test: avoid unchecked option parsing in Flatpak regression

Release 0.18.1: fix Flatpak update permissions
Merge main into release for DeckCraft v0.18.0
2026-11-12 00:47:28 -06:00 · 2026-11-11 14:08:49 -05:00 · 2026-11-11 14:04:28 -05:00 · 2026-11-11 16:35:50 +01:00 · 2026-11-09 06:29:58 -05:00
90 changed files with 15163 additions and 1537 deletions
@@ -26,10 +26,6 @@ jobs:
      # Same craft-fonts commit as release.yml.
      CRAFT_FONTS_REF: 37827adc41fd165f9a9234ac40f94dbad353aa69
    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
      - name: Check out craft-fonts
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
@@ -27,10 +27,6 @@ jobs:
    name: Windows installation policy (no app build)
    runs-on: windows-latest
    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
@@ -1,10 +1,6 @@
 name: Release

 on:
-  # A nightly dry run on main: every release build except macOS, nothing signed or released
-  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
-  schedule:
-    - cron: "16 1 * * *"
  push:
    branches: [release]
  workflow_dispatch:
@@ -34,7 +30,6 @@ jobs:
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
    with:
-      dry-run: ${{ github.event_name == 'schedule' }}
      app-name: deckcraft
      app-title: DeckCraft
      # Keep identical to ci.yml and freebsd.yml. The shared release workflow sets
@@ -844,24 +844,15 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "craft-audio"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=75895c0321d8cb6e175a42466cba050352b117c5#75895c0321d8cb6e175a42466cba050352b117c5"
-dependencies = [
- "craft-media",
- "thiserror 2.0.21",
-]
-
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"

 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
 dependencies = [
 "fixed_decimal",
 "icu_decimal",
@@ -884,26 +875,15 @@ dependencies = [
 [[package]]
 name = "craft-media"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=75895c0321d8cb6e175a42466cba050352b117c5#75895c0321d8cb6e175a42466cba050352b117c5"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
 dependencies = [
 "thiserror 2.0.21",
 ]

-[[package]]
-name = "craft-metafile"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=8079878ae2b166c1ea8229e40eff7e08c916e532#8079878ae2b166c1ea8229e40eff7e08c916e532"
-dependencies = [
- "encoding_rs",
- "image",
- "kurbo",
- "thiserror 2.0.21",
-]
-
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
 dependencies = [
 "krilla",
 "thiserror 2.0.21",
@@ -912,7 +892,7 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
 dependencies = [
 "craft-fonts-build",
 "craft-i18n",
@@ -932,7 +912,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
 dependencies = [
 "chrono",
 "dunce",
@@ -942,7 +922,6 @@ dependencies = [
 "image",
 "log",
 "plist",
- "rustix 1.1.5",
 "semver",
 "serde",
 "serde_json",
@@ -1186,6 +1165,20 @@ dependencies = [
 "thiserror 2.0.21",
 ]

+[[package]]
+name = "deckcraft-isobmff"
+version = "0.18.1"
+dependencies = [
+ "craft-media",
+]
+
+[[package]]
+name = "deckcraft-matroska"
+version = "0.18.1"
+dependencies = [
+ "craft-media",
+]
+
 [[package]]
 name = "deckcraft-mcp"
 version = "0.18.1"
@@ -1200,11 +1193,13 @@ dependencies = [
 name = "deckcraft-media"
 version = "0.18.1"
 dependencies = [
- "craft-audio",
- "craft-media",
 "deckcraft-av1",
 "deckcraft-h264",
 "deckcraft-hevc",
+ "deckcraft-isobmff",
+ "deckcraft-matroska",
+ "deckcraft-ogg",
+ "deckcraft-opus",
 "deckcraft-vp9",
 "image",
 "log",
@@ -1212,6 +1207,15 @@ dependencies = [
 "thiserror 2.0.21",
 ]

+[[package]]
+name = "deckcraft-metafile"
+version = "0.18.1"
+dependencies = [
+ "image",
+ "kurbo",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "deckcraft-model"
 version = "0.18.1"
@@ -1224,6 +1228,14 @@ dependencies = [
 "unicode-segmentation",
 ]

