, self.downsample, silence);
-            f1.copy_from_slice(f0);
-            for (ch, f) in [(0usize, &*f1), (1usize, &*f0)] {
-                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
-                for b in 0..bcount {
-                    m.mdct[shift].backward(&f[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
-                }
-            }
-        } else if cc == 1 && c == 2 {
-            denormalise_bands(x, f0, &self.old_band_e, start, eff_end, mm, self.downsample, silence);
-            denormalise_bands(&x[n..], f1, &self.old_band_e[NB_EBANDS..], start, eff_end, mm, self.downsample, silence);
-            for i in 0..n {
-                f0[i] = 0.5 * (f0[i] + f1[i]);
-            }
-            let mem = &mut self.decode_mem[..ml];
-            for b in 0..bcount {
-                m.mdct[shift].backward(&f0[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
-            }
-        } else {
-            for ch in 0..cc {
-                denormalise_bands(&x[ch * n..], f0, &self.old_band_e[ch * NB_EBANDS..], start, eff_end, mm, self.downsample, silence);
-                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
-                for b in 0..bcount {
-                    m.mdct[shift].backward(&f0[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
-                }
-            }
-        }
-        self.freq = freq;
-    }
-
-    fn deemphasis(&mut self, n: usize, pcm: &mut [f32], accum: bool) {
-        let cc = self.channels;
-        let ml = self.mem_len();
-        let ds = self.downsample;
-        let out_off = DECODE_BUFFER_SIZE - n;
-        let mut scratch = std::mem::take(&mut self.pcm_scratch);
-        for ch in 0..cc {
-            let mem = &self.decode_mem[ch * ml + out_off..ch * ml + out_off + n];
-            let mut mstate = self.preemph_mem[ch];
-            scratch.clear();
-            for &v in mem {
-                let tmp = v + 1e-30 + mstate;
-                mstate = PREEMPH * tmp;
-                scratch.push(tmp);
-            }
-            self.preemph_mem[ch] = mstate;
-            for j in 0..n / ds {
-                let v = scratch[j * ds] * (1.0 / 32768.0);
-                let o = &mut pcm[j * cc + ch];
-                if accum {
-                    *o += v;
-                } else {
-                    *o = v;
-                }
-            }
-        }
-        self.pcm_scratch = scratch;
-    }
-
-    /// Packet-loss concealment: pitch-periodic extension for the first lost frames, then
-    /// decaying shaped noise.
-    fn decode_lost(&mut self, n: usize, lm: usize) {
-        let cc = self.channels;
-        let ml = self.mem_len();
-        let m = self.m;
-        let pitch_based = self.loss_count < 5 && self.start == 0 && !self.skip_plc;
-        if !pitch_based {
-            let decay = if self.loss_count == 0 { 1.5 } else { 0.5 };
-            for ch in 0..cc {
-                for i in self.start..self.end {
-                    let k = ch * NB_EBANDS + i;
-                    self.old_band_e[k] = self.background_log_e[k].max(self.old_band_e[k] - decay);
-                }
-            }
-            let mut seed = self.rng;
-            let mut x = std::mem::take(&mut self.x);
-            x.clear();
-            x.resize(cc * n, 0.0);
-            let eff_end = self.end.min(NB_EBANDS);
-            for ch in 0..cc {
-                for i in self.start..eff_end {
-                    let off = n * ch + ((EBANDS[i] as usize) << lm);
-                    let blen = ((EBANDS[i + 1] - EBANDS[i]) as usize) << lm;
-                    for v in x[off..off + blen].iter_mut() {
-                        seed = bands::lcg_rand(seed);
-                        *v = ((seed as i32) >> 20) as f32;
-                    }
-                    renormalise_vector(&mut x[off..off + blen], 1.0);
-                }
-            }
-            self.rng = seed;
-            for ch in 0..cc {
-                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
-                mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
-            }
-            let saved_sc = self.stream_channels;
-            self.stream_channels = cc;
-            self.synthesis(&x, n, self.start, eff_end, cc, false, lm, false);
-            self.stream_channels = saved_sc;
-            self.x = x;
-        } else {
-            // Pitch search on the (mono-mixed) history.
-            let hist_len = 1024usize;
-            let base = DECODE_BUFFER_SIZE - hist_len;
-            let mut mono = vec![0f32; hist_len];
-            for ch in 0..cc {
-                for (i, v) in mono.iter_mut().enumerate() {
-                    *v += self.decode_mem[ch * ml + base + i];
-                }
-            }
-            let period = if self.loss_count == 0 { find_pitch(&mono) } else { self.postfilter_period_old.max(PLC_PITCH_LAG_MIN as i32) as usize };
-            let period = period.clamp(PLC_PITCH_LAG_MIN, PLC_PITCH_LAG_MAX);
-            // Remember the period for subsequent losses in the (otherwise unused) old period slot.
-            self.postfilter_period_old = period as i32;
-            let fade = 0.8f32.powi(self.loss_count as i32 + 1);
-            let mut ext = vec![0f32; n + OVERLAP];
-            for ch in 0..cc {
-                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
-                // Energy decay across the last two periods.
-                let e1: f32 = mem[DECODE_BUFFER_SIZE - period..DECODE_BUFFER_SIZE].iter().map(|v| v * v).sum();
-                let e0: f32 = mem[DECODE_BUFFER_SIZE - 2 * period..DECODE_BUFFER_SIZE - period].iter().map(|v| v * v).sum();
-                let decay = if e0 > 0.0 { (e1 / e0).sqrt().min(1.0) } else { 0.0 };
-                let mut g = 1.0f32;
-                for (i, e) in ext.iter_mut().enumerate() {
-                    if i > 0 && i % period == 0 {
-                        g *= decay;
-                    }
-                    let src = DECODE_BUFFER_SIZE - period + (i % period);
-                    *e = mem[src] * g * fade;
-                }
-                mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
-                let out_off = DECODE_BUFFER_SIZE - n;
-                // Cross-fade the start with the previous overlap so the transition is smooth.
-                mem[out_off..out_off + n].copy_from_slice(&ext[..n]);
-                let tail = &ext[n..n + OVERLAP];
-                for i in 0..OVERLAP / 2 {
-                    mem[DECODE_BUFFER_SIZE + i] = m.window[i] * tail[OVERLAP - 1 - i] + m.window[OVERLAP - 1 - i] * tail[i];
-                }
-            }
-        }
-        self.loss_count += 1;
-    }
-}
-
-fn find_pitch(x: &[f32]) -> usize {
-    let n = x.len();
-    let win = 512.min(n - PLC_PITCH_LAG_MAX);
-    let tgt = &x[n - win..];
-    let mut best = PLC_PITCH_LAG_MIN;
-    let mut best_score = f32::MIN;
-    let e_t: f32 = tgt.iter().map(|v| v * v).sum::<f32>() + 1e-9;
-    for lag in PLC_PITCH_LAG_MIN..=PLC_PITCH_LAG_MAX {
-        let src = &x[n - win - lag..n - lag];
-        let mut xy = 0f32;
-        let mut yy = 1e-9f32;
-        for (a, b) in tgt.iter().zip(src) {
-            xy += a * b;
-            yy += b * b;
-        }
-        let score = xy / (e_t * yy).sqrt();
-        if score > best_score {
-            best_score = score;
-            best = lag;
-        }
-    }
-    best
-}
-
-fn tf_decode(start: usize, end: usize, is_transient: bool, tf_res: &mut [i32; NB_EBANDS], lm: usize, dec: &mut RangeDecoder) {
-    let mut budget = dec.storage() as i32 * 8;
-    let mut tell = dec.tell();
-    let mut logp: u32 = if is_transient { 2 } else { 4 };
-    let tf_select_rsv = lm > 0 && tell + (logp as i32) < budget;
-    budget -= tf_select_rsv as i32;
-    let mut tf_changed = 0;
-    let mut curr = 0;
-    for r in tf_res.iter_mut().take(end).skip(start) {
-        if tell + logp as i32 <= budget {
-            curr ^= dec.bit_logp(logp) as i32;
-            tell = dec.tell();
-            tf_changed |= curr;
-        }
-        *r = curr;
-        logp = if is_transient { 4 } else { 5 };
-    }
-    let mut tf_select = 0;
-    let ti = 4 * is_transient as usize;
-    if tf_select_rsv && TF_SELECT_TABLE[lm][ti + tf_changed as usize] != TF_SELECT_TABLE[lm][ti + 2 + tf_changed as usize] {
-        tf_select = dec.bit_logp(1) as usize;
-    }
-    for r in tf_res.iter_mut().take(end).skip(start) {
-        *r = TF_SELECT_TABLE[lm][ti + 2 * tf_select + *r as usize] as i32;
-    }
-}
-
-/// Pitch post-filter (in place on `buf[off .. off + n]`, reading history before `off`).
-#[allow(clippy::too_many_arguments)]
-fn comb_filter(buf: &mut [f32], off: usize, t0: i32, t1: i32, n: usize, g0: f32, g1: f32, tapset0: usize, tapset1: usize, window: &[f32; OVERLAP]) {
-    if g0 == 0.0 && g1 == 0.0 {
-        return;
-    }
-    let t0 = t0.max(COMBFILTER_MINPERIOD) as usize;
-    let t1 = t1.max(COMBFILTER_MINPERIOD) as usize;
-    let g00 = g0 * COMB_GAINS[tapset0][0];
-    let g01 = g0 * COMB_GAINS[tapset0][1];
-    let g02 = g0 * COMB_GAINS[tapset0][2];
-    let g10 = g1 * COMB_GAINS[tapset1][0];
-    let g11 = g1 * COMB_GAINS[tapset1][1];
-    let g12 = g1 * COMB_GAINS[tapset1][2];
-    let mut x1 = buf[off + 1 - t1];
-    let mut x2 = buf[off - t1];
-    let mut x3 = buf[off - t1 - 1];
-    let mut x4 = buf[off - t1 - 2];
-    let overlap = if g0 == g1 && t0 == t1 && tapset0 == tapset1 { 0 } else { OVERLAP.min(n) };
-    let mut i = 0;
-    while i < overlap {
-        let p = off + i;
-        let x0 = buf[p + 2 - t1];
-        let f = window[i] * window[i];
-        let a = 1.0 - f;
-        buf[p] = buf[p]
-            + a * g00 * buf[p - t0]
-            + a * g01 * (buf[p + 1 - t0] + buf[p - t0 - 1])
-            + a * g02 * (buf[p + 2 - t0] + buf[p - t0 - 2])
-            + f * g10 * x2
-            + f * g11 * (x1 + x3)
-            + f * g12 * (x0 + x4);
-        x4 = x3;
-        x3 = x2;
-        x2 = x1;
-        x1 = x0;
-        i += 1;
-    }
-    if g1 == 0.0 {
-        return;
-    }
-    // Constant filter for the rest of the block.
-    let t = t1;
-    for i in overlap..n {
-        let p = off + i;
-        buf[p] = buf[p] + g10 * buf[p - t] + g11 * (buf[p + 1 - t] + buf[p - t - 1]) + g12 * (buf[p + 2 - t] + buf[p - t - 2]);
-    }
-}

crates/opus/src/celt/energy.rs

@@ -1,171 +0,0 @@
-//! Band energy decoding: Laplace-coded coarse energy, fine energy and the final refinement
-//! (RFC 6716 §4.3.2).
-
-use super::rate::MAX_FINE_BITS;
-use super::tables::{BETA_COEF, BETA_INTRA, E_PROB_MODEL, NB_EBANDS, PRED_COEF, SMALL_ENERGY_ICDF};
-use crate::range::RangeDecoder;
-
-const LAPLACE_MINP: u32 = 1;
-const LAPLACE_NMIN: u32 = 16;
-
-fn laplace_get_freq1(fs0: u32, decay: u32) -> u32 {
-    let ft = 32768 - LAPLACE_MINP * (2 * LAPLACE_NMIN) - fs0;
-    (ft * (16384 - decay)) >> 15
-}
-
-/// Decodes a Laplace-distributed integer (`fs` = probability of 0 in Q15, `decay` in Q14).
-pub fn laplace_decode(dec: &mut RangeDecoder, mut fs: u32, decay: u32) -> i32 {
-    let mut val = 0i32;
-    let fm = dec.decode_bin(15);
-    let mut fl = 0u32;
-    if fm >= fs {
-        val += 1;
-        fl = fs;
-        fs = laplace_get_freq1(fs, decay) + LAPLACE_MINP;
-        while fs > LAPLACE_MINP && fm >= fl + 2 * fs {
-            fs *= 2;
-            fl += fs;
-            fs = (((fs - 2 * LAPLACE_MINP) * decay) >> 15) + LAPLACE_MINP;
-            val += 1;
-        }
-        if fs <= LAPLACE_MINP {
-            let di = (fm - fl) >> 1;
-            val += di as i32;
-            fl += 2 * di * LAPLACE_MINP;
-        }
-        if fm < fl + fs {
-            val = -val;
-        } else {
-            fl += fs;
-        }
-    }
-    dec.update_bin(fl, (fl + fs).min(32768), 15);
-    val
-}
-
-/// `unquant_coarse_energy`.
-#[allow(clippy::too_many_arguments)]
-pub fn unquant_coarse_energy(start: usize, end: usize, old_e: &mut [f32], intra: bool, dec: &mut RangeDecoder, c: usize, lm: usize) {
-    let prob = &E_PROB_MODEL[lm][intra as usize];
-    let (coef, beta) = if intra { (0.0, BETA_INTRA) } else { (PRED_COEF[lm], BETA_COEF[lm]) };
-    let budget = dec.storage() as i32 * 8;
-    let mut prev = [0f32; 2];
-    for i in start..end {
-        for ch in 0..c {
-            let tell = dec.tell();
-            let qi = if budget - tell >= 15 {
-                let pi = 2 * i.min(20);
-                laplace_decode(dec, (prob[pi] as u32) << 7, (prob[pi + 1] as u32) << 6)
-            } else if budget - tell >= 2 {
-                let q = dec.icdf(&SMALL_ENERGY_ICDF, 2) as i32;
-                (q >> 1) ^ -(q & 1)
-            } else if budget - tell >= 1 {
-                -(dec.bit_logp(1) as i32)
-            } else {
-                -1
-            };
-            let q = qi as f32;
-            let idx = i + ch * NB_EBANDS;
-            old_e[idx] = old_e[idx].max(-9.0);
-            let tmp = coef * old_e[idx] + prev[ch] + q;
-            old_e[idx] = tmp;
-            prev[ch] = prev[ch] + q - beta * q;
-        }
-    }
-}
-
-pub fn unquant_fine_energy(start: usize, end: usize, old_e: &mut [f32], fine_quant: &[i32; NB_EBANDS], dec: &mut RangeDecoder, c: usize) {
-    for i in start..end {
-        let fq = fine_quant[i];
-        if fq <= 0 {
-            continue;
-        }
-        for ch in 0..c {
-            let q2 = dec.bits(fq as u32);
-            let offset = (q2 as f32 + 0.5) * (1 << (14 - fq)) as f32 / 16384.0 - 0.5;
-            old_e[i + ch * NB_EBANDS] += offset;
-        }
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-pub fn unquant_energy_finalise(
-    start: usize,
-    end: usize,
-    old_e: &mut [f32],
-    fine_quant: &[i32; NB_EBANDS],
-    fine_priority: &[i32; NB_EBANDS],
-    mut bits_left: i32,
-    dec: &mut RangeDecoder,
-    c: usize,
-) {
-    for prio in 0..2 {
-        let mut i = start;
-        while i < end && bits_left >= c as i32 {
-            if fine_quant[i] >= MAX_FINE_BITS || fine_priority[i] != prio {
-                i += 1;
-                continue;
-            }
-            for ch in 0..c {
-                let q2 = dec.bits(1);
-                let offset = (q2 as f32 - 0.5) * (1 << (14 - fine_quant[i] - 1)) as f32 / 16384.0;
-                old_e[i + ch * NB_EBANDS] += offset;
-                bits_left -= 1;
-            }
-            i += 1;
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::range::enc::RangeEncoder;
-
-    fn laplace_encode(e: &mut RangeEncoder, value: i32, mut fs: u32, decay: u32) {
-        let mut fl = 0u32;
-        let mut val = value;
-        if val != 0 {
-            let s: i32 = if val < 0 { -1 } else { 0 };
-            val = val.abs();
-            fl = fs;
-            fs = laplace_get_freq1(fs, decay);
-            let mut i = 1;
-            while fs > 0 && i < val {
-                fs *= 2;
-                fl += fs + 2 * LAPLACE_MINP;
-                fs = (fs * decay) >> 15;
-                i += 1;
-            }
-            if fs == 0 {
-                let ndi_max = (32768 - fl + LAPLACE_MINP - 1) as i32;
-                let ndi_max = (ndi_max - s) >> 1;
-                let di = (val - i).min(ndi_max - 1);
-                fl = (fl as i32 + (2 * di + 1 + s) * LAPLACE_MINP as i32) as u32;
-                fs = LAPLACE_MINP.min(32768 - fl);
-            } else {
-                fs += LAPLACE_MINP;
-                if s == 0 {
-                    fl += fs;
-                }
-            }
-        }
-        e.encode(fl, fl + fs, 32768);
-    }
-
-    #[test]
-    fn laplace_roundtrip() {
-        for &(fs, decay) in &[(72u32 << 7, 127u32 << 6), (24 << 7, 179 << 6), (177 << 7, 11 << 6)] {
-            let vals: Vec<i32> = (-12..=12).collect();
-            let mut e = RangeEncoder::new(400);
-            for &v in &vals {
-                laplace_encode(&mut e, v, fs, decay);
-            }
-            let buf = e.done();
-            let mut d = RangeDecoder::new(&buf);
-            for &v in &vals {
-                assert_eq!(laplace_decode(&mut d, fs, decay), v, "fs={fs} v={v}");
-            }
-        }
-    }
-}

crates/opus/src/celt/mdct.rs

@@ -1,205 +0,0 @@
-//! Inverse MDCT with the low-overlap window and in-place TDAC (RFC 6716 §4.3.7).
-//!
-//! The IMDCT is computed through an N/4-point complex FFT (pre-rotation, FFT, post-rotation),
-//! producing the N/2 "folded" time samples; the window overlap region is then unfolded against the
-//! folded tail of the previous block, which the caller keeps in place in the output buffer.
-
-#[derive(Clone, Copy, Default, Debug)]
-pub struct Cpx {
-    pub re: f32,
-    pub im: f32,
-}
-
-impl Cpx {
-    #[inline]
-    fn mul(self, o: Cpx) -> Cpx {
-        Cpx { re: self.re * o.re - self.im * o.im, im: self.re * o.im + self.im * o.re }
-    }
-    #[inline]
-    fn add(self, o: Cpx) -> Cpx {
-        Cpx { re: self.re + o.re, im: self.im + o.im }
-    }
-}
-
-/// Mixed-radix (2, 3, 4, 5) forward complex FFT, unscaled.
-pub struct Fft {
-    n: usize,
-    factors: Vec<usize>,
-    twiddle: Vec<Cpx>,
-}
-
-impl Fft {
-    pub fn new(n: usize) -> Fft {
-        let mut factors = Vec::new();
-        let mut m = n;
-        for p in [4usize, 2, 3, 5] {
-            while m.is_multiple_of(p) {
-                factors.push(p);
-                m /= p;
-            }
-        }
-        assert_eq!(m, 1, "unsupported FFT size {n}");
-        let twiddle = (0..n)
-            .map(|k| {
-                let ph = -2.0 * std::f64::consts::PI * k as f64 / n as f64;
-                Cpx { re: ph.cos() as f32, im: ph.sin() as f32 }
-            })
-            .collect();
-        Fft { n, factors, twiddle }
-    }
-
-    pub fn process(&self, data: &mut [Cpx], scratch: &mut Vec<Cpx>) {
-        scratch.clear();
-        scratch.extend_from_slice(&data[..self.n]);
-        self.rec(&mut data[..self.n], scratch, 1, self.n, 0, 1);
-    }
-
-    fn rec(&self, out: &mut [Cpx], inp: &[Cpx], in_stride: usize, n: usize, fi: usize, tw_stride: usize) {
-        let p = self.factors[fi];
-        let m = n / p;
-        if m == 1 {
-            for (i, o) in out.iter_mut().enumerate().take(p) {
-                *o = inp[i * in_stride];
-            }
-        } else {
-            for q in 0..p {
-                self.rec(&mut out[q * m..(q + 1) * m], &inp[q * in_stride..], in_stride * p, m, fi + 1, tw_stride * p);
-            }
-        }
-        let big = self.n;
-        let mut t = [Cpx::default(); 5];
-        for k in 0..m {
-            for q in 0..p {
-                let w = self.twiddle[(q * k * tw_stride) % big];
-                t[q] = out[q * m + k].mul(w);
-            }
-            for q2 in 0..p {
-                let mut acc = Cpx::default();
-                for (q, tq) in t.iter().enumerate().take(p) {
-                    let w = self.twiddle[((q * q2) % p) * (big / p)];
-                    acc = acc.add(tq.mul(w));
-                }
-                out[q2 * m + k] = acc;
-            }
-        }
-    }
-}
-
-pub struct Imdct {
-    /// Full MDCT length (2x the number of coefficients).
-    n: usize,
-    trig: Vec<f32>,
-    fft: Fft,
-}
-
-impl Imdct {
-    pub fn new(n: usize) -> Imdct {
-        let trig = (0..n / 2).map(|i| (2.0 * std::f64::consts::PI * (i as f64 + 0.125) / n as f64).cos() as f32).collect();
-        Imdct { n, trig, fft: Fft::new(n / 4) }
-    }
-
-    /// Inverse transform of `n/2` coefficients read from `input` at `stride`.
-    ///
-    /// Writes the folded block to `out[overlap/2 .. overlap/2 + n/2]` and unfolds the first
-    /// `overlap` samples against the previous block's folded tail already stored in
-    /// `out[0 .. overlap/2]`.
-    pub fn backward(&self, input: &[f32], stride: usize, out: &mut [f32], window: &[f32], overlap: usize, work: &mut ImdctScratch) {
-        let n2 = self.n >> 1;
-        let n4 = self.n >> 2;
-        let t = &self.trig;
-        let z = &mut work.z;
-        z.clear();
-        for i in 0..n4 {
-            let x1 = input[2 * i * stride];
-            let x2 = input[stride * (n2 - 1 - 2 * i)];
-            let yr = x2 * t[i] + x1 * t[n4 + i];
-            let yi = x1 * t[i] - x2 * t[n4 + i];
-            z.push(Cpx { re: yi, im: yr });
-        }
-        self.fft.process(z, &mut work.scratch);
-        let base = overlap >> 1;
-        let y = &mut out[base..base + n2];
-        for i in 0..n4.div_ceil(2) {
-            let front = z[i];
-            let back = z[n4 - 1 - i];
-            let (re, im) = (front.im, front.re);
-            let (t0, t1) = (t[i], t[n4 + i]);
-            let yr0 = re * t0 + im * t1;
-            let yi0 = re * t1 - im * t0;
-            let (re, im) = (back.im, back.re);
-            let (t0, t1) = (t[n4 - i - 1], t[n2 - i - 1]);
-            let yr1 = re * t0 + im * t1;
-            let yi1 = re * t1 - im * t0;
-            y[2 * i] = yr0;
-            y[n2 - 1 - 2 * i] = yi0;
-            y[n2 - 2 - 2 * i] = yr1;
-            y[2 * i + 1] = yi1;
-        }
-        // Mirror on both sides for TDAC.
-        for i in 0..overlap / 2 {
-            let x1 = out[overlap - 1 - i];
-            let x2 = out[i];
-            let w1 = window[i];
-            let w2 = window[overlap - 1 - i];
-            out[i] = x2 * w2 - x1 * w1;
-            out[overlap - 1 - i] = x2 * w1 + x1 * w2;
-        }
-    }
-}
-
-#[derive(Default)]
-pub struct ImdctScratch {
-    z: Vec<Cpx>,
-    scratch: Vec<Cpx>,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn fft_matches_dft() {
-        for &n in &[60usize, 120, 240, 480] {
-            let fft = Fft::new(n);
-            let x: Vec<Cpx> = (0..n).map(|i| Cpx { re: ((i * 7) % 13) as f32 - 6.0, im: ((i * 3) % 5) as f32 - 2.0 }).collect();
-            let mut y = x.clone();
-            fft.process(&mut y, &mut Vec::new());
-            for k in [0, 1, 7, n / 2, n - 1] {
-                let mut acc = (0f64, 0f64);
-                for (i, v) in x.iter().enumerate() {
-                    let ph = -2.0 * std::f64::consts::PI * (i * k) as f64 / n as f64;
-                    acc.0 += v.re as f64 * ph.cos() - v.im as f64 * ph.sin();
-                    acc.1 += v.re as f64 * ph.sin() + v.im as f64 * ph.cos();
-                }
-                assert!((acc.0 - y[k].re as f64).abs() < 1e-2 && (acc.1 - y[k].im as f64).abs() < 1e-2, "n={n} k={k}");
-            }
-        }
-    }
-
-    /// The folded output must equal the direct IMDCT formula folded by TDAC symmetry.
-    #[test]
-    fn imdct_matches_direct_formula() {
-        let n = 240;
-        let n2 = n / 2;
-        let im = Imdct::new(n);
-        let x: Vec<f32> = (0..n2).map(|k| ((k * 37 % 11) as f32 - 5.0) / 5.0).collect();
-        let overlap = 0;
-        let mut out = vec![0f32; n2];
-        im.backward(&x, 1, &mut out, &[], overlap, &mut ImdctScratch::default());
-        // Direct IMDCT y[t] = sum X[k] cos(2pi/N (t + 1/2 + N/4)(k + 1/2)), t in 0..N.
-        let y: Vec<f64> = (0..n)
-            .map(|t| {
-                (0..n2)
-                    .map(|k| x[k] as f64 * (2.0 * std::f64::consts::PI / n as f64 * (t as f64 + 0.5 + n as f64 / 4.0) * (k as f64 + 0.5)).cos())
-                    .sum()
-            })
-            .collect();
-        // The folded half: out[i] relates to y in the middle half; check proportionality.
-        let mid: Vec<f64> = (0..n2).map(|i| y[n / 4 + i]).collect();
-        let dot: f64 = mid.iter().zip(&out).map(|(a, b)| a * *b as f64).sum();
-        let ea: f64 = mid.iter().map(|a| a * a).sum();
-        let eb: f64 = out.iter().map(|b| (*b as f64).powi(2)).sum();
-        let corr = dot.abs() / (ea.sqrt() * eb.sqrt());
-        assert!(corr > 0.999, "corr {corr}");
-    }
-}