+[[package]]
+name = "deckcraft-ogg"
+version = "0.18.1"
+
+[[package]]
+name = "deckcraft-opus"
+version = "0.18.1"
+
 [[package]]
 name = "deckcraft-pdf"
 version = "0.18.1"
@@ -1262,11 +1274,11 @@ dependencies = [
 name = "deckcraft-render"
 version = "0.18.1"
 dependencies = [
- "craft-metafile",
 "deckcraft-anim",
 "deckcraft-color",
 "deckcraft-fonts",
 "deckcraft-geom",
+ "deckcraft-metafile",
 "deckcraft-model",
 "deckcraft-text",
 "image",
@@ -2779,7 +2791,7 @@ dependencies = [
 [[package]]
 name = "krilla"
 version = "0.8.2"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=1b34eba41e62138fc2438d2734523b302840b45d#1b34eba41e62138fc2438d2734523b302840b45d"
 dependencies = [
 "base64 0.22.1",
 "bumpalo",
@@ -14,6 +14,7 @@ repository = "https://github.com/storytold/deckcraft"
 # internal
 deckcraft-geom = { path = "crates/geom" }
 deckcraft-color = { path = "crates/color" }
+deckcraft-metafile = { path = "crates/metafile" }
 deckcraft-model = { path = "crates/model" }
 deckcraft-fonts = { path = "crates/fonts" }
 deckcraft-text = { path = "crates/text" }
@@ -26,12 +27,16 @@ deckcraft-engine = { path = "crates/engine" }
 deckcraft-mcp = { path = "crates/mcp" }
 deckcraft-ui-egui = { path = "crates/ui-egui" }
 deckcraft-media = { path = "crates/media" }
-# video codecs (ported from FilmCraft, same owner and licence)
+# codecs (ported from FilmCraft, same owner and licence)
 deckcraft-bitstream = { path = "crates/bitstream" }
 deckcraft-h264 = { path = "crates/h264" }
 deckcraft-hevc = { path = "crates/hevc" }
 deckcraft-vp9 = { path = "crates/vp9" }
 deckcraft-av1 = { path = "crates/av1" }
+deckcraft-isobmff = { path = "crates/isobmff" }
+deckcraft-matroska = { path = "crates/matroska" }
+deckcraft-ogg = { path = "crates/ogg" }
+deckcraft-opus = { path = "crates/opus" }

 # foundation
 kurbo = { version = "0.13", features = ["serde"] }
@@ -54,15 +59,11 @@ harfrust = "0.13"
 vello_cpu = "0.2"
 vello_common = { version = "0.2", default-features = false }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
-# craft-media and craft-audio share types and stay on one rev.
-craft-media = { git = "https://github.com/storytold/craft-libs", rev = "75895c0321d8cb6e175a42466cba050352b117c5", version = "=0.1.0", default-features = false }
-craft-audio = { git = "https://github.com/storytold/craft-libs", rev = "75895c0321d8cb6e175a42466cba050352b117c5", version = "=0.1.0", default-features = false, features = ["opus-decode"] }
-# WMF, EMF and EMF+ reader.
-craft-metafile = { git = "https://github.com/storytold/craft-libs", rev = "8079878ae2b166c1ea8229e40eff7e08c916e532", version = "=0.1.0" }
-craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.1.0", default-features = false, features = ["write", "write-simple-text"] }
+craft-media = { git = "https://github.com/storytold/craft-libs", rev = "1b34eba41e62138fc2438d2734523b302840b45d", version = "=0.1.0", default-features = false }
+craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "1b34eba41e62138fc2438d2734523b302840b45d", version = "=0.1.0", default-features = false, features = ["write", "write-simple-text"] }
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", features = ["egui"] }
-craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.1.0" }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "1b34eba41e62138fc2438d2734523b302840b45d", features = ["egui"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "1b34eba41e62138fc2438d2734523b302840b45d", version = "=0.1.0" }
 i_overlay = "9"
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
@@ -108,7 +109,7 @@ codegen-units = 16
 debug = 0

 [patch.crates-io]
-krilla = { git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", version = "=0.8.2" }
+krilla = { git = "https://github.com/storytold/craft-libs", rev = "1b34eba41e62138fc2438d2734523b302840b45d", version = "=0.8.2" }
 ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
@@ -76,9 +76,8 @@ Code dependencies
 - symphonia (audio decoding for MP3, AAC, ALAC, FLAC, Vorbis, WAV, AIFF, CAF) is used unmodified
  under the Mozilla Public License 2.0; its source is available at
  https://github.com/pdeljanov/Symphonia.
- The H.264, HEVC, VP9 and AV1 crates under crates/ are ported from FilmCraft (same owner,
-  MIT OR Apache-2.0). The Opus decoder (craft-audio) and the MP4, Matroska and Ogg demuxers
-  (craft-media) come from craft-libs (same owner, MIT OR Apache-2.0).
+- The H.264, HEVC, VP9, AV1, Opus, MP4, Matroska and Ogg crates under crates/ are ported from
+  FilmCraft (same owner, MIT OR Apache-2.0).