crates/opus/src/celt/rate.rs

@@ -1,584 +0,0 @@
-//! Pulse cache and bit allocation (RFC 6716 §4.3.3, §4.3.4.1).
-
-use super::tables::{ALLOC, EBANDS, LOG2_FRAC_TABLE, MAX_LM, NB_EBANDS, OVERLAP};
-use crate::range::{BITRES, RangeDecoder};
-
-const MAX_PSEUDO: i32 = 40;
-const LOG_MAX_PSEUDO: i32 = 6;
-pub const MAX_FINE_BITS: i32 = 8;
-const FINE_OFFSET: i32 = 21;
-pub const QTHETA_OFFSET: i32 = 4;
-pub const QTHETA_OFFSET_TWOPHASE: i32 = 16;
-const ALLOC_STEPS: i32 = 6;
-
-/// Number of pulses represented by pseudo-pulse index `i`.
-pub fn get_pulses(i: i32) -> i32 {
-    if i < 8 { i } else { (8 + (i & 7)) << ((i >> 3) - 1) }
-}
-
-/// Conservative (rounded up) log2 of `val` with `frac` fractional bits.
-pub fn log2_frac(mut val: u32, mut frac: u32) -> i32 {
-    let mut l = crate::range::ilog(val);
-    if val & val.wrapping_sub(1) != 0 {
-        if l > 16 {
-            val = ((val - 1) >> (l - 16)) + 1;
-        } else {
-            val <<= 16 - l;
-        }
-        let mut l = (l - 1) << frac;
-        loop {
-            let b = (val >> 16) as i32;
-            l += b << frac;
-            val = (val + b as u32) >> b;
-            val = (val * val + 0x7FFF) >> 15;
-            if frac == 0 {
-                break;
-            }
-            frac -= 1;
-        }
-        l + (val > 0x8000) as i32
-    } else {
-        l -= 1;
-        l << frac
-    }
-}
-
-/// PVQ codebook size V(N, K) as u128 (saturating far above 2^32).
-pub fn pvq_v(n: usize, k: usize) -> u128 {
-    // V(N,K) = V(N-1,K) + V(N,K-1) + V(N-1,K-1); computed row by row.
-    if k == 0 {
-        return 1;
-    }
-    if n == 0 {
-        return 0;
-    }
-    let mut row = vec![0u128; k + 1]; // V(0, k)
-    row[0] = 1;
-    for _ in 0..n {
-        let mut prev_diag = row[0]; // V(n-1, 0)
-        // V(n, 0) = 1
-        for kk in 1..=k {
-            let up = row[kk]; // V(n-1, kk)
-            let v = up.saturating_add(row[kk - 1]).saturating_add(prev_diag);
-            prev_diag = up;
-            row[kk] = v.min(u128::MAX >> 8);
-        }
-        row[0] = 1;
-    }
-    row[k]
-}
-
-fn fits_in32(n: usize, k: i32) -> bool {
-    pvq_v(n, k as usize) <= u32::MAX as u128
-}
-
-/// Precomputed per-mode data shared by all CELT decoders.
-pub struct Mode {
-    /// log2 of band width in 1/8 bits.
-    pub log_n: [i32; NB_EBANDS],
-    /// Index into `cache_bits` for `(LM+1)*NB_EBANDS + band` (-1 when unused).
-    pub cache_index: Vec<i16>,
-    /// `cache[0]` = max pseudo-pulses; `cache[k]` = bits(k) - 1 in 1/8 bits.
-    pub cache_bits: Vec<u8>,
-    /// Per-band maximum allocation: `[(2*LM + C-1)*NB_EBANDS + band]`.
-    pub caps: Vec<u8>,
-    pub window: [f32; OVERLAP],
-    pub mdct: [super::mdct::Imdct; MAX_LM + 1],
-}
-
-impl Mode {
-    pub fn new() -> Mode {
-        let mut log_n = [0i32; NB_EBANDS];
-        for (i, l) in log_n.iter_mut().enumerate() {
-            *l = log2_frac((EBANDS[i + 1] - EBANDS[i]) as u32, BITRES);
-        }
-        let (cache_index, cache_bits) = compute_pulse_cache(MAX_LM as i32);
-        let mut m = Mode {
-            log_n,
-            cache_index,
-            cache_bits,
-            caps: Vec::new(),
-            window: [0.0; OVERLAP],
-            mdct: [super::mdct::Imdct::new(1920), super::mdct::Imdct::new(960), super::mdct::Imdct::new(480), super::mdct::Imdct::new(240)],
-        };
-        m.caps = compute_caps(&m);
-        for i in 0..OVERLAP {
-            let x = std::f64::consts::FRAC_PI_2 * (i as f64 + 0.5) / OVERLAP as f64;
-            let s = x.sin();
-            m.window[i] = (std::f64::consts::FRAC_PI_2 * s * s).sin() as f32;
-        }
-        m
-    }
-
-    #[inline]
-    pub fn cache(&self, lm: i32, band: usize) -> &[u8] {
-        let idx = self.cache_index[((lm + 1) as usize) * NB_EBANDS + band];
-        &self.cache_bits[idx.max(0) as usize..]
-    }
-
-    pub fn bits2pulses(&self, band: usize, lm: i32, bits: i32) -> i32 {
-        let cache = self.cache(lm, band);
-        let mut lo = 0i32;
-        let mut hi = cache[0] as i32;
-        let bits = bits - 1;
-        for _ in 0..LOG_MAX_PSEUDO {
-            let mid = (lo + hi + 1) >> 1;
-            if cache[mid as usize] as i32 >= bits {
-                hi = mid;
-            } else {
-                lo = mid;
-            }
-        }
-        let lo_bits = if lo == 0 { -1 } else { cache[lo as usize] as i32 };
-        if bits - lo_bits <= cache[hi as usize] as i32 - bits { lo } else { hi }
-    }
-
-    pub fn pulses2bits(&self, band: usize, lm: i32, pulses: i32) -> i32 {
-        if pulses == 0 { 0 } else { self.cache(lm, band)[pulses as usize] as i32 + 1 }
-    }
-
-    /// Per-band allocation caps for this frame (`init_caps`).
-    pub fn init_caps(&self, lm: usize, c: usize) -> [i32; NB_EBANDS] {
-        let mut cap = [0i32; NB_EBANDS];
-        for (i, cp) in cap.iter_mut().enumerate() {
-            let n = (EBANDS[i + 1] - EBANDS[i]) << lm;
-            *cp = (self.caps[NB_EBANDS * (2 * lm + c - 1) + i] as i32 + 64) * c as i32 * n >> 2;
-        }
-        cap
-    }
-}
-
-fn compute_pulse_cache(lm_max: i32) -> (Vec<i16>, Vec<u8>) {
-    let nb = NB_EBANDS;
-    let rows = (lm_max + 2) as usize;
-    let mut index = vec![-1i16; nb * rows];
-    let mut entries: Vec<(usize, i32, usize)> = Vec::new(); // (N, K, offset)
-    let mut curr = 0usize;
-    for i in 0..rows {
-        for j in 0..nb {
-            let n = (((EBANDS[j + 1] - EBANDS[j]) << i) >> 1) as usize;
-            index[i * nb + j] = -1;
-            // Reuse the entry of an earlier band with the same size.
-            'search: for k in 0..=i {
-                for nn in 0..nb {
-                    if k == i && nn >= j {
-                        break;
-                    }
-                    if n == (((EBANDS[nn + 1] - EBANDS[nn]) << k) >> 1) as usize {
-                        index[i * nb + j] = index[k * nb + nn];
-                        break 'search;
-                    }
-                }
-            }
-            if index[i * nb + j] == -1 && n != 0 {
-                let mut k = 0;
-                while k < MAX_PSEUDO && fits_in32(n, get_pulses(k + 1)) {
-                    k += 1;
-                }
-                index[i * nb + j] = curr as i16;
-                entries.push((n, k, curr));
-                curr += (k + 1) as usize;
-            }
-        }
-    }
-    let mut bits = vec![0u8; curr];
-    for &(n, k, off) in &entries {
-        let maxk = get_pulses(k) as usize;
-        let tmp = required_bits(n, maxk, BITRES);
-        for j in 1..=k {
-            bits[off + j as usize] = (tmp[get_pulses(j) as usize] - 1) as u8;
-        }
-        bits[off] = k as u8;
-    }
-    (index, bits)
-}
-
-/// Bits (1/2^frac units, rounded up) needed for each K in `0..=maxk` for dimension `n`.
-fn required_bits(n: usize, maxk: usize, frac: u32) -> Vec<i32> {
-    let mut out = vec![0i32; maxk + 1];
-    if n == 1 {
-        for o in out.iter_mut().skip(1) {
-            *o = 1 << frac;
-        }
-    } else {
-        for (k, o) in out.iter_mut().enumerate().skip(1) {
-            let v = pvq_v(n, k);
-            *o = log2_frac(v as u32, frac);
-        }
-    }
-    out
-}
-
-fn compute_caps(m: &Mode) -> Vec<u8> {
-    let nb = NB_EBANDS;
-    let mut caps = vec![0u8; (MAX_LM + 1) * 2 * nb];
-    for i in 0..=MAX_LM as i32 {
-        for c in 1..=2i32 {
-            for j in 0..nb {
-                let mut n0 = EBANDS[j + 1] - EBANDS[j];
-                let max_bits = if n0 << i == 1 {
-                    c * (1 + MAX_FINE_BITS) << BITRES
-                } else {
-                    let mut lm0 = 0;
-                    if n0 > 2 {
-                        n0 >>= 1;
-                        lm0 -= 1;
-                    } else if n0 <= 1 {
-                        lm0 = i.min(1);
-                        n0 <<= lm0;
-                    }
-                    let pcache = m.cache(lm0, j);
-                    let mut mb = pcache[pcache[0] as usize] as i32 + 1;
-                    let mut n = n0;
-                    for k in 0..(i - lm0) {
-                        mb <<= 1;
-                        let offset = ((m.log_n[j] + ((lm0 + k) << BITRES)) >> 1) - QTHETA_OFFSET;
-                        let num = 459 * ((2 * n - 1) * offset + mb);
-                        let den = ((2 * n - 1) << 9) - 459;
-                        let qb = ((num + (den >> 1)) / den).min(57);
-                        mb += qb;
-                        n <<= 1;
-                    }
-                    if c == 2 {
-                        mb <<= 1;
-                        let offset = ((m.log_n[j] + (i << BITRES)) >> 1) - if n == 2 { QTHETA_OFFSET_TWOPHASE } else { QTHETA_OFFSET };
-                        let ndof = 2 * n - 1 - (n == 2) as i32;
-                        let p = if n == 2 { 512 } else { 487 };
-                        let num = p * (mb + ndof * offset);
-                        let den = (ndof << 9) - p;
-                        let qb = ((num + (den >> 1)) / den).min(if n == 2 { 64 } else { 61 });
-                        mb += qb;
-                    }
-                    let ndof = c * n + if c == 2 && n > 2 { 1 } else { 0 };
-                    let mut offset = ((m.log_n[j] + (i << BITRES)) >> 1) - FINE_OFFSET;
-                    if n == 2 {
-                        offset += (1 << BITRES) >> 2;
-                    }
-                    let num = mb + ndof * offset;
-                    let den = (ndof - 1) << BITRES;
-                    let qb = ((num + (den >> 1)) / den).min(MAX_FINE_BITS);
-                    mb += c * qb << BITRES;
-                    mb
-                };
-                let w = c * ((EBANDS[j + 1] - EBANDS[j]) << i);
-                let v = (4 * max_bits / w) - 64;
-                caps[((i * 2 + c - 1) as usize) * nb + j] = v.clamp(0, 255) as u8;
-            }
-        }
-    }
-    caps
-}
-
-/// Result of the allocation process.
-pub struct Allocation {
-    pub coded_bands: usize,
-    pub intensity: usize,
-    pub dual_stereo: bool,
-    pub balance: i32,
-    pub pulses: [i32; NB_EBANDS],
-    pub fine_quant: [i32; NB_EBANDS],
-    pub fine_priority: [i32; NB_EBANDS],
-}
-
-/// `clt_compute_allocation` (decoder side).
-#[allow(clippy::too_many_arguments)]
-pub fn compute_allocation(
-    m: &Mode,
-    start: usize,
-    end: usize,
-    offsets: &[i32; NB_EBANDS],
-    cap: &[i32; NB_EBANDS],
-    alloc_trim: i32,
-    total: i32,
-    c: usize,
-    lm: usize,
-    dec: &mut RangeDecoder,
-) -> Allocation {
-    let ci = c as i32;
-    let lmi = lm as i32;
-    let mut total = total.max(0);
-    let mut skip_start = start;
-    let skip_rsv = if total >= 1 << BITRES { 1 << BITRES } else { 0 };
-    total -= skip_rsv;
-    let mut intensity_rsv = 0;
-    let mut dual_stereo_rsv = 0;
-    if c == 2 {
-        intensity_rsv = LOG2_FRAC_TABLE[end - start];
-        if intensity_rsv > total {
-            intensity_rsv = 0;
-        } else {
-            total -= intensity_rsv;
-            dual_stereo_rsv = if total >= 1 << BITRES { 1 << BITRES } else { 0 };
-            total -= dual_stereo_rsv;
-        }
-    }
-    let mut bits1 = [0i32; NB_EBANDS];
-    let mut bits2 = [0i32; NB_EBANDS];
-    let mut thresh = [0i32; NB_EBANDS];
-    let mut trim_offset = [0i32; NB_EBANDS];
-    for j in start..end {
-        let w = EBANDS[j + 1] - EBANDS[j];
-        thresh[j] = (ci << BITRES).max((3 * w << lmi << BITRES) >> 4);
-        trim_offset[j] = ci * w * (alloc_trim - 5 - lmi) * (end as i32 - j as i32 - 1) * (1 << (lmi + BITRES as i32)) >> 6;
-        if w << lmi == 1 {
-            trim_offset[j] -= ci << BITRES;
-        }
-    }
-    let nb_alloc = ALLOC.len() as i32;
-    let mut lo = 1;
-    let mut hi = nb_alloc - 1;
-    loop {
-        let mut done = false;
-        let mut psum = 0;
-        let mid = (lo + hi) >> 1;
-        for j in (start..end).rev() {
-            let n = EBANDS[j + 1] - EBANDS[j];
-            let mut bitsj = ci * n * (ALLOC[mid as usize][j] as i32) << lmi >> 2;
-            if bitsj > 0 {
-                bitsj = (bitsj + trim_offset[j]).max(0);
-            }
-            bitsj += offsets[j];
-            if bitsj >= thresh[j] || done {
-                done = true;
-                psum += bitsj.min(cap[j]);
-            } else if bitsj >= ci << BITRES {
-                psum += ci << BITRES;
-            }
-        }
-        if psum > total {
-            hi = mid - 1;
-        } else {
-            lo = mid + 1;
-        }
-        if lo > hi {
-            break;
-        }
-    }
-    hi = lo;
-    lo -= 1;
-    for j in start..end {
-        let n = EBANDS[j + 1] - EBANDS[j];
-        let mut bits1j = ci * n * (ALLOC[lo as usize][j] as i32) << lmi >> 2;
-        let mut bits2j = if hi >= nb_alloc { cap[j] } else { ci * n * (ALLOC[hi as usize][j] as i32) << lmi >> 2 };
-        if bits1j > 0 {
-            bits1j = (bits1j + trim_offset[j]).max(0);
-        }
-        if bits2j > 0 {
-            bits2j = (bits2j + trim_offset[j]).max(0);
-        }
-        if lo > 0 {
-            bits1j += offsets[j];
-        }
-        bits2j += offsets[j];
-        if offsets[j] > 0 {
-            skip_start = j;
-        }
-        bits2j = (bits2j - bits1j).max(0);
-        bits1[j] = bits1j;
-        bits2[j] = bits2j;
-    }
-    interp_bits2pulses(m, start, end, skip_start, &bits1, &bits2, &thresh, cap, total, skip_rsv, intensity_rsv, dual_stereo_rsv, c, lm, dec)
-}
-
-#[allow(clippy::too_many_arguments)]
-fn interp_bits2pulses(
-    m: &Mode,
-    start: usize,
-    end: usize,
-    skip_start: usize,
-    bits1: &[i32; NB_EBANDS],
-    bits2: &[i32; NB_EBANDS],
-    thresh: &[i32; NB_EBANDS],
-    cap: &[i32; NB_EBANDS],
-    mut total: i32,
-    skip_rsv: i32,
-    mut intensity_rsv: i32,
-    mut dual_stereo_rsv: i32,
-    c: usize,
-    lm: usize,
-    dec: &mut RangeDecoder,
-) -> Allocation {
-    let ci = c as i32;
-    let alloc_floor = ci << BITRES;
-    let stereo = (c > 1) as i32;
-    let log_m = (lm as i32) << BITRES;
-    let mut lo = 0;
-    let mut hi = 1 << ALLOC_STEPS;
-    for _ in 0..ALLOC_STEPS {
-        let mid = (lo + hi) >> 1;
-        let mut psum = 0;
-        let mut done = false;
-        for j in (start..end).rev() {
-            let tmp = bits1[j] + (mid * bits2[j] >> ALLOC_STEPS);
-            if tmp >= thresh[j] || done {
-                done = true;
-                psum += tmp.min(cap[j]);
-            } else if tmp >= alloc_floor {
-                psum += alloc_floor;
-            }
-        }
-        if psum > total {
-            hi = mid;
-        } else {
-            lo = mid;
-        }
-    }
-    let mut bits = [0i32; NB_EBANDS];
-    let mut psum = 0;
-    let mut done = false;
-    for j in (start..end).rev() {
-        let mut tmp = bits1[j] + (lo * bits2[j] >> ALLOC_STEPS);
-        if tmp < thresh[j] && !done {
-            tmp = if tmp >= alloc_floor { alloc_floor } else { 0 };
-        } else {
-            done = true;
-        }
-        tmp = tmp.min(cap[j]);
-        bits[j] = tmp;
-        psum += tmp;
-    }
-    let s = start;
-    let mut coded_bands = end;
-    loop {
-        let j = coded_bands - 1;
-        if j <= skip_start {
-            total += skip_rsv;
-            break;
-        }
-        let mut left = total - psum;
-        let span = EBANDS[coded_bands] - EBANDS[s];
-        let percoeff = left / span;
-        left -= span * percoeff;
-        let rem = (left - (EBANDS[j] - EBANDS[s])).max(0);
-        let band_width = EBANDS[coded_bands] - EBANDS[j];
-        let mut band_bits = bits[j] + percoeff * band_width + rem;
-        if band_bits >= thresh[j].max(alloc_floor + (1 << BITRES)) {
-            if dec.bit_logp(1) {
-                break;
-            }
-            psum += 1 << BITRES;
-            band_bits -= 1 << BITRES;
-        }
-        psum -= bits[j] + intensity_rsv;
-        if intensity_rsv > 0 {
-            intensity_rsv = LOG2_FRAC_TABLE[j - s];
-        }
-        psum += intensity_rsv;
-        if band_bits >= alloc_floor {
-            psum += alloc_floor;
-            bits[j] = alloc_floor;
-        } else {
-            bits[j] = 0;
-        }
-        coded_bands -= 1;
-    }
-    let intensity = if intensity_rsv > 0 { s + dec.uint((coded_bands + 1 - s) as u32) as usize } else { 0 };
-    if intensity <= s {
-        total += dual_stereo_rsv;
-        dual_stereo_rsv = 0;
-    }
-    let dual_stereo = if dual_stereo_rsv > 0 { dec.bit_logp(1) } else { false };
-    let mut left = total - psum;
-    let span = EBANDS[coded_bands] - EBANDS[s];
-    let percoeff = left / span;
-    left -= span * percoeff;
-    for j in s..coded_bands {
-        bits[j] += percoeff * (EBANDS[j + 1] - EBANDS[j]);
-    }
-    for j in s..coded_bands {
-        let tmp = left.min(EBANDS[j + 1] - EBANDS[j]);
-        bits[j] += tmp;
-        left -= tmp;
-    }
-    let mut ebits = [0i32; NB_EBANDS];
-    let mut fine_priority = [0i32; NB_EBANDS];
-    let mut balance = 0;
-    for j in s..coded_bands {
-        let n0 = EBANDS[j + 1] - EBANDS[j];
-        let n = n0 << lm;
-        let bit = bits[j] + balance;
-        let mut excess;
-        if n > 1 {
-            excess = (bit - cap[j]).max(0);
-            bits[j] = bit - excess;
-            let den = ci * n + if c == 2 && n > 2 && !dual_stereo && j < intensity { 1 } else { 0 };
-            let nclogn = den * (m.log_n[j] + log_m);
-            let mut offset = (nclogn >> 1) - den * FINE_OFFSET;
-            if n == 2 {
-                offset += (den << BITRES) >> 2;
-            }
-            if bits[j] + offset < den * 2 << BITRES {
-                offset += nclogn >> 2;
-            } else if bits[j] + offset < den * 3 << BITRES {
-                offset += nclogn >> 3;
-            }
-            let mut eb = (bits[j] + offset + (den << (BITRES - 1))).max(0);
-            eb = (eb / den) >> BITRES;
-            if ci * eb > (bits[j] >> BITRES) {
-                eb = bits[j] >> stereo >> BITRES;
-            }
-            eb = eb.min(MAX_FINE_BITS);
-            ebits[j] = eb;
-            fine_priority[j] = (eb * (den << BITRES) >= bits[j] + offset) as i32;
-            bits[j] -= ci * eb << BITRES;
-        } else {
-            excess = (bit - (ci << BITRES)).max(0);
-            bits[j] = bit - excess;
-            ebits[j] = 0;
-            fine_priority[j] = 1;
-        }
-        if excess > 0 {
-            let extra_fine = (excess >> (stereo + BITRES as i32)).min(MAX_FINE_BITS - ebits[j]);
-            ebits[j] += extra_fine;
-            let extra_bits = extra_fine * ci << BITRES;
-            fine_priority[j] = (extra_bits >= excess - balance) as i32;
-            excess -= extra_bits;
-        }
-        balance = excess;
-    }
-    for j in coded_bands..end {
-        ebits[j] = bits[j] >> stereo >> BITRES;
-        bits[j] = 0;
-        fine_priority[j] = (ebits[j] < 1) as i32;
-    }
-    Allocation { coded_bands, intensity, dual_stereo, balance, pulses: bits, fine_quant: ebits, fine_priority }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn log2_frac_values() {
-        assert_eq!(log2_frac(1, 3), 0);
-        assert_eq!(log2_frac(2, 3), 8);
-        assert_eq!(log2_frac(4, 3), 16);
-        assert_eq!(log2_frac(6, 3), 21);
-        assert_eq!(log2_frac(18, 3), 34);
-        assert_eq!(log2_frac(22, 3), 36);
-    }
-
-    #[test]
-    fn pvq_counts() {
-        // V(N,1) = 2N, V(1,K) = 2 (K>0), V(2,K) = 4K.
-        assert_eq!(pvq_v(5, 1), 10);
-        assert_eq!(pvq_v(1, 7), 2);
-        assert_eq!(pvq_v(2, 9), 36);
-        assert_eq!(pvq_v(3, 2), 18);
-        assert_eq!(pvq_v(0, 0), 1);
-        assert_eq!(pvq_v(0, 3), 0);
-    }
-
-    #[test]
-    fn caps_match_reference_shape() {
-        let m = Mode::new();
-        // 1-bin bands at LM=0 (mono and stereo) are capped at 224.
-        assert!(m.caps[..8].iter().all(|&c| c == 224));
-        assert!(m.caps[21..29].iter().all(|&c| c == 224));
-        let first_rows: [u8; 42] = [
-            224, 224, 224, 224, 224, 224, 224, 224, 160, 160, 160, 160, 185, 185, 185, 178, 178, 168, 134, 61, 37, 224, 224, 224, 224, 224, 224, 224,
-            224, 240, 240, 240, 240, 207, 207, 207, 198, 198, 183, 144, 66, 40,
-        ];
-        assert_eq!(&m.caps[..42], &first_rows[..]);
-    }
-}

crates/opus/src/celt/tables.rs

@@ -1,130 +0,0 @@
-//! Constant tables of the 48 kHz CELT mode (RFC 6716 §4.3).
-
-/// Number of energy bands.
-pub const NB_EBANDS: usize = 21;
-/// Band edges in units of 2.5 ms MDCT bins (Table 55).
-pub const EBANDS: [i32; NB_EBANDS + 1] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 12, 14, 16, 20, 24, 28, 34, 40, 48, 60, 78, 100];
-/// Overlap of the low-overlap window (samples at 48 kHz).
-pub const OVERLAP: usize = 120;
-/// Size of the shortest MDCT (2.5 ms).
-pub const SHORT_MDCT: usize = 120;
-/// Largest LM (20 ms frames).
-pub const MAX_LM: usize = 3;
-/// Pre-emphasis coefficient.
-pub const PREEMPH: f32 = 0.850_006_1;
-
-/// Static allocation table (Table 57), indexed `[quality][band]`, in 1/32 bit per MDCT bin.
-pub const ALLOC: [[u8; NB_EBANDS]; 11] = transpose([
-    [0, 90, 110, 118, 126, 134, 144, 152, 162, 172, 200],
-    [0, 80, 100, 110, 119, 127, 137, 145, 155, 165, 200],
-    [0, 75, 90, 103, 112, 120, 130, 138, 148, 158, 200],
-    [0, 69, 84, 93, 104, 114, 124, 132, 142, 152, 200],
-    [0, 63, 78, 86, 95, 103, 113, 123, 133, 143, 200],
-    [0, 56, 71, 80, 89, 97, 107, 117, 127, 137, 200],
-    [0, 49, 65, 75, 83, 91, 101, 111, 121, 131, 200],
-    [0, 40, 58, 70, 78, 85, 95, 105, 115, 125, 200],
-    [0, 34, 51, 65, 72, 78, 88, 98, 108, 118, 198],
-    [0, 29, 45, 59, 66, 72, 82, 92, 102, 112, 193],
-    [0, 20, 39, 53, 60, 66, 76, 86, 96, 106, 188],
-    [0, 18, 32, 47, 54, 60, 70, 80, 90, 100, 183],
-    [0, 10, 26, 40, 47, 54, 64, 74, 84, 94, 178],
-    [0, 0, 20, 31, 39, 47, 57, 67, 77, 87, 173],
-    [0, 0, 12, 23, 32, 41, 51, 61, 71, 81, 168],
-    [0, 0, 0, 15, 25, 35, 45, 55, 65, 75, 163],
-    [0, 0, 0, 4, 17, 29, 39, 49, 59, 69, 158],
-    [0, 0, 0, 0, 12, 23, 33, 43, 53, 63, 153],
-    [0, 0, 0, 0, 1, 16, 26, 36, 46, 56, 148],
-    [0, 0, 0, 0, 0, 10, 15, 20, 30, 45, 129],
-    [0, 0, 0, 0, 0, 1, 1, 1, 1, 20, 104],
-]);
-
-const fn transpose(t: [[u8; 11]; NB_EBANDS]) -> [[u8; NB_EBANDS]; 11] {
-    let mut out = [[0u8; NB_EBANDS]; 11];
-    let mut b = 0;
-    while b < NB_EBANDS {
-        let mut q = 0;
-        while q < 11 {
-            out[q][b] = t[b][q];
-            q += 1;
-        }
-        b += 1;
-    }
-    out
-}
-
-/// Mean band energy (log2 domain) removed before coarse quantisation.
-pub const E_MEANS: [f32; 25] = [
-    6.4375, 6.25, 5.75, 5.3125, 5.0625, 4.8125, 4.5, 4.375, 4.875, 4.6875, 4.5625, 4.4375, 4.875, 4.625, 4.3125, 4.5, 4.375, 4.625, 4.75, 4.4375,
-    3.75, 3.75, 3.75, 3.75, 3.75,
-];
-
-/// Inter-frame prediction coefficient (alpha) per LM, Q15.
-pub const PRED_COEF: [f32; 4] = [29440.0 / 32768.0, 26112.0 / 32768.0, 21248.0 / 32768.0, 16384.0 / 32768.0];
-/// Inter-band prediction coefficient (beta) per LM for inter frames, Q15.
-pub const BETA_COEF: [f32; 4] = [30147.0 / 32768.0, 22282.0 / 32768.0, 12124.0 / 32768.0, 6554.0 / 32768.0];
-/// Beta for intra frames.
-pub const BETA_INTRA: f32 = 4915.0 / 32768.0;
-
-/// Laplace model parameters for coarse energy: `[LM][intra][2*band + {0: prob, 1: decay}]`.
-pub const E_PROB_MODEL: [[[u8; 42]; 2]; 4] = [
-    [
-        [
-            72, 127, 65, 129, 66, 128, 65, 128, 64, 128, 62, 128, 64, 128, 64, 128, 92, 78, 92, 79, 92, 78, 90, 79, 116, 41, 115, 40, 114, 40, 132,
-            26, 132, 26, 145, 17, 161, 12, 176, 10, 177, 11,
-        ],
-        [
-            24, 179, 48, 138, 54, 135, 54, 132, 53, 134, 56, 133, 55, 132, 55, 132, 61, 114, 70, 96, 74, 88, 75, 88, 87, 74, 89, 66, 91, 67, 100, 59,
-            108, 50, 120, 40, 122, 37, 97, 43, 78, 50,
-        ],
-    ],
-    [
-        [
-            83, 78, 84, 81, 88, 75, 86, 74, 87, 71, 90, 73, 93, 74, 93, 74, 109, 40, 114, 36, 117, 34, 117, 34, 143, 17, 145, 18, 146, 19, 162, 12,
-            165, 10, 178, 7, 189, 6, 190, 8, 177, 9,
-        ],
-        [
-            23, 178, 54, 115, 63, 102, 66, 98, 69, 99, 74, 89, 71, 91, 73, 91, 78, 89, 86, 80, 92, 66, 93, 64, 102, 59, 103, 60, 104, 60, 117, 52,
-            123, 44, 138, 35, 133, 31, 97, 38, 77, 45,
-        ],
-    ],
-    [
-        [
-            61, 90, 93, 60, 105, 42, 107, 41, 110, 45, 116, 38, 113, 38, 112, 38, 124, 26, 132, 27, 136, 19, 140, 20, 155, 14, 159, 16, 158, 18, 170,
-            13, 177, 10, 187, 8, 192, 6, 175, 9, 159, 10,
-        ],
-        [
-            21, 178, 59, 110, 71, 86, 75, 85, 84, 83, 91, 66, 88, 73, 87, 72, 92, 75, 98, 72, 105, 58, 107, 54, 115, 52, 114, 55, 112, 56, 129, 51,
-            132, 40, 150, 33, 140, 29, 98, 35, 77, 42,
-        ],
-    ],
-    [
-        [
-            42, 121, 96, 66, 108, 43, 111, 40, 117, 44, 123, 32, 120, 36, 119, 33, 127, 33, 134, 34, 139, 21, 147, 23, 152, 20, 158, 25, 154, 26,
-            166, 21, 173, 16, 184, 13, 184, 10, 150, 13, 139, 15,
-        ],
-        [
-            22, 178, 63, 114, 74, 82, 84, 83, 92, 82, 103, 62, 96, 72, 96, 67, 101, 73, 107, 72, 113, 55, 118, 52, 125, 52, 118, 52, 117, 55, 135,
-            49, 137, 39, 157, 32, 145, 29, 97, 33, 77, 40,
-        ],
-    ],
-];
-
-/// Inverse CDF for coarse energy when only a few bits remain.
-pub const SMALL_ENERGY_ICDF: [u8; 3] = [2, 1, 0];
-/// Conservative log2 in 1/8 bits of the number of coded bands (intensity reservation).
-pub const LOG2_FRAC_TABLE: [i32; 24] = [0, 8, 13, 16, 19, 21, 23, 24, 26, 27, 28, 29, 30, 31, 32, 32, 33, 34, 34, 35, 36, 36, 37, 37];
-/// TF resolution changes: `[LM][4*transient + 2*tf_select + tf_flag]`.
-pub const TF_SELECT_TABLE: [[i8; 8]; 4] =
-    [[0, -1, 0, -1, 0, -1, 0, -1], [0, -1, 0, -2, 1, 0, 1, -1], [0, -2, 0, -3, 2, 0, 1, -1], [0, -2, 0, -3, 3, 0, 1, -1]];
-/// Spreading decision `{7, 2, 21, 2}/32`.
-pub const SPREAD_ICDF: [u8; 4] = [25, 23, 2, 0];
-/// Allocation trim (Table 58).
-pub const TRIM_ICDF: [u8; 11] = [126, 124, 119, 109, 87, 41, 19, 9, 4, 2, 0];
-/// Post-filter tapset `{2, 1, 1}/4`.
-pub const TAPSET_ICDF: [u8; 3] = [2, 1, 0];
-/// Post-filter tap gains per tapset.
-pub const COMB_GAINS: [[f32; 3]; 3] =
-    [[0.306_640_62, 0.217_041_02, 0.129_638_67], [0.463_867_2, 0.268_066_4, 0.0], [0.799_804_7, 0.100_097_656, 0.0]];
-
-/// Hadamard "sequency" ordering for 2, 4, 8 and 16 blocks, concatenated.
-pub const ORDERY: [usize; 30] = [1, 0, 3, 0, 2, 1, 7, 0, 4, 3, 6, 1, 5, 2, 15, 0, 8, 7, 12, 3, 11, 4, 14, 1, 9, 6, 13, 2, 10, 5];

crates/opus/src/decoder.rs

@@ -1,477 +0,0 @@
-//! Single-stream Opus decoder: mode switching, hybrid summation, redundancy and transitions
-//! (RFC 6716 §4, §4.5).
-
-use crate::celt::CeltDecoder;
-use crate::celt::tables::OVERLAP;
-use crate::packet::{Bandwidth, Mode, Packet};
-use crate::range::RangeDecoder;
-use crate::silk::{LostFlag, SilkDecoder};
-use crate::{Error, Result};
-
-/// Output sample rates supported by the decoder.
-pub const SAMPLE_RATES: [u32; 5] = [8000, 12000, 16000, 24000, 48000];
-
-/// Decoder for one elementary Opus stream (mono or stereo), like `OpusDecoder`.
-pub struct StreamDecoder {
-    rate: u32,
-    channels: usize,
-    celt: CeltDecoder,
-    silk: SilkDecoder,
-    stream_channels: usize,
-    bandwidth: Bandwidth,
-    mode: Option<Mode>,
-    prev_mode: Option<Mode>,
-    frame_size: usize,
-    prev_redundancy: bool,
-    last_packet_duration: usize,
-    range_final: u32,
-    /// Output gain in Q8 dB (OpusHead output gain).
-    gain_q8: i16,
-}
-
-impl StreamDecoder {
-    /// Creates a decoder producing `channels` (1 or 2) at `rate` (8/12/16/24/48 kHz).
-    pub fn new(rate: u32, channels: usize) -> Result<StreamDecoder> {
-        if !SAMPLE_RATES.contains(&rate) {
-            return Err(Error::InvalidArgument("sample rate must be 8000, 12000, 16000, 24000 or 48000"));
-        }
-        if !(1..=2).contains(&channels) {
-            return Err(Error::InvalidArgument("channels must be 1 or 2"));
-        }
-        Ok(StreamDecoder {
-            rate,
-            channels,
-            celt: CeltDecoder::new(rate, channels),
-            silk: SilkDecoder::new(rate, channels),
-            stream_channels: channels,
-            bandwidth: Bandwidth::Fullband,
-            mode: None,
-            prev_mode: None,
-            frame_size: rate as usize / 400,
-            prev_redundancy: false,
-            last_packet_duration: 0,
-            range_final: 0,
-            gain_q8: 0,
-        })
-    }
-
-    pub fn sample_rate(&self) -> u32 {
-        self.rate
-    }
-
-    pub fn channels(&self) -> usize {
-        self.channels
-    }
-
-    /// Final range coder state of the last decoded frame (for conformance checks).
-    pub fn final_range(&self) -> u32 {
-        self.range_final
-    }
-
-    /// Duration (samples per channel) of the last decoded packet.
-    pub fn last_packet_duration(&self) -> usize {
-        self.last_packet_duration
-    }
-
-    /// Sets the output gain in Q8 dB (as in the OpusHead header).
-    pub fn set_gain_q8(&mut self, gain: i16) {
-        self.gain_q8 = gain;
-    }
-
-    /// Disables the 180-degree intensity-stereo phase inversion (RFC 8251 §10).
-    pub fn set_phase_inversion_disabled(&mut self, disabled: bool) {
-        self.celt.disable_inv = disabled;
-    }
-
-    /// `OPUS_RESET_STATE`.
-    pub fn reset(&mut self) {
-        self.celt.reset();
-        self.silk.reset();
-        self.stream_channels = self.channels;
-        self.bandwidth = Bandwidth::Fullband;
-        self.mode = None;
-        self.prev_mode = None;
-        self.frame_size = self.rate as usize / 400;
-        self.prev_redundancy = false;
-        self.last_packet_duration = 0;
-        self.range_final = 0;
-    }
-
-    /// Decodes a packet into interleaved samples appended to `out`. `None` conceals one lost
-    /// packet of the last packet's duration. Returns samples per channel.
-    pub fn decode_interleaved(&mut self, packet: Option<&[u8]>, out: &mut Vec<f32>) -> Result<usize> {
-        match packet {
-            Some(p) if !p.is_empty() => self.decode_packet(p, out),
-            _ => {
-                let n = if self.last_packet_duration > 0 { self.last_packet_duration } else { self.rate as usize / 50 };
-                self.conceal(n, out)
-            }
-        }
-    }
-
-    /// Conceals `n` samples (a multiple of 2.5 ms).
-    pub fn conceal(&mut self, n: usize, out: &mut Vec<f32>) -> Result<usize> {
-        let f2_5 = self.rate as usize / 400;
-        if n == 0 || !n.is_multiple_of(f2_5) {
-            return Err(Error::InvalidArgument("concealment length must be a multiple of 2.5 ms"));
-        }
-        let start = out.len();
-        out.resize(start + n * self.channels, 0.0);
-        let mut done = 0;
-        while done < n {
-            let r = self.decode_frame(None, &mut out[start + done * self.channels..], n - done, false)?;
-            done += r;
-        }
-        self.last_packet_duration = n;
-        Ok(n)
-    }
-
-    /// Decodes the in-band FEC (LBRR) of `packet` for the previous (lost) packet of `n` samples.
-    pub fn decode_fec(&mut self, packet: &[u8], n: usize, out: &mut Vec<f32>) -> Result<usize> {
-        let p = Packet::parse(packet)?;
-        let pfs = p.toc.frame_samples(self.rate);
-        if n < pfs || p.toc.mode == Mode::CeltOnly || self.mode == Some(Mode::CeltOnly) {
-            return self.conceal(n, out);
-        }
-        let start = out.len();
-        if n > pfs {
-            self.conceal(n - pfs, out)?;
-        }
-        self.mode = Some(p.toc.mode);
-        self.bandwidth = p.toc.bandwidth;
-        self.frame_size = pfs;
-        self.stream_channels = p.toc.channels();
-        let off = out.len();
-        out.resize(off + pfs * self.channels, 0.0);
-        self.decode_frame(Some(p.frames[0]), &mut out[off..], pfs, true)?;
-        self.last_packet_duration = n;
-        debug_assert_eq!(out.len() - start, n * self.channels);
-        Ok(n)
-    }
-
-    fn decode_packet(&mut self, data: &[u8], out: &mut Vec<f32>) -> Result<usize> {
-        let p = Packet::parse(data)?;
-        let fs = p.toc.frame_samples(self.rate);
-        self.mode = Some(p.toc.mode);
-        self.bandwidth = p.toc.bandwidth;
-        self.frame_size = fs;
-        self.stream_channels = p.toc.channels();
-        let start = out.len();
-        out.resize(start + fs * p.frames.len() * self.channels, 0.0);
-        let mut nb = 0;
-        for f in &p.frames {
-            let r = self.decode_frame(Some(f), &mut out[start + nb * self.channels..], fs, false)?;
-            nb += r;
-        }
-        out.truncate(start + nb * self.channels);
-        self.last_packet_duration = nb;
-        Ok(nb)
-    }
-
-    /// `opus_decode_frame`: decodes one frame (or conceals when `data` is `None`/≤1 byte).
-    fn decode_frame(&mut self, data: Option<&[u8]>, pcm: &mut [f32], frame_size: usize, fec: bool) -> Result<usize> {
-        let ch = self.channels;
-        let fs = self.rate as usize;
-        let f20 = fs / 50;
-        let f10 = f20 >> 1;
-        let f5 = f10 >> 1;
-        let f2_5 = f5 >> 1;
-        let mut frame_size = frame_size.min(fs / 25 * 3);
-        let data = match data {
-            Some(d) if d.len() > 1 => Some(d),
-            _ => {
-                frame_size = frame_size.min(self.frame_size);
-                None
-            }
-        };
-        let (mut audiosize, mode, bandwidth);
-        match data {
-            Some(_) => {
-                audiosize = self.frame_size;
-                mode = self.mode.unwrap_or(Mode::CeltOnly);
-                bandwidth = Some(self.bandwidth);
-            }
-            None => {
-                audiosize = frame_size;
-                bandwidth = None;
-                mode = match self.prev_mode {
-                    None => {
-                        pcm[..audiosize * ch].fill(0.0);
-                        return Ok(audiosize);
-                    }
-                    Some(m) => m,
-                };
-                if audiosize > f20 {
-                    self.conceal_long(pcm, audiosize, f20)?;
-                    return Ok(frame_size);
-                }
-                audiosize = shorten_concealment(audiosize, mode, fs);
-            }
-        }
-        let data_len = data.map_or(0, <[_]>::len);
-        let mut dec_storage;
-        let mut dec: Option<&mut RangeDecoder> = match data {
-            Some(d) => {
-                dec_storage = RangeDecoder::new(d);
-                Some(&mut dec_storage)
-            }
-            None => None,
-        };
-        let mut transition = false;
-        if data.is_some()
-            && self.prev_mode.is_some()
-            && ((mode == Mode::CeltOnly && self.prev_mode != Some(Mode::CeltOnly) && !self.prev_redundancy)
-                || (mode != Mode::CeltOnly && self.prev_mode == Some(Mode::CeltOnly)))
-        {
-            transition = true;
-        }
-        let mut pcm_transition = Vec::new();
-        if transition && mode == Mode::CeltOnly {
-            pcm_transition.resize(f5 * ch, 0.0);
-            let n = f5.min(audiosize);
-            self.decode_frame(None, &mut pcm_transition, n, false)?;
-        }
-        if audiosize > frame_size {
-            return Err(Error::InvalidArgument("frame larger than output buffer"));
-        }
-        frame_size = audiosize;
-
-        // SILK.
-        let mut pcm_silk: Vec<f32> = Vec::new();
-        if mode != Mode::CeltOnly {
-            pcm_silk = self.decode_silk_layer(
-                dec.as_deref_mut(),
-                SilkLayer { mode, bandwidth, lost: lost_flag(data.is_some(), fec), frame_size, audiosize, f10 },
-            )?;
-        }
-
-        let mut start_band = 0;
-        let mut redundancy = Redundancy::none(data_len);
-        if !fec
-            && mode != Mode::CeltOnly
-            && let Some(d) = dec.as_deref_mut()
-        {
-            redundancy = Redundancy::parse(d, mode, self.mode == Some(Mode::Hybrid), data_len);
-        }
-        let Redundancy { present: redundancy, celt_to_silk, bytes: redundancy_bytes, len } = redundancy;
-        if mode != Mode::CeltOnly {
-            start_band = 17;
-        }
-        if redundancy {
-            transition = false;
-        }
-        if transition && mode != Mode::CeltOnly {
-            pcm_transition.resize(f5 * ch, 0.0);
-            let n = f5.min(audiosize);
-            self.decode_frame(None, &mut pcm_transition, n, false)?;
-        }
-        if let Some(bw) = bandwidth {
-            self.celt.end = bw.celt_end_band();
-        }
-        self.celt.stream_channels = self.stream_channels;
-        let mut redundant_audio = vec![0f32; if redundancy { f5 * ch } else { 0 }];
-        let mut redundant_rng = 0u32;
-        let red_data = data.map(|d| &d[len..len + redundancy_bytes]);
-        if redundancy && celt_to_silk {
-            self.celt.start = 0;
-            self.celt.decode(red_data, f5, &mut redundant_audio, false, None)?;
-            redundant_rng = self.celt.rng;
-        }
-        self.celt.start = start_band;
-
-        if mode != Mode::SilkOnly {
-            let celt_frame = f20.min(frame_size);
-            if self.prev_mode.is_some() && Some(mode) != self.prev_mode && !self.prev_redundancy {
-                self.celt.reset();
-            }
-            let cdata = if fec { None } else { data.map(|d| &d[..len]) };
-            let cdec = if fec { None } else { dec.as_deref_mut() };
-            self.celt.decode(cdata, celt_frame, pcm, false, cdec)?;
-        } else {
-            pcm[..frame_size * ch].fill(0.0);
-            if self.prev_mode == Some(Mode::Hybrid) && !(redundancy && celt_to_silk && self.prev_redundancy) {
-                self.celt.start = 0;
-                let silence = [0xFFu8, 0xFF];
-                self.celt.decode(Some(&silence), f2_5, pcm, true, None)?;
-            }
-        }
-        if mode != Mode::CeltOnly {
-            for (o, s) in pcm[..frame_size * ch].iter_mut().zip(&pcm_silk) {
-                *o += *s;
-            }
-        }
-        let window = &crate::celt::mode().window;
-        if redundancy && !celt_to_silk {
-            self.celt.reset();
-            self.celt.start = 0;
-            self.celt.decode(red_data, f5, &mut redundant_audio, false, None)?;
-            redundant_rng = self.celt.rng;
-            let o = ch * (frame_size - f2_5);
-            let tail: Vec<f32> = pcm[o..o + f2_5 * ch].to_vec();
-            smooth_fade(&tail, &redundant_audio[ch * f2_5..], &mut pcm[o..], f2_5, ch, window, self.rate);
-        }
-        if redundancy && celt_to_silk {
-            self.fade_in_from(pcm, &redundant_audio, f2_5);
-        }
-        if transition {
-            if audiosize >= f5 {
-                self.fade_in_from(pcm, &pcm_transition, f2_5);
-            } else {
-                let cur: Vec<f32> = pcm[..ch * f2_5].to_vec();
-                smooth_fade(&pcm_transition, &cur, pcm, f2_5, ch, window, self.rate);
-            }
-        }
-        if self.gain_q8 != 0 {
-            let g = (6.488_141e-4f32 * self.gain_q8 as f32).exp2();
-            for v in pcm[..frame_size * ch].iter_mut() {
-                *v *= g;
-            }
-        }
-        self.range_final = match dec.as_deref() {
-            Some(d) if data_len > 1 => d.rng() ^ redundant_rng,
-            _ => 0,
-        };
-        self.prev_mode = Some(mode);
-        self.prev_redundancy = redundancy && !celt_to_silk;
-        Ok(audiosize)
-    }
-
-    /// Conceals a lost span longer than 20 ms by decoding it in 20 ms pieces.
-    fn conceal_long(&mut self, pcm: &mut [f32], audiosize: usize, f20: usize) -> Result<()> {
-        let mut done = 0;
-        while done < audiosize {
-            done += self.decode_frame(None, &mut pcm[done * self.channels..], (audiosize - done).min(f20), false)?;
-        }
-        Ok(())
-    }
-
-    /// Replaces the first `f2_5` samples of `pcm` with `src` and cross-fades the following `f2_5` samples from `src` into `pcm`.
-    fn fade_in_from(&self, pcm: &mut [f32], src: &[f32], f2_5: usize) {
-        let ch = self.channels;
-        let window = &crate::celt::mode().window;
-        pcm[..f2_5 * ch].copy_from_slice(&src[..f2_5 * ch]);
-        let cur: Vec<f32> = pcm[ch * f2_5..ch * 2 * f2_5].to_vec();
-        smooth_fade(&src[ch * f2_5..], &cur, &mut pcm[ch * f2_5..], f2_5, ch, window, self.rate);
-    }
-
-    /// Runs the SILK layer over the frame, zero-filling spans it cannot decode when the packet was lost.
-    fn decode_silk_layer(&mut self, mut dec: Option<&mut RangeDecoder>, l: SilkLayer) -> Result<Vec<f32>> {
-        let ch = self.channels;
-        let mut pcm_silk = vec![0.0; l.frame_size.max(l.f10) * ch];
-        if self.prev_mode == Some(Mode::CeltOnly) {
-            self.silk.reset();
-        }
-        let payload_ms = (1000 * l.audiosize / self.rate as usize).max(10);
-        if l.lost != LostFlag::Lost {
-            self.silk.set_stream(self.stream_channels, silk_internal_rate(l.mode, l.bandwidth));
-        }
-        let mut decoded = 0;
-        while decoded < l.frame_size {
-            let first = decoded == 0;
-            let out = &mut pcm_silk[decoded * ch..];
-            let n = match self.silk.decode(dec.as_deref_mut(), l.lost, first, payload_ms, out) {
-                Ok(n) => n,
-                Err(_) if l.lost != LostFlag::Normal => {
-                    let n = l.frame_size - decoded;
-                    pcm_silk[decoded * ch..(decoded + n) * ch].fill(0.0);
-                    n
-                }
-                Err(e) => return Err(e),
-            };
-            if n == 0 {
-                break;
-            }
-            decoded += n;
-        }
-        Ok(pcm_silk)
-    }
-}
-
-/// Inputs for one SILK-layer decode.
-struct SilkLayer {
-    mode: Mode,
-    bandwidth: Option<Bandwidth>,
-    lost: LostFlag,
-    frame_size: usize,
-    audiosize: usize,
-    f10: usize,
-}
-
-fn lost_flag(has_data: bool, fec: bool) -> LostFlag {
-    if !has_data {
-        LostFlag::Lost
-    } else if fec {
-        LostFlag::Lbrr
-    } else {
-        LostFlag::Normal
-    }
-}
-
-fn silk_internal_rate(mode: Mode, bandwidth: Option<Bandwidth>) -> u32 {
-    match (mode, bandwidth) {
-        (Mode::SilkOnly, Some(Bandwidth::Narrowband)) => 8000,
-        (Mode::SilkOnly, Some(Bandwidth::Mediumband)) => 12000,
-        _ => 16000,
-    }
-}
-
-/// Picks the shorter concealment length for spans of at most 20 ms (10 ms, or 5 ms outside SILK-only mode).
-fn shorten_concealment(audiosize: usize, mode: Mode, rate: usize) -> usize {
-    let f20 = rate / 50;
-    let f10 = f20 >> 1;
-    let f5 = f10 >> 1;
-    if audiosize >= f20 {
-        audiosize
-    } else if audiosize > f10 {
-        f10
-    } else if mode != Mode::SilkOnly && audiosize > f5 && audiosize < f10 {
-        f5
-    } else {
-        audiosize
-    }
-}
-
-/// In-band redundancy header of a packet: whether a redundant CELT frame follows, its direction and size.
-struct Redundancy {
-    present: bool,
-    celt_to_silk: bool,
-    bytes: usize,
-    /// Payload length left for the main frame.
-    len: usize,
-}
-
-impl Redundancy {
-    fn none(len: usize) -> Self {
-        Self { present: false, celt_to_silk: false, bytes: 0, len }
-    }
-
-    fn parse(d: &mut RangeDecoder, mode: Mode, prev_hybrid: bool, len: usize) -> Self {
-        let mut r = Self::none(len);
-        if d.tell() + 17 + 20 * prev_hybrid as i32 > 8 * len as i32 {
-            return r;
-        }
-        r.present = if mode == Mode::Hybrid { d.bit_logp(12) } else { true };
-        if !r.present {
-            return r;
-        }
-        r.celt_to_silk = d.bit_logp(1);
-        r.bytes = if mode == Mode::Hybrid { d.uint(256) as usize + 2 } else { len - ((d.tell() as usize + 7) >> 3) };
-        if r.bytes > len || (len - r.bytes) * 8 < d.tell() as usize {
-            r = Self { celt_to_silk: r.celt_to_silk, ..Self::none(0) };
-        } else {
-            r.len -= r.bytes;
-        }
-        d.shrink_storage(r.bytes);
-        r
-    }
-}
-
-fn smooth_fade(in1: &[f32], in2: &[f32], out: &mut [f32], overlap: usize, ch: usize, window: &[f32; OVERLAP], rate: u32) {
-    let inc = (48000 / rate) as usize;
-    for c in 0..ch {
-        for i in 0..overlap {
-            let w = window[i * inc] * window[i * inc];
-            out[i * ch + c] = w * in2[i * ch + c] + (1.0 - w) * in1[i * ch + c];
-        }
-    }
-}

crates/opus/src/header.rs

@@ -1,196 +0,0 @@
-//! Opus identification header (`OpusHead`, RFC 7845 §5.1) and the ISO-BMFF `dOps` box payload.
-
-use crate::{Error, Result};
-
-/// Decoder configuration: channel layout, multistream mapping, pre-skip and output gain.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct OpusHead {
-    /// Output channel count (1..=255).
-    pub channels: usize,
-    /// Samples (at 48 kHz) to discard from the start of the decoded stream.
-    pub pre_skip: u16,
-    /// Sample rate of the original input (informational only).
-    pub input_sample_rate: u32,
-    /// Output gain in Q7.8 dB.
-    pub output_gain: i16,
-    /// Channel mapping family (0: mono/stereo, 1: Vorbis order surround, 255: unspecified order).
-    pub mapping_family: u8,
-    /// Number of elementary streams.
-    pub streams: usize,
-    /// Number of coupled (stereo) streams; these come first.
-    pub coupled_streams: usize,
-    /// Output channel → decoded channel index (255 = silence).
-    pub mapping: Vec<u8>,
-}
-
-impl OpusHead {
-    /// A family-0 configuration for plain mono/stereo streams (no header present).
-    pub fn simple(channels: usize) -> Result<OpusHead> {
-        if !(1..=2).contains(&channels) {
-            return Err(Error::InvalidArgument("family 0 supports 1 or 2 channels"));
-        }
-        Ok(OpusHead {
-            channels,
-            pre_skip: 0,
-            input_sample_rate: 48000,
-            output_gain: 0,
-            mapping_family: 0,
-            streams: 1,
-            coupled_streams: channels - 1,
-            mapping: (0..channels as u8).collect(),
-        })
-    }
-
-    /// Parses an `OpusHead` packet (Ogg first packet, Matroska `CodecPrivate`).
-    pub fn parse(data: &[u8]) -> Result<OpusHead> {
-        if data.len() < 19 || &data[..8] != b"OpusHead" {
-            return Err(Error::InvalidHeader("missing OpusHead magic"));
-        }
-        let version = data[8];
-        if version >> 4 != 0 {
-            return Err(Error::Unsupported("OpusHead major version"));
-        }
-        let channels = data[9] as usize;
-        let pre_skip = u16::from_le_bytes([data[10], data[11]]);
-        let input_sample_rate = u32::from_le_bytes([data[12], data[13], data[14], data[15]]);
-        let output_gain = i16::from_le_bytes([data[16], data[17]]);
-        let family = data[18];
-        Self::build(channels, pre_skip, input_sample_rate, output_gain, family, &data[19..])
-    }
-
-    /// Parses the payload of an ISO-BMFF `dOps` box (Opus in MP4, big-endian fields).
-    pub fn from_dops(data: &[u8]) -> Result<OpusHead> {
-        if data.len() < 11 {
-            return Err(Error::InvalidHeader("dOps too short"));
-        }
-        if data[0] != 0 {
-            return Err(Error::Unsupported("dOps version"));
-        }
-        let channels = data[1] as usize;
-        let pre_skip = u16::from_be_bytes([data[2], data[3]]);
-        let input_sample_rate = u32::from_be_bytes([data[4], data[5], data[6], data[7]]);
-        let output_gain = i16::from_be_bytes([data[8], data[9]]);
-        Self::build(channels, pre_skip, input_sample_rate, output_gain, data[10], &data[11..])
-    }
-
-    /// Serialises as an `OpusHead` packet.
-    pub fn to_bytes(&self) -> Vec<u8> {
-        let mut v = b"OpusHead".to_vec();
-        v.push(1);
-        v.push(self.channels as u8);
-        v.extend(self.pre_skip.to_le_bytes());
-        v.extend(self.input_sample_rate.to_le_bytes());
-        v.extend(self.output_gain.to_le_bytes());
-        v.push(self.mapping_family);
-        if self.mapping_family != 0 {
-            v.push(self.streams as u8);
-            v.push(self.coupled_streams as u8);
-            v.extend(&self.mapping);
-        }
-        v
-    }
-
-    fn build(channels: usize, pre_skip: u16, input_sample_rate: u32, output_gain: i16, family: u8, rest: &[u8]) -> Result<OpusHead> {
-        if channels == 0 {
-            return Err(Error::InvalidHeader("zero channels"));
-        }
-        let (streams, coupled, mapping) = if family == 0 {
-            if channels > 2 {
-                return Err(Error::InvalidHeader("family 0 allows at most 2 channels"));
-            }
-            (1, channels - 1, (0..channels as u8).collect::<Vec<_>>())
-        } else {
-            if family == 3 {
-                return Err(Error::Unsupported("channel mapping family 3 (projection)"));
-            }
-            if rest.len() < 2 + channels {
-                return Err(Error::InvalidHeader("truncated channel mapping table"));
-            }
-            let streams = rest[0] as usize;
-            let coupled = rest[1] as usize;
-            if streams == 0 || coupled > streams || streams + coupled > 255 {
-                return Err(Error::InvalidHeader("bad stream counts"));
-            }
-            if family == 1 && !(1..=8).contains(&channels) {
-                return Err(Error::InvalidHeader("family 1 allows 1 to 8 channels"));
-            }
-            let mapping = rest[2..2 + channels].to_vec();
-            if mapping.iter().any(|&m| m != 255 && m as usize >= streams + coupled) {
-                return Err(Error::InvalidHeader("channel mapping out of range"));
-            }
-            (streams, coupled, mapping)
-        };
-        Ok(OpusHead { channels, pre_skip, input_sample_rate, output_gain, mapping_family: family, streams, coupled_streams: coupled, mapping })
-    }
-
-    /// Checks the invariants the decoder indexes by, for headers built by hand rather than parsed.
-    pub fn validate(&self) -> Result<()> {
-        if self.channels == 0 {
-            return Err(Error::InvalidHeader("zero channels"));
-        }
-        if self.streams == 0 || self.coupled_streams > self.streams || self.streams + self.coupled_streams > 255 {
-            return Err(Error::InvalidHeader("bad stream counts"));
-        }
-        if self.mapping.len() != self.channels {
-            return Err(Error::InvalidHeader("channel mapping length differs from channel count"));
-        }
-        if self.mapping.iter().any(|&m| m != 255 && m as usize >= self.streams + self.coupled_streams) {
-            return Err(Error::InvalidHeader("channel mapping out of range"));
-        }
-        Ok(())
-    }
-
-    /// Linear output gain factor.
-    pub fn gain_linear(&self) -> f32 {
-        10f32.powf(self.output_gain as f32 / (20.0 * 256.0))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parse_family0_and_roundtrip() {
-        let mut h = b"OpusHead".to_vec();
-        h.extend([1, 2, 0x38, 0x01, 0x80, 0xBB, 0, 0, 0x00, 0x01, 0]);
-        let head = OpusHead::parse(&h).unwrap();
-        assert_eq!(head.channels, 2);
-        assert_eq!(head.pre_skip, 312);
-        assert_eq!(head.input_sample_rate, 48000);
-        assert_eq!(head.output_gain, 256);
-        assert_eq!((head.streams, head.coupled_streams), (1, 1));
-        assert_eq!(head.to_bytes(), h);
-        assert!((head.gain_linear() - 1.122).abs() < 1e-3);
-    }
-
-    #[test]
-    fn parse_family1_51() {
-        let mut h = b"OpusHead".to_vec();
-        h.extend([1, 6, 0x38, 0x01, 0x80, 0xBB, 0, 0, 0, 0, 1, 4, 2, 0, 4, 1, 2, 3, 5]);
-        let head = OpusHead::parse(&h).unwrap();
-        assert_eq!((head.channels, head.streams, head.coupled_streams), (6, 4, 2));
-        assert_eq!(head.mapping, vec![0, 4, 1, 2, 3, 5]);
-        assert_eq!(OpusHead::parse(&head.to_bytes()).unwrap(), head);
-    }
-
-    #[test]
-    fn rejects_garbage() {
-        assert!(OpusHead::parse(b"OpusHea").is_err());
-        assert!(OpusHead::parse(b"OpusTags...........").is_err());
-        let mut h = b"OpusHead".to_vec();
-        h.extend([1, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        assert!(OpusHead::parse(&h).is_err());
-        let mut h = b"OpusHead".to_vec();
-        h.extend([1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 5]);
-        assert!(OpusHead::parse(&h).is_err());
-    }
-
-    #[test]
-    fn dops() {
-        let d = [0u8, 2, 0x01, 0x38, 0, 0, 0xBB, 0x80, 0, 0, 0];
-        let head = OpusHead::from_dops(&d).unwrap();
-        assert_eq!(head.pre_skip, 312);
-        assert_eq!(head.channels, 2);
-    }
-}

crates/opus/src/lib.rs

@@ -1,46 +0,0 @@
-//! Clean-room pure-Rust Opus decoder (RFC 6716, updated by RFC 8251).
-//!
-//! Layer L0: no dependencies beyond `std`; no `unsafe`; builds for `wasm32-unknown-unknown`.
-
-// Spec-style indexed loops (FilmCraft allows this lint workspace-wide).
-#![allow(clippy::needless_range_loop)]
-#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
-// The fixed-point parts mirror the normative integer arithmetic; keep C-like shift expressions.
-#![allow(clippy::precedence, clippy::int_plus_one)]
-
-pub(crate) mod celt;
-mod decoder;
-mod header;
-mod multistream;
-pub mod packet;
-pub(crate) mod range;
-pub(crate) mod silk;
-
-pub use decoder::{SAMPLE_RATES, StreamDecoder};
-pub use header::OpusHead;
-pub use multistream::Decoder;
-pub use packet::{Bandwidth, Mode, Packet, Toc};
-
-/// Errors from header parsing and decoding.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Error {
-    InvalidArgument(&'static str),
-    InvalidPacket(&'static str),
-    InvalidHeader(&'static str),
-    Unsupported(&'static str),
-}
-
-impl std::fmt::Display for Error {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Error::InvalidArgument(s) => write!(f, "invalid argument: {s}"),
-            Error::InvalidPacket(s) => write!(f, "invalid packet: {s}"),
-            Error::InvalidHeader(s) => write!(f, "invalid header: {s}"),
-            Error::Unsupported(s) => write!(f, "unsupported: {s}"),
-        }
-    }
-}
-
-impl std::error::Error for Error {}
-
-pub type Result<T> = std::result::Result<T, Error>;

crates/opus/src/multistream.rs

@@ -1,198 +0,0 @@
-//! Public decoder: OpusHead-configured (multistream) decoding to planar f32.
-
-use crate::decoder::StreamDecoder;
-use crate::header::OpusHead;
-use crate::packet::Packet;
-use crate::{Error, Result};
-
-/// Opus decoder for an `OpusHead` configuration (mono, stereo, or multistream surround).
-///
-/// Produces planar f32 at the chosen output rate. Pre-skip is *not* removed unless
-/// [`Decoder::set_trim_pre_skip`] is enabled (containers usually handle it via edit lists /
-/// granule positions). The header's output gain is applied.
-pub struct Decoder {
-    head: OpusHead,
-    rate: u32,
-    streams: Vec<StreamDecoder>,
-    trim_pre_skip: bool,
-    skip_remaining: usize,
-    scratch: Vec<Vec<f32>>,
-}
-
-impl Decoder {
-    /// Creates a 48 kHz decoder from an `OpusHead` packet (Ogg / Matroska `CodecPrivate`).
-    pub fn new(opus_head: &[u8]) -> Result<Decoder> {
-        Self::from_head(OpusHead::parse(opus_head)?, 48000)
-    }
-
-    /// Creates a decoder for plain mono/stereo packets without a header.
-    pub fn simple(sample_rate: u32, channels: usize) -> Result<Decoder> {
-        Self::from_head(OpusHead::simple(channels)?, sample_rate)
-    }
-
-    /// Creates a decoder for a parsed header at `sample_rate` (8/12/16/24/48 kHz).
-    pub fn from_head(head: OpusHead, sample_rate: u32) -> Result<Decoder> {
-        head.validate()?;
-        let mut streams = Vec::with_capacity(head.streams);
-        for s in 0..head.streams {
-            let ch = if s < head.coupled_streams { 2 } else { 1 };
-            let mut d = StreamDecoder::new(sample_rate, ch)?;
-            d.set_gain_q8(head.output_gain);
-            streams.push(d);
-        }
-        Ok(Decoder { rate: sample_rate, streams, trim_pre_skip: false, skip_remaining: 0, scratch: vec![Vec::new(); head.streams], head })
-    }
-
-    pub fn head(&self) -> &OpusHead {
-        &self.head
-    }
-
-    pub fn sample_rate(&self) -> u32 {
-        self.rate
-    }
-
-    pub fn channels(&self) -> usize {
-        self.head.channels
-    }
-
-    /// Pre-skip in samples at the output rate.
-    pub fn pre_skip(&self) -> usize {
-        self.head.pre_skip as usize * self.rate as usize / 48000
-    }
-
-    /// When enabled, the first [`Self::pre_skip`] output samples are dropped.
-    pub fn set_trim_pre_skip(&mut self, enable: bool) {
-        self.trim_pre_skip = enable;
-        self.skip_remaining = if enable { self.pre_skip() } else { 0 };
-    }
-
-    /// Disables intensity-stereo phase inversion (useful when downmixing; RFC 8251 section 10).
-    pub fn set_phase_inversion_disabled(&mut self, disabled: bool) {
-        for s in &mut self.streams {
-            s.set_phase_inversion_disabled(disabled);
-        }
-    }
-
-    /// Final range coder state of the first stream (conformance testing).
-    pub fn final_range(&self) -> u32 {
-        self.streams.first().map_or(0, |s| s.final_range())
-    }
-
-    pub fn reset(&mut self) {
-        for s in &mut self.streams {
-            s.reset();
-        }
-        self.skip_remaining = if self.trim_pre_skip { self.pre_skip() } else { 0 };
-    }
-
-    /// Decodes one packet (`None` = lost packet, concealed) into planar channels.
-    pub fn decode(&mut self, packet: Option<&[u8]>) -> Result<Vec<Vec<f32>>> {
-        let n = self.streams.len();
-        for b in &mut self.scratch {
-            b.clear();
-        }
-        let mut samples = None;
-        match packet {
-            Some(data) if !data.is_empty() => {
-                let mut off = 0;
-                for s in 0..n {
-                    let rest = &data[off..];
-                    if rest.is_empty() {
-                        return Err(Error::InvalidPacket("truncated multistream packet"));
-                    }
-                    let used = if s + 1 < n { Packet::parse_self_delimited(rest)?.1 } else { rest.len() };
-                    let pkt = &rest[..used];
-                    let r = if s + 1 < n {
-                        // Re-frame the self-delimited packet as a regular one for the stream decoder.
-                        let (p, _) = Packet::parse_self_delimited(pkt)?;
-                        let regular = reframe(&p);
-                        self.streams[s].decode_interleaved(Some(&regular), &mut self.scratch[s])?
-                    } else {
-                        self.streams[s].decode_interleaved(Some(pkt), &mut self.scratch[s])?
-                    };
-                    if *samples.get_or_insert(r) != r {
-                        return Err(Error::InvalidPacket("multistream frame durations differ"));
-                    }
-                    off += used;
-                }
-            }
-            _ => {
-                let dur = match self.streams[0].last_packet_duration() {
-                    0 => self.rate as usize / 50,
-                    d => d,
-                };
-                for s in 0..n {
-                    self.streams[s].conceal(dur, &mut self.scratch[s])?;
-                }
-                samples = Some(dur);
-            }
-        }
-        let samples = samples.unwrap_or(0);
-        let mut out = vec![vec![0f32; samples]; self.head.channels];
-        for (c, o) in out.iter_mut().enumerate() {
-            let m = self.head.mapping[c] as usize;
-            if m == 255 {
-                continue;
-            }
-            let (s, ch, nch) = if m < 2 * self.head.coupled_streams { (m / 2, m % 2, 2) } else { (m - self.head.coupled_streams, 0, 1) };
-            let src = &self.scratch[s];
-            for (i, v) in o.iter_mut().enumerate() {
-                *v = src[i * nch + ch];
-            }
-        }
-        if self.skip_remaining > 0 {
-            let k = self.skip_remaining.min(samples);
-            for o in &mut out {
-                o.drain(..k);
-            }
-            self.skip_remaining -= k;
-        }
-        Ok(out)
-    }
-}
-
-/// Rebuilds a regular (code 3 VBR) packet from a parsed self-delimited one.
-fn reframe(p: &Packet) -> Vec<u8> {
-    let mut v = vec![(p.toc.config << 3) | if p.toc.stereo { 4 } else { 0 } | 3];
-    v.push(0x80 | p.frames.len() as u8);
-    for f in &p.frames[..p.frames.len() - 1] {
-        let s = f.len();
-        if s < 252 {
-            v.push(s as u8);
-        } else {
-            let b0 = 252 + (s & 3);
-            v.push(b0 as u8);
-            v.push(((s - b0) >> 2) as u8);
-        }
-    }
-    for f in &p.frames {
-        v.extend_from_slice(f);
-    }
-    v
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn head(channels: usize, streams: usize, coupled: usize, mapping: Vec<u8>) -> OpusHead {
-        OpusHead { channels, pre_skip: 0, input_sample_rate: 48000, output_gain: 0, mapping_family: 1, streams, coupled_streams: coupled, mapping }
-    }
-
-    #[test]
-    fn from_head_rejects_inconsistent_headers() {
-        assert!(Decoder::from_head(head(1, 0, 0, vec![0]), 48000).is_err(), "zero streams");
-        assert!(Decoder::from_head(head(2, 1, 0, vec![0]), 48000).is_err(), "short mapping");
-        assert!(Decoder::from_head(head(1, 1, 0, vec![1]), 48000).is_err(), "mapping index out of range");
-        assert!(Decoder::from_head(head(1, 1, 2, vec![0]), 48000).is_err(), "more coupled than streams");
-        assert!(Decoder::from_head(head(0, 1, 0, vec![]), 48000).is_err(), "zero channels");
-    }
-
-    #[test]
-    fn from_head_accepts_valid_headers() {
-        assert!(Decoder::from_head(head(1, 1, 0, vec![0]), 48000).is_ok());
-        assert!(Decoder::from_head(head(2, 1, 1, vec![0, 1]), 48000).is_ok());
-        assert!(Decoder::from_head(head(3, 2, 1, vec![0, 1, 2]), 48000).is_ok());
-        assert!(Decoder::from_head(head(2, 1, 0, vec![0, 255]), 48000).is_ok());
-    }
-}

crates/opus/src/packet.rs

@@ -1,340 +0,0 @@
-//! TOC byte and frame packing (RFC 6716 §3).
-
-use crate::Error;
-
-/// Coding mode of an Opus frame.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Mode {
-    SilkOnly,
-    Hybrid,
-    CeltOnly,
-}
-
-/// Audio bandwidth.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
-pub enum Bandwidth {
-    /// 4 kHz.
-    Narrowband,
-    /// 6 kHz.
-    Mediumband,
-    /// 8 kHz.
-    Wideband,
-    /// 12 kHz.
-    SuperWideband,
-    /// 20 kHz.
-    Fullband,
-}
-
-impl Bandwidth {
-    /// Number of CELT bands coded for this bandwidth.
-    pub fn celt_end_band(self) -> usize {
-        match self {
-            Bandwidth::Narrowband => 13,
-            Bandwidth::Mediumband | Bandwidth::Wideband => 17,
-            Bandwidth::SuperWideband => 19,
-            Bandwidth::Fullband => 21,
-        }
-    }
-}
-
-/// Decoded table-of-contents byte.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct Toc {
-    pub config: u8,
-    pub mode: Mode,
-    pub bandwidth: Bandwidth,
-    pub stereo: bool,
-    /// Frame count code (0..=3).
-    pub code: u8,
-}
-
-impl Toc {
-    pub fn parse(b: u8) -> Toc {
-        let config = b >> 3;
-        let (mode, bandwidth) = match config {
-            0..=3 => (Mode::SilkOnly, Bandwidth::Narrowband),
-            4..=7 => (Mode::SilkOnly, Bandwidth::Mediumband),
-            8..=11 => (Mode::SilkOnly, Bandwidth::Wideband),
-            12..=13 => (Mode::Hybrid, Bandwidth::SuperWideband),
-            14..=15 => (Mode::Hybrid, Bandwidth::Fullband),
-            16..=19 => (Mode::CeltOnly, Bandwidth::Narrowband),
-            20..=23 => (Mode::CeltOnly, Bandwidth::Wideband),
-            24..=27 => (Mode::CeltOnly, Bandwidth::SuperWideband),
-            _ => (Mode::CeltOnly, Bandwidth::Fullband),
-        };
-        Toc { config, mode, bandwidth, stereo: b & 4 != 0, code: b & 3 }
-    }
-
-    /// Samples per frame at 48 kHz.
-    pub fn frame_samples_48k(&self) -> usize {
-        self.frame_samples(48000)
-    }
-
-    /// Samples per frame at `rate`.
-    pub fn frame_samples(&self, rate: u32) -> usize {
-        let rate = rate as usize;
-        let c = self.config as usize;
-        match self.mode {
-            Mode::CeltOnly => (rate << (c & 3)) / 400,
-            Mode::Hybrid => {
-                if c & 1 != 0 {
-                    rate / 50
-                } else {
-                    rate / 100
-                }
-            }
-            Mode::SilkOnly => match c & 3 {
-                3 => rate * 60 / 1000,
-                s => (rate << s) / 100,
-            },
-        }
-    }
-
-    pub fn channels(&self) -> usize {
-        if self.stereo { 2 } else { 1 }
-    }
-}
-
-/// A parsed packet: TOC plus the byte ranges of each frame.
-#[derive(Clone, Debug)]
-pub struct Packet<'a> {
-    pub toc: Toc,
-    pub frames: Vec<&'a [u8]>,
-    /// Bytes of padding (code 3 only).
-    pub padding: usize,
-}
-
-fn parse_size(data: &[u8]) -> Option<(usize, usize)> {
-    match data.first() {
-        None => None,
-        Some(&b) if b < 252 => Some((b as usize, 1)),
-        Some(&b) => data.get(1).map(|&b1| (4 * b1 as usize + b as usize, 2)),
-    }
-}
-
-impl<'a> Packet<'a> {
-    /// Parses a packet (RFC 6716 section 3.2), enforcing requirements R1 to R7.
-    pub fn parse(data: &'a [u8]) -> Result<Packet<'a>, Error> {
-        Self::parse_impl(data, false).map(|(p, _)| p)
-    }
-
-    /// Parses a self-delimited packet (RFC 6716 Appendix B, used for all but the last stream of
-    /// a multistream packet); returns the packet and the number of bytes it occupies.
-    pub fn parse_self_delimited(data: &'a [u8]) -> Result<(Packet<'a>, usize), Error> {
-        Self::parse_impl(data, true)
-    }
-
-    fn parse_impl(data: &'a [u8], self_delimited: bool) -> Result<(Packet<'a>, usize), Error> {
-        const BAD: Error = Error::InvalidPacket("malformed packet framing");
-        if data.is_empty() {
-            return Err(Error::InvalidPacket("empty packet"));
-        }
-        let toc = Toc::parse(data[0]);
-        let fs = toc.frame_samples_48k();
-        let mut pos = 1usize;
-        let mut len = data.len() as isize - 1;
-        let mut sizes: Vec<isize> = Vec::new();
-        let mut padding = 0usize;
-        let mut cbr = false;
-        let count;
-        let mut last_size = len;
-        let read_size = |pos: &mut usize, len: &mut isize| -> Result<isize, Error> {
-            let avail = &data[*pos..(*pos + (*len).max(0) as usize).min(data.len())];
-            let (s, n) = parse_size(avail).ok_or(BAD)?;
-            *pos += n;
-            *len -= n as isize;
-            Ok(s as isize)
-        };
-        match toc.code {
-            0 => count = 1,
-            1 => {
-                count = 2;
-                cbr = true;
-                if !self_delimited {
-                    if len & 1 != 0 {
-                        return Err(BAD);
-                    }
-                    last_size = len / 2;
-                    sizes.push(last_size);
-                }
-            }
-            2 => {
-                count = 2;
-                let s0 = read_size(&mut pos, &mut len)?;
-                if s0 > len {
-                    return Err(BAD);
-                }
-                sizes.push(s0);
-                last_size = len - s0;
-            }
-            _ => {
-                if len < 1 {
-                    return Err(BAD);
-                }
-                let ch = data[pos];
-                pos += 1;
-                len -= 1;
-                count = (ch & 0x3F) as usize;
-                if count == 0 || fs * count > 5760 {
-                    return Err(BAD);
-                }
-                if ch & 0x40 != 0 {
-                    loop {
-                        if len <= 0 {
-                            return Err(BAD);
-                        }
-                        let b = data[pos];
-                        pos += 1;
-                        len -= 1;
-                        let tmp = if b == 255 { 254 } else { b as isize };
-                        len -= tmp;
-                        padding += tmp as usize;
-                        if b != 255 {
-                            break;
-                        }
-                    }
-                }
-                if len < 0 {
-                    return Err(BAD);
-                }
-                cbr = ch & 0x80 == 0;
-                if !cbr {
-                    last_size = len;
-                    for _ in 0..count - 1 {
-                        let before = len;
-                        let s = read_size(&mut pos, &mut len)?;
-                        if s > len {
-                            return Err(BAD);
-                        }
-                        sizes.push(s);
-                        last_size -= (before - len) + s;
-                    }
-                    if last_size < 0 {
-                        return Err(BAD);
-                    }
-                } else if !self_delimited {
-                    last_size = len / count as isize;
-                    if last_size * count as isize != len {
-                        return Err(BAD);
-                    }
-                    for _ in 0..count - 1 {
-                        sizes.push(last_size);
-                    }
-                }
-            }
-        }
-        if self_delimited {
-            let before = len;
-            let s = read_size(&mut pos, &mut len)?;
-            if s > len {
-                return Err(BAD);
-            }
-            if cbr {
-                if s * count as isize > len {
-                    return Err(BAD);
-                }
-                sizes = vec![s; count - 1];
-            } else if (before - len) + s > last_size {
-                return Err(BAD);
-            }
-            last_size = s;
-        }
-        if last_size > 1275 || sizes.iter().any(|&s| s > 1275) {
-            return Err(BAD);
-        }
-        sizes.push(last_size);
-        let mut frames = Vec::with_capacity(count);
-        for &s in &sizes {
-            let s = s as usize;
-            if pos + s > data.len() {
-                return Err(BAD);
-            }
-            frames.push(&data[pos..pos + s]);
-            pos += s;
-        }
-        let total = if self_delimited { pos + padding } else { data.len() };
-        if total > data.len() {
-            return Err(BAD);
-        }
-        Ok((Packet { toc, frames, padding }, total))
-    }
-}
-
-/// Number of samples (at 48 kHz) in a packet, or an error for malformed framing.
-pub fn packet_samples_48k(data: &[u8]) -> Result<usize, Error> {
-    let p = Packet::parse(data)?;
-    Ok(p.toc.frame_samples_48k() * p.frames.len())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn toc_configs() {
-        for cfg in 0u8..32 {
-            let t = Toc::parse(cfg << 3);
-            let ms10 = t.frame_samples(48000) * 10 / 48; // tenths of ms
-            let expect = match cfg {
-                0..=11 => [100, 200, 400, 600][cfg as usize & 3],
-                12..=15 => [100, 200][cfg as usize & 1],
-                _ => [25, 50, 100, 200][cfg as usize & 3],
-            };
-            assert_eq!(ms10, expect, "config {cfg}");
-        }
-        assert!(Toc::parse(0x04).stereo);
-    }
-
-    #[test]
-    fn frame_codes() {
-        // code 0
-        let p = Packet::parse(&[0x00, 1, 2, 3]).unwrap();
-        assert_eq!(p.frames, vec![&[1u8, 2, 3][..]]);
-        // code 1 (odd payload is invalid)
-        assert!(Packet::parse(&[0x01, 1, 2, 3]).is_err());
-        let p = Packet::parse(&[0x01, 1, 2, 3, 4]).unwrap();
-        assert_eq!(p.frames.len(), 2);
-        // code 2
-        let p = Packet::parse(&[0x02, 1, 9, 8, 7]).unwrap();
-        assert_eq!(p.frames, vec![&[9u8][..], &[8u8, 7][..]]);
-        assert!(Packet::parse(&[0x02, 5, 1]).is_err());
-        // code 3 CBR with padding: 2 frames of 2 bytes, 3 bytes padding
-        let p = Packet::parse(&[0x03, 0x42, 3, 1, 2, 3, 4, 0, 0, 0]).unwrap();
-        assert_eq!(p.frames, vec![&[1u8, 2][..], &[3u8, 4][..]]);
-        assert_eq!(p.padding, 3);
-        // code 3 VBR
-        let p = Packet::parse(&[0x03, 0x83, 1, 2, 10, 20, 21, 30]).unwrap();
-        assert_eq!(p.frames, vec![&[10u8][..], &[20u8, 21][..], &[30u8][..]]);
-        // too many frames (> 120 ms)
-        assert!(Packet::parse(&[0x03 | (3 << 3), 0x03, 0]).is_err());
-        // zero frames
-        assert!(Packet::parse(&[0x03, 0x00]).is_err());
-        assert!(Packet::parse(&[]).is_err());
-    }
-
-    #[test]
-    fn two_byte_sizes() {
-        let mut pkt = vec![0x02u8, 252, 1];
-        pkt.extend(std::iter::repeat_n(7u8, 256));
-        pkt.extend([1, 2]);
-        let p = Packet::parse(&pkt).unwrap();
-        assert_eq!(p.frames[0].len(), 256);
-        assert_eq!(p.frames[1], &[1, 2]);
-    }
-
-    #[test]
-    fn self_delimited() {
-        // code 0 with explicit size, followed by trailing data of the next stream.
-        let (p, used) = Packet::parse_self_delimited(&[0x00, 2, 5, 6, 0xAA, 0xBB]).unwrap();
-        assert_eq!(p.frames, vec![&[5u8, 6][..]]);
-        assert_eq!(used, 4);
-        // code 1: one size for both frames.
-        let (p, used) = Packet::parse_self_delimited(&[0x01, 1, 5, 6, 9]).unwrap();
-        assert_eq!(p.frames, vec![&[5u8][..], &[6u8][..]]);
-        assert_eq!(used, 4);
-        // code 3 VBR, 2 frames: size of frame 0, then size of last frame.
-        let (p, used) = Packet::parse_self_delimited(&[0x03, 0x82, 1, 2, 7, 8, 9, 0xFF]).unwrap();
-        assert_eq!(p.frames, vec![&[7u8][..], &[8u8, 9][..]]);
-        assert_eq!(used, 7);
-    }
-}