 - Krilla 0.8.2 (https://github.com/LaurenzV/krilla) is used through craft-pdf under
  MIT OR Apache-2.0. craft-libs vendors that version with page/surface unwind recovery
@@ -2,7 +2,7 @@

 **Stage: alpha** · next: beta, ~20 points and ~120–210 h away

-> **Last reviewed:** 2026-11-04 · **Last updated:** 2026-11-11 · **Change:** trivial (the Opus decoder and the Ogg, MP4 and Matroska demuxers come from craft-libs; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-11-04 · **Last updated:** 2026-11-04 · **Change:** trivial (Ogg Opus recovery includes trailing packets without granules in its reported duration; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-11-02 · **Last updated:** 2026-11-03 · **Change:** trivial (progress log: web `?host=parent` bridge opens and saves through a same-origin framing page; scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)

 > **Last reviewed:** 2026-11-02 · **Last updated:** 2026-11-03 · **Change:** trivial (community PR wave 10: PPTX and native saves keep table cell centred anchoring, text overflow, compatible line spacing, normalised character height, Thai distributed alignment, RTL table direction, alternate run language and reflection transforms; imported effects placed by parent time-node delays; Reuse Slides fits the destination size and brings custom table styles; deleted slides leave custom shows; merged shapes drop their animations; Compress Pictures measures grouped pictures at displayed size; parity scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
@@ -154,7 +154,6 @@ app's JSON control channel (`deckcraft --control PORT`).

 | Date | What landed |
 |---|---|
-| 2026-11-11 | Media: the Opus decoder and the Ogg, MP4/MOV and Matroska demuxers are craft-audio and craft-media from craft-libs; DeckCraft's own copies and re-export crates are removed |
 | 2026-11-04 | Ogg Opus recovery keeps trailing packets without granules in the total duration, matching their recovered positions; valid end trimming stays covered |
 | 2026-11-03 | Web: the `?host=parent` bridge (as in GridCraft, WordCraft and PdfCraft) lets a same-origin page that frames DeckCraft send a presentation and store its saves; Save writes an opened .pptx back as .pptx under its own name, as on the desktop |
 | 2026-11-02 | Slide show on Linux and the BSDs: Presenter View stays off when winit lists exactly one display, as in PowerPoint; if it lists none, the setting is kept. On one display the presenter window covered the show, and the hidden window stalled every frame: slide changes took up to ~1.7 s under Hyprland (#1156) |
@@ -341,7 +340,6 @@ app's JSON control channel (`deckcraft --control PORT`).

 | Date | Change | Summary |
 |---|---|---|
-| 2026-11-11 | trivial | Opus and container code moved to craft-libs crates; parity scores unchanged |
 | 2026-11-04 | trivial | Ogg Opus recovery duration includes its recovered tail; parity scores unchanged |
 | 2026-11-02 | trivial | Progress log: run alternate-language metadata round-trips through native and PPTX formats; product parity scores unchanged |
 | 2026-11-03 | trivial | Reuse Slides brings referenced custom table styles along; scores unchanged |
@@ -118,8 +118,6 @@ enum Output {
        grain: FilmGrainParams,
        apply_film_grain: bool,
        pts: i64,
-        /// What copying the picture out costs, in the reference's own format.
-        bytes: u64,
    },
 }