crates/opus/src/range.rs

@@ -1,497 +0,0 @@
-//! Range decoder (RFC 6716 §4.1).
-//!
-//! The decoder reads range-coded symbols from the front of the buffer and raw bits from the back.
-//! Reading past either end yields zeros (never panics); callers detect corruption through
-//! [`RangeDecoder::tell`] exceeding the budget or through out-of-range values.
-
-const SYM_BITS: u32 = 8;
-const CODE_BITS: u32 = 32;
-const SYM_MAX: u32 = (1 << SYM_BITS) - 1;
-#[cfg(test)]
-const CODE_SHIFT: u32 = CODE_BITS - SYM_BITS - 1;
-const CODE_TOP: u32 = 1 << (CODE_BITS - 1);
-const CODE_BOT: u32 = CODE_TOP >> SYM_BITS;
-const CODE_EXTRA: u32 = (CODE_BITS - 2) % SYM_BITS + 1;
-/// Bit resolution of [`RangeDecoder::tell_frac`] (1/8 bit).
-pub const BITRES: u32 = 3;
-
-/// Number of bits needed to represent `x` (0 for 0).
-#[inline]
-pub fn ilog(x: u32) -> i32 {
-    (32 - x.leading_zeros()) as i32
-}
-
-#[derive(Clone, Debug)]
-pub struct RangeDecoder<'a> {
-    buf: &'a [u8],
-    /// Bytes available to the decoder (may be reduced, e.g. for redundancy).
-    storage: usize,
-    offs: usize,
-    end_offs: usize,
-    end_window: u32,
-    nend_bits: i32,
-    nbits_total: i32,
-    rng: u32,
-    val: u32,
-    rem: u32,
-    /// Set when an out-of-range value was decoded.
-    pub error: bool,
-}
-
-impl<'a> RangeDecoder<'a> {
-    pub fn new(buf: &'a [u8]) -> Self {
-        let mut d = RangeDecoder {
-            buf,
-            storage: buf.len(),
-            offs: 0,
-            end_offs: 0,
-            end_window: 0,
-            nend_bits: 0,
-            nbits_total: (CODE_BITS + 1 - ((CODE_BITS - CODE_EXTRA) / SYM_BITS) * SYM_BITS) as i32,
-            rng: 1 << CODE_EXTRA,
-            val: 0,
-            rem: 0,
-            error: false,
-        };
-        d.rem = d.read_byte();
-        d.val = d.rng - 1 - (d.rem >> (SYM_BITS - CODE_EXTRA));
-        d.normalize();
-        d
-    }
-
-    /// Size of the buffer in bytes as seen by the decoder.
-    pub fn storage(&self) -> usize {
-        self.storage
-    }
-
-    /// Shrinks the buffer seen by the decoder (raw bits are then read from the new end).
-    pub fn shrink_storage(&mut self, by: usize) {
-        self.storage = self.storage.saturating_sub(by);
-    }
-
-    pub fn rng(&self) -> u32 {
-        self.rng
-    }
-
-    #[inline]
-    fn read_byte(&mut self) -> u32 {
-        if self.offs < self.storage {
-            let b = self.buf[self.offs];
-            self.offs += 1;
-            b as u32
-        } else {
-            0
-        }
-    }
-
-    #[inline]
-    fn read_byte_from_end(&mut self) -> u32 {
-        if self.end_offs < self.storage {
-            self.end_offs += 1;
-            self.buf[self.storage - self.end_offs] as u32
-        } else {
-            0
-        }
-    }
-
-    #[inline]
-    fn normalize(&mut self) {
-        while self.rng <= CODE_BOT {
-            self.nbits_total += SYM_BITS as i32;
-            self.rng <<= SYM_BITS;
-            let sym = self.rem;
-            self.rem = self.read_byte();
-            let sym = ((sym << SYM_BITS) | self.rem) >> (SYM_BITS - CODE_EXTRA);
-            self.val = ((self.val << SYM_BITS).wrapping_add(SYM_MAX & !sym)) & (CODE_TOP - 1);
-        }
-    }
-
-    /// Returns the cumulative frequency of the next symbol for total `ft` (call [`Self::update`] next).
-    #[inline]
-    pub fn decode(&mut self, ft: u32) -> u32 {
-        let ext = self.rng / ft;
-        let s = self.val / ext;
-        // stash ext in rem-free form: recomputed by update()
-        ft - (s + 1).min(ft)
-    }
-
-    /// Like [`Self::decode`] with `ft = 1 << bits`.
-    #[inline]
-    pub fn decode_bin(&mut self, bits: u32) -> u32 {
-        let ext = self.rng >> bits;
-        let s = self.val / ext;
-        (1 << bits) - (s + 1).min(1 << bits)
-    }
-
-    /// Consumes the symbol with cumulative range `[fl, fh)` of total `ft`.
-    #[inline]
-    pub fn update(&mut self, fl: u32, fh: u32, ft: u32) {
-        let ext = self.rng / ft;
-        let s = ext * (ft - fh);
-        self.val = self.val.wrapping_sub(s);
-        self.rng = if fl > 0 { ext * (fh - fl) } else { self.rng - s };
-        self.normalize();
-    }
-
-    /// Like [`Self::update`] for a symbol decoded with [`Self::decode_bin`].
-    #[inline]
-    pub fn update_bin(&mut self, fl: u32, fh: u32, bits: u32) {
-        let ext = self.rng >> bits;
-        let ft = 1u32 << bits;
-        let s = ext * (ft - fh);
-        self.val = self.val.wrapping_sub(s);
-        self.rng = if fl > 0 { ext * (fh - fl) } else { self.rng - s };
-        self.normalize();
-    }
-
-    /// Decodes a binary symbol whose probability of being 1 is `1/2^logp`.
-    #[inline]
-    pub fn bit_logp(&mut self, logp: u32) -> bool {
-        let r = self.rng;
-        let d = self.val;
-        let s = r >> logp;
-        let ret = d < s;
-        if !ret {
-            self.val = d - s;
-        }
-        self.rng = if ret { s } else { r - s };
-        self.normalize();
-        ret
-    }
-
-    /// Decodes a symbol with an "inverse CDF" table (`icdf[i] = ft - cdf[i+1]`, `ft = 1 << ftb`).
-    #[inline]
-    pub fn icdf(&mut self, icdf: &[u8], ftb: u32) -> usize {
-        let mut s = self.rng;
-        let d = self.val;
-        let r = s >> ftb;
-        let mut ret = 0usize;
-        let mut t;
-        loop {
-            t = s;
-            let v = icdf.get(ret).copied().unwrap_or(0) as u32;
-            s = r * v;
-            if d >= s || ret + 1 >= icdf.len() {
-                break;
-            }
-            ret += 1;
-        }
-        // If the table is exhausted without d >= s, force the last symbol (only on corrupt tables).
-        if d < s {
-            s = 0;
-        }
-        self.val = d - s;
-        self.rng = t - s;
-        self.normalize();
-        ret
-    }
-
-    /// Decodes a uniformly distributed integer in `[0, ft)` (`ft >= 2`).
-    pub fn uint(&mut self, ft: u32) -> u32 {
-        debug_assert!(ft > 1);
-        let ft1 = ft - 1;
-        let ftb = ilog(ft1);
-        if ftb > 8 {
-            let ftb = (ftb - 8) as u32;
-            let top = (ft1 >> ftb) + 1;
-            let s = self.decode(top);
-            self.update(s, s + 1, top);
-            let t = (s << ftb) | self.bits(ftb);
-            if t <= ft1 {
-                return t;
-            }
-            self.error = true;
-            ft1
-        } else {
-            let s = self.decode(ft);
-            self.update(s, s + 1, ft);
-            s
-        }
-    }
-
-    /// Reads `bits` raw bits (0..=25) from the end of the buffer.
-    pub fn bits(&mut self, bits: u32) -> u32 {
-        if bits == 0 {
-            return 0;
-        }
-        let mut window = self.end_window;
-        let mut available = self.nend_bits;
-        if (available as u32) < bits {
-            loop {
-                window |= self.read_byte_from_end() << available;
-                available += SYM_BITS as i32;
-                if available > (CODE_BITS - SYM_BITS) as i32 {
-                    break;
-                }
-            }
-        }
-        let ret = window & ((1u32 << bits) - 1);
-        window >>= bits;
-        available -= bits as i32;
-        self.end_window = window;
-        self.nend_bits = available;
-        self.nbits_total += bits as i32;
-        ret
-    }
-
-    /// Advances the bit counter so that [`Self::tell`] reports `total` (CELT silence frames).
-    pub fn skip_to_end(&mut self, total: i32) {
-        let t = self.tell();
-        self.nbits_total += total - t;
-    }
-
-    /// Number of bits consumed so far (rounded up).
-    #[inline]
-    pub fn tell(&self) -> i32 {
-        self.nbits_total - ilog(self.rng)
-    }
-
-    /// Number of 1/8 bits consumed so far (rounded up).
-    pub fn tell_frac(&self) -> u32 {
-        let nbits = (self.nbits_total as u32) << BITRES;
-        let mut l = ilog(self.rng) as u32;
-        let mut r = self.rng >> (l - 16);
-        for _ in 0..BITRES {
-            r = (r * r) >> 15;
-            let b = r >> 16;
-            l = (l << 1) | b;
-            r >>= b;
-        }
-        nbits.wrapping_sub(l)
-    }
-}
-
-#[cfg(test)]
-pub(crate) mod enc {
-    //! Minimal range encoder (RFC 6716 §5.1), used only to build test streams.
-    use super::*;
-
-    pub struct RangeEncoder {
-        out: Vec<u8>,
-        end: Vec<u8>,
-        end_window: u32,
-        nend_bits: i32,
-        rng: u32,
-        low: u32,
-        rem: i32,
-        ext: u32,
-        size: usize,
-    }
-
-    impl RangeEncoder {
-        pub fn new(size: usize) -> Self {
-            RangeEncoder { out: Vec::new(), end: Vec::new(), end_window: 0, nend_bits: 0, rng: CODE_TOP, low: 0, rem: -1, ext: 0, size }
-        }
-        fn carry_out(&mut self, c: u32) {
-            if c != SYM_MAX {
-                let carry = c >> SYM_BITS;
-                if self.rem >= 0 {
-                    self.out.push((self.rem as u32 + carry) as u8);
-                }
-                if self.ext > 0 {
-                    let sym = (SYM_MAX + carry) & SYM_MAX;
-                    for _ in 0..self.ext {
-                        self.out.push(sym as u8);
-                    }
-                    self.ext = 0;
-                }
-                self.rem = (c & SYM_MAX) as i32;
-            } else {
-                self.ext += 1;
-            }
-        }
-        fn normalize(&mut self) {
-            while self.rng <= CODE_BOT {
-                self.carry_out(self.low >> CODE_SHIFT);
-                self.low = (self.low << SYM_BITS) & (CODE_TOP - 1);
-                self.rng <<= SYM_BITS;
-            }
-        }
-        pub fn encode(&mut self, fl: u32, fh: u32, ft: u32) {
-            let r = self.rng / ft;
-            if fl > 0 {
-                self.low += self.rng - r * (ft - fl);
-                self.rng = r * (fh - fl);
-            } else {
-                self.rng -= r * (ft - fh);
-            }
-            self.normalize();
-        }
-        pub fn bit_logp(&mut self, val: bool, logp: u32) {
-            let r = self.rng;
-            let s = r >> logp;
-            let r2 = r - s;
-            if val {
-                self.low += r2;
-                self.rng = s;
-            } else {
-                self.rng = r2;
-            }
-            self.normalize();
-        }
-        pub fn icdf(&mut self, s: usize, icdf: &[u8], ftb: u32) {
-            let r = self.rng >> ftb;
-            if s > 0 {
-                self.low += self.rng - r * icdf[s - 1] as u32;
-                self.rng = r * (icdf[s - 1] as u32 - icdf[s] as u32);
-            } else {
-                self.rng -= r * icdf[s] as u32;
-            }
-            self.normalize();
-        }
-        pub fn uint(&mut self, fl: u32, ft: u32) {
-            let ft1 = ft - 1;
-            let ftb = ilog(ft1);
-            if ftb > 8 {
-                let ftb = (ftb - 8) as u32;
-                let top = (ft1 >> ftb) + 1;
-                let v = fl >> ftb;
-                self.encode(v, v + 1, top);
-                self.bits(fl & ((1 << ftb) - 1), ftb);
-            } else {
-                self.encode(fl, fl + 1, ft);
-            }
-        }
-        pub fn bits(&mut self, val: u32, bits: u32) {
-            let mut window = self.end_window;
-            let mut used = self.nend_bits;
-            if used as u32 + bits > CODE_BITS {
-                while used >= SYM_BITS as i32 {
-                    self.end.push((window & SYM_MAX) as u8);
-                    window >>= SYM_BITS;
-                    used -= SYM_BITS as i32;
-                }
-            }
-            window |= val << used;
-            used += bits as i32;
-            self.end_window = window;
-            self.nend_bits = used;
-        }
-        /// Finalises and returns a buffer of exactly `size` bytes.
-        pub fn done(mut self) -> Vec<u8> {
-            let mut l = CODE_BITS as i32 - ilog(self.rng);
-            let mut msk = (CODE_TOP - 1) >> l;
-            let mut end = (self.low + msk) & !msk;
-            if (end | msk) >= self.low + self.rng {
-                l += 1;
-                msk >>= 1;
-                end = (self.low + msk) & !msk;
-            }
-            while l > 0 {
-                self.carry_out(end >> CODE_SHIFT);
-                end = (end << SYM_BITS) & (CODE_TOP - 1);
-                l -= SYM_BITS as i32;
-            }
-            if self.rem >= 0 || self.ext > 0 {
-                self.carry_out(0);
-            }
-            let mut window = self.end_window;
-            let mut used = self.nend_bits;
-            while used > 0 {
-                self.end.push((window & SYM_MAX) as u8);
-                window >>= SYM_BITS;
-                used -= SYM_BITS as i32;
-            }
-            assert!(self.out.len() + self.end.len() <= self.size, "range encoder overflow");
-            let mut buf = self.out;
-            buf.resize(self.size - self.end.len(), 0);
-            for &b in self.end.iter().rev() {
-                buf.push(b);
-            }
-            buf
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::enc::RangeEncoder;
-    use super::*;
-
-    struct Lcg(u32);
-    impl Lcg {
-        fn next(&mut self) -> u32 {
-            self.0 = self.0.wrapping_mul(1664525).wrapping_add(1013904223);
-            self.0 >> 8
-        }
-    }
-
-    #[test]
-    fn roundtrip_mixed_symbols() {
-        let mut rng = Lcg(1);
-        for trial in 0..200 {
-            let n = 1 + (rng.next() % 300) as usize;
-            let mut ops = Vec::new();
-            for _ in 0..n {
-                match rng.next() % 5 {
-                    0 => {
-                        let ft = 2 + rng.next() % 1000;
-                        let v = rng.next() % ft;
-                        ops.push((0u8, v, ft));
-                    }
-                    1 => {
-                        let logp = 1 + rng.next() % 15;
-                        ops.push((1, rng.next().is_multiple_of(7) as u32, logp));
-                    }
-                    2 => {
-                        let bits = 1 + rng.next() % 24;
-                        ops.push((2, rng.next() & ((1 << bits) - 1), bits));
-                    }
-                    3 => {
-                        let ft = 2 + rng.next() % 100_000_000;
-                        ops.push((3, rng.next() % ft, ft));
-                    }
-                    _ => ops.push((4, rng.next() % 4, 0)),
-                }
-            }
-            let icdf: [u8; 4] = [200, 120, 30, 0];
-            let mut e = RangeEncoder::new(8 * n + 16);
-            for &(k, v, p) in &ops {
-                match k {
-                    0 => e.encode(v, v + 1, p),
-                    1 => e.bit_logp(v != 0, p),
-                    2 => e.bits(v, p),
-                    3 => e.uint(v, p),
-                    _ => e.icdf(v as usize, &icdf, 8),
-                }
-            }
-            let buf = e.done();
-            let mut d = RangeDecoder::new(&buf);
-            for (i, &(k, v, p)) in ops.iter().enumerate() {
-                let got = match k {
-                    0 => {
-                        let s = d.decode(p);
-                        d.update(s, s + 1, p);
-                        s
-                    }
-                    1 => d.bit_logp(p) as u32,
-                    2 => d.bits(p),
-                    3 => d.uint(p),
-                    _ => d.icdf(&icdf, 8) as u32,
-                };
-                assert_eq!(got, v, "trial {trial} op {i} kind {k}");
-            }
-            assert!(!d.error);
-        }
-    }
-
-    #[test]
-    fn tell_starts_at_one_bit() {
-        let buf = [0u8; 8];
-        let d = RangeDecoder::new(&buf);
-        assert_eq!(d.tell(), 1);
-        assert_eq!(d.tell_frac(), 8);
-    }
-
-    #[test]
-    fn empty_and_garbage_never_panic() {
-        let mut d = RangeDecoder::new(&[]);
-        for i in 0..100 {
-            d.bits(1 + i % 20);
-            d.uint(3 + i * 77);
-            d.icdf(&[250, 100, 0], 8);
-            d.bit_logp(1 + i % 15);
-        }
-        let _ = d.tell_frac();
-    }
-}

crates/opus/src/silk.rs

@@ -1,912 +0,0 @@
-//! SILK layer decoder (RFC 6716 §4.2).
-//!
-//! Parameter decoding and reconstruction follow the normative fixed-point arithmetic so that the
-//! output matches the reference decoder sample for sample at the internal rate. Resampling to the
-//! output rate uses our own linear-phase interpolator with the delays of RFC 6716 Table 54.
-
-pub(crate) mod lpc;
-mod resampler;
-#[allow(dead_code)]
-pub(crate) mod tables;
-
-use lpc::{MAX_LPC_ORDER, bwexpander, div32_varq, inverse32_varq, nlsf_decode, nlsf2a, rshift_round, sat16, smlawb, smulwb, smulww};
-use resampler::Resampler;
-use tables::{
-    CB_NB_10, CB_NB_20, CB_WB_10, CB_WB_20, DELTA_GAIN, EXC_LSB, EXC_SIGN, GAIN_MSB, LBRR_FLAGS, LTP_FILTER, LTP_PERIODICITY, LTP_SCALE, LTP_TAPS_0,
-    LTP_TAPS_1, LTP_TAPS_2, MID_ONLY, NLSF_EXT, NLSF_INTERP, NLSF_SEL_NBMB, NLSF_SEL_WB, NLSF_STAGE1, NLSF_STAGE2, PITCH_CONTOUR, PITCH_DELTA,
-    PITCH_HIGH, PITCH_LOW, PULSE_COUNT, RATE_LEVEL, SHELL_2, SHELL_4, SHELL_8, SHELL_16, STEREO_PRED_JOINT, STEREO_WEIGHTS_Q13, TYPE_ACTIVE,
-    TYPE_INACTIVE, UNIFORM3, UNIFORM4, UNIFORM5, UNIFORM8,
-};
-
-use crate::range::RangeDecoder;
-use crate::{Error, Result};
-
-const MAX_FRAME: usize = 320;
-const MAX_SUBFR: usize = 80;
-const LTP_ORDER: usize = 5;
-const OUT_BUF: usize = MAX_FRAME + 2 * MAX_SUBFR;
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum LostFlag {
-    Normal,
-    Lost,
-    Lbrr,
-}
-
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum Cond {
-    Independently,
-    IndependentlyNoLtpScaling,
-    Conditionally,
-}
-
-#[derive(Clone, Default)]
-struct Indices {
-    gains: [i32; 4],
-    ltp_index: [usize; 4],
-    nlsf: [i32; 17],
-    lag_index: i32,
-    contour_index: usize,
-    signal_type: usize,
-    quant_offset_type: usize,
-    nlsf_interp_q2: i32,
-    per_index: usize,
-    ltp_scale_index: usize,
-    seed: i32,
-}
-
-#[derive(Clone)]
-struct Channel {
-    fs_khz: usize,
-    nb_subfr: usize,
-    frame_length: usize,
-    subfr_length: usize,
-    ltp_mem_length: usize,
-    lpc_order: usize,
-    prev_gain_q16: i32,
-    s_lpc_q14: [i32; MAX_LPC_ORDER],
-    out_buf: [i16; OUT_BUF],
-    lag_prev: i32,
-    last_gain_index: i32,
-    prev_signal_type: usize,
-    first_frame_after_reset: bool,
-    prev_nlsf_q15: [i32; MAX_LPC_ORDER],
-    ec_prev_signal_type: usize,
-    ec_prev_lag_index: i32,
-    vad_flags: [bool; 3],
-    lbrr_flag: bool,
-    lbrr_flags: [bool; 3],
-    n_frames_decoded: usize,
-    n_frames_per_packet: usize,
-    loss_cnt: u32,
-    indices: Indices,
-    resampler: Resampler,
-    // PLC memory.
-    plc_lpc_q12: [i32; MAX_LPC_ORDER],
-    plc_gain_q16: i32,
-    plc_pitch: i32,
-    plc_rand: u32,
-}
-
-impl Channel {
-    fn new() -> Channel {
-        Channel {
-            fs_khz: 0,
-            nb_subfr: 4,
-            frame_length: 0,
-            subfr_length: 0,
-            ltp_mem_length: 0,
-            lpc_order: 0,
-            prev_gain_q16: 65536,
-            s_lpc_q14: [0; MAX_LPC_ORDER],
-            out_buf: [0; OUT_BUF],
-            lag_prev: 100,
-            last_gain_index: 10,
-            prev_signal_type: 0,
-            first_frame_after_reset: true,
-            prev_nlsf_q15: [0; MAX_LPC_ORDER],
-            ec_prev_signal_type: 0,
-            ec_prev_lag_index: 0,
-            vad_flags: [false; 3],
-            lbrr_flag: false,
-            lbrr_flags: [false; 3],
-            n_frames_decoded: 0,
-            n_frames_per_packet: 1,
-            loss_cnt: 0,
-            indices: Indices::default(),
-            resampler: Resampler::new(16000, 16000),
-            plc_lpc_q12: [0; MAX_LPC_ORDER],
-            plc_gain_q16: 0,
-            plc_pitch: 0,
-            plc_rand: 22222,
-        }
-    }
-
-    fn set_fs(&mut self, fs_khz: usize, api_rate: u32) {
-        self.subfr_length = 5 * fs_khz;
-        let frame_length = self.nb_subfr * self.subfr_length;
-        if self.fs_khz != fs_khz || self.resampler.rates() != (fs_khz as u32 * 1000, api_rate) {
-            self.resampler = Resampler::new(fs_khz as u32 * 1000, api_rate);
-        }
-        if self.fs_khz != fs_khz || frame_length != self.frame_length {
-            if self.fs_khz != fs_khz {
-                self.ltp_mem_length = 20 * fs_khz;
-                self.lpc_order = if fs_khz == 16 { 16 } else { 10 };
-                self.first_frame_after_reset = true;
-                self.lag_prev = 100;
-                self.last_gain_index = 10;
-                self.prev_signal_type = 0;
-                self.out_buf = [0; OUT_BUF];
-                self.s_lpc_q14 = [0; MAX_LPC_ORDER];
-            }
-            self.fs_khz = fs_khz;
-            self.frame_length = frame_length;
-        }
-    }
-
-    fn decode_indices(&mut self, dec: &mut RangeDecoder, frame_index: usize, decode_lbrr: bool, cond: Cond) {
-        let ix = if decode_lbrr || self.vad_flags[frame_index] { dec.icdf(&TYPE_ACTIVE, 8) + 2 } else { dec.icdf(&TYPE_INACTIVE, 8) };
-        let ind = &mut self.indices;
-        ind.signal_type = ix >> 1;
-        ind.quant_offset_type = ix & 1;
-        if cond == Cond::Conditionally {
-            ind.gains[0] = dec.icdf(&DELTA_GAIN, 8) as i32;
-        } else {
-            ind.gains[0] = (dec.icdf(GAIN_MSB[ind.signal_type], 8) as i32) << 3;
-            ind.gains[0] += dec.icdf(&UNIFORM8, 8) as i32;
-        }
-        for i in 1..self.nb_subfr {
-            ind.gains[i] = dec.icdf(&DELTA_GAIN, 8) as i32;
-        }
-        let wb = self.lpc_order == 16;
-        let s1 = (ind.signal_type >> 1) + if wb { 2 } else { 0 };
-        let i1 = dec.icdf(NLSF_STAGE1[s1], 8);
-        ind.nlsf[0] = i1 as i32;
-        for i in 0..self.lpc_order {
-            let cb = if wb { 8 + NLSF_SEL_WB[i1][i] as usize } else { NLSF_SEL_NBMB[i1][i] as usize };
-            let mut v = dec.icdf(NLSF_STAGE2[cb], 8) as i32;
-            if v == 0 {
-                v -= dec.icdf(&NLSF_EXT, 8) as i32;
-            } else if v == 8 {
-                v += dec.icdf(&NLSF_EXT, 8) as i32;
-            }
-            ind.nlsf[i + 1] = v - 4;
-        }
-        ind.nlsf_interp_q2 = if self.nb_subfr == 4 { dec.icdf(&NLSF_INTERP, 8) as i32 } else { 4 };
-        if ind.signal_type == 2 {
-            let mut absolute = true;
-            if cond == Cond::Conditionally && self.ec_prev_signal_type == 2 {
-                let d = dec.icdf(&PITCH_DELTA, 8) as i32;
-                if d > 0 {
-                    ind.lag_index = self.ec_prev_lag_index + d - 9;
-                    absolute = false;
-                }
-            }
-            if absolute {
-                ind.lag_index = dec.icdf(&PITCH_HIGH, 8) as i32 * (self.fs_khz as i32 >> 1);
-                let low = match self.fs_khz {
-                    8 => PITCH_LOW[0],
-                    12 => PITCH_LOW[1],
-                    _ => PITCH_LOW[2],
-                };
-                ind.lag_index += dec.icdf(low, 8) as i32;
-            }
-            self.ec_prev_lag_index = ind.lag_index;
-            let contour = match (self.fs_khz, self.nb_subfr) {
-                (8, 2) => PITCH_CONTOUR[0],
-                (8, _) => PITCH_CONTOUR[1],
-                (_, 2) => PITCH_CONTOUR[2],
-                _ => PITCH_CONTOUR[3],
-            };
-            ind.contour_index = dec.icdf(contour, 8);
-            ind.per_index = dec.icdf(&LTP_PERIODICITY, 8);
-            for k in 0..self.nb_subfr {
-                ind.ltp_index[k] = dec.icdf(LTP_FILTER[ind.per_index], 8);
-            }
-            ind.ltp_scale_index = if cond == Cond::Independently { dec.icdf(&LTP_SCALE, 8) } else { 0 };
-        }
-        self.ec_prev_signal_type = ind.signal_type;
-        ind.seed = dec.icdf(&UNIFORM4, 8) as i32;
-    }
-
-    fn decode_frame(&mut self, dec: Option<&mut RangeDecoder>, out: &mut [i16], lost: LostFlag, cond: Cond) {
-        let l = self.frame_length;
-        let decode = match (lost, &dec) {
-            (LostFlag::Normal, Some(_)) => true,
-            (LostFlag::Lbrr, Some(_)) => self.lbrr_flags[self.n_frames_decoded],
-            _ => false,
-        };
-        if decode && let Some(dec) = dec {
-            self.decode_indices(dec, self.n_frames_decoded, lost == LostFlag::Lbrr, cond);
-            let mut pulses = [0i32; MAX_FRAME + 16];
-            decode_pulses(dec, &mut pulses, self.indices.signal_type, self.indices.quant_offset_type, l);
-            let ctrl = self.decode_parameters(cond);
-            self.decode_core(&ctrl, &pulses, out);
-            self.plc_lpc_q12 = ctrl.pred_coef_q12[1];
-            self.plc_gain_q16 = ctrl.gains_q16[self.nb_subfr - 1];
-            self.plc_pitch = if self.indices.signal_type == 2 { ctrl.pitch_l[self.nb_subfr - 1] } else { 0 };
-            self.loss_cnt = 0;
-            self.prev_signal_type = self.indices.signal_type;
-            self.first_frame_after_reset = false;
-            self.lag_prev = ctrl.pitch_l[self.nb_subfr - 1];
-        } else {
-            self.conceal(out);
-        }
-        // Update the output buffer.
-        let mv = self.ltp_mem_length - l;
-        self.out_buf.copy_within(l..l + mv, 0);
-        self.out_buf[mv..mv + l].copy_from_slice(&out[..l]);
-    }
-
-    fn decode_parameters(&mut self, cond: Cond) -> Ctrl {
-        let mut ctrl = Ctrl::default();
-        let nb = self.nb_subfr;
-        // Gains.
-        let mut prev = self.last_gain_index;
-        for k in 0..nb {
-            let ind = self.indices.gains[k];
-            if k == 0 && cond != Cond::Conditionally {
-                prev = ind.max(prev - 16);
-            } else {
-                let tmp = ind - 4;
-                let thr = 2 * 36 - 64 + prev;
-                if tmp > thr {
-                    prev += (tmp << 1) - thr;
-                } else {
-                    prev += tmp;
-                }
-            }
-            prev = prev.clamp(0, 63);
-            ctrl.gains_q16[k] = log2lin((smulwb(0x1D1C71, prev) + 2090).min(3967));
-        }
-        self.last_gain_index = prev;
-        // LPC.
-        let order = self.lpc_order;
-        let nlsf = nlsf_decode(&self.indices.nlsf, order == 16);
-        ctrl.pred_coef_q12[1] = nlsf2a(&nlsf[..order]);
-        if self.first_frame_after_reset {
-            self.indices.nlsf_interp_q2 = 4;
-        }
-        if self.indices.nlsf_interp_q2 < 4 {
-            let mut n0 = [0i32; MAX_LPC_ORDER];
-            for i in 0..order {
-                n0[i] = self.prev_nlsf_q15[i] + ((self.indices.nlsf_interp_q2 * (nlsf[i] - self.prev_nlsf_q15[i])) >> 2);
-            }
-            ctrl.pred_coef_q12[0] = nlsf2a(&n0[..order]);
-        } else {
-            ctrl.pred_coef_q12[0] = ctrl.pred_coef_q12[1];
-        }
-        self.prev_nlsf_q15 = nlsf;
-        if self.loss_cnt > 0 {
-            bwexpander(&mut ctrl.pred_coef_q12[0][..order], 63570);
-            bwexpander(&mut ctrl.pred_coef_q12[1][..order], 63570);
-        }
-        if self.indices.signal_type == 2 {
-            let fs = self.fs_khz as i32;
-            let min_lag = 2 * fs;
-            let max_lag = 18 * fs;
-            let lag = min_lag + self.indices.lag_index;
-            for k in 0..nb {
-                let off = match (self.fs_khz, nb) {
-                    (8, 2) => CB_NB_10[self.indices.contour_index][k],
-                    (8, _) => CB_NB_20[self.indices.contour_index][k],
-                    (_, 2) => CB_WB_10[self.indices.contour_index][k],
-                    _ => CB_WB_20[self.indices.contour_index][k],
-                };
-                ctrl.pitch_l[k] = (lag + off).clamp(min_lag, max_lag);
-            }
-            for k in 0..nb {
-                let ix = self.indices.ltp_index[k];
-                let taps = match self.indices.per_index {
-                    0 => LTP_TAPS_0[ix.min(7)],
-                    1 => LTP_TAPS_1[ix.min(15)],
-                    _ => LTP_TAPS_2[ix.min(31)],
-                };
-                for i in 0..LTP_ORDER {
-                    ctrl.ltp_coef_q14[k * LTP_ORDER + i] = taps[i] << 7;
-                }
-            }
-            ctrl.ltp_scale_q14 = [15565, 12288, 8192][self.indices.ltp_scale_index];
-        }
-        ctrl
-    }
-
-    fn decode_core(&mut self, ctrl: &Ctrl, pulses: &[i32], xq: &mut [i16]) {
-        let ind = &self.indices;
-        let l = self.frame_length;
-        let sub = self.subfr_length;
-        let order = self.lpc_order;
-        let ltp_mem = self.ltp_mem_length;
-        let mut s_ltp = [0i16; MAX_FRAME];
-        let mut s_ltp_q15 = [0i32; 2 * MAX_FRAME];
-        let mut res_q14 = [0i32; MAX_SUBFR];
-        let mut s_lpc = [0i32; MAX_SUBFR + MAX_LPC_ORDER];
-        let offset_q10 = [[100, 240], [32, 100]][ind.signal_type >> 1][ind.quant_offset_type];
-        let interp = ind.nlsf_interp_q2 < 4;
-        let mut exc = [0i32; MAX_FRAME];
-        let mut seed = ind.seed;
-        for i in 0..l {
-            seed = seed.wrapping_mul(196_314_165).wrapping_add(907_633_515);
-            let mut e = pulses[i] << 14;
-            if e > 0 {
-                e -= 80 << 4;
-            } else if e < 0 {
-                e += 80 << 4;
-            }
-            e += offset_q10 << 4;
-            if seed < 0 {
-                e = -e;
-            }
-            exc[i] = e;
-            seed = seed.wrapping_add(pulses[i]);
-        }
-        s_lpc[..MAX_LPC_ORDER].copy_from_slice(&self.s_lpc_q14);
-        let mut ltp_buf_idx = ltp_mem;
-        for k in 0..self.nb_subfr {
-            let a_q12 = &ctrl.pred_coef_q12[k >> 1];
-            let mut b_q14 = [0i32; LTP_ORDER];
-            b_q14.copy_from_slice(&ctrl.ltp_coef_q14[k * LTP_ORDER..(k + 1) * LTP_ORDER]);
-            let mut signal_type = ind.signal_type;
-            let gain_q10 = ctrl.gains_q16[k] >> 6;
-            let mut inv_gain_q31 = inverse32_varq(ctrl.gains_q16[k], 47);
-            let gain_adj_q16 = if ctrl.gains_q16[k] != self.prev_gain_q16 {
-                let g = div32_varq(self.prev_gain_q16, ctrl.gains_q16[k], 16);
-                for v in s_lpc[..MAX_LPC_ORDER].iter_mut() {
-                    *v = smulww(g, *v);
-                }
-                g
-            } else {
-                1 << 16
-            };
-            self.prev_gain_q16 = ctrl.gains_q16[k];
-            let mut lag = ctrl.pitch_l[k];
-            if self.loss_cnt > 0 && self.prev_signal_type == 2 && signal_type != 2 && k < 2 {
-                b_q14 = [0; LTP_ORDER];
-                b_q14[LTP_ORDER / 2] = 1 << 12;
-                signal_type = 2;
-                lag = self.lag_prev;
-            }
-            if signal_type == 2 {
-                let lag_u = lag as usize;
-                if k == 0 || (k == 2 && interp) {
-                    let start_idx = ltp_mem as isize - lag as isize - order as isize - (LTP_ORDER / 2) as isize;
-                    let start_idx = start_idx.max(0) as usize;
-                    if k == 2 {
-                        self.out_buf[ltp_mem..ltp_mem + 2 * sub].copy_from_slice(&xq[..2 * sub]);
-                    }
-                    let src_off = start_idx + k * sub;
-                    lpc_analysis_filter(&mut s_ltp[start_idx..ltp_mem], &self.out_buf[src_off..src_off + ltp_mem - start_idx], a_q12, order);
-                    if k == 0 {
-                        inv_gain_q31 = smulwb(inv_gain_q31, ctrl.ltp_scale_q14) << 2;
-                    }
-                    for i in 0..(lag_u + LTP_ORDER / 2).min(ltp_mem) {
-                        s_ltp_q15[ltp_buf_idx - i - 1] = smulwb(inv_gain_q31, s_ltp[ltp_mem - i - 1] as i32);
-                    }
-                } else if gain_adj_q16 != 1 << 16 {
-                    for i in 0..(lag_u + LTP_ORDER / 2).min(ltp_buf_idx) {
-                        let p = ltp_buf_idx - i - 1;
-                        s_ltp_q15[p] = smulww(gain_adj_q16, s_ltp_q15[p]);
-                    }
-                }
-                let base = ltp_buf_idx as isize - lag as isize + (LTP_ORDER / 2) as isize;
-                for i in 0..sub {
-                    let p = base + i as isize;
-                    let g = |o: isize| -> i32 { if p - o >= 0 { s_ltp_q15[(p - o) as usize] } else { 0 } };
-                    let mut pred = 2i32;
-                    pred = smlawb(pred, g(0), b_q14[0]);
-                    pred = smlawb(pred, g(1), b_q14[1]);
-                    pred = smlawb(pred, g(2), b_q14[2]);
-                    pred = smlawb(pred, g(3), b_q14[3]);
-                    pred = smlawb(pred, g(4), b_q14[4]);
-                    res_q14[i] = exc[k * sub + i].wrapping_add(pred << 1);
-                    s_ltp_q15[ltp_buf_idx] = res_q14[i] << 1;
-                    ltp_buf_idx += 1;
-                }
-            } else {
-                res_q14[..sub].copy_from_slice(&exc[k * sub..(k + 1) * sub]);
-            }
-            for i in 0..sub {
-                let mut pred = (order >> 1) as i32;
-                for j in 0..order {
-                    pred = smlawb(pred, s_lpc[MAX_LPC_ORDER + i - 1 - j], a_q12[j]);
-                }
-                let v = res_q14[i].saturating_add(pred.saturating_mul(16));
-                s_lpc[MAX_LPC_ORDER + i] = v;
-                xq[k * sub + i] = sat16(rshift_round(smulww(v, gain_q10), 8)) as i16;
-            }
-            s_lpc.copy_within(sub..sub + MAX_LPC_ORDER, 0);
-        }
-        self.s_lpc_q14.copy_from_slice(&s_lpc[..MAX_LPC_ORDER]);
-    }
-
-    /// Basic concealment: pitch-periodic repetition for voiced history, otherwise LPC-shaped
-    /// noise at the residual level of the history; both fade out over successive losses.
-    fn conceal(&mut self, out: &mut [i16]) {
-        let l = self.frame_length;
-        if l == 0 {
-            return;
-        }
-        self.loss_cnt += 1;
-        let order = self.lpc_order;
-        let mem = self.ltp_mem_length;
-        let fade = 0.85f32.powi(self.loss_cnt as i32);
-        let hist: Vec<f32> = self.out_buf[..mem].iter().map(|&v| v as f32).collect();
-        let pitch = self.plc_pitch as usize;
-        let mut y = hist.clone();
-        if pitch > 0 && pitch < mem {
-            for _ in 0..l {
-                let v = y[y.len() - pitch] * fade;
-                y.push(v);
-            }
-        } else {
-            let mut a12 = self.plc_lpc_q12;
-            bwexpander(&mut a12[..order], 64880);
-            self.plc_lpc_q12 = a12;
-            let a: Vec<f32> = a12[..order].iter().map(|&v| v as f32 / 4096.0).collect();
-            let mut e = 0f32;
-            for i in order..mem {
-                let mut r = hist[i];
-                for j in 0..order {
-                    r -= a[j] * hist[i - 1 - j];
-                }
-                e += r * r;
-            }
-            let rms = (e / (mem - order).max(1) as f32).sqrt() * fade;
-            for _ in 0..l {
-                self.plc_rand = self.plc_rand.wrapping_mul(196_314_165).wrapping_add(907_633_515);
-                let mut v = ((self.plc_rand as i32) >> 16) as f32 / 32768.0 * rms * 1.7;
-                for j in 0..order {
-                    v += a[j] * y[y.len() - 1 - j];
-                }
-                y.push(v.clamp(-32768.0, 32767.0));
-            }
-        }
-        for (o, v) in out.iter_mut().zip(&y[mem..mem + l]) {
-            *o = v.clamp(-32768.0, 32767.0) as i16;
-        }
-        // Keep the LPC synthesis state consistent for the next decoded frame.
-        let g = self.prev_gain_q16.max(1) as i64;
-        for j in 0..MAX_LPC_ORDER {
-            let v = out[l - MAX_LPC_ORDER + j] as i64;
-            self.s_lpc_q14[j] = ((v << 30) / g).clamp(i32::MIN as i64, i32::MAX as i64) as i32;
-        }
-        self.lag_prev = self.plc_pitch.max(1);
-        self.first_frame_after_reset = false;
-    }
-}
-
-#[derive(Default)]
-struct Ctrl {
-    gains_q16: [i32; 4],
-    pred_coef_q12: [[i32; MAX_LPC_ORDER]; 2],
-    pitch_l: [i32; 4],
-    ltp_coef_q14: [i32; 4 * LTP_ORDER],
-    ltp_scale_q14: i32,
-}
-
-fn log2lin(in_log_q7: i32) -> i32 {
-    if in_log_q7 < 0 {
-        return 0;
-    }
-    if in_log_q7 >= 3967 {
-        return i32::MAX;
-    }
-    let out = 1i32 << (in_log_q7 >> 7);
-    let frac = in_log_q7 & 0x7F;
-    if in_log_q7 < 2048 {
-        out + ((out * smlawb(frac, frac * (128 - frac), -174)) >> 7)
-    } else {
-        out + (out >> 7) * smlawb(frac, frac * (128 - frac), -174)
-    }
-}
-
-fn lpc_analysis_filter(out: &mut [i16], input: &[i16], b: &[i32], d: usize) {
-    let len = out.len();
-    for ix in d..len {
-        let mut acc: i32 = 0;
-        for j in 0..d {
-            acc = acc.wrapping_add((input[ix - 1 - j] as i32).wrapping_mul(b[j]));
-        }
-        let v = ((input[ix] as i32) << 12).wrapping_sub(acc);
-        out[ix] = sat16(rshift_round(v, 12)) as i16;
-    }
-    for v in out.iter_mut().take(d.min(len)) {
-        *v = 0;
-    }
-}
-
-fn decode_pulses(dec: &mut RangeDecoder, pulses: &mut [i32], signal_type: usize, quant_offset_type: usize, frame_length: usize) {
-    let rate_level = dec.icdf(RATE_LEVEL[signal_type >> 1], 8);
-    let mut iter = frame_length >> 4;
-    if iter * 16 < frame_length {
-        iter += 1;
-    }
-    let mut sum_pulses = [0i32; 20];
-    let mut n_lshifts = [0i32; 20];
-    for i in 0..iter {
-        let mut s = dec.icdf(PULSE_COUNT[rate_level], 8) as i32;
-        while s == 17 {
-            n_lshifts[i] += 1;
-            let tab = if n_lshifts[i] == 10 { PULSE_COUNT[10] } else { PULSE_COUNT[9] };
-            s = dec.icdf(tab, 8) as i32;
-        }
-        sum_pulses[i] = s;
-    }
-    for i in 0..iter {
-        let blk = &mut pulses[i * 16..(i + 1) * 16];
-        if sum_pulses[i] > 0 {
-            shell_decode(dec, blk, sum_pulses[i]);
-        } else {
-            blk.fill(0);
-        }
-    }
-    for i in 0..iter {
-        let nls = n_lshifts[i];
-        if nls > 0 {
-            for p in pulses[i * 16..(i + 1) * 16].iter_mut() {
-                let mut a = *p;
-                for _ in 0..nls {
-                    a = (a << 1) + dec.icdf(&EXC_LSB, 8) as i32;
-                }
-                *p = a;
-            }
-            sum_pulses[i] |= nls << 5;
-        }
-    }
-    // Signs.
-    let base = 7 * (quant_offset_type + (signal_type << 1));
-    let len = (frame_length + 8) >> 4;
-    for i in 0..len {
-        let p = sum_pulses[i];
-        if p > 0 {
-            let tab = EXC_SIGN[base + ((p & 0x1F) as usize).min(6)];
-            for q in pulses[i * 16..(i + 1) * 16].iter_mut() {
-                if *q > 0 && dec.icdf(tab, 8) == 0 {
-                    *q = -*q;
-                }
-            }
-        }
-    }
-}
-
-fn shell_decode(dec: &mut RangeDecoder, out: &mut [i32], total: i32) {
-    fn split(dec: &mut RangeDecoder, out: &mut [i32], n: usize, count: i32) {
-        if n == 1 {
-            out[0] = count;
-            return;
-        }
-        if count == 0 {
-            out[..n].fill(0);
-            return;
-        }
-        let tab = match n {
-            16 => SHELL_16[(count - 1) as usize],
-            8 => SHELL_8[(count - 1) as usize],
-            4 => SHELL_4[(count - 1) as usize],
-            _ => SHELL_2[(count - 1) as usize],
-        };
-        let left = dec.icdf(tab, 8) as i32;
-        let h = n / 2;
-        let (a, b) = out.split_at_mut(h);
-        split(dec, a, h, left);
-        split(dec, b, h, count - left);
-    }
-    split(dec, out, 16, total.min(16));
-}
-
-#[derive(Default, Clone)]
-struct Stereo {
-    pred_prev_q13: [i32; 2],
-    s_mid: [i16; 2],
-    s_side: [i16; 2],
-}
-
-fn stereo_decode_pred(dec: &mut RangeDecoder) -> [i32; 2] {
-    let n = dec.icdf(&STEREO_PRED_JOINT, 8);
-    let mut ix = [[0usize; 3]; 2];
-    ix[0][2] = n / 5;
-    ix[1][2] = n - 5 * ix[0][2];
-    for v in ix.iter_mut() {
-        v[0] = dec.icdf(&UNIFORM3, 8);
-        v[1] = dec.icdf(&UNIFORM5, 8);
-    }
-    let mut pred = [0i32; 2];
-    for (p, v) in pred.iter_mut().zip(ix.iter_mut()) {
-        v[0] += 3 * v[2];
-        let low = STEREO_WEIGHTS_Q13[v[0]];
-        let step = smulwb(STEREO_WEIGHTS_Q13[v[0] + 1] - low, 6554);
-        *p = low + step * (2 * v[1] as i32 + 1);
-    }
-    pred[0] -= pred[1];
-    pred
-}
-
-fn stereo_ms_to_lr(st: &mut Stereo, x1: &mut [i16], x2: &mut [i16], pred_q13: [i32; 2], fs_khz: usize, len: usize) {
-    x1[..2].copy_from_slice(&st.s_mid);
-    x2[..2].copy_from_slice(&st.s_side);
-    st.s_mid.copy_from_slice(&x1[len..len + 2]);
-    st.s_side.copy_from_slice(&x2[len..len + 2]);
-    let mut p0 = st.pred_prev_q13[0];
-    let mut p1 = st.pred_prev_q13[1];
-    let denom_q16 = (1 << 16) / (8 * fs_khz as i32);
-    let d0 = rshift_round((pred_q13[0] - st.pred_prev_q13[0]) as i16 as i32 * denom_q16 as i16 as i32, 16);
-    let d1 = rshift_round((pred_q13[1] - st.pred_prev_q13[1]) as i16 as i32 * denom_q16 as i16 as i32, 16);
-    let interp = 8 * fs_khz;
-    for n in 0..len {
-        if n < interp {
-            p0 += d0;
-            p1 += d1;
-        } else if n == interp {
-            p0 = pred_q13[0];
-            p1 = pred_q13[1];
-        }
-        let sum = ((x1[n] as i32 + x1[n + 2] as i32) + ((x1[n + 1] as i32) << 1)) << 9;
-        let mut s = smlawb((x2[n + 1] as i32) << 8, sum, p0);
-        s = smlawb(s, (x1[n + 1] as i32) << 11, p1);
-        x2[n + 1] = sat16(rshift_round(s, 8)) as i16;
-    }
-    st.pred_prev_q13 = pred_q13;
-    for n in 0..len {
-        let a = x1[n + 1] as i32;
-        let b = x2[n + 1] as i32;
-        x1[n + 1] = sat16(a + b) as i16;
-        x2[n + 1] = sat16(a - b) as i16;
-    }
-}
-
-/// SILK decoder for up to two internal channels (`silk_decoder`).
-pub struct SilkDecoder {
-    api_rate: u32,
-    api_channels: usize,
-    ch: [Channel; 2],
-    stereo: Stereo,
-    channels_internal: usize,
-    channels_internal_prev: usize,
-    internal_rate: u32,
-    prev_decode_only_middle: bool,
-    ms_pred: [i32; 2],
-    decode_only_middle: bool,
-}
-
-impl SilkDecoder {
-    pub fn new(api_rate: u32, api_channels: usize) -> SilkDecoder {
-        SilkDecoder {
-            api_rate,
-            api_channels,
-            ch: [Channel::new(), Channel::new()],
-            stereo: Stereo::default(),
-            channels_internal: api_channels,
-            channels_internal_prev: 0,
-            internal_rate: 16000,
-            prev_decode_only_middle: false,
-            ms_pred: [0; 2],
-            decode_only_middle: false,
-        }
-    }
-
-    pub fn reset(&mut self) {
-        self.ch = [Channel::new(), Channel::new()];
-        self.stereo = Stereo::default();
-        self.prev_decode_only_middle = false;
-        self.channels_internal_prev = 0;
-    }
-
-    pub fn set_stream(&mut self, channels: usize, internal_rate: u32) {
-        self.channels_internal = channels;
-        self.internal_rate = internal_rate;
-    }
-
-    /// Decodes one SILK frame (10 or 20 ms) into interleaved `out` at the API rate.
-    pub fn decode(
-        &mut self,
-        mut dec: Option<&mut RangeDecoder>,
-        lost: LostFlag,
-        new_packet: bool,
-        payload_ms: usize,
-        out: &mut [f32],
-    ) -> Result<usize> {
-        let nci = self.channels_internal;
-        if new_packet {
-            for c in self.ch.iter_mut() {
-                c.n_frames_decoded = 0;
-            }
-        }
-        if nci > self.channels_internal_prev && self.channels_internal_prev != 0 {
-            self.ch[1] = Channel::new();
-        }
-        let stereo_to_mono = nci == 1 && self.channels_internal_prev == 2 && self.internal_rate == 1000 * self.ch[0].fs_khz as u32;
-        if self.ch[0].n_frames_decoded == 0 {
-            self.configure_channels(nci, payload_ms)?;
-        }
-        if self.api_channels == 2 && nci == 2 && self.channels_internal_prev == 1 {
-            self.stereo.pred_prev_q13 = [0; 2];
-            self.stereo.s_side = [0; 2];
-            self.ch[1].resampler = self.ch[0].resampler.clone();
-        }
-        self.channels_internal_prev = nci;
-
-        if lost != LostFlag::Lost && self.ch[0].n_frames_decoded == 0 {
-            let d = dec.as_deref_mut().ok_or(Error::InvalidPacket("missing SILK data"))?;
-            self.read_packet_flags(d, nci);
-            if lost == LostFlag::Normal {
-                self.skip_lbrr_data(d, nci);
-            }
-        }
-        if nci == 2 {
-            self.decode_stereo_prediction(dec.as_deref_mut(), lost);
-        }
-        if nci == 2 && !self.decode_only_middle && self.prev_decode_only_middle {
-            self.reset_side_channel();
-        }
-        let l = self.ch[0].frame_length;
-        let mut buf = [[0i16; MAX_FRAME + 2]; 2];
-        self.decode_channel_frames(dec, lost, nci, &mut buf);
-        if self.api_channels == 2 && nci == 2 {
-            let (a, b) = buf.split_at_mut(1);
-            stereo_ms_to_lr(&mut self.stereo, &mut a[0], &mut b[0], self.ms_pred, self.ch[0].fs_khz, l);
-        } else {
-            buf[0][..2].copy_from_slice(&self.stereo.s_mid);
-            self.stereo.s_mid.copy_from_slice(&buf[0][l..l + 2]);
-        }
-        let n_out = self.resample_to_output(&buf, nci, stereo_to_mono, out);
-        if lost == LostFlag::Lost {
-            for c in self.ch.iter_mut().take(nci) {
-                c.last_gain_index = 10;
-            }
-        } else {
-            self.prev_decode_only_middle = self.decode_only_middle;
-        }
-        Ok(n_out)
-    }
-
-    /// Applies the packet's frame layout and internal sampling rate to the first `nci` channels.
-    fn configure_channels(&mut self, nci: usize, payload_ms: usize) -> Result<()> {
-        let (nfpp, nb) = match payload_ms {
-            10 => (1, 2),
-            20 => (1, 4),
-            40 => (2, 4),
-            60 => (3, 4),
-            _ => return Err(Error::InvalidPacket("bad SILK frame size")),
-        };
-        let fs_khz = ((self.internal_rate >> 10) + 1) as usize;
-        for c in self.ch.iter_mut().take(nci) {
-            c.n_frames_per_packet = nfpp;
-            c.nb_subfr = nb;
-            c.set_fs(fs_khz, self.api_rate);
-        }
-        Ok(())
-    }
-
-    /// Reads the per-frame VAD flags and LBRR flags at the start of a packet.
-    fn read_packet_flags(&mut self, d: &mut RangeDecoder, nci: usize) {
-        for c in self.ch.iter_mut().take(nci) {
-            for i in 0..c.n_frames_per_packet {
-                c.vad_flags[i] = d.bit_logp(1);
-            }
-            c.lbrr_flag = d.bit_logp(1);
-        }
-        for c in self.ch.iter_mut().take(nci) {
-            c.lbrr_flags = [false; 3];
-            if !c.lbrr_flag {
-                continue;
-            }
-            if c.n_frames_per_packet == 1 {
-                c.lbrr_flags[0] = true;
-            } else {
-                let sym = d.icdf(LBRR_FLAGS[c.n_frames_per_packet - 2], 8) + 1;
-                for i in 0..c.n_frames_per_packet {
-                    c.lbrr_flags[i] = (sym >> i) & 1 != 0;
-                }
-            }
-        }
-    }
-
-    /// Consumes (without using) the in-band LBRR frames of a normally decoded packet.
-    fn skip_lbrr_data(&mut self, d: &mut RangeDecoder, nci: usize) {
-        for i in 0..self.ch[0].n_frames_per_packet {
-            for n in 0..nci {
-                if !self.ch[n].lbrr_flags[i] {
-                    continue;
-                }
-                if nci == 2 && n == 0 {
-                    stereo_decode_pred(d);
-                    if !self.ch[1].lbrr_flags[i] {
-                        d.icdf(&MID_ONLY, 8);
-                    }
-                }
-                let cond = if i > 0 && self.ch[n].lbrr_flags[i - 1] { Cond::Conditionally } else { Cond::Independently };
-                let c = &mut self.ch[n];
-                c.decode_indices(d, i, true, cond);
-                let mut pulses = [0i32; MAX_FRAME + 16];
-                decode_pulses(d, &mut pulses, c.indices.signal_type, c.indices.quant_offset_type, c.frame_length);
-            }
-        }
-    }
-
-    /// Reads the mid/side prediction weights, or reuses the previous ones when this frame carries none.
-    fn decode_stereo_prediction(&mut self, dec: Option<&mut RangeDecoder>, lost: LostFlag) {
-        let fi = self.ch[0].n_frames_decoded;
-        let coded = lost == LostFlag::Normal || (lost == LostFlag::Lbrr && self.ch[0].lbrr_flags[fi]);
-        match dec {
-            Some(d) if coded => {
-                self.ms_pred = stereo_decode_pred(d);
-                let side_inactive = (lost == LostFlag::Normal && !self.ch[1].vad_flags[fi]) || (lost == LostFlag::Lbrr && !self.ch[1].lbrr_flags[fi]);
-                self.decode_only_middle = side_inactive && d.icdf(&MID_ONLY, 8) == 1;
-            }
-            _ => self.ms_pred = self.stereo.pred_prev_q13,
-        }
-    }
-
-    /// Resets the side channel's decoder state when it resumes after a mid-only stretch.
-    fn reset_side_channel(&mut self) {
-        let c = &mut self.ch[1];
-        c.out_buf = [0; OUT_BUF];
-        c.s_lpc_q14 = [0; MAX_LPC_ORDER];
-        c.lag_prev = 100;
-        c.last_gain_index = 10;
-        c.prev_signal_type = 0;
-        c.first_frame_after_reset = true;
-    }
-
-    /// Frame-coding condition for channel `n` of the frame currently being decoded.
-    fn frame_condition(&self, n: usize, lost: LostFlag) -> Cond {
-        let frame_index = self.ch[0].n_frames_decoded as isize - n as isize;
-        if frame_index <= 0 {
-            Cond::Independently
-        } else if lost == LostFlag::Lbrr {
-            if self.ch[n].lbrr_flags[frame_index as usize - 1] { Cond::Conditionally } else { Cond::Independently }
-        } else if n > 0 && self.prev_decode_only_middle {
-            Cond::IndependentlyNoLtpScaling
-        } else {
-            Cond::Conditionally
-        }
-    }
-
-    /// Decodes the current frame of every active channel into `buf` (silence for an inactive side channel).
-    fn decode_channel_frames(&mut self, mut dec: Option<&mut RangeDecoder>, lost: LostFlag, nci: usize, buf: &mut [[i16; MAX_FRAME + 2]; 2]) {
-        let has_side = if lost == LostFlag::Normal {
-            !self.decode_only_middle
-        } else {
-            !self.prev_decode_only_middle || (nci == 2 && lost == LostFlag::Lbrr && self.ch[1].lbrr_flags[self.ch[1].n_frames_decoded])
-        };
-        let l = self.ch[0].frame_length;
-        for n in 0..nci {
-            if n == 0 || has_side {
-                let cond = self.frame_condition(n, lost);
-                self.ch[n].decode_frame(dec.as_deref_mut(), &mut buf[n][2..], lost, cond);
-            } else {
-                buf[n][2..2 + l].fill(0);
-            }
-            self.ch[n].n_frames_decoded += 1;
-        }
-    }
-
-    /// Resamples the decoded channels to the API rate into interleaved `out`; returns samples per channel.
-    fn resample_to_output(&mut self, buf: &[[i16; MAX_FRAME + 2]; 2], nci: usize, stereo_to_mono: bool, out: &mut [f32]) -> usize {
-        let l = self.ch[0].frame_length;
-        let n_out = l * self.api_rate as usize / (self.ch[0].fs_khz * 1000);
-        let ach = self.api_channels;
-        let mut tmp = Vec::with_capacity(n_out);
-        for n in 0..ach.min(nci) {
-            tmp.clear();
-            self.ch[n].resampler.process(&buf[n][1..1 + l], &mut tmp);
-            for (i, &v) in tmp.iter().enumerate().take(n_out) {
-                out[i * ach + n] = v / 32768.0;
-            }
-        }
-        if ach == 2 && nci == 1 {
-            if stereo_to_mono {
-                tmp.clear();
-                self.ch[1].resampler.process(&buf[0][1..1 + l], &mut tmp);
-                for (i, &v) in tmp.iter().enumerate().take(n_out) {
-                    out[i * 2 + 1] = v / 32768.0;
-                }
-            } else {
-                for i in 0..n_out {
-                    out[i * 2 + 1] = out[i * 2];
-                }
-            }
-        }
-        n_out
-    }
-}

crates/opus/src/silk/lpc.rs

@@ -1,377 +0,0 @@
-//! Fixed-point NLSF decoding, NLSF→LPC conversion and filter stabilisation
-//! (RFC 6716 §4.2.7.5, with the RFC 8251 §6/§7 overflow fixes).
-
-use super::tables::{
-    COS_Q12, LSF_ORDER_NBMB, LSF_ORDER_WB, NLSF_CB_NBMB, NLSF_CB_WB, NLSF_MIN_SPACING_NBMB, NLSF_MIN_SPACING_WB, NLSF_PRED_NBMB, NLSF_PRED_WB,
-    NLSF_PSEL_NBMB, NLSF_PSEL_WB,
-};
-
-pub const MAX_LPC_ORDER: usize = 16;
-
-#[inline]
-pub fn smulwb(a: i32, b: i32) -> i32 {
-    ((a as i64 * (b as i16) as i64) >> 16) as i32
-}
-#[inline]
-pub fn smlawb(a: i32, b: i32, c: i32) -> i32 {
-    a.wrapping_add(smulwb(b, c))
-}
-#[inline]
-pub fn smulww(a: i32, b: i32) -> i32 {
-    ((a as i64 * b as i64) >> 16) as i32
-}
-#[inline]
-pub fn smmul(a: i32, b: i32) -> i32 {
-    ((a as i64 * b as i64) >> 32) as i32
-}
-#[inline]
-pub fn rshift_round(a: i32, s: u32) -> i32 {
-    if s == 1 { (a >> 1) + (a & 1) } else { ((a >> (s - 1)) + 1) >> 1 }
-}
-#[inline]
-pub fn rshift_round64(a: i64, s: u32) -> i64 {
-    if s == 1 { (a >> 1) + (a & 1) } else { ((a >> (s - 1)) + 1) >> 1 }
-}
-#[inline]
-pub fn sat16(a: i32) -> i32 {
-    a.clamp(-32768, 32767)
-}
-
-/// `silk_INVERSE32_varQ`: approximation of `(1 << q_res) / b32`.
-pub fn inverse32_varq(b32: i32, q_res: i32) -> i32 {
-    let b_headrm = b32.unsigned_abs().leading_zeros() as i32 - 1;
-    let b32_nrm = b32.wrapping_shl(b_headrm as u32);
-    let b32_inv = (i32::MAX >> 2) / (b32_nrm >> 16);
-    let mut result = b32_inv << 16;
-    let err_q32 = ((1i32 << 29).wrapping_sub(smulwb(b32_nrm, b32_inv))).wrapping_shl(3);
-    result = result.wrapping_add(((err_q32 as i64 * b32_inv as i64) >> 16) as i32);
-    let lshift = 61 - b_headrm - q_res;
-    if lshift <= 0 {
-        let s = (-lshift) as u32;
-        let lim_hi = i32::MAX >> s;
-        let lim_lo = i32::MIN >> s;
-        result.clamp(lim_lo, lim_hi) << s
-    } else if lshift < 32 {
-        result >> lshift
-    } else {
-        0
-    }
-}
-
-/// `silk_DIV32_varQ`: approximation of `(a32 << q_res) / b32`.
-pub fn div32_varq(a32: i32, b32: i32, q_res: i32) -> i32 {
-    let a_headrm = a32.unsigned_abs().leading_zeros() as i32 - 1;
-    let a32_nrm = a32.wrapping_shl(a_headrm as u32);
-    let b_headrm = b32.unsigned_abs().leading_zeros() as i32 - 1;
-    let b32_nrm = b32.wrapping_shl(b_headrm as u32);
-    let b32_inv = (i32::MAX >> 2) / (b32_nrm >> 16);
-    let mut result = smulwb(a32_nrm, b32_inv);
-    let a32_nrm = a32_nrm.wrapping_sub(((smmul(b32_nrm, result) as i64) << 3) as i32);
-    result = smlawb(result, a32_nrm, b32_inv);
-    let lshift = 29 + a_headrm - b_headrm - q_res;
-    if lshift < 0 {
-        let s = (-lshift) as u32;
-        let lim_hi = i32::MAX >> s;
-        let lim_lo = i32::MIN >> s;
-        result.clamp(lim_lo, lim_hi) << s
-    } else if lshift < 32 {
-        result >> lshift
-    } else {
-        0
-    }
-}
-
-fn sqrt_approx(x: i32) -> i32 {
-    if x <= 0 {
-        return 0;
-    }
-    let lz = x.leading_zeros() as i32;
-    let frac = (x.rotate_right((24 - lz).rem_euclid(32) as u32)) & 0x7f;
-    let mut y = if lz & 1 != 0 { 32768 } else { 46214 };
-    y >>= lz >> 1;
-    smlawb(y, y, 213 * frac)
-}
-
-/// Decodes the stage-1/stage-2 indices into stabilised NLSFs (Q15).
-pub fn nlsf_decode(indices: &[i32], wb: bool) -> [i32; MAX_LPC_ORDER] {
-    let order = if wb { 16 } else { 10 };
-    let i1 = indices[0] as usize;
-    let cb1: &[i32] = if wb { &NLSF_CB_WB[i1] } else { &NLSF_CB_NBMB[i1] };
-    let qstep = if wb { 9830 } else { 11796 };
-    // Residual dequantisation with backwards prediction.
-    let mut res_q10 = [0i32; MAX_LPC_ORDER];
-    let mut out_q10 = 0i32;
-    for i in (0..order).rev() {
-        let pred = if i + 1 < order {
-            let sel = if wb { NLSF_PSEL_WB[i1][i] } else { NLSF_PSEL_NBMB[i1][i] } as usize;
-            let w = if wb { NLSF_PRED_WB[sel][i] } else { NLSF_PRED_NBMB[sel][i] };
-            (out_q10 * w) >> 8
-        } else {
-            0
-        };
-        let mut v = indices[i + 1] << 10;
-        if v > 0 {
-            v -= 102;
-        } else if v < 0 {
-            v += 102;
-        }
-        out_q10 = smlawb(pred, v, qstep);
-        res_q10[i] = out_q10;
-    }
-    // Laroia weights.
-    let mut nlsf = [0i32; MAX_LPC_ORDER];
-    for k in 0..order {
-        let prev = if k == 0 { 0 } else { cb1[k - 1] };
-        let next = if k + 1 == order { 256 } else { cb1[k + 1] };
-        let w = (1024 / (cb1[k] - prev).max(1) + 1024 / (next - cb1[k]).max(1)).min(32767);
-        let w_q9 = sqrt_approx(w << 16);
-        let v = (cb1[k] << 7) + (res_q10[k] << 14) / w_q9.max(1);
-        nlsf[k] = v.clamp(0, 32767);
-    }
-    let dmin: &[i32] = if wb { &NLSF_MIN_SPACING_WB } else { &NLSF_MIN_SPACING_NBMB };
-    nlsf_stabilize(&mut nlsf[..order], dmin);
-    nlsf
-}
-
-pub fn nlsf_stabilize(nlsf: &mut [i32], dmin: &[i32]) {
-    let l = nlsf.len();
-    for _ in 0..20 {
-        let mut min_diff = nlsf[0] - dmin[0];
-        let mut idx = 0;
-        for i in 1..l {
-            let d = nlsf[i] - (nlsf[i - 1] + dmin[i]);
-            if d < min_diff {
-                min_diff = d;
-                idx = i;
-            }
-        }
-        let d = 32768 - (nlsf[l - 1] + dmin[l]);
-        if d < min_diff {
-            min_diff = d;
-            idx = l;
-        }
-        if min_diff >= 0 {
-            return;
-        }
-        if idx == 0 {
-            nlsf[0] = dmin[0];
-        } else if idx == l {
-            nlsf[l - 1] = 32768 - dmin[l];
-        } else {
-            let mut min_center = dmin[..idx].iter().sum::<i32>();
-            min_center += dmin[idx] >> 1;
-            let mut max_center = 32768 - dmin[idx + 1..=l].iter().sum::<i32>();
-            max_center -= dmin[idx] >> 1;
-            let c = rshift_round(nlsf[idx - 1] + nlsf[idx], 1);
-            let c = if min_center > max_center { c.clamp(max_center, min_center) } else { c.clamp(min_center, max_center) };
-            nlsf[idx - 1] = c - (dmin[idx] >> 1);
-            nlsf[idx] = nlsf[idx - 1] + dmin[idx];
-        }
-    }
-    // Fallback.
-    nlsf.sort_unstable();
-    nlsf[0] = nlsf[0].max(dmin[0]);
-    for i in 1..l {
-        nlsf[i] = nlsf[i].max(sat16(nlsf[i - 1] + dmin[i]));
-    }
-    nlsf[l - 1] = nlsf[l - 1].min(32768 - dmin[l]);
-    for i in (0..l - 1).rev() {
-        nlsf[i] = nlsf[i].min(nlsf[i + 1] - dmin[i + 1]);
-    }
-}
-
-fn bwexpander_32(ar: &mut [i32], mut chirp_q16: i32) {
-    let d = ar.len();
-    let chirp_minus_one = chirp_q16 - 65536;
-    for v in ar.iter_mut().take(d - 1) {
-        *v = smulww(chirp_q16, *v);
-        chirp_q16 += rshift_round(chirp_q16.wrapping_mul(chirp_minus_one), 16);
-    }
-    ar[d - 1] = smulww(chirp_q16, ar[d - 1]);
-}
-
-/// `silk_bwexpander` on Q12 coefficients (16-bit).
-pub fn bwexpander(ar: &mut [i32], mut chirp_q16: i32) {
-    let d = ar.len();
-    let chirp_minus_one = chirp_q16 - 65536;
-    for v in ar.iter_mut().take(d - 1) {
-        *v = rshift_round(chirp_q16.wrapping_mul(*v), 16);
-        chirp_q16 += rshift_round(chirp_q16.wrapping_mul(chirp_minus_one), 16);
-    }
-    ar[d - 1] = rshift_round(chirp_q16.wrapping_mul(ar[d - 1]), 16);
-}
-
-fn lpc_inverse_pred_gain(a_q12: &[i32]) -> i32 {
-    const QA: u32 = 24;
-    const A_LIMIT: i32 = 16_773_022;
-    let order = a_q12.len();
-    let mut a = [0i32; MAX_LPC_ORDER];
-    let mut dc = 0;
-    for k in 0..order {
-        dc += a_q12[k];
-        a[k] = a_q12[k] << (QA - 12);
-    }
-    if dc >= 4096 {
-        return 0;
-    }
-    let mut inv_gain: i32 = 1 << 30;
-    let mul32_frac_q31 = |x: i32, y: i32| rshift_round64(x as i64 * y as i64, 31) as i32;
-    for k in (1..order).rev() {
-        if a[k] > A_LIMIT || a[k] < -A_LIMIT {
-            return 0;
-        }
-        let rc_q31 = -(a[k] << (31 - QA));
-        let rc_mult1 = (1i32 << 30) - smmul(rc_q31, rc_q31);
-        inv_gain = smmul(inv_gain, rc_mult1) << 2;
-        if inv_gain < 107_374 {
-            return 0;
-        }
-        let mult2q = 32 - rc_mult1.unsigned_abs().leading_zeros() as i32;
-        let rc_mult2 = inverse32_varq(rc_mult1, mult2q + 30);
-        for n in 0..(k + 1) >> 1 {
-            let t1 = a[n];
-            let t2 = a[k - n - 1];
-            let v1 = rshift_round64(t1.saturating_sub(mul32_frac_q31(t2, rc_q31)) as i64 * rc_mult2 as i64, mult2q as u32);
-            if v1 > i32::MAX as i64 || v1 < i32::MIN as i64 {
-                return 0;
-            }
-            let v2 = rshift_round64(t2.saturating_sub(mul32_frac_q31(t1, rc_q31)) as i64 * rc_mult2 as i64, mult2q as u32);
-            if v2 > i32::MAX as i64 || v2 < i32::MIN as i64 {
-                return 0;
-            }
-            a[n] = v1 as i32;
-            a[k - n - 1] = v2 as i32;
-        }
-    }
-    if a[0] > A_LIMIT || a[0] < -A_LIMIT {
-        return 0;
-    }
-    let rc_q31 = -(a[0] << (31 - QA));
-    let rc_mult1 = (1i32 << 30) - smmul(rc_q31, rc_q31);
-    inv_gain = smmul(inv_gain, rc_mult1) << 2;
-    if inv_gain < 107_374 {
-        return 0;
-    }
-    inv_gain
-}
-
-/// Converts NLSFs (Q15) to stable Q12 LPC coefficients (`silk_NLSF2A`).
-pub fn nlsf2a(nlsf: &[i32]) -> [i32; MAX_LPC_ORDER] {
-    let d = nlsf.len();
-    let ordering: &[usize] = if d == 16 { &LSF_ORDER_WB } else { &LSF_ORDER_NBMB };
-    let mut c_q17 = [0i32; MAX_LPC_ORDER];
-    for k in 0..d {
-        let i = (nlsf[k] >> 8) as usize;
-        let f = nlsf[k] & 255;
-        let c0 = COS_Q12[i];
-        let c1 = COS_Q12[(i + 1).min(128)];
-        c_q17[ordering[k]] = (c0 * 256 + (c1 - c0) * f + 4) >> 3;
-    }
-    let d2 = d / 2;
-    let find_poly = |off: usize| -> [i64; 10] {
-        let mut out = [0i64; 10];
-        out[0] = 1 << 16;
-        out[1] = -(c_q17[off] as i64);
-        for k in 1..d2 {
-            let ftmp = c_q17[2 * k + off] as i64;
-            out[k + 1] = 2 * out[k - 1] - ((ftmp * out[k] + 32768) >> 16);
-            for n in (2..=k).rev() {
-                out[n] += out[n - 2] - ((ftmp * out[n - 1] + 32768) >> 16);
-            }
-            out[1] -= ftmp;
-        }
-        out
-    };
-    let p = find_poly(0);
-    let q = find_poly(1);
-    let mut a32 = [0i32; MAX_LPC_ORDER];
-    for k in 0..d2 {
-        let ptmp = p[k + 1] + p[k];
-        let qtmp = q[k + 1] - q[k];
-        a32[k] = (-qtmp - ptmp) as i32;
-        a32[d - k - 1] = (qtmp - ptmp) as i32;
-    }
-    let a32 = &mut a32[..d];
-    // Limit the dynamic range (silk_LPC_fit with QIN = 17, QOUT = 12).
-    let mut a_q12 = [0i32; MAX_LPC_ORDER];
-    let mut i = 0;
-    while i < 10 {
-        let mut maxabs = 0i32;
-        let mut idx = 0;
-        for (k, &v) in a32.iter().enumerate() {
-            let av = v.saturating_abs();
-            if av > maxabs {
-                maxabs = av;
-                idx = k;
-            }
-        }
-        let maxabs = rshift_round(maxabs, 5);
-        if maxabs > 32767 {
-            let maxabs = maxabs.min(163_838);
-            let chirp = 65470 - ((maxabs - 32767) << 14) / ((maxabs * (idx as i32 + 1)) >> 2);
-            bwexpander_32(a32, chirp);
-        } else {
-            break;
-        }
-        i += 1;
-    }
-    if i == 10 {
-        for k in 0..d {
-            a_q12[k] = sat16(rshift_round(a32[k], 5));
-            a32[k] = a_q12[k] << 5;
-        }
-    } else {
-        for k in 0..d {
-            a_q12[k] = rshift_round(a32[k], 5);
-        }
-    }
-    for i in 0..16 {
-        if lpc_inverse_pred_gain(&a_q12[..d]) == 0 {
-            bwexpander_32(a32, 65536 - (2 << i));
-            for k in 0..d {
-                a_q12[k] = rshift_round(a32[k], 5);
-            }
-        } else {
-            break;
-        }
-    }
-    a_q12
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn flat_nlsf_gives_small_lpc() {
-        // Uniformly spaced NLSFs correspond to an (almost) flat spectrum.
-        let nlsf: Vec<i32> = (1..=16).map(|k| k * 32768 / 17).collect();
-        let a = nlsf2a(&nlsf);
-        assert!(a.iter().all(|v| v.abs() < 600), "{a:?}");
-        let nlsf: Vec<i32> = (1..=10).map(|k| k * 32768 / 11).collect();
-        let a = nlsf2a(&nlsf);
-        assert!(a[..10].iter().all(|v| v.abs() < 600), "{a:?}");
-    }
-
-    #[test]
-    fn stabilize_enforces_spacing() {
-        let mut v = [100, 90, 80, 30000, 30001, 30002, 31000, 32000, 32700, 32760];
-        nlsf_stabilize(&mut v, &NLSF_MIN_SPACING_NBMB);
-        assert!(v[0] >= NLSF_MIN_SPACING_NBMB[0]);
-        for i in 1..10 {
-            assert!(v[i] - v[i - 1] >= NLSF_MIN_SPACING_NBMB[i], "{v:?}");
-        }
-        assert!(32768 - v[9] >= NLSF_MIN_SPACING_NBMB[10]);
-    }
-
-    #[test]
-    fn inverse_approximations() {
-        for &b in &[65536, 100_000, 1 << 20, 81920, 1_686_110_208] {
-            let inv = inverse32_varq(b, 47) as f64;
-            let exact = 2f64.powi(47) / b as f64;
-            assert!((inv - exact).abs() / exact < 1e-3, "{b}");
-        }
-        let q = div32_varq(65536, 131072, 16) as f64;
-        assert!((q - 32768.0).abs() < 2.0);
-    }
-}

crates/opus/src/silk/resampler.rs

@@ -1,205 +0,0 @@
-//! SILK output resampler (RFC 6716 §4.2.9: non-normative filter, normative delay budget).
-//!
-//! A windowed-sinc polyphase interpolator whose group delay matches the delay allocation of
-//! RFC 6716 Table 54 (and the integer delays used when no rate conversion is needed), so that the
-//! SILK output lines up with the CELT layer in Hybrid mode.
-
-#[derive(Clone)]
-pub struct Resampler {
-    fin: u32,
-    fout: u32,
-    /// Pure-delay mode (equal rates): delay line.
-    copy_delay: usize,
-    /// Polyphase taps per output phase.
-    phases: Vec<(i64, Vec<f32>)>,
-    period: u64,
-    /// Total delay in units of 1/fout input samples.
-    delay_q: i64,
-    half: i64,
-    future: i64,
-    hist: Vec<f32>,
-    /// Absolute input index of `hist[0]`.
-    hist_start: i64,
-    n_in: i64,
-    n_out: u64,
-}
-
-fn gcd(a: u32, b: u32) -> u32 {
-    if b == 0 { a } else { gcd(b, a % b) }
-}
-
-/// Least-squares fractional-delay interpolator: taps at offsets `-past+1 ..= future` (in input
-/// samples) approximating a delay of `frac` samples over `[0, wp]`, with zero response weighted
-/// over `[ws, pi]` when `ws < pi` (decimation).
-fn design_fractional(past: i64, future: i64, frac: f64, wp: f64, ws: f64) -> Vec<f64> {
-    let offs: Vec<f64> = ((-past + 1)..=future).map(|m| m as f64).collect();
-    let n = offs.len();
-    // \int_a^b cos(w x) dw
-    let ic = |x: f64, a: f64, b: f64| if x.abs() < 1e-12 { b - a } else { ((b * x).sin() - (a * x).sin()) / x };
-    let stop_w = 30.0;
-    const LOW_W: f64 = 0.05;
-    let mut q = vec![vec![0f64; n + 1]; n];
-    for i in 0..n {
-        for k in 0..n {
-            let d = offs[i] - offs[k];
-            let mut v = ic(d, 0.0, 0.6 * wp) + LOW_W * ic(d, 0.6 * wp, wp);
-            if ws < std::f64::consts::PI {
-                v += stop_w * ic(d, ws, std::f64::consts::PI);
-            }
-            q[i][k] = v + if i == k { 1e-9 } else { 0.0 };
-        }
-        q[i][n] = ic(offs[i] - frac, 0.0, 0.6 * wp) + LOW_W * ic(offs[i] - frac, 0.6 * wp, wp);
-    }
-    // Gaussian elimination with partial pivoting.
-    for c in 0..n {
-        let p = (c..n).max_by(|&a, &b| q[a][c].abs().total_cmp(&q[b][c].abs())).unwrap_or(c);
-        q.swap(c, p);
-        let piv = q[c][c];
-        for r in 0..n {
-            if r != c {
-                let f = q[r][c] / piv;
-                if f != 0.0 {
-                    for k in c..=n {
-                        q[r][k] -= f * q[c][k];
-                    }
-                }
-            }
-        }
-    }
-    (0..n).map(|i| q[i][n] / q[i][i]).collect()
-}
-
-impl Resampler {
-    pub fn new(fin: u32, fout: u32) -> Resampler {
-        let mut r = Resampler {
-            fin,
-            fout,
-            copy_delay: 0,
-            phases: Vec::new(),
-            period: 1,
-            delay_q: 0,
-            half: 0,
-            future: 0,
-            hist: Vec::new(),
-            hist_start: 0,
-            n_in: 0,
-            n_out: 0,
-        };
-        if fin == fout {
-            r.copy_delay = match fin {
-                8000 => 4,
-                12000 => 9,
-                _ => 12,
-            };
-            r.hist = vec![0.0; r.copy_delay];
-            return r;
-        }
-        // Delay in milliseconds per internal bandwidth (RFC 6716 Table 54).
-        let delay_ms = match fin {
-            8000 => 0.538,
-            12000 => 0.692,
-            _ => 0.706,
-        };
-        let d_in = delay_ms * fin as f64 / 1000.0; // input samples
-        // Future taps are limited by the delay budget; past taps are free.
-        let future = (d_in.floor() as i64).max(1);
-        let past = 24i64;
-        r.half = past;
-        r.future = future;
-        r.delay_q = (d_in * fout as f64).round() as i64;
-        let g = gcd(fin, fout);
-        r.period = (fout / g) as u64;
-        let pi = std::f64::consts::PI;
-        // Passband edge and (for decimation) stopband edge in radians per input sample.
-        let (wp, ws) = if fout > fin { (0.94 * pi, pi) } else { (0.88 * pi * fout as f64 / fin as f64, pi * fout as f64 / fin as f64) };
-        for j in 0..r.period as i64 {
-            let num = j * fin as i64 - r.delay_q;
-            let base = num.div_euclid(fout as i64);
-            let frac = num.rem_euclid(fout as i64) as f64 / fout as f64;
-            let taps = design_fractional(past, future, frac, wp, ws);
-            r.phases.push((base, taps.iter().map(|&t| t as f32).collect()));
-        }
-        r.hist = vec![0.0; (past + future + 4) as usize];
-        r.hist_start = -(past + future + 4);
-        r
-    }
-
-    pub fn rates(&self) -> (u32, u32) {
-        (self.fin, self.fout)
-    }
-
-    /// Resamples `input` (16-bit scale) and appends the output samples.
-    pub fn process(&mut self, input: &[i16], out: &mut Vec<f32>) {
-        if self.fin == self.fout {
-            for &v in input {
-                self.hist.push(v as f32);
-            }
-            let n = self.hist.len() - self.copy_delay;
-            out.extend_from_slice(&self.hist[..n]);
-            self.hist.drain(..n);
-            return;
-        }
-        self.hist.extend(input.iter().map(|&v| v as f32));
-        self.n_in += input.len() as i64;
-        let total_out = (self.n_in as u64 * self.fout as u64) / self.fin as u64;
-        while self.n_out < total_out {
-            let j = self.n_out;
-            let cycle = (j / self.period) as i64;
-            let (base0, ref taps) = self.phases[(j % self.period) as usize];
-            let base = base0 + cycle * self.fin as i64 * self.period as i64 / self.fout as i64;
-            let first = base - self.half + 1;
-            let mut acc = 0f32;
-            for (m, &t) in taps.iter().enumerate() {
-                let idx = first + m as i64 - self.hist_start;
-                if idx >= 0 && (idx as usize) < self.hist.len() {
-                    acc += self.hist[idx as usize] * t;
-                }
-            }
-            out.push(acc);
-            self.n_out += 1;
-        }
-        // Trim history, keeping enough for the next taps.
-        let keep_from = self.n_in - (self.half + self.future + 4);
-        if keep_from > self.hist_start {
-            let drop = (keep_from - self.hist_start) as usize;
-            self.hist.drain(..drop.min(self.hist.len()));
-            self.hist_start = keep_from;
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn upsample_sine_and_delay() {
-        for &(fin, fout) in &[(16000u32, 48000u32), (8000, 48000), (12000, 48000), (16000, 24000), (16000, 8000), (12000, 16000)] {
-            let mut r = Resampler::new(fin, fout);
-            let f = 440.0;
-            let n = fin as usize / 10;
-            let x: Vec<i16> = (0..n).map(|i| ((2.0 * std::f64::consts::PI * f * i as f64 / fin as f64).sin() * 10000.0) as i16).collect();
-            let mut y = Vec::new();
-            for c in x.chunks(fin as usize / 50) {
-                r.process(c, &mut y);
-            }
-            assert_eq!(y.len(), n * fout as usize / fin as usize);
-            // Compare against the ideal delayed sine.
-            let delay_ms = match fin {
-                8000 => 0.538,
-                12000 => 0.692,
-                _ => 0.706,
-            };
-            let mut err = 0f64;
-            let mut sig = 0f64;
-            for (j, &v) in y.iter().enumerate().skip(fout as usize / 100) {
-                let t = j as f64 / fout as f64 - delay_ms / 1000.0;
-                let ideal = (2.0 * std::f64::consts::PI * f * t).sin() * 10000.0;
-                err += (v as f64 - ideal).powi(2);
-                sig += ideal * ideal;
-            }
-            let snr = 10.0 * (sig / err).log10();
-            assert!(snr > 35.0, "{fin}->{fout}: {snr} dB");
-        }
-    }
-}

crates/opus/src/silk/tables.rs

@@ -1,540 +0,0 @@
-//! SILK probability tables and codebooks, transcribed from RFC 6716 §4.2 (Tables 4–53).
-//!
-//! PDFs are written as in the RFC (`{...}/256`) and converted at compile time to the inverse-CDF
-//! form consumed by the range decoder.
-
-/// Converts a PDF (summing to 256) into an inverse CDF (`256 - cdf[i+1]`).
-pub const fn icdf<const N: usize>(pdf: &[u8; N]) -> [u8; N] {
-    let mut out = [0u8; N];
-    let mut acc: u32 = 0;
-    let mut i = 0;
-    while i < N {
-        acc += pdf[i] as u32;
-        out[i] = (256 - acc) as u8;
-        i += 1;
-    }
-    out
-}
-
-pub const STEREO_PRED_JOINT: [u8; 25] = icdf(&[7, 2, 1, 1, 1, 10, 24, 8, 1, 1, 3, 23, 92, 23, 3, 1, 1, 8, 24, 10, 1, 1, 1, 2, 7]);
-pub const UNIFORM3: [u8; 3] = icdf(&[85, 86, 85]);
-pub const UNIFORM5: [u8; 5] = icdf(&[51, 51, 52, 51, 51]);
-pub const STEREO_WEIGHTS_Q13: [i32; 16] = [-13732, -10050, -8266, -7526, -6500, -5000, -2950, -820, 820, 2950, 5000, 6500, 7526, 8266, 10050, 13732];
-pub const MID_ONLY: [u8; 2] = icdf(&[192, 64]);
-pub const TYPE_INACTIVE: [u8; 2] = icdf(&[26, 230]);
-pub const TYPE_ACTIVE: [u8; 4] = icdf(&[24, 74, 148, 10]);
-pub const GAIN_MSB: [&[u8]; 3] =
-    [&icdf::<8>(&[32, 112, 68, 29, 12, 1, 1, 1]), &icdf::<8>(&[2, 17, 45, 60, 62, 47, 19, 4]), &icdf::<8>(&[1, 3, 26, 71, 94, 50, 9, 2])];
-pub const UNIFORM8: [u8; 8] = icdf(&[32, 32, 32, 32, 32, 32, 32, 32]);
-pub const DELTA_GAIN: [u8; 41] =
-    icdf(&[6, 5, 11, 31, 132, 21, 8, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]);
-pub const NLSF_STAGE1: [&[u8]; 4] = [
-    &icdf::<32>(&[44, 34, 30, 19, 21, 12, 11, 3, 3, 2, 16, 2, 2, 1, 5, 2, 1, 3, 3, 1, 1, 2, 2, 2, 3, 1, 9, 9, 2, 7, 2, 1]),
-    &icdf::<32>(&[1, 10, 1, 8, 3, 8, 8, 14, 13, 14, 1, 14, 12, 13, 11, 11, 12, 11, 10, 10, 11, 8, 9, 8, 7, 8, 1, 1, 6, 1, 6, 5]),
-    &icdf::<32>(&[31, 21, 3, 17, 1, 8, 17, 4, 1, 18, 16, 4, 2, 3, 1, 10, 1, 3, 16, 11, 16, 2, 2, 3, 2, 11, 1, 4, 9, 8, 7, 3]),
-    &icdf::<32>(&[1, 4, 16, 5, 18, 11, 5, 14, 15, 1, 3, 12, 13, 14, 14, 6, 14, 12, 2, 6, 1, 12, 12, 11, 10, 3, 10, 5, 1, 1, 1, 3]),
-];
-pub const NLSF_STAGE2: [&[u8]; 16] = [
-    &icdf::<9>(&[1, 1, 1, 15, 224, 11, 1, 1, 1]),
-    &icdf::<9>(&[1, 1, 2, 34, 183, 32, 1, 1, 1]),
-    &icdf::<9>(&[1, 1, 4, 42, 149, 55, 2, 1, 1]),
-    &icdf::<9>(&[1, 1, 8, 52, 123, 61, 8, 1, 1]),
-    &icdf::<9>(&[1, 3, 16, 53, 101, 74, 6, 1, 1]),
-    &icdf::<9>(&[1, 3, 17, 55, 90, 73, 15, 1, 1]),
-    &icdf::<9>(&[1, 7, 24, 53, 74, 67, 26, 3, 1]),
-    &icdf::<9>(&[1, 1, 18, 63, 78, 58, 30, 6, 1]),
-    &icdf::<9>(&[1, 1, 1, 9, 232, 9, 1, 1, 1]),
-    &icdf::<9>(&[1, 1, 2, 28, 186, 35, 1, 1, 1]),
-    &icdf::<9>(&[1, 1, 3, 42, 152, 53, 2, 1, 1]),
-    &icdf::<9>(&[1, 1, 10, 49, 126, 65, 2, 1, 1]),
-    &icdf::<9>(&[1, 4, 19, 48, 100, 77, 5, 1, 1]),
-    &icdf::<9>(&[1, 1, 14, 54, 100, 72, 12, 1, 1]),
-    &icdf::<9>(&[1, 1, 15, 61, 87, 61, 25, 4, 1]),
-    &icdf::<9>(&[1, 7, 21, 50, 77, 81, 17, 1, 1]),
-];
-pub const NLSF_SEL_NBMB: [[u8; 10]; 32] = [
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [1, 3, 1, 2, 2, 1, 2, 1, 1, 1],
-    [2, 1, 1, 1, 1, 1, 1, 1, 1, 1],
-    [1, 2, 2, 2, 2, 1, 2, 1, 1, 1],
-    [2, 3, 3, 3, 3, 2, 2, 2, 2, 2],
-    [0, 5, 3, 3, 2, 2, 2, 2, 1, 1],
-    [0, 2, 2, 2, 2, 2, 2, 2, 2, 1],
-    [2, 3, 6, 4, 4, 4, 5, 4, 5, 5],
-    [2, 4, 5, 5, 4, 5, 4, 6, 4, 4],
-    [2, 4, 4, 7, 4, 5, 4, 5, 5, 4],
-    [4, 3, 3, 3, 2, 3, 2, 2, 2, 2],
-    [1, 5, 5, 6, 4, 5, 4, 5, 5, 5],
-    [2, 7, 4, 6, 5, 5, 5, 5, 5, 5],
-    [2, 7, 5, 5, 5, 5, 5, 6, 5, 4],
-    [3, 3, 5, 4, 4, 5, 4, 5, 4, 4],
-    [2, 3, 3, 5, 5, 4, 4, 4, 4, 4],
-    [2, 4, 4, 6, 4, 5, 4, 5, 5, 5],
-    [2, 5, 4, 6, 5, 5, 5, 4, 5, 4],
-    [2, 7, 4, 5, 4, 5, 4, 5, 5, 5],
-    [2, 5, 4, 6, 7, 6, 5, 6, 5, 4],
-    [3, 6, 7, 4, 6, 5, 5, 6, 4, 5],
-    [2, 7, 6, 4, 4, 4, 5, 4, 5, 5],
-    [4, 5, 5, 4, 6, 6, 5, 6, 5, 4],
-    [2, 5, 5, 6, 5, 6, 4, 6, 4, 4],
-    [4, 5, 5, 5, 3, 7, 4, 5, 5, 4],
-    [2, 3, 4, 5, 5, 6, 4, 5, 5, 4],
-    [2, 3, 2, 3, 3, 4, 2, 3, 3, 3],
-    [1, 1, 2, 2, 2, 2, 2, 3, 2, 2],
-    [4, 5, 5, 6, 6, 6, 5, 6, 4, 5],
-    [3, 5, 5, 4, 4, 4, 4, 3, 3, 2],
-    [2, 5, 3, 7, 5, 5, 4, 4, 5, 4],
-    [4, 4, 5, 4, 5, 6, 5, 6, 5, 4],
-];
-pub const NLSF_SEL_WB: [[u8; 16]; 32] = [
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [2, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 0, 3],
-    [2, 5, 5, 3, 7, 4, 4, 5, 2, 5, 4, 5, 5, 4, 3, 3],
-    [0, 2, 1, 2, 2, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1],
-    [0, 6, 5, 4, 6, 4, 7, 5, 4, 4, 4, 5, 5, 4, 4, 3],
-    [0, 3, 5, 5, 4, 3, 3, 5, 3, 3, 3, 3, 3, 3, 2, 4],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 2, 6, 3, 7, 2, 5, 3, 4, 5, 5, 4, 3, 3, 2, 3],
-    [0, 6, 2, 6, 6, 4, 5, 4, 6, 5, 4, 4, 5, 3, 3, 3],
-    [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
-    [2, 2, 3, 4, 5, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 3],
-    [2, 2, 3, 3, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 1, 3],
-    [3, 4, 4, 4, 6, 4, 4, 5, 3, 5, 4, 4, 5, 4, 3, 4],
-    [0, 6, 4, 5, 4, 7, 5, 2, 6, 5, 7, 4, 4, 3, 5, 3],
-    [0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0],
-    [1, 6, 5, 7, 5, 4, 5, 3, 4, 5, 4, 4, 4, 3, 3, 4],
-    [1, 3, 3, 4, 4, 3, 3, 5, 2, 3, 3, 5, 5, 5, 3, 4],
-    [2, 3, 3, 2, 2, 2, 3, 2, 1, 2, 1, 2, 1, 1, 1, 4],
-    [0, 2, 3, 5, 3, 3, 2, 2, 2, 1, 1, 0, 0, 0, 0, 0],
-    [3, 4, 3, 5, 3, 3, 2, 2, 1, 1, 1, 1, 1, 2, 2, 4],
-    [2, 6, 3, 7, 7, 4, 5, 4, 5, 3, 5, 3, 3, 2, 3, 3],
-    [2, 3, 5, 6, 6, 3, 5, 3, 4, 4, 3, 3, 3, 3, 2, 4],
-    [1, 3, 3, 4, 4, 4, 4, 3, 5, 5, 5, 3, 1, 1, 1, 1],
-    [2, 5, 3, 6, 6, 4, 7, 4, 4, 5, 3, 4, 4, 3, 3, 3],
-    [0, 6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 6, 6, 3, 5, 2, 5, 5, 3, 4, 4, 7, 7, 4, 4, 4],
-    [3, 3, 7, 3, 5, 4, 3, 3, 3, 2, 2, 3, 3, 3, 2, 3],
-    [0, 0, 1, 0, 0, 0, 2, 1, 2, 1, 1, 2, 2, 2, 1, 1],
-    [0, 3, 2, 5, 3, 3, 2, 3, 2, 1, 0, 0, 1, 0, 0, 1],
-    [3, 5, 5, 4, 7, 5, 3, 3, 2, 3, 2, 2, 1, 0, 1, 0],
-    [2, 3, 5, 3, 4, 3, 3, 3, 2, 1, 2, 6, 4, 0, 0, 0],
-];
-pub const NLSF_EXT: [u8; 7] = icdf(&[156, 60, 24, 9, 4, 2, 1]);
-pub const NLSF_PRED_NBMB: [[i32; 9]; 2] = [[179, 138, 140, 148, 151, 149, 153, 151, 163], [116, 67, 82, 59, 92, 72, 100, 89, 92]];
-pub const NLSF_PRED_WB: [[i32; 15]; 2] = [
-    [175, 148, 160, 176, 178, 173, 174, 164, 177, 174, 196, 182, 198, 192, 182],
-    [68, 62, 66, 60, 72, 117, 85, 90, 118, 136, 151, 142, 160, 142, 155],
-];
-pub const NLSF_PSEL_NBMB: [[u8; 9]; 32] = [
-    [0, 1, 0, 0, 0, 0, 0, 0, 0],
-    [1, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [1, 1, 1, 0, 0, 0, 0, 1, 0],
-    [0, 1, 0, 0, 0, 0, 0, 0, 0],
-    [0, 1, 0, 0, 0, 0, 0, 0, 0],
-    [1, 0, 1, 1, 0, 0, 0, 1, 0],
-    [0, 1, 1, 0, 0, 1, 1, 0, 0],
-    [0, 0, 1, 1, 0, 1, 0, 1, 1],
-    [0, 0, 1, 1, 0, 0, 1, 1, 1],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 1, 0, 1, 1, 1, 1, 1, 0],
-    [0, 1, 0, 1, 1, 1, 1, 1, 0],
-    [0, 1, 1, 1, 1, 1, 1, 1, 0],
-    [1, 0, 1, 1, 0, 1, 1, 1, 1],
-    [0, 1, 1, 1, 1, 1, 0, 1, 0],
-    [0, 0, 1, 1, 0, 1, 0, 1, 0],
-    [0, 0, 1, 1, 1, 0, 1, 1, 1],
-    [0, 1, 1, 0, 0, 1, 1, 1, 0],
-    [0, 0, 0, 1, 1, 1, 0, 1, 0],
-    [0, 1, 1, 0, 0, 1, 0, 1, 0],
-    [0, 1, 1, 0, 0, 0, 1, 1, 0],
-    [0, 0, 0, 0, 0, 1, 1, 1, 1],
-    [0, 0, 1, 1, 0, 0, 0, 1, 1],
-    [0, 0, 0, 1, 0, 1, 1, 1, 1],
-    [0, 1, 1, 1, 1, 1, 1, 1, 0],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 0, 1, 0, 1, 1, 0, 1, 0],
-    [1, 0, 0, 1, 0, 0, 0, 0, 0],
-    [0, 0, 0, 1, 1, 0, 1, 0, 1],
-    [1, 0, 1, 1, 0, 1, 1, 1, 1],
-];
-pub const NLSF_PSEL_WB: [[u8; 15]; 32] = [
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0],
-    [0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0],
-    [0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0],
-    [0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1],
-    [0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
-    [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0],
-    [0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0],
-    [0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0],
-    [0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1],
-    [0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0],
-    [0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0],
-    [0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
-    [0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0],
-    [0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0],
-    [0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0],
-    [0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
-    [0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1],
-    [0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
-    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
-    [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0],
-    [0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0],
-];
-pub const NLSF_CB_NBMB: [[i32; 10]; 32] = [
-    [12, 35, 60, 83, 108, 132, 157, 180, 206, 228],
-    [15, 32, 55, 77, 101, 125, 151, 175, 201, 225],
-    [19, 42, 66, 89, 114, 137, 162, 184, 209, 230],
-    [12, 25, 50, 72, 97, 120, 147, 172, 200, 223],
-    [26, 44, 69, 90, 114, 135, 159, 180, 205, 225],
-    [13, 22, 53, 80, 106, 130, 156, 180, 205, 228],
-    [15, 25, 44, 64, 90, 115, 142, 168, 196, 222],
-    [19, 24, 62, 82, 100, 120, 145, 168, 190, 214],
-    [22, 31, 50, 79, 103, 120, 151, 170, 203, 227],
-    [21, 29, 45, 65, 106, 124, 150, 171, 196, 224],
-    [30, 49, 75, 97, 121, 142, 165, 186, 209, 229],
-    [19, 25, 52, 70, 93, 116, 143, 166, 192, 219],
-    [26, 34, 62, 75, 97, 118, 145, 167, 194, 217],
-    [25, 33, 56, 70, 91, 113, 143, 165, 196, 223],
-    [21, 34, 51, 72, 97, 117, 145, 171, 196, 222],
-    [20, 29, 50, 67, 90, 117, 144, 168, 197, 221],
-    [22, 31, 48, 66, 95, 117, 146, 168, 196, 222],
-    [24, 33, 51, 77, 116, 134, 158, 180, 200, 224],
-    [21, 28, 70, 87, 106, 124, 149, 170, 194, 217],
-    [26, 33, 53, 64, 83, 117, 152, 173, 204, 225],
-    [27, 34, 65, 95, 108, 129, 155, 174, 210, 225],
-    [20, 26, 72, 99, 113, 131, 154, 176, 200, 219],
-    [34, 43, 61, 78, 93, 114, 155, 177, 205, 229],
-    [23, 29, 54, 97, 124, 138, 163, 179, 209, 229],
-    [30, 38, 56, 89, 118, 129, 158, 178, 200, 231],
-    [21, 29, 49, 63, 85, 111, 142, 163, 193, 222],
-    [27, 48, 77, 103, 133, 158, 179, 196, 215, 232],
-    [29, 47, 74, 99, 124, 151, 176, 198, 220, 237],
-    [33, 42, 61, 76, 93, 121, 155, 174, 207, 225],
-    [29, 53, 87, 112, 136, 154, 170, 188, 208, 227],
-    [24, 30, 52, 84, 131, 150, 166, 186, 203, 229],
-    [37, 48, 64, 84, 104, 118, 156, 177, 201, 230],
-];
-pub const NLSF_CB_WB: [[i32; 16]; 32] = [
-    [7, 23, 38, 54, 69, 85, 100, 116, 131, 147, 162, 178, 193, 208, 223, 239],
-    [13, 25, 41, 55, 69, 83, 98, 112, 127, 142, 157, 171, 187, 203, 220, 236],
-    [15, 21, 34, 51, 61, 78, 92, 106, 126, 136, 152, 167, 185, 205, 225, 240],
-    [10, 21, 36, 50, 63, 79, 95, 110, 126, 141, 157, 173, 189, 205, 221, 237],
-    [17, 20, 37, 51, 59, 78, 89, 107, 123, 134, 150, 164, 184, 205, 224, 240],
-    [10, 15, 32, 51, 67, 81, 96, 112, 129, 142, 158, 173, 189, 204, 220, 236],
-    [8, 21, 37, 51, 65, 79, 98, 113, 126, 138, 155, 168, 179, 192, 209, 218],
-    [12, 15, 34, 55, 63, 78, 87, 108, 118, 131, 148, 167, 185, 203, 219, 236],
-    [16, 19, 32, 36, 56, 79, 91, 108, 118, 136, 154, 171, 186, 204, 220, 237],
-    [11, 28, 43, 58, 74, 89, 105, 120, 135, 150, 165, 180, 196, 211, 226, 241],
-    [6, 16, 33, 46, 60, 75, 92, 107, 123, 137, 156, 169, 185, 199, 214, 225],
-    [11, 19, 30, 44, 57, 74, 89, 105, 121, 135, 152, 169, 186, 202, 218, 234],
-    [12, 19, 29, 46, 57, 71, 88, 100, 120, 132, 148, 165, 182, 199, 216, 233],
-    [17, 23, 35, 46, 56, 77, 92, 106, 123, 134, 152, 167, 185, 204, 222, 237],
-    [14, 17, 45, 53, 63, 75, 89, 107, 115, 132, 151, 171, 188, 206, 221, 240],
-    [9, 16, 29, 40, 56, 71, 88, 103, 119, 137, 154, 171, 189, 205, 222, 237],
-    [16, 19, 36, 48, 57, 76, 87, 105, 118, 132, 150, 167, 185, 202, 218, 236],
-    [12, 17, 29, 54, 71, 81, 94, 104, 126, 136, 149, 164, 182, 201, 221, 237],
-    [15, 28, 47, 62, 79, 97, 115, 129, 142, 155, 168, 180, 194, 208, 223, 238],
-    [8, 14, 30, 45, 62, 78, 94, 111, 127, 143, 159, 175, 192, 207, 223, 239],
-    [17, 30, 49, 62, 79, 92, 107, 119, 132, 145, 160, 174, 190, 204, 220, 235],
-    [14, 19, 36, 45, 61, 76, 91, 108, 121, 138, 154, 172, 189, 205, 222, 238],
-    [12, 18, 31, 45, 60, 76, 91, 107, 123, 138, 154, 171, 187, 204, 221, 236],
-    [13, 17, 31, 43, 53, 70, 83, 103, 114, 131, 149, 167, 185, 203, 220, 237],
-    [17, 22, 35, 42, 58, 78, 93, 110, 125, 139, 155, 170, 188, 206, 224, 240],
-    [8, 15, 34, 50, 67, 83, 99, 115, 131, 146, 162, 178, 193, 209, 224, 239],
-    [13, 16, 41, 66, 73, 86, 95, 111, 128, 137, 150, 163, 183, 206, 225, 241],
-    [17, 25, 37, 52, 63, 75, 92, 102, 119, 132, 144, 160, 175, 191, 212, 231],
-    [19, 31, 49, 65, 83, 100, 117, 133, 147, 161, 174, 187, 200, 213, 227, 242],
-    [18, 31, 52, 68, 88, 103, 117, 126, 138, 149, 163, 177, 192, 207, 223, 239],
-    [16, 29, 47, 61, 76, 90, 106, 119, 133, 147, 161, 176, 193, 209, 224, 240],
-    [15, 21, 35, 50, 61, 73, 86, 97, 110, 119, 129, 141, 175, 198, 218, 237],
-];
-pub const NLSF_MIN_SPACING_NBMB: [i32; 11] = [250, 3, 6, 3, 3, 3, 4, 3, 3, 3, 461];
-pub const NLSF_MIN_SPACING_WB: [i32; 17] = [100, 3, 40, 3, 3, 3, 5, 14, 14, 10, 11, 3, 8, 9, 7, 3, 347];
-pub const NLSF_INTERP: [u8; 5] = icdf(&[13, 22, 29, 11, 181]);
-pub const LSF_ORDER_NBMB: [usize; 10] = [0, 9, 6, 3, 4, 5, 8, 1, 2, 7];
-pub const LSF_ORDER_WB: [usize; 16] = [0, 15, 8, 7, 4, 11, 12, 3, 2, 13, 10, 5, 6, 9, 14, 1];
-pub const COS_Q12: [i32; 129] = [
-    4096, 4095, 4091, 4085, 4076, 4065, 4052, 4036, 4017, 3997, 3973, 3948, 3920, 3889, 3857, 3822, 3784, 3745, 3703, 3659, 3613, 3564, 3513, 3461,
-    3406, 3349, 3290, 3229, 3166, 3102, 3035, 2967, 2896, 2824, 2751, 2676, 2599, 2520, 2440, 2359, 2276, 2191, 2106, 2019, 1931, 1842, 1751, 1660,
-    1568, 1474, 1380, 1285, 1189, 1093, 995, 897, 799, 700, 601, 501, 401, 301, 201, 101, 0, -101, -201, -301, -401, -501, -601, -700, -799, -897,
-    -995, -1093, -1189, -1285, -1380, -1474, -1568, -1660, -1751, -1842, -1931, -2019, -2106, -2191, -2276, -2359, -2440, -2520, -2599, -2676, -2751,
-    -2824, -2896, -2967, -3035, -3102, -3166, -3229, -3290, -3349, -3406, -3461, -3513, -3564, -3613, -3659, -3703, -3745, -3784, -3822, -3857,
-    -3889, -3920, -3948, -3973, -3997, -4017, -4036, -4052, -4065, -4076, -4085, -4091, -4095, -4096,
-];
-pub const PITCH_HIGH: [u8; 32] = icdf(&[3, 3, 6, 11, 21, 30, 32, 19, 11, 10, 12, 13, 13, 12, 11, 9, 8, 7, 6, 4, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1]);
-pub const PITCH_LOW: [&[u8]; 3] =
-    [&icdf::<4>(&[64, 64, 64, 64]), &icdf::<6>(&[43, 42, 43, 43, 42, 43]), &icdf::<8>(&[32, 32, 32, 32, 32, 32, 32, 32])];
-pub const PITCH_DELTA: [u8; 21] = icdf(&[46, 2, 2, 3, 4, 6, 10, 15, 26, 38, 30, 22, 15, 10, 7, 6, 4, 4, 2, 2, 2]);
-pub const PITCH_CONTOUR: [&[u8]; 4] = [
-    &icdf::<3>(&[143, 50, 63]),
-    &icdf::<11>(&[68, 12, 21, 17, 19, 22, 30, 24, 17, 16, 10]),
-    &icdf::<12>(&[91, 46, 39, 19, 14, 12, 8, 7, 6, 5, 5, 4]),
-    &icdf::<34>(&[33, 22, 18, 16, 15, 14, 14, 13, 13, 10, 9, 9, 8, 6, 6, 6, 5, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1]),
-];
-pub const CB_NB_10: [[i32; 2]; 3] = [[0, 0], [1, 0], [0, 1]];
-pub const CB_NB_20: [[i32; 4]; 11] = [
-    [0, 0, 0, 0],
-    [2, 1, 0, -1],
-    [-1, 0, 1, 2],
-    [-1, 0, 0, 1],
-    [-1, 0, 0, 0],
-    [0, 0, 0, 1],
-    [0, 0, 1, 1],
-    [1, 1, 0, 0],
-    [1, 0, 0, 0],
-    [0, 0, 0, -1],
-    [1, 0, 0, -1],
-];
-pub const CB_WB_10: [[i32; 2]; 12] = [[0, 0], [0, 1], [1, 0], [-1, 1], [1, -1], [-1, 2], [2, -1], [-2, 2], [2, -2], [-2, 3], [3, -2], [-3, 3]];
-pub const CB_WB_20: [[i32; 4]; 34] = [
-    [0, 0, 0, 0],
-    [0, 0, 1, 1],
-    [1, 1, 0, 0],
-    [-1, 0, 0, 0],
-    [0, 0, 0, 1],
-    [1, 0, 0, 0],
-    [-1, 0, 0, 1],
-    [0, 0, 0, -1],
-    [-1, 0, 1, 2],
-    [1, 0, 0, -1],
-    [-2, -1, 1, 2],
-    [2, 1, 0, -1],
-    [-2, 0, 0, 2],
-    [-2, 0, 1, 3],
-    [2, 1, -1, -2],
-    [-3, -1, 1, 3],
-    [2, 0, 0, -2],
-    [3, 1, 0, -2],
-    [-3, -1, 2, 4],
-    [-4, -1, 1, 4],
-    [3, 1, -1, -3],
-    [-4, -1, 2, 5],
-    [4, 2, -1, -3],
-    [4, 1, -1, -4],
-    [-5, -1, 2, 6],
-    [5, 2, -1, -4],
-    [-6, -2, 2, 6],
-    [-5, -2, 2, 5],
-    [6, 2, -1, -5],
-    [-7, -2, 3, 8],
-    [6, 2, -2, -6],
-    [5, 2, -2, -5],
-    [8, 3, -2, -7],
-    [-9, -3, 3, 9],
-];
-pub const LTP_PERIODICITY: [u8; 3] = icdf(&[77, 80, 99]);
-pub const LTP_FILTER: [&[u8]; 3] = [
-    &icdf::<8>(&[185, 15, 13, 13, 9, 9, 6, 6]),
-    &icdf::<16>(&[57, 34, 21, 20, 15, 13, 12, 13, 10, 10, 9, 10, 9, 8, 7, 8]),
-    &icdf::<32>(&[15, 16, 14, 12, 12, 12, 11, 11, 11, 10, 9, 9, 9, 9, 8, 8, 8, 8, 7, 7, 6, 6, 5, 4, 5, 4, 4, 4, 3, 4, 3, 2]),
-];
-pub const LTP_TAPS_0: [[i32; 5]; 8] = [
-    [4, 6, 24, 7, 5],
-    [0, 0, 2, 0, 0],
-    [12, 28, 41, 13, -4],
-    [-9, 15, 42, 25, 14],
-    [1, -2, 62, 41, -9],
-    [-10, 37, 65, -4, 3],
-    [-6, 4, 66, 7, -8],
-    [16, 14, 38, -3, 33],
-];
-pub const LTP_TAPS_1: [[i32; 5]; 16] = [
-    [13, 22, 39, 23, 12],
-    [-1, 36, 64, 27, -6],
-    [-7, 10, 55, 43, 17],
-    [1, 1, 8, 1, 1],
-    [6, -11, 74, 53, -9],
-    [-12, 55, 76, -12, 8],
-    [-3, 3, 93, 27, -4],
-    [26, 39, 59, 3, -8],
-    [2, 0, 77, 11, 9],
-    [-8, 22, 44, -6, 7],
-    [40, 9, 26, 3, 9],
-    [-7, 20, 101, -7, 4],
-    [3, -8, 42, 26, 0],
-    [-15, 33, 68, 2, 23],
-    [-2, 55, 46, -2, 15],
-    [3, -1, 21, 16, 41],
-];
-pub const LTP_TAPS_2: [[i32; 5]; 32] = [
-    [-6, 27, 61, 39, 5],
-    [-11, 42, 88, 4, 1],
-    [-2, 60, 65, 6, -4],
-    [-1, -5, 73, 56, 1],
-    [-9, 19, 94, 29, -9],
-    [0, 12, 99, 6, 4],
-    [8, -19, 102, 46, -13],
-    [3, 2, 13, 3, 2],
-    [9, -21, 84, 72, -18],
-    [-11, 46, 104, -22, 8],
-    [18, 38, 48, 23, 0],
-    [-16, 70, 83, -21, 11],
-    [5, -11, 117, 22, -8],
-    [-6, 23, 117, -12, 3],
-    [3, -8, 95, 28, 4],
-    [-10, 15, 77, 60, -15],
-    [-1, 4, 124, 2, -4],
-    [3, 38, 84, 24, -25],
-    [2, 13, 42, 13, 31],
-    [21, -4, 56, 46, -1],
-    [-1, 35, 79, -13, 19],
-    [-7, 65, 88, -9, -14],
-    [20, 4, 81, 49, -29],
-    [20, 0, 75, 3, -17],
-    [5, -9, 44, 92, -8],
-    [1, -3, 22, 69, 31],
-    [-6, 95, 41, -12, 5],
-    [39, 67, 16, -4, 1],
-    [0, -6, 120, 55, -36],
-    [-13, 44, 122, 4, -24],
-    [81, 5, 11, 3, 7],
-    [2, 0, 9, 10, 88],
-];
-pub const LTP_SCALE: [u8; 3] = icdf(&[128, 64, 64]);
-pub const UNIFORM4: [u8; 4] = icdf(&[64, 64, 64, 64]);
-pub const RATE_LEVEL: [&[u8]; 2] = [&icdf::<9>(&[15, 51, 12, 46, 45, 13, 33, 27, 14]), &icdf::<9>(&[33, 30, 36, 17, 34, 49, 18, 21, 18])];
-pub const PULSE_COUNT: [&[u8]; 11] = [
-    &icdf::<18>(&[131, 74, 25, 8, 3, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
-    &icdf::<18>(&[58, 93, 60, 23, 7, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
-    &icdf::<18>(&[43, 51, 46, 33, 24, 16, 11, 8, 6, 3, 3, 3, 2, 1, 1, 2, 1, 2]),
-    &icdf::<18>(&[17, 52, 71, 57, 31, 12, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
-    &icdf::<18>(&[6, 21, 41, 53, 49, 35, 21, 11, 6, 3, 2, 2, 1, 1, 1, 1, 1, 1]),
-    &icdf::<18>(&[7, 14, 22, 28, 29, 28, 25, 20, 17, 13, 11, 9, 7, 5, 4, 4, 3, 10]),
-    &icdf::<18>(&[2, 5, 14, 29, 42, 46, 41, 31, 19, 11, 6, 3, 2, 1, 1, 1, 1, 1]),
-    &icdf::<18>(&[1, 2, 4, 10, 19, 29, 35, 37, 34, 28, 20, 14, 8, 5, 4, 2, 2, 2]),
-    &icdf::<18>(&[1, 2, 2, 5, 9, 14, 20, 24, 27, 28, 26, 23, 20, 15, 11, 8, 6, 15]),
-    &icdf::<18>(&[1, 1, 1, 6, 27, 58, 56, 39, 25, 14, 10, 6, 3, 3, 2, 1, 1, 2]),
-    &icdf::<18>(&[2, 1, 6, 27, 58, 56, 39, 25, 14, 10, 6, 3, 3, 2, 1, 1, 2, 0]),
-];
-pub const SHELL_16: [&[u8]; 16] = [
-    &icdf::<2>(&[126, 130]),
-    &icdf::<3>(&[56, 142, 58]),
-    &icdf::<4>(&[25, 101, 104, 26]),
-    &icdf::<5>(&[12, 60, 108, 64, 12]),
-    &icdf::<6>(&[7, 35, 84, 87, 37, 6]),
-    &icdf::<7>(&[4, 20, 59, 86, 63, 21, 3]),
-    &icdf::<8>(&[3, 12, 38, 72, 75, 42, 12, 2]),
-    &icdf::<9>(&[2, 8, 25, 54, 73, 59, 27, 7, 1]),
-    &icdf::<10>(&[2, 5, 17, 39, 63, 65, 42, 18, 4, 1]),
-    &icdf::<11>(&[1, 4, 12, 28, 49, 63, 54, 30, 11, 3, 1]),
-    &icdf::<12>(&[1, 4, 8, 20, 37, 55, 57, 41, 22, 8, 2, 1]),
-    &icdf::<13>(&[1, 3, 7, 15, 28, 44, 53, 48, 33, 16, 6, 1, 1]),
-    &icdf::<14>(&[1, 2, 6, 12, 21, 35, 47, 48, 40, 25, 12, 5, 1, 1]),
-    &icdf::<15>(&[1, 1, 4, 10, 17, 27, 37, 47, 43, 33, 21, 9, 4, 1, 1]),
-    &icdf::<16>(&[1, 1, 1, 8, 14, 22, 33, 40, 43, 38, 28, 16, 8, 1, 1, 1]),
-    &icdf::<17>(&[1, 1, 1, 1, 13, 18, 27, 36, 41, 41, 34, 24, 14, 1, 1, 1, 1]),
-];
-pub const SHELL_8: [&[u8]; 16] = [
-    &icdf::<2>(&[127, 129]),
-    &icdf::<3>(&[53, 149, 54]),
-    &icdf::<4>(&[22, 105, 106, 23]),
-    &icdf::<5>(&[11, 61, 111, 63, 10]),
-    &icdf::<6>(&[6, 35, 86, 88, 36, 5]),
-    &icdf::<7>(&[4, 20, 59, 87, 62, 21, 3]),
-    &icdf::<8>(&[3, 13, 40, 71, 73, 41, 13, 2]),
-    &icdf::<9>(&[3, 9, 27, 53, 70, 56, 28, 9, 1]),
-    &icdf::<10>(&[3, 8, 19, 37, 57, 61, 44, 20, 6, 1]),
-    &icdf::<11>(&[3, 7, 15, 28, 44, 54, 49, 33, 17, 5, 1]),
-    &icdf::<12>(&[1, 7, 13, 22, 34, 46, 48, 38, 28, 14, 4, 1]),
-    &icdf::<13>(&[1, 1, 11, 22, 27, 35, 42, 47, 33, 25, 10, 1, 1]),
-    &icdf::<14>(&[1, 1, 6, 14, 26, 37, 43, 43, 37, 26, 14, 6, 1, 1]),
-    &icdf::<15>(&[1, 1, 4, 10, 20, 31, 40, 42, 40, 31, 20, 10, 4, 1, 1]),
-    &icdf::<16>(&[1, 1, 3, 8, 16, 26, 35, 38, 38, 35, 26, 16, 8, 3, 1, 1]),
-    &icdf::<17>(&[1, 1, 2, 6, 12, 21, 30, 36, 38, 36, 30, 21, 12, 6, 2, 1, 1]),
-];
-pub const SHELL_4: [&[u8]; 16] = [
-    &icdf::<2>(&[127, 129]),
-    &icdf::<3>(&[49, 157, 50]),
-    &icdf::<4>(&[20, 107, 109, 20]),
-    &icdf::<5>(&[11, 60, 113, 62, 10]),
-    &icdf::<6>(&[7, 36, 84, 87, 36, 6]),
-    &icdf::<7>(&[6, 24, 57, 82, 60, 23, 4]),
-    &icdf::<8>(&[5, 18, 39, 64, 68, 42, 16, 4]),
-    &icdf::<9>(&[6, 14, 29, 47, 61, 52, 30, 14, 3]),
-    &icdf::<10>(&[1, 15, 23, 35, 51, 50, 40, 30, 10, 1]),
-    &icdf::<11>(&[1, 1, 21, 32, 42, 52, 46, 41, 18, 1, 1]),
-    &icdf::<12>(&[1, 6, 16, 27, 36, 42, 42, 36, 27, 16, 6, 1]),
-    &icdf::<13>(&[1, 5, 12, 21, 31, 38, 40, 38, 31, 21, 12, 5, 1]),
-    &icdf::<14>(&[1, 3, 9, 17, 26, 34, 38, 38, 34, 26, 17, 9, 3, 1]),
-    &icdf::<15>(&[1, 3, 7, 14, 22, 29, 34, 36, 34, 29, 22, 14, 7, 3, 1]),
-    &icdf::<16>(&[1, 2, 5, 11, 18, 25, 31, 35, 35, 31, 25, 18, 11, 5, 2, 1]),
-    &icdf::<17>(&[1, 1, 4, 9, 15, 21, 28, 32, 34, 32, 28, 21, 15, 9, 4, 1, 1]),
-];
-pub const SHELL_2: [&[u8]; 16] = [
-    &icdf::<2>(&[128, 128]),
-    &icdf::<3>(&[42, 172, 42]),
-    &icdf::<4>(&[21, 107, 107, 21]),
-    &icdf::<5>(&[12, 60, 112, 61, 11]),
-    &icdf::<6>(&[8, 34, 86, 86, 35, 7]),
-    &icdf::<7>(&[8, 23, 55, 90, 55, 20, 5]),
-    &icdf::<8>(&[5, 15, 38, 72, 72, 36, 15, 3]),
-    &icdf::<9>(&[6, 12, 27, 52, 77, 47, 20, 10, 5]),
-    &icdf::<10>(&[6, 19, 28, 35, 40, 40, 35, 28, 19, 6]),
-    &icdf::<11>(&[4, 14, 22, 31, 37, 40, 37, 31, 22, 14, 4]),
-    &icdf::<12>(&[3, 10, 18, 26, 33, 38, 38, 33, 26, 18, 10, 3]),
-    &icdf::<13>(&[2, 8, 13, 21, 29, 36, 38, 36, 29, 21, 13, 8, 2]),
-    &icdf::<14>(&[1, 5, 10, 17, 25, 32, 38, 38, 32, 25, 17, 10, 5, 1]),
-    &icdf::<15>(&[1, 4, 7, 13, 21, 29, 35, 36, 35, 29, 21, 13, 7, 4, 1]),
-    &icdf::<16>(&[1, 2, 5, 10, 17, 25, 32, 36, 36, 32, 25, 17, 10, 5, 2, 1]),
-    &icdf::<17>(&[1, 2, 4, 7, 13, 21, 28, 34, 36, 34, 28, 21, 13, 7, 4, 2, 1]),
-];
-pub const EXC_LSB: [u8; 2] = icdf(&[136, 120]);
-pub const EXC_SIGN: [&[u8]; 42] = [
-    &icdf::<2>(&[2, 254]),
-    &icdf::<2>(&[207, 49]),
-    &icdf::<2>(&[189, 67]),
-    &icdf::<2>(&[179, 77]),
-    &icdf::<2>(&[174, 82]),
-    &icdf::<2>(&[163, 93]),
-    &icdf::<2>(&[157, 99]),
-    &icdf::<2>(&[58, 198]),
-    &icdf::<2>(&[245, 11]),
-    &icdf::<2>(&[238, 18]),
-    &icdf::<2>(&[232, 24]),
-    &icdf::<2>(&[225, 31]),
-    &icdf::<2>(&[220, 36]),
-    &icdf::<2>(&[211, 45]),
-    &icdf::<2>(&[1, 255]),
-    &icdf::<2>(&[210, 46]),
-    &icdf::<2>(&[190, 66]),
-    &icdf::<2>(&[178, 78]),
-    &icdf::<2>(&[169, 87]),
-    &icdf::<2>(&[162, 94]),
-    &icdf::<2>(&[152, 104]),
-    &icdf::<2>(&[48, 208]),
-    &icdf::<2>(&[242, 14]),
-    &icdf::<2>(&[235, 21]),
-    &icdf::<2>(&[224, 32]),
-    &icdf::<2>(&[214, 42]),
-    &icdf::<2>(&[205, 51]),
-    &icdf::<2>(&[190, 66]),
-    &icdf::<2>(&[1, 255]),
-    &icdf::<2>(&[162, 94]),
-    &icdf::<2>(&[152, 104]),
-    &icdf::<2>(&[147, 109]),
-    &icdf::<2>(&[144, 112]),
-    &icdf::<2>(&[141, 115]),
-    &icdf::<2>(&[138, 118]),
-    &icdf::<2>(&[8, 248]),
-    &icdf::<2>(&[203, 53]),
-    &icdf::<2>(&[187, 69]),
-    &icdf::<2>(&[176, 80]),
-    &icdf::<2>(&[168, 88]),
-    &icdf::<2>(&[161, 95]),
-    &icdf::<2>(&[154, 102]),
-];
-pub const LBRR_FLAGS: [&[u8]; 2] = [&icdf::<3>(&[53, 53, 150]), &icdf::<7>(&[41, 20, 29, 41, 15, 28, 82])];

crates/pdf/src/lib.rs

@@ -301,18 +301,14 @@ pub fn master_text_pieces(pres: &Presentation, m: &deckcraft_model::Master, pape
     let (kx, ky) = (paper.0 / pres.notes_size.width.max(1.0), paper.1 / pres.notes_size.height.max(1.0));
     let mut out = vec![];
     for pt in deckcraft_render::place_master_texts(pres, m, n) {
+        let mut para_chars: HashMap<usize, Vec<char>> = HashMap::new();
         for run in &pt.layout.runs {
             let Some(g) = run.glyphs.first() else { continue };
-            let text: String = pt
-                .body
-                .paragraphs
-                .get(run.para)
-                .map(|p| p.runs.iter().map(|r| r.content()).collect::<String>())
-                .unwrap_or_default()
-                .chars()
-                .skip(run.chars.0)
-                .take(run.chars.1.saturating_sub(run.chars.0))
-                .collect();
+            let chars = para_chars.entry(run.para).or_insert_with(|| {
+                pt.body.paragraphs.get(run.para).map(|p| p.runs.iter().flat_map(|r| r.content().chars()).collect()).unwrap_or_default()
+            });
+            let (a, b) = (run.chars.0.min(chars.len()), run.chars.1.min(chars.len()));
+            let text: String = chars.get(a..b.max(a)).unwrap_or_default().iter().collect();
             if text.trim().is_empty() {
                 continue;
             }
@@ -498,6 +494,9 @@ impl Backdrops {
 /// Most pixels one slide raster may have; it is RGBA, and the backdrop and the content are two rasters.
 const MAX_RASTER_PIXELS: f64 = 64_000_000.0;
 
+/// Most ruled note lines one handout area gets (a letter page holds about 30).
+const MAX_NOTE_LINES: usize = 500;
+
 /// Render scale for a slide of `slide` units drawn `box_width` points wide at `dpi`, with the total pixel count capped.
 fn raster_scale(box_width: f64, slide: (f64, f64), dpi: f64) -> f64 {
     let scale = (box_width / 72.0 * dpi.clamp(36.0, 600.0)) / slide.0;
@@ -574,20 +573,17 @@ impl Exporter<'_> {
 
     /// Invisible glyphs exactly over the rasterised text.
     fn text_layer(&mut self, s: &mut Surface, pt: &PlacedText, view: Affine, visible: bool) -> Result<()> {
+        // Each paragraph's characters, gathered once: a long paragraph wraps into many runs.
+        let mut para_chars: HashMap<usize, Vec<char>> = HashMap::new();
         for run in &pt.layout.runs {
             if run.glyphs.is_empty() || run.size <= 0.0 {
                 continue;
             }
-            let text: String = pt
-                .body
-                .paragraphs
-                .get(run.para)
-                .map(|p| p.runs.iter().map(|r| r.content()).collect::<String>())
-                .unwrap_or_default()
-                .chars()
-                .skip(run.chars.0)
-                .take(run.chars.1.saturating_sub(run.chars.0))
-                .collect();
+            let chars = para_chars.entry(run.para).or_insert_with(|| {
+                pt.body.paragraphs.get(run.para).map(|p| p.runs.iter().flat_map(|r| r.content().chars()).collect()).unwrap_or_default()
+            });
+            let (a, b) = (run.chars.0.min(chars.len()), run.chars.1.min(chars.len()));
+            let text: String = chars.get(a..b.max(a)).unwrap_or_default().iter().collect();
             if text.trim().is_empty() {
                 continue;
             }
@@ -667,19 +663,28 @@ impl Exporter<'_> {
         let lh = size * 1.3;
         let mut y = area.y0 + size;
         s.set_fill(Some(grey(0x20, 1.0)));
+        let space = width(" ");
         'outer: for para in text.split('\n') {
+            // The line's width is kept as words are added, not measured again for each word.
             let mut line = String::new();
+            let mut line_w = 0.0;
             for word in para.split(' ') {
-                let cand = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
-                if width(&cand) > area.width() && !line.is_empty() {
+                let word_w = width(word);
+                let cand_w = if line.is_empty() { word_w } else { line_w + space + word_w };
+                if cand_w > area.width() && !line.is_empty() {
                     if y > area.y1 {
                         break 'outer;
                     }
                     s.draw_text(Point::from_xy(area.x0 as f32, y as f32), font.clone(), size as f32, &line, false, TextDirection::Auto);
                     y += lh;
                     line = word.to_string();
+                    line_w = word_w;
                 } else {
-                    line = cand;
+                    if !line.is_empty() {
+                        line.push(' ');
+                    }
+                    line.push_str(word);
+                    line_w = cand_w;
                 }
             }
             if y > area.y1 {
@@ -696,20 +701,26 @@ impl Exporter<'_> {
 
     /// Ruled lines for handwritten notes (3-per-page handouts).
     fn note_lines(&self, s: &mut Surface, r: Rect) {
-        let mut y = r.y0 + 18.0;
+        // Counted, not stepped: at huge coordinates adding 22 leaves y unchanged, and a huge page
+        // would want millions of rules.
+        let first = r.y0 + 18.0;
+        let count = ((r.y1 - first) / 22.0).floor() + 1.0;
+        if count.is_nan() || count < 1.0 {
+            return;
+        }
         s.set_stroke(Some(krilla::paint::Stroke {
             paint: krilla::color::rgb::Color::new(0xB0, 0xB0, 0xB0).into(),
             width: 0.5,
             ..Default::default()
         }));
-        while y <= r.y1 {
+        for i in 0..(count.min(MAX_NOTE_LINES as f64) as usize) {
+            let y = first + 22.0 * i as f64;
             let mut p = kurbo::BezPath::new();
             p.move_to((r.x0, y));
             p.line_to((r.x1, y));
             if let Some(path) = to_path(&p) {
                 s.draw_path(&path);
             }
-            y += 22.0;
         }
         s.set_stroke(None);
     }

crates/pdf/src/tests.rs

@@ -728,3 +728,17 @@ fn raster_scale_caps_total_pixels_not_each_side() {
     let s = raster_scale(720.0, (960.0, 540.0), 200.0);
     assert!((s - 720.0 / 72.0 * 200.0 / 960.0).abs() < 1e-12);
 }
+
+#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
+#[cfg_attr(not(target_arch = "wasm32"), test)]
+fn huge_paper_and_long_notes_export_in_bounded_work() {
+    // At 1e19 pt adding a rule's 22 pt leaves y unchanged: the rules are counted, not stepped. A narrow page keeps the raster small.
+    let p = deck(1);
+    let bytes = export(&p, &PdfOptions { paper: (612.0, 1.0e19), ..opts(PageLayout::Handouts { per_page: 3 }) }).expect("export");
+    assert!(bytes.starts_with(b"%PDF-"));
+    // 20,000 short words of notes, wrapped with the line width kept as words are added.
+    let mut p = deck(1);
+    Arc::make_mut(&mut p.slides[0]).notes = TextBody::from_text(&"ab ".repeat(20_000));
+    let bytes = export(&p, &opts(PageLayout::Notes)).expect("export");
+    assert!(bytes.starts_with(b"%PDF-"));
+}

crates/pptx/src/dgm.rs

@@ -403,7 +403,7 @@ pub fn data_xml(d: &Diagram, seed: u32, drawing_rel: &str, pics: &[(usize, Strin
     w.finish()
 }
 
-/// The outline of a data part: the `parOf` tree under the document point, depth first.
+/// The outline of a data part: the `parOf` tree under the document point, depth first, or the data points in `ptLst` order when no `parOf` connections exist.
 pub fn outline(data: &El) -> Vec<DiagramNode> {
     outline_ids(data).into_iter().map(|(_, n)| n).collect()
 }
@@ -429,11 +429,13 @@ pub fn node_pictures(data: &El) -> Vec<(usize, String)> {
     out
 }
 
+/// Extracts diagram outline `(modelId, DiagramNode)` pairs in tree order from a `dgm:dataModel` element.
 fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
     let Some(pts) = data.child("ptLst") else { return vec![] };
     let mut texts: HashMap<&str, String> = HashMap::new();
     let mut assistants: std::collections::HashSet<&str> = std::collections::HashSet::new();
     let mut titles: HashMap<&str, String> = HashMap::new();
+    let mut pt_order: Vec<&str> = Vec::new();
     let mut doc: Option<&str> = None;
     for pt in pts.children_named("pt").take(MAX_NODES * 4) {
         let Some(id) = pt.attr("modelId") else { continue };
@@ -442,6 +444,7 @@ fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
             ty @ ("node" | "asst") => {
                 let t = pt.child("t").map(paragraphs).unwrap_or_default();
                 texts.insert(id, t);
+                pt_order.push(id);
                 if ty == "asst" {
                     assistants.insert(id);
                 }
@@ -459,7 +462,6 @@ fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
             _ => {}
         }
     }
-    let Some(doc) = doc else { return vec![] };
     let mut kids: HashMap<&str, Vec<(i64, &str)>> = HashMap::new();
     if let Some(cx) = data.child("cxnLst") {
         for c in cx.children_named("cxn").take(MAX_NODES * 4) {
@@ -478,7 +480,7 @@ fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
     let mut out = vec![];
     let mut seen = std::collections::HashSet::new();
     // Depth first, iteratively; a node reached twice (a cycle in a hostile file) is skipped.
-    let mut stack: Vec<(&str, u8)> = kids.get(doc).map(|v| v.iter().rev().map(|(_, id)| (*id, 0u8)).collect()).unwrap_or_default();
+    let mut stack: Vec<(&str, u8)> = doc.and_then(|d| kids.get(d)).map(|v| v.iter().rev().map(|(_, id)| (*id, 0u8)).collect()).unwrap_or_default();
     while let Some((id, level)) = stack.pop() {
         if out.len() >= MAX_NODES || !seen.insert(id) {
             continue;
@@ -497,6 +499,23 @@ fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
             stack.extend(v.iter().rev().map(|(_, c)| (*c, level.saturating_add(1))));
         }
     }
+    if out.is_empty() && kids.is_empty() {
+        for id in pt_order {
+            if out.len() >= MAX_NODES || !seen.insert(id) {
+                continue;
+            }
+            out.push((
+                id.to_string(),
+                DiagramNode {
+                    text: texts.get(id).cloned().unwrap_or_default(),
+                    level: 0,
+                    picture: None,
+                    assistant: assistants.contains(id),
+                    title: titles.get(id).cloned().unwrap_or_default(),
+                },
+            ));
+        }
+    }
     out
 }
 
@@ -878,5 +897,14 @@ mod tests {
         assert_eq!(colors_for(&cs_id("accent4")), "accent4");
         assert_eq!(colors_for(&cs_id("")), "");
         assert_eq!(style_for(&qs_id("outline")), "outline");
+
+        let unconnected = br#"<dgm:dataModel xmlns:dgm="d"><dgm:ptLst><dgm:pt modelId="0" type="doc"/><dgm:pt modelId="1" type="node"><dgm:t><a:p xmlns:a="a"><a:r><a:t>Alpha</a:t></a:r></a:p></dgm:t></dgm:pt><dgm:pt modelId="2" type="node"><dgm:t><a:p xmlns:a="a"><a:r><a:t>Beta</a:t></a:r></a:p></dgm:t></dgm:pt></dgm:ptLst><dgm:cxnLst/></dgm:dataModel>"#;
+        let unconnected_doc = crate::xml::parse(unconnected).unwrap();
+        assert_eq!(outline(&unconnected_doc.root), nodes(&[("Alpha", 0), ("Beta", 0)]));
+
+        // When parOf connections exist but no root (type="doc") reaches them, do not flatten the hierarchy to level 0.
+        let unrooted_hierarchy = br#"<dgm:dataModel xmlns:dgm="d"><dgm:ptLst><dgm:pt modelId="1" type="node"><dgm:t><a:p xmlns:a="a"><a:r><a:t>Parent</a:t></a:r></a:p></dgm:t></dgm:pt><dgm:pt modelId="2" type="node"><dgm:t><a:p xmlns:a="a"><a:r><a:t>Child</a:t></a:r></a:p></dgm:t></dgm:pt></dgm:ptLst><dgm:cxnLst><dgm:cxn srcId="1" destId="2"/></dgm:cxnLst></dgm:dataModel>"#;
+        let unrooted_doc = crate::xml::parse(unrooted_hierarchy).unwrap();
+        assert!(outline(&unrooted_doc.root).is_empty());
     }
 }

crates/pptx/src/lib.rs

@@ -70,6 +70,13 @@ pub fn import_checked(bytes: &[u8]) -> Result<(Presentation, Vec<String>), PptxE
     read::import_checked(bytes)
 }
 
+/// [`import`] with a lower presentation-wide chart point budget, so tests reach the over-budget
+/// path without a multi-million-point chart.
+#[doc(hidden)]
+pub fn import_with_chart_budget(bytes: &[u8], points: usize) -> Result<Presentation, PptxError> {
+    read::import_with_chart_points(bytes, points).map(|(p, _)| p)
+}
+
 /// Read the theme of a `.thmx` file, or of a `.pptx` / `.potx`'s first master, with its media.
 pub fn import_theme(bytes: &[u8]) -> Result<(deckcraft_model::theme::Theme, Vec<deckcraft_model::MediaItem>), PptxError> {
     read::import_theme(bytes)

crates/pptx/src/read.rs

@@ -10,6 +10,7 @@ mod timing;
 pub(crate) use chart::{chart_from as chart_from_el, read_chart_xml};
 pub(crate) use chartex::{chartex_from, read_chartex_xml};
 
+use std::cell::Cell;
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 
@@ -38,8 +39,17 @@ pub struct Imp<'a> {
     pub vml_previews: HashMap<String, HashMap<String, String>>,
     /// Aggregate byte count of retained chart sidecars across the presentation.
     pub kept_sidecar_bytes: usize,
+    /// Data slots of the charts decoded so far (see `chart::MAX_PRESENTATION_CHART_POINTS`).
+    pub chart_points: usize,
+    /// Points the presentation may hold across modelled charts.
+    pub chart_points_cap: usize,
     /// Cached kept sidecars by normalized chart part name.
     pub kept_charts: HashMap<String, deckcraft_model::chart::ChartKept>,
+    /// Chart parts whose sidecar capture was refused, with the retained-byte total it started from:
+    /// the same start gives the same refusal, so the copy is not repeated.
+    pub rejected_kept: HashMap<String, usize>,
+    /// Bytes of chart parts decoded so far, rejected ones included (see `chart::MAX_CHART_DECODE_BYTES`).
+    pub chart_decode_bytes: usize,
     /// Add-in tags parts, parsed once each, by normalized part name.
     pub tags_by_part: HashMap<String, Arc<[(String, String)]>>,
     /// Bytes of tags copied into the model so far (see [`MAX_TAG_BYTES`]).
@@ -90,21 +100,22 @@ pub struct Part {
     pub ns: Vec<(String, String)>,
     /// Prefixes bound below the root only (on a wrapper such as `mc:Choice`), each to one namespace.
     pub inner_ns: Vec<(String, String)>,
+    /// Bytes of namespace declarations this part may still copy onto kept fragments.
+    ns_budget: Cell<usize>,
 }
 
 impl Part {
     pub fn new(pkg: &Package, name: &str, doc: &Doc) -> Self {
         let ns = doc.ns_decls();
-        Part { name: name.to_string(), rels: pkg.rels(name), inner_ns: inner_decls(&doc.root, &ns), ns }
+        Part { name: name.to_string(), rels: pkg.rels(name), inner_ns: inner_decls(&doc.root, &ns), ns, ns_budget: Cell::new(MAX_COPIED_NS_BYTES) }
     }
     /// Serialize an element with the namespace declarations it needs from the part root.
     pub fn keep(&self, el: &El) -> String {
-        keep_xml(el, &self.ns)
+        keep_with(el, &[&self.ns], Some(&self.ns_budget))
     }
     /// Like [`Part::keep`], also declaring prefixes that only an enclosing wrapper binds.
     pub fn keep_inner(&self, el: &El) -> String {
-        let ns: Vec<(String, String)> = self.ns.iter().chain(&self.inner_ns).cloned().collect();
-        keep_xml(el, &ns)
+        keep_with(el, &[&self.ns, &self.inner_ns], Some(&self.ns_budget))
     }
 }
 
@@ -139,36 +150,81 @@ fn inner_decls(root: &El, ns: &[(String, String)]) -> Vec<(String, String)> {
     out
 }
 
-/// Serialize `el`, declaring every prefix it uses that the source root declared.
-pub fn keep_xml(el: &El, ns: &[(String, String)]) -> String {
-    let mut used = HashSet::new();
-    fn rec(e: &El, used: &mut HashSet<String>, depth: usize) {
+/// Longest namespace name copied onto a kept fragment or a resolved `mc` branch. Real ones are
+/// URIs of well under 100 bytes; a longer one is not copied, so one declaration cannot be
+/// multiplied by every fragment that uses its prefix.
+const MAX_NS_VALUE: usize = 2048;
+
+/// Namespace declaration bytes one part may copy onto all its kept fragments together; past it a
+/// fragment keeps its markup but is not given further declarations.
+const MAX_COPIED_NS_BYTES: usize = 8 << 20;
+
+/// Prefixes `el` and its descendants use in element and attribute names, and those listed in
+/// `mc:Ignorable` or `mc:MustUnderstand` (which must stay declared for the markup-compatibility rules to hold),
+/// and those starting a QName-like attribute value.
+fn used_prefixes(el: &El) -> HashSet<&str> {
+    fn rec<'a>(e: &'a El, used: &mut HashSet<&'a str>, depth: usize) {
         if depth > crate::xml::MAX_DEPTH {
             return;
         }
         if let Some((p, _)) = e.name.split_once(':') {
-            used.insert(p.to_string());
+            used.insert(p);
         }
-        for (k, _) in &e.attrs {
-            if let Some((p, _)) = k.split_once(':')
+        for (k, v) in &e.attrs {
+            if let Some((p, local)) = k.split_once(':')
                 && p != "xmlns"
                 && p != "xml"
             {
-                used.insert(p.to_string());
+                used.insert(p);
+                if local == "Ignorable" || local == "MustUnderstand" {
+                    used.extend(v.split_whitespace());
+                }
+            }
+            // QName-valued attributes (`xsi:type="q:Item"`) need their prefix declared too.
+            if k != "xmlns" && !k.starts_with("xmlns:") {
+                for t in v.split_whitespace() {
+                    if let Some((p, _)) = t.split_once(':')
+                        && !p.is_empty()
+                    {
+                        used.insert(p);
+                    }
+                }
             }
         }
         for c in e.elements() {
             rec(c, used, depth + 1);
         }
     }
+    let mut used = HashSet::new();
     rec(el, &mut used, 0);
-    let mut el = el.clone();
-    for (k, v) in ns {
+    used
+}
+
+/// Serialize `el`, declaring every prefix it uses that the source root declared.
+pub fn keep_xml(el: &El, ns: &[(String, String)]) -> String {
+    keep_with(el, &[ns], None)
+}
+
+fn keep_with(el: &El, decls: &[&[(String, String)]], budget: Option<&Cell<usize>>) -> String {
+    let used = used_prefixes(el);
+    let mut have: HashSet<&str> = el.attrs.iter().map(|(a, _)| a.as_str()).collect();
+    let mut extra = Vec::new();
+    for (k, v) in decls.iter().flat_map(|d| d.iter()) {
         let p = k.strip_prefix("xmlns:").unwrap_or("");
-        if !p.is_empty() && used.contains(p) && !el.attrs.iter().any(|(a, _)| a == k) {
-            el.attrs.push((k.clone(), v.clone()));
+        if !p.is_empty() && used.contains(p) && v.len() <= MAX_NS_VALUE && !have.contains(k.as_str()) {
+            let cost = k.len() + v.len();
+            if let Some(b) = budget {
+                if b.get() < cost {
+                    continue;
+                }
+                b.set(b.get() - cost);
+            }
+            have.insert(k);
+            extra.push((k.clone(), v.clone()));
         }
     }
+    let mut el = el.clone();
+    el.attrs.extend(extra);
     el.to_xml()
 }
 
@@ -317,10 +373,18 @@ fn kept_parts(pkg: &Package, pres_path: &str) -> Vec<deckcraft_model::KeptPart>
             // The part's own relationships (customXml item → itemProps) and their targets.
             let rp = opc::rels_path(&name);
             if let Some(rels_xml) = text(&rp) {
+                let mut capped = false;
                 for sub in pkg.rels(&name).items.iter().filter(|s| !s.external && keepable(&s.target)) {
-                    if let Some(x) = text(&sub.target)
-                        && !out.iter().any(|k| k.name.eq_ignore_ascii_case(&sub.target))
-                    {
+                    // Checked before the part is read: repeated relationships to one large part
+                    // must not copy it again each time.
+                    if out.iter().any(|k| k.name.eq_ignore_ascii_case(&sub.target)) {
+                        continue;
+                    }
+                    if out.len() >= 400 {
+                        capped = true;
+                        continue;
+                    }
+                    if let Some(x) = text(&sub.target) {
                         out.push(KeptPart {
                             content_type: pkg.content_type(&sub.target).unwrap_or_default(),
                             name: sub.target.clone(),
@@ -329,7 +393,9 @@ fn kept_parts(pkg: &Package, pres_path: &str) -> Vec<deckcraft_model::KeptPart>
                         });
                     }
                 }
-                out.push(KeptPart { name: rp, xml: rels_xml, ..Default::default() });
+                if !capped && out.len() < 400 {
+                    out.push(KeptPart { name: rp, xml: rels_xml, ..Default::default() });
+                }
             }
         }
     }
@@ -366,15 +432,39 @@ fn resolve_mc_rels(el: &mut El, depth: usize, rels: Option<&Rels>) {
                     });
                     let branch = choice.or_else(|| ac.child("Fallback"));
                     if let Some(b) = branch {
+                        // The branch's namespace declarations (the first usable one of each name,
+                        // in order), indexed by prefix once: each child then looks up the prefixes
+                        // it uses instead of scanning every declaration.
+                        let mut decls: Vec<(&String, &String)> = Vec::new();
+                        // An oversized declaration still shadows an outer one of its name: its
+                        // content is left unbound rather than bound to the outer namespace.
+                        let mut by_prefix: HashMap<&str, Option<usize>> = HashMap::new();
+                        for (k, v) in b.attrs.iter().chain(ac.attrs.iter()) {
+                            let prefix = if k == "xmlns" { Some("") } else { k.strip_prefix("xmlns:") };
+                            if let Some(p) = prefix
+                                && !by_prefix.contains_key(p)
+                            {
+                                by_prefix.insert(p, (v.len() <= MAX_NS_VALUE).then_some(decls.len()));
+                                if v.len() <= MAX_NS_VALUE {
+                                    decls.push((k, v));
+                                }
+                            }
+                        }
                         for n in &b.children {
                             if let Node::El(e) = n {
+                                // Carry the namespace declarations from the branch that its content
+                                // uses (all of them per child made children x declarations copies).
+                                let used = used_prefixes(e);
+                                let have: HashSet<&str> = e.attrs.iter().map(|(a, _)| a.as_str()).collect();
+                                let mut wanted: Vec<usize> = std::iter::once("")
+                                    .chain(used.iter().copied())
+                                    .filter_map(|p| by_prefix.get(p).copied().flatten())
+                                    .filter(|&i| !have.contains(decls[i].0.as_str()))
+                                    .collect();
+                                wanted.sort_unstable();
+                                wanted.dedup();
                                 let mut e = e.clone();
-                                // Carry namespace declarations from the branch onto its content.
-                                for (k, v) in b.attrs.iter().chain(ac.attrs.iter()) {
-                                    if k.starts_with("xmlns") && !e.attrs.iter().any(|(a, _)| a == k) {
-                                        e.attrs.push((k.clone(), v.clone()));
-                                    }
-                                }
+                                e.attrs.extend(wanted.into_iter().map(|i| (decls[i].0.clone(), decls[i].1.clone())));
                                 out.push(Node::El(e));
                             }
                         }
@@ -445,7 +535,11 @@ pub fn import_theme(bytes: &[u8]) -> Result<(deckcraft_model::theme::Theme, Vec<
         table_style_ids: Vec::new(),
         vml_previews: HashMap::new(),
         kept_sidecar_bytes: 0,
+        chart_points: 0,
+        chart_points_cap: chart::MAX_PRESENTATION_CHART_POINTS,
         kept_charts: HashMap::new(),
+        rejected_kept: HashMap::new(),
+        chart_decode_bytes: 0,
         tags_by_part: HashMap::new(),
         tag_bytes: 0,
         tags_capped: false,
@@ -463,6 +557,11 @@ pub fn import(bytes: &[u8]) -> Result<Presentation, PptxError> {
 /// [`import`], plus the parts of the slide list the file names but that couldn't be read (a
 /// missing or truncated slide): those slides are left out, so a caller can say so (#203).
 pub fn import_checked(bytes: &[u8]) -> Result<(Presentation, Vec<String>), PptxError> {
+    import_with_chart_points(bytes, chart::MAX_PRESENTATION_CHART_POINTS)
+}
+
+/// [`import_checked`] with the presentation's chart point budget set (tests lower it).
+pub(crate) fn import_with_chart_points(bytes: &[u8], chart_points_cap: usize) -> Result<(Presentation, Vec<String>), PptxError> {
     let mut lost_slides: Vec<String> = vec![];
     let pkg = Package::open(bytes)?;
     let root_rels = pkg.rels("");
@@ -487,7 +586,11 @@ pub fn import_checked(bytes: &[u8]) -> Result<(Presentation, Vec<String>), PptxE
         table_style_ids: Vec::new(),
         vml_previews: HashMap::new(),
         kept_sidecar_bytes: 0,
+        chart_points: 0,
+        chart_points_cap,
         kept_charts: HashMap::new(),
+        rejected_kept: HashMap::new(),
+        chart_decode_bytes: 0,
         tags_by_part: HashMap::new(),
         tag_bytes: 0,
         tags_capped: false,
@@ -1423,3 +1526,90 @@ fn header_footer(p: &Presentation) -> HeaderFooter {
     }
     hf
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn mc_branches_carry_only_the_declarations_their_content_uses() {
+        // 2,000 declarations on the branch and 2,000 children: each child gets the one it uses
+        // (and the default), not all 2,000.
+        let decls: String = (0..2000).map(|i| format!(r#" xmlns:n{i}="urn:n{i}""#)).collect();
+        let kids: String = (0..2000).map(|i| format!("<n{i}:x/>")).collect();
+        let x = format!(
+            r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns="urn:d"{decls}>{kids}</mc:Fallback></mc:AlternateContent></r>"#
+        );
+        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
+        resolve_mc(&mut d.root, 0);
+        let kids: Vec<&El> = d.root.elements().collect();
+        assert_eq!(kids.len(), 2000);
+        assert_eq!(kids[7].attrs, vec![("xmlns".to_string(), "urn:d".to_string()), ("xmlns:n7".to_string(), "urn:n7".to_string())]);
+    }
+
+    /// The branch's own declaration of a prefix wins over the `AlternateContent`'s; an oversized
+    /// one still shadows it (its content stays unbound); a child's own declaration is left alone.
+    #[test]
+    fn mc_branch_declarations_keep_their_precedence() {
+        let long = "u".repeat(MAX_NS_VALUE + 1);
+        let x = format!(
+            r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent xmlns:p="urn:ac" xmlns:q="urn:q-short"><mc:Fallback xmlns:p="urn:b" xmlns:q="{long}"><p:x/><q:y/><p:z xmlns:p="urn:own"/></mc:Fallback></mc:AlternateContent></r>"#
+        );
+        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
+        resolve_mc(&mut d.root, 0);
+        let kids: Vec<&El> = d.root.elements().collect();
+        let attrs = |i: usize| kids[i].attrs.iter().map(|(k, v)| format!("{k}={v}")).collect::<Vec<_>>();
+        assert_eq!(attrs(0), ["xmlns:p=urn:b"]);
+        assert!(attrs(1).is_empty(), "{:?}", attrs(1));
+        assert_eq!(attrs(2), ["xmlns:p=urn:own"]);
+    }
+
+    #[test]
+    fn mc_branches_keep_prefixes_named_by_must_understand() {
+        let x = r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns:q="urn:q"><a mc:MustUnderstand="q"/></mc:Fallback></mc:AlternateContent></r>"#;
+        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
+        resolve_mc(&mut d.root, 0);
+        let kid = d.root.elements().next().unwrap();
+        assert!(kid.attrs.iter().any(|(k, v)| k == "xmlns:q" && v == "urn:q"), "{:?}", kid.attrs);
+    }
+
+    #[test]
+    fn mc_branches_keep_prefixes_used_in_qname_values() {
+        let x = r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns:q="urn:q" xmlns:z="urn:z"><n xmlns:xsi="urn:xsi" xsi:type="q:Item"/></mc:Fallback></mc:AlternateContent></r>"#;
+        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
+        resolve_mc(&mut d.root, 0);
+        let kid = d.root.elements().next().unwrap();
+        assert!(kid.attrs.iter().any(|(k, v)| k == "xmlns:q" && v == "urn:q"), "{:?}", kid.attrs);
+        assert!(!kid.attrs.iter().any(|(k, _)| k == "xmlns:z"), "unused declarations stay out: {:?}", kid.attrs);
+    }
+
+    #[test]
+    fn kept_fragments_skip_oversized_namespace_names() {
+        let big = "u".repeat(MAX_NS_VALUE + 1);
+        let ns = vec![("xmlns:a".to_string(), "urn:a".to_string()), ("xmlns:b".to_string(), big)];
+        let d = crate::xml::parse(br#"<a:x xmlns:a="urn:a" xmlns:b="urn:b"><b:y/></a:x>"#).unwrap();
+        let mut el = d.root.clone();
+        el.attrs.clear();
+        let out = keep_xml(&el, &ns);
+        assert!(out.contains(r#"xmlns:a="urn:a""#), "{out}");
+        assert!(!out.contains("uuuu"), "the oversized declaration is not copied");
+    }
+
+    #[test]
+    fn copied_namespace_bytes_are_budgeted_per_part() {
+        let d = crate::xml::parse(br#"<a:x xmlns:a="urn:a"><a:y/></a:x>"#).unwrap();
+        let mut el = d.root.clone();
+        el.attrs.clear();
+        let part = Part {
+            name: String::new(),
+            rels: Default::default(),
+            ns: vec![("xmlns:a".to_string(), "urn:a".to_string())],
+            inner_ns: vec![],
+            ns_budget: Cell::new(15),
+        };
+        assert!(part.keep(&el).contains(r#"xmlns:a="urn:a""#), "within budget");
+        assert!(part.ns_budget.get() < 15);
+        let again = part.keep(&el);
+        assert!(!again.contains("xmlns:a"), "budget spent, no further declarations: {again}");
+    }
+}

crates/pptx/src/read/chart.rs

@@ -39,6 +39,33 @@ pub(crate) fn rich_text(t: &El) -> Option<String> {
 /// Most category/value/size slots one chart may decode across all its series and caches, so
 /// sparse `ptCount`/`idx` declarations can't expand far beyond the XML they came from.
 pub(crate) const MAX_CHART_POINTS: usize = 1_000_000;
+/// Data slots (values and categories) the charts of one presentation may hold in all; a chart past
+/// it is read as a placeholder frame. Each frame that references a chart decodes its own copy.
+pub(crate) const MAX_PRESENTATION_CHART_POINTS: usize = 4_000_000;
+
+/// Chart part bytes all chart frames of a presentation may decode, counting every attempt: a
+/// chart that is rejected, or has no data slots, would otherwise be decoded again for each frame
+/// that shows it.
+pub(crate) const MAX_CHART_DECODE_BYTES: usize = 256 * 1024 * 1024;
+
+/// Slots a decoded chart holds, counting the chart itself as at least one.
+pub(crate) fn point_count(c: &Chart) -> usize {
+    let series = |s: &deckcraft_model::chart::Series| {
+        let bars = s.error_bars.as_ref().map_or(0, |e| e.plus.len().saturating_add(e.minus.len()));
+        s.values.len().saturating_add(s.x_values.len()).saturating_add(s.sizes.len()).saturating_add(bars)
+    };
+    let levels: usize = c.category_levels.iter().map(Vec::len).sum();
+    1usize.saturating_add(c.categories.len()).saturating_add(levels).saturating_add(c.series.iter().map(series).fold(0, usize::saturating_add))
+}
+
+/// Bytes of the strings a kept relationship owns.
+fn part_bytes(p: &deckcraft_model::chart::ChartPart) -> usize {
+    p.bytes.len() + p.name.len() + p.content_type.len()
+}
+
+fn rel_bytes(r: &deckcraft_model::chart::ChartRel) -> usize {
+    r.id.len() + r.rel_type.len() + r.target.len() + r.part.len()
+}
 
 /// Most slots one cache may hold.
 const MAX_CACHE_POINTS: usize = 100_000;
@@ -103,6 +130,48 @@ pub fn read_chart_xml(bytes: &[u8]) -> Option<Chart> {
     Some(c)
 }
 
+/// The chart a graphic frame points at. A chart that would cross the presentation's point or
+/// decode limits is not modelled: it is kept as its original part with the relationships it
+/// reaches (`verbatim`), so a save writes it back whole instead of dropping it and its workbook.
+pub(crate) fn frame_chart(imp: &mut super::Imp, part: &super::Part, rid: &str, uri: &str) -> Option<Chart> {
+    let rel = part.rels.get(rid)?;
+    let chartex = uri.ends_with("/chartex");
+    let bytes = imp.pkg.xml_bytes(&rel.target)?;
+    if imp.chart_decode_bytes.saturating_add(bytes.len()) > MAX_CHART_DECODE_BYTES {
+        log::warn!("pptx: chart {} is past the presentation's chart decode limit and is not kept", rel.target);
+        return None;
+    }
+    imp.chart_decode_bytes += bytes.len();
+    let parsed = if imp.chart_points < imp.chart_points_cap {
+        let c = if chartex { super::read_chartex_xml(bytes) } else { super::read_chart_xml(bytes) }?;
+        let n = point_count(&c);
+        if imp.chart_points.saturating_add(n) <= imp.chart_points_cap {
+            imp.chart_points = imp.chart_points.saturating_add(n);
+            let mut c = c;
+            c.kept = capture_kept(imp, &rel.target);
+            return Some(c);
+        }
+        Some(c)
+    } else {
+        None
+    };
+    // Past the limit: keep the part itself (charged to the sidecar budget) and show an empty chart.
+    if chartex || imp.kept_sidecar_bytes.saturating_add(bytes.len()) > MAX_KEPT_TOTAL_BYTES {
+        log::warn!("pptx: chart {} is past the presentation's chart limits and is not kept", rel.target);
+        return None;
+    }
+    imp.kept_sidecar_bytes += bytes.len();
+    log::warn!("pptx: chart {} is past the presentation's chart limits; shown empty and written back unchanged", rel.target);
+    let mut c = parsed.unwrap_or_default();
+    c.series.clear();
+    c.categories.clear();
+    c.category_levels.clear();
+    c.raw = Some(String::from_utf8_lossy(bytes).into_owned());
+    c.verbatim = true;
+    c.kept = capture_kept(imp, &rel.target);
+    Some(c)
+}
+
 pub(crate) fn chart_from(root: &El) -> Option<Chart> {
     chart_within(root, MAX_CHART_POINTS)
 }
@@ -466,9 +535,20 @@ pub(crate) fn capture_kept(imp: &mut super::Imp, chart_part: &str) -> deckcraft_
 
     let key = crate::opc::norm(chart_part);
     if let Some(cached) = imp.kept_charts.get(&key) {
+        // Every frame that shows this chart gets its own copy, so each copy is charged like the first.
+        let bytes: usize = cached.parts.iter().map(part_bytes).sum::<usize>() + cached.rels.iter().map(rel_bytes).sum::<usize>();
+        if imp.kept_sidecar_bytes.saturating_add(bytes) > MAX_KEPT_TOTAL_BYTES {
+            log::warn!("pptx: chart sidecar retained byte budget exceeded for {chart_part}");
+            return ChartKept::default();
+        }
+        imp.kept_sidecar_bytes += bytes;
         return cached.clone();
     }
 
+    let charged_before = imp.kept_sidecar_bytes;
+    if imp.rejected_kept.get(&key) == Some(&charged_before) {
+        return ChartKept::default();
+    }
     let mut kept = ChartKept::default();
     // The chart document itself is rewritten; don't store a second copy of it.
     let mut seen = std::collections::HashMap::from([(key.clone(), true)]);
@@ -485,6 +565,18 @@ pub(crate) fn capture_kept(imp: &mut super::Imp, chart_part: &str) -> deckcraft_
             kept.rels.push(ChartRel { id: r.id, rel_type: r.ty, target: r.target_raw, part: r.target, external: false });
         }
     }
+    // The first capture's relationship strings and the parts' names and content types are retained
+    // too (the part bytes were charged as copied).
+    let rel_total: usize =
+        kept.rels.iter().map(rel_bytes).sum::<usize>() + kept.parts.iter().map(|p| p.name.len() + p.content_type.len()).sum::<usize>();
+    if imp.kept_sidecar_bytes.saturating_add(rel_total) > MAX_KEPT_TOTAL_BYTES {
+        log::warn!("pptx: chart sidecar retained byte budget exceeded for {chart_part}");
+        // The dropped parts must not stay charged against later charts.
+        imp.kept_sidecar_bytes = charged_before;
+        imp.rejected_kept.insert(key, charged_before);
+        return ChartKept::default();
+    }
+    imp.kept_sidecar_bytes += rel_total;
     imp.kept_charts.insert(key, kept.clone());
     kept
 }
@@ -590,6 +682,16 @@ fn text_size(e: Option<&El>) -> Option<f64> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn point_count_charges_every_retained_vector() {
+        let mut c = Chart { categories: vec!["a".into()], category_levels: vec![vec!["x".into(); 2], vec!["y".into(); 3]], ..Default::default() };
+        let mut s =
+            deckcraft_model::chart::Series { values: vec![Some(1.0); 4], x_values: vec![None; 5], sizes: vec![None; 6], ..Default::default() };
+        s.error_bars = Some(deckcraft_model::chart::ErrorBars { plus: vec![None; 7], minus: vec![None; 8], ..Default::default() });
+        c.series = vec![s];
+        assert_eq!(point_count(&c), 1 + 1 + 5 + 4 + 5 + 6 + 15);
+    }
+
     #[test]
     fn sparse_caches_share_one_chart_wide_budget() {
         // Every series declares 100000 points but writes one: without a chart-wide budget each

crates/pptx/src/read/dml.rs

@@ -629,7 +629,19 @@ pub fn list_style(imp: &mut Imp, part: &Part, ls: &El) -> ListStyle {
 }
 
 pub fn text_body(imp: &mut Imp, part: &Part, tx: &El) -> TextBody {
-    let body = tx.child("bodyPr").map(body_pr).unwrap_or_default();
+    let mut body = tx.child("bodyPr").map(body_pr).unwrap_or_default();
+    if let Some(b) = tx.child("bodyPr") {
+        let mut raw3d = String::new();
+        if let Some(sc) = b.child("scene3d") {
+            raw3d.push_str(&part.keep_inner(sc));
+        }
+        if let Some(sp) = b.child("sp3d").or_else(|| b.child("flatTx")) {
+            raw3d.push_str(&part.keep_inner(sp));
+        }
+        if !raw3d.is_empty() && raw3d.len() <= 64 * 1024 {
+            body.raw3d = Some(raw3d);
+        }
+    }
     let list_style = tx.child("lstStyle").map(|l| list_style(imp, part, l)).unwrap_or_default();
     let paragraphs = tx.children_named("p").take(100_000).map(|p| paragraph(imp, part, p)).collect();
     TextBody { body, list_style, paragraphs }
@@ -729,7 +741,13 @@ mod tests {
         // 200 `m:t` nested in each other around one word: the word, not 200 copies of it.
         let x = format!(r#"<a14:m xmlns:a14="a" xmlns:m="m"><m:oMath>{}word{}</m:oMath></a14:m>"#, "<m:t>".repeat(200), "</m:t>".repeat(200));
         let d = parse(x.as_bytes()).unwrap();
-        let part = Part { name: "ppt/slides/slide1.xml".into(), rels: Default::default(), ns: vec![], inner_ns: vec![] };
+        let part = Part {
+            name: "ppt/slides/slide1.xml".into(),
+            rels: Default::default(),
+            ns: vec![],
+            inner_ns: vec![],
+            ns_budget: std::cell::Cell::new(1 << 20),
+        };
         let mut para = Paragraph::default();
         push_math_run(&mut para, &part, &d.root);
         assert_eq!(para.runs[0].text, "word");

crates/pptx/src/read/shapes.rs

@@ -395,6 +395,12 @@ fn grp(imp: &mut Imp, part: &Part, ctx: &mut IdCtx, e: &El, depth: usize) -> Sha
         if let Some(fx) = pr.child("effectLst") {
             s.effects = Some(dml::effects(fx));
         }
+        if let Some(sc) = pr.child("scene3d") {
+            let raw = part.keep_inner(sc);
+            if !raw.is_empty() && raw.len() <= 64 * 1024 {
+                s.effects.get_or_insert_with(Effects::default).raw3d = Some(raw);
+            }
+        }
     }
     let children = sp_tree(imp, part, ctx, e, depth + 1);
     let child = child.or_else(|| s.xfrm.map(|x| Xfrm::new(x.x, x.y, x.w, x.h))).unwrap_or_default();
@@ -428,11 +434,8 @@ fn frame(imp: &mut Imp, part: &Part, ctx: &mut IdCtx, e: &El, depth: usize) -> S
             return s;
         }
         if let Some(c) = gd.child("chart")
-            && let Some(rel) = part.rels.get(c.attr("r:id").unwrap_or(""))
-            && let Some(bytes) = imp.pkg.xml_bytes(&rel.target)
-            && let Some(mut chart) = if uri.ends_with("/chartex") { super::read_chartex_xml(bytes) } else { super::read_chart_xml(bytes) }
+            && let Some(chart) = super::chart::frame_chart(imp, part, c.attr("r:id").unwrap_or(""), uri)
         {
-            chart.kept = super::chart::capture_kept(imp, &rel.target);
             s.kind = ShapeKind::Chart(Box::new(chart));
             return s;
         }

crates/pptx/src/write/chart.rs

@@ -132,7 +132,20 @@ fn title(w: &mut W, text: &str, c: &Chart) {
     w.close("c:title");
 }
 
+/// Points one cache writes. Excel and PowerPoint hold 32,000 points per series, so this is far
+/// above any chart they make; a longer vector is cut here with a warning, not refused.
+const MAX_CACHE_POINTS: usize = 1_000_000;
+
+/// `vals` cut to [`MAX_CACHE_POINTS`].
+fn capped<T>(vals: &[T]) -> &[T] {
+    if vals.len() > MAX_CACHE_POINTS {
+        log::warn!("pptx: chart data cache cut from {} to {MAX_CACHE_POINTS} points", vals.len());
+    }
+    &vals[..vals.len().min(MAX_CACHE_POINTS)]
+}
+
 fn str_cache(w: &mut W, f: &str, vals: &[String]) {
+    let vals = capped(vals);
     w.open0("c:strRef");
     w.elt("c:f", f);
     w.open0("c:strCache");
@@ -147,6 +160,7 @@ fn str_cache(w: &mut W, f: &str, vals: &[String]) {
 }
 
 fn num_cache(w: &mut W, f: &str, vals: &[Option<f64>]) {
+    let vals = capped(vals);
     w.open0("c:numRef");
     w.elt("c:f", f);
     w.open0("c:numCache");
@@ -165,6 +179,7 @@ fn num_cache(w: &mut W, f: &str, vals: &[Option<f64>]) {
 
 /// Numbers written into the chart itself (`c:numLit`), with no worksheet range behind them.
 fn num_lit(w: &mut W, vals: &[Option<f64>]) {
+    let vals = capped(vals);
     w.open0("c:numLit");
     w.val("c:ptCount", vals.len());
     for (i, v) in vals.iter().enumerate() {
@@ -246,6 +261,9 @@ fn point_fills(w: &mut W, s: &Series, g: Group) {
     }
 }
 
+/// Data points (categories and values counted per series) one chart group writes to its caches.
+const MAX_EXPORT_POINTS: usize = 4_000_000;
+
 fn series(w: &mut W, c: &Chart, s: &Series, i: usize, kind: ChartType, g: Group) {
     w.open0("c:ser");
     w.val("c:idx", i);
@@ -305,7 +323,7 @@ fn series(w: &mut W, c: &Chart, s: &Series, i: usize, kind: ChartType, g: Group)
             trendline(w, t);
         }
     }
-    let n = c.categories.len().max(s.values.len());
+    let n = c.categories.len().max(s.values.len()).min(MAX_CACHE_POINTS);
     let last = n + 1;
     if let Some(e) = &s.error_bars {
         error_bars(w, e, g);
@@ -491,6 +509,24 @@ fn axes(w: &mut W, c: &Chart, g: Group) {
     w.close("c:valAx");
 }
 
+/// Points `series` writes into its caches for group `g`, synthesized vectors included.
+fn series_points(c: &Chart, s: &Series, g: Group) -> usize {
+    let v = s.values.len();
+    if matches!(g, Group::Scatter | Group::Bubble) {
+        let xs = if s.x_values.is_empty() { v } else { s.x_values.len() };
+        let sizes = if g != Group::Bubble {
+            0
+        } else if s.sizes.is_empty() {
+            v
+        } else {
+            s.sizes.len()
+        };
+        xs.saturating_add(v).saturating_add(sizes)
+    } else {
+        c.categories.len().saturating_add(v)
+    }
+}
+
 fn plot_group(w: &mut W, c: &Chart, kind: ChartType, list: &[(usize, &Series)]) {
     let g = group_of(kind);
     let grouping = if kind.percent() {
@@ -529,7 +565,17 @@ fn plot_group(w: &mut W, c: &Chart, kind: ChartType, list: &[(usize, &Series)])
     if g != Group::Stock {
         w.val("c:varyColors", vary);
     }
-    for (i, s) in list {
+    // Each series repeats the categories in its own cache, so the output grows with series times
+    // categories: stop adding series once a group's caches pass the budget (the first is always written).
+    // The first series is always written; each of its caches is cut at MAX_CACHE_POINTS.
+    let mut left = MAX_EXPORT_POINTS;
+    for (n, (i, s)) in list.iter().enumerate() {
+        let cost = series_points(c, s, g);
+        if n > 0 && cost > left {
+            log::warn!("pptx: chart export stopped after {n} series; the data caches passed {MAX_EXPORT_POINTS} points");
+            break;
+        }
+        left = left.saturating_sub(cost);
         series(w, c, s, *i, kind, g);
     }
     if c.data_labels {
@@ -610,6 +656,18 @@ fn kept_chartex(c: &Chart) -> Option<Vec<u8>> {
 
 /// The chart part XML, and whether it is the original part (so its relationships still apply).
 pub fn chart_xml(c: &Chart) -> (Vec<u8>, bool) {
+    // A chart too large to model is written back as it was read.
+    if c.verbatim
+        && let Some(raw) = &c.raw
+        && let Ok(doc) = crate::xml::parse(raw.as_bytes())
+        && doc.root.is("chartSpace")
+    {
+        let mut keep = doc.root;
+        drop_unkept_refs(&mut keep, c);
+        let mut w = W::new();
+        w.raw(&keep.to_xml());
+        return (w.finish(), true);
+    }
     // Reuse the kept part when the chart is unchanged since it was read.
     if let Some(raw) = &c.raw
         && !raw.contains(NS_CX)
@@ -1049,7 +1107,21 @@ mod region_map_tests {
 mod tests {
     use deckcraft_color::{ColorTransform, Rgba};
     use deckcraft_model::ColorRef;
-    use deckcraft_model::chart::{Chart, ChartType};
+    use deckcraft_model::chart::{Chart, ChartType, Series};
+
+    #[test]
+    fn export_cost_counts_the_caches_each_group_writes() {
+        let s = Series { values: vec![Some(1.0); 600], ..Default::default() };
+        let mut c = Chart::sample(ChartType::Column);
+        c.categories = vec!["a".into(); 1000];
+        // Category and value caches: 1,000 + 600, however the series is stored.
+        assert_eq!(super::series_points(&c, &s, super::Group::Bar), 1600);
+        // A bubble series without x values or sizes still writes three value-length caches.
+        assert_eq!(super::series_points(&c, &s, super::Group::Bubble), 1800);
+        assert_eq!(super::series_points(&c, &s, super::Group::Scatter), 1200);
+        let s = Series { values: vec![Some(1.0); 600], x_values: vec![Some(1.0); 5], sizes: vec![Some(1.0); 7], ..Default::default() };
+        assert_eq!(super::series_points(&c, &s, super::Group::Bubble), 612);
+    }
 
     /// The chart's text colour is written where PowerPoint keeps it (`c:txPr` on the axes, legend,
     /// data labels and chart, the title's run defaults) and read back as the same colour.
@@ -1110,3 +1182,19 @@ mod tests {
         assert!(!crate::read::chart::read_chart_xml(&super::chart_xml(&c).0).unwrap().cat_reversed);
     }
 }
+
+#[cfg(test)]
+mod cache_cap_tests {
+    use super::*;
+
+    /// A cache longer than the cap is cut, never refused; anything a real chart holds (32,000
+    /// points per series) is far under it. Zero-sized elements, so the test allocates nothing.
+    #[test]
+    fn caches_are_cut_at_the_cap_not_refused() {
+        const { assert!(MAX_CACHE_POINTS >= 32_000) };
+        let over = vec![(); MAX_CACHE_POINTS + 1];
+        assert_eq!(capped(&over).len(), MAX_CACHE_POINTS);
+        let real = vec![(); 32_000];
+        assert_eq!(capped(&real).len(), 32_000);
+    }
+}

crates/pptx/src/write/dml.rs

@@ -461,6 +461,21 @@ fn sound_label(name: &str) -> String {
     if label.is_empty() { "sound.wav".into() } else { label }
 }
 
+/// Validate an unmodelled 3-D fragment (`a:scene3d`, `a:sp3d`, `a:flatTx`) before writing raw XML.
+pub fn valid_raw3d<'a>(raw: &'a str, allowed: &[&str]) -> Option<&'a str> {
+    if raw.is_empty() || raw.len() > 64 * 1024 {
+        return None;
+    }
+    let wrap = format!("<r xmlns:a=\"{}\">{raw}</r>", crate::opc::NS_A);
+    let doc = crate::xml::parse(wrap.as_bytes()).ok()?;
+    let els: Vec<_> = doc.root.elements().collect();
+    (!els.is_empty()
+        && els.len() <= allowed.len()
+        && doc.root.children.len() == els.len()
+        && els.iter().all(|e| e.prefix() == "a" && allowed.contains(&e.local()) && !crate::read::has_rel_refs(e)))
+    .then_some(raw)
+}
+
 pub fn body_pr(w: &mut W, b: &BodyProps) {
     let a = A::new()
         .o("rot", b.rot.map(|r| (r * 60_000.0).round().clamp(-21_600_000.0, 21_600_000.0) as i64))
@@ -481,7 +496,8 @@ pub fn body_pr(w: &mut W, b: &BodyProps) {
         .o("vertOverflow", b.vert_overflow.map(|v| v.xml()))
         .o("horzOverflow", deckcraft_model::text::TextOverflow::horz_xml(b.horz_overflow));
     let warp = b.warp.as_deref().filter(|s| !s.is_empty() && s.chars().all(|c| c.is_ascii_alphanumeric()));
-    if warp.is_none() && b.autofit.is_none() {
+    let raw3d = b.raw3d.as_deref().and_then(|s| valid_raw3d(s, &["scene3d", "sp3d", "flatTx"]));
+    if warp.is_none() && b.autofit.is_none() && raw3d.is_none() {
         w.empty("a:bodyPr", a);
         return;
     }
@@ -515,6 +531,9 @@ pub fn body_pr(w: &mut W, b: &BodyProps) {
         }
         None => {}
     }
+    if let Some(raw) = raw3d {
+        w.raw(raw);
+    }
     w.close("a:bodyPr");
 }
 

crates/pptx/src/write/shapes.rs

@@ -334,7 +334,20 @@ pub fn shape(w: &mut W, x: &mut Exp, o: &mut Out, cx: &mut Ctx, s: &Shape, depth
                 dml::fill(w, x, o, f);
             }
             if let Some(fx) = &s.effects {
-                dml::effects(w, fx);
+                if fx.fill_overlay.is_some()
+                    || fx.glow.is_some()
+                    || fx.inner_shadow.is_some()
+                    || fx.outer_shadow.is_some()
+                    || fx.reflection.is_some()
+                    || fx.soft_edge.is_some()
+                {
+                    dml::effects(w, fx);
+                }
+                if let Some(raw) =
+                    fx.raw3d.as_deref().map(|s| s.find("<a:sp3d").map_or(s, |i| &s[..i])).and_then(|s| dml::valid_raw3d(s, &["scene3d"]))
+                {
+                    w.raw(raw);
+                }
             }
             w.close("p:grpSpPr");
             shapes(w, x, o, cx, children, depth + 1);
@@ -529,10 +542,22 @@ fn diagram(w: &mut W, x: &mut Exp, o: &mut Out, cx: &mut Ctx, s: &Shape, d: &dec
     let (sx, sy) = (frame.w / child.w.max(1e-6), frame.h / child.h.max(1e-6));
     let mut k = 0;
     let mut flat = vec![];
-    walk(children, &mut |c, _| {
-        if matches!(c.kind, ShapeKind::Shape) {
-            flat.push(c.clone());
+    walk(children, &mut |c, _| match &c.kind {
+        ShapeKind::Shape => flat.push(c.clone()),
+        ShapeKind::Connector { .. } => {
+            let mut sc = c.clone();
+            if sc.geom.preset_name() == Some("rect") {
+                sc.geom = Geom::preset("line");
+            }
+            flat.push(sc);
         }
+        ShapeKind::Picture { fill } => {
+            let mut sc = c.clone();
+            sc.kind = ShapeKind::Shape;
+            sc.fill = Some(deckcraft_model::style::Fill::Picture(fill.clone()));
+            flat.push(sc);
+        }
+        _ => {}
     });
     for mut c in flat.into_iter().take(10_000) {
         if let Some(xf) = &mut c.xfrm {

crates/pptx/tests/it/chart_embed.rs

@@ -328,3 +328,30 @@ fn an_unchanged_chartex_keeps_its_embedded_workbook() {
     assert!(saved.iter().all(|(n, _)| n != "ppt/charts/_rels/chart1.xml.rels"), "the fallback chart has no workbook");
     assert!(!text_of(&saved, "ppt/charts/chart1.xml").contains("externalData"));
 }
+
+/// A chart past the presentation's point budget is not modelled, but a save writes the original
+/// chart part and its workbook back instead of dropping both.
+#[test]
+fn a_chart_past_the_point_budget_is_saved_whole() {
+    let src = with_workbook(&chart_pptx());
+    let p = deckcraft_pptx::import_with_chart_budget(&src, 0).expect("import");
+    let chart = p
+        .slides
+        .iter()
+        .flat_map(|s| s.shapes.iter())
+        .find_map(|s| match &s.kind {
+            ShapeKind::Chart(c) => Some(c.clone()),
+            _ => None,
+        })
+        .expect("the chart stays a chart");
+    assert!(chart.verbatim && chart.series.is_empty());
+    let saved = parts(&deckcraft_pptx::export(&p).expect("export"));
+    let workbook = saved.iter().find(|(n, _)| n == "ppt/embeddings/kept1.xlsx").map(|(_, d)| d.as_slice());
+    assert_eq!(workbook, Some(WORKBOOK));
+    let xml = saved
+        .iter()
+        .find(|(n, _)| n.starts_with("ppt/charts/chart") && n.ends_with(".xml"))
+        .map(|(_, d)| String::from_utf8_lossy(d).into_owned())
+        .expect("chart xml");
+    assert!(xml.contains("externalData") && xml.contains("c:pie"), "{xml}");
+}

crates/pptx/tests/it/corpus_style.rs

@@ -241,6 +241,67 @@ fn theme_and_bevel_survive(once: &Presentation, twice: &Presentation) {
     assert_eq!(by_name(twice, "Bevel").effects.as_ref().and_then(|e| e.raw3d.as_deref()), Some(raw));
 }
 
+#[test]
+fn text_and_group_3d_survive() {
+    let text_3d =
+        "<a:scene3d><a:camera prst=\"orthographicFront\"/><a:lightRig rig=\"threePt\" dir=\"t\"/></a:scene3d><a:sp3d extrusionH=\"12700\"/>";
+    let flat_tx = "<a:scene3d><a:camera prst=\"orthographicFront\"/><a:lightRig rig=\"threePt\" dir=\"t\"/></a:scene3d><a:flatTx z=\"0\"/>";
+    let mut p3 = defaults::new_presentation(None);
+    let mut sh = shape(&mut p3, "Text3D", 10.0, 10.0, 100.0, 40.0);
+    sh.text = Some(TextBody {
+        body: BodyProps { raw3d: Some(text_3d.into()), ..Default::default() },
+        paragraphs: vec![Paragraph::new("3D Text")],
+        ..Default::default()
+    });
+    let mut sh_flat = shape(&mut p3, "FlatTx3D", 10.0, 55.0, 100.0, 40.0);
+    sh_flat.text = Some(TextBody {
+        body: BodyProps { raw3d: Some(flat_tx.into()), ..Default::default() },
+        paragraphs: vec![Paragraph::new("Flat Text")],
+        ..Default::default()
+    });
+    let grp_3d = "<a:scene3d><a:camera prst=\"isometricTopUp\"/><a:lightRig rig=\"threePt\" dir=\"t\"/></a:scene3d>";
+    let mut grp = shape(&mut p3, "Group3D", 10.0, 60.0, 100.0, 80.0);
+    grp.effects = Some(Effects { raw3d: Some(grp_3d.into()), ..Default::default() });
+    grp.kind = ShapeKind::Group { children: vec![sh, sh_flat], child: Xfrm::new(10.0, 10.0, 100.0, 80.0) };
+    let layout = defaults::layout_of_kind(&p3, deckcraft_model::LayoutType::Blank).unwrap_or_default();
+    let mut s3 = defaults::new_slide(&mut p3, layout).expect("slide");
+    s3.shapes.push(grp);
+    p3.slides.push(Arc::new(s3));
+
+    let bytes = deckcraft_pptx::export(&p3).expect("export");
+    let slide_xml = {
+        use std::io::Read;
+        let mut z = zip::ZipArchive::new(std::io::Cursor::new(&bytes)).expect("zip");
+        let mut s = String::new();
+        z.by_name("ppt/slides/slide2.xml").expect("slide2").read_to_string(&mut s).expect("utf8");
+        s
+    };
+    assert!(!slide_xml.contains("<a:effectLst/>"), "Group3D with only raw3d must not emit empty effectLst: {slide_xml}");
+    assert!(slide_xml.contains("<a:flatTx z=\"0\"/>"), "{slide_xml}");
+
+    let r3 = deckcraft_pptx::import(&bytes).expect("import");
+    let r3_twice = round(&r3);
+    let g3 = by_name(&r3, "Group3D");
+    let g3_raw = g3.effects.as_ref().and_then(|e| e.raw3d.as_deref()).unwrap_or("");
+    let t3_raw = g3.children()[0].text.as_ref().and_then(|t| t.body.raw3d.as_deref()).unwrap_or("");
+    let flat_raw = g3.children()[1].text.as_ref().and_then(|t| t.body.raw3d.as_deref()).unwrap_or("");
+    assert!(g3_raw.contains("isometricTopUp"), "{g3_raw}");
+    assert!(t3_raw.contains("orthographicFront") && t3_raw.contains("extrusionH=\"12700\""), "{t3_raw}");
+    assert!(flat_raw.contains("flatTx"), "{flat_raw}");
+    assert_eq!(by_name(&r3_twice, "Group3D").effects.as_ref().and_then(|e| e.raw3d.as_deref()), Some(g3_raw));
+    assert_eq!(by_name(&r3_twice, "Group3D").children()[0].text.as_ref().and_then(|t| t.body.raw3d.as_deref()), Some(t3_raw));
+    assert_eq!(by_name(&r3_twice, "Group3D").children()[1].text.as_ref().and_then(|t| t.body.raw3d.as_deref()), Some(flat_raw));
+
+    // BodyProps::inherit propagates parent raw3d only when child raw3d is None.
+    let parent_body = BodyProps { raw3d: Some(text_3d.into()), ..Default::default() };
+    let mut child_body = BodyProps::default();
+    child_body.inherit(&parent_body);
+    assert_eq!(child_body.raw3d.as_deref(), Some(text_3d));
+    let mut override_body = BodyProps { raw3d: Some(flat_tx.into()), ..Default::default() };
+    override_body.inherit(&parent_body);
+    assert_eq!(override_body.raw3d.as_deref(), Some(flat_tx));
+}
+
 fn connector_glue_survives(p: &Presentation, once: &Presentation, twice: &Presentation) {
     let c = by_name(once, "Connector");
     assert!(matches!(c.kind, ShapeKind::Connector { start: Some((s, 3)), end: Some((e, 1)) } if s == left_of(p) && e == right_of(p)), "{:?}", c.kind);

crates/render/src/bevel.rs

@@ -125,10 +125,13 @@ pub fn draw(ctx: &mut RenderContext, bevel: &Bevel, fill: Option<Rgba>, path: &B
     let longest = bounds.width().max(bounds.height()) * k;
     let s = (MAX_SIDE / longest).min(1.0) * k;
     let (pw, ph) = (((bounds.width() * s).ceil() as u32).clamp(1, 2048), ((bounds.height() * s).ceil() as u32).clamp(1, 2048));
-    let polys = crate::pathgrad::polygons(path);
+    // Each pixel tests every edge, so a dense outline is simplified to the raster's edge budget.
+    let pixel = (bounds.width() / f64::from(pw)).min(bounds.height() / f64::from(ph));
+    let polys = crate::pathgrad::simplify(crate::pathgrad::polygons(path), pixel, crate::pathgrad::edge_budget(pw, ph));
     if polys.is_empty() {
         return;
     }
+    let (pw, ph) = crate::pathgrad::fit_raster(polys.iter().map(|p| p.len().saturating_sub(1)).sum(), pw, ph);
     let areas: Vec<f64> = polys.iter().map(|p| p.windows(2).map(|w| w[0].x * w[1].y - w[1].x * w[0].y).sum::<f64>() / 2.0).collect();
     let face = lit.factor([0.0, 0.0, 1.0]);
     let ratio = if bevel.w > 0.0 { bevel.h / bevel.w } else { 0.0 };

crates/render/src/colr.rs

@@ -11,6 +11,8 @@ use vello_cpu::{RenderContext, peniko};
 
 /// Nesting depth of clips and layers past which a glyph opens no more (hostile fonts).
 const MAX_DEPTH: usize = 64;
+/// Fills and gradient stops one colour glyph may paint; the rest of a hostile glyph is skipped.
+const MAX_WORK: usize = 100_000;
 
 /// Paint `gid` of `face` as a colour glyph, its origin mapped by `at` (y down, points) at `scale`
 /// points per font unit. `fg` is the text colour (palette index 0xFFFF) and `alpha` fades it all.
@@ -26,7 +28,7 @@ pub fn paint(ctx: &mut RenderContext, face: &FontFace, gid: u32, at: Affine, sca
         .unwrap_or_default();
     // Font units are y up; the slide is y down.
     let base = at * Affine::scale(scale) * Affine::scale_non_uniform(1.0, -1.0);
-    let mut p = Painter { ctx, face, base, stack: vec![Affine::IDENTITY], palette, fg, opened: Vec::new() };
+    let mut p = Painter { ctx, face, base, stack: vec![Affine::IDENTITY], palette, fg, opened: Vec::new(), work: 0 };
     p.ctx.push_layer(None, None, Some(alpha.clamp(0.0, 1.0) as f32), None, None);
     let ok = glyph.paint(face.location(), &mut p).is_ok();
     // A malformed glyph may leave layers open: close them all.
@@ -50,6 +52,8 @@ struct Painter<'a> {
     /// Clips and composite groups pushed by the glyph, innermost last: true when a layer was
     /// opened on the context for it (false past `MAX_DEPTH`, so its pop is skipped too).
     opened: Vec<bool>,
+    /// Fills plus gradient stops painted so far, against [`MAX_WORK`].
+    work: usize,
 }
 
 fn affine(t: &Transform) -> Affine {
@@ -174,6 +178,16 @@ impl ColorPainter for Painter<'_> {
     }
 
     fn fill(&mut self, brush: Brush<'_>) {
+        let stops = match &brush {
+            Brush::Solid { .. } => 0,
+            Brush::LinearGradient { color_stops, .. } | Brush::RadialGradient { color_stops, .. } | Brush::SweepGradient { color_stops, .. } => {
+                color_stops.len()
+            }
+        };
+        self.work = self.work.saturating_add(1 + stops);
+        if self.work > MAX_WORK {
+            return;
+        }
         match brush {
             Brush::Solid { palette_index, alpha } => {
                 let c = self.color(palette_index, alpha);