@@ -134,7 +132,7 @@ impl Output {
    fn take(self) -> Result<Picture> {
        match self {
            Output::Decoded(s) => s.wait().map(|p| Arc::try_unwrap(p).unwrap_or_else(|p| (*p).clone())),
-            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts, .. } => {
+            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts } => {
                let rf = slot.wait()?;
                Ok(output_picture(&seq, &rf, width, height, &grain, apply_film_grain, pts))
            }
@@ -381,8 +379,8 @@ impl Decoder {
        // Output policy (7.18.1 note): with scalability, show one frame per temporal unit, the
        // highest spatial layer present.
        let scalable = self.seq.as_ref().is_some_and(|s| s.op_idc != 0);
-        let kept: Vec<Output> = if !scalable {
-            out.into_iter().map(|(o, _, _)| o).collect()
+        if !scalable {
+            self.out.extend(out.into_iter().map(|(o, _, _)| o));
        } else {
            let mut last: Option<(usize, u32)> = None;
            let mut sel: Vec<Output> = Vec::new();
@@ -402,27 +400,8 @@ impl Decoder {
                    }
                }
            }
-            sel
-        };
-        // Every repeat is copied out whole, so the repeats this call keeps (after the layer
-        // selection) must not queue more than half the decoder budget; the first one over it and
-        // everything after is dropped.
-        let mut r = r;
-        let mut repeat_bytes = 0u64;
-        let mut ok = Vec::with_capacity(kept.len());
-        for o in kept {
-            if let Output::Existing { bytes, .. } = &o {
-                repeat_bytes = repeat_bytes.saturating_add(*bytes);
-                if repeat_bytes > self.memory_budget / 2 {
-                    if r.is_ok() {
-                        r = Err(Error::Invalid("repeated frame outputs exceed the decoder memory budget"));
-                    }
-                    break;
-                }
-            }
-            ok.push(o);
+            self.out.extend(sel);
        }
-        self.out.extend(ok);
        r
    }

@@ -524,15 +503,6 @@ impl Decoder {
            let idx = fh.frame_to_show_map_idx;
            let slot = self.ref_frames[idx].clone().ok_or(Error::Invalid("show_existing_frame of an empty slot"))?;
            let info = self.refs[idx].clone();
-            // Sized in the reference's own format: a new sequence header may differ from it.
-            let shape = deckcraft_bitstream::budget::PictureShape {
-                width: u64::from(info.upscaled_width),
-                height: u64::from(info.frame_height),
-                shift_x: u32::from(info.subsampling_x),
-                shift_y: u32::from(info.subsampling_y),
-                chroma_planes: if info.mono_chrome { 0 } else { 2 },
-                bytes_per_sample: 2,
-            };
            let o = Output::Existing {
                slot: slot.clone(),
                seq: seq.clone(),
@@ -541,7 +511,6 @@ impl Decoder {
                grain: fh.film_grain.clone(),
                apply_film_grain: self.apply_film_grain,
                pts: self.pts,
-                bytes: shape.bytes().unwrap_or(u64::MAX),
            };
            if fh.frame_type == KEY_FRAME as u8 {
                // reference frame loading process (7.21) then refresh every slot (7.20)
@@ -660,9 +629,6 @@ impl Decoder {
                ri.lf_deltas = fh.lf.deltas;
                ri.seg_features = fh.seg.features;
                ri.grain = fh.film_grain.clone();
-                ri.subsampling_x = job.seq.color.subsampling_x;
-                ri.subsampling_y = job.seq.color.subsampling_y;
-                ri.mono_chrome = job.seq.color.mono_chrome;
                self.ref_frames[i] = Some(job.slot.clone());
            }
        }
@@ -811,14 +777,6 @@ fn decode_frame(job: &FrameJob, pool: &Pool, stats: &mut DecodeStats) -> Result<
    Ok((rf, pic))
 }

-/// Bytes all parallel tile states may hold of whole-frame CDEF and restoration metadata; past it
-/// the tiles decode one after another on the frame's own metadata.
-const TILE_METADATA_BUDGET: usize = 256 << 20;
-
-fn tile_metadata_fits(tiles: usize, per_tile: usize) -> bool {
-    tiles.checked_mul(per_tile).is_some_and(|n| n <= TILE_METADATA_BUDGET)
-}
-
 /// Decode the tiles of a frame (tile number, data), in parallel when several; returns the final
 /// CDFs of tile context_update_tile_id.
 fn decode_tiles(pool: &Pool, fs: &mut FrameState, cdfs: &Cdfs, tiles: &[(usize, Vec<u8>)]) -> Result<Option<Box<Cdfs>>> {
@@ -832,7 +790,7 @@ fn decode_tiles(pool: &Pool, fs: &mut FrameState, cdfs: &Cdfs, tiles: &[(usize,
    };
    // Intra block copy reads the current frame through the tile's own buffer: keep whole-frame
    // buffers (tiles one after another) for it.
-    if tiles.len() > 1 && pool.is_parallel() && !fs.fh.allow_intrabc && tile_metadata_fits(tiles.len(), fs.tile_metadata_bytes()) {
+    if tiles.len() > 1 && pool.is_parallel() && !fs.fh.allow_intrabc {
        let mut states: Vec<TileState> = tiles
            .iter()
            .map(|(num, _)| {
@@ -1117,14 +1075,6 @@ mod guard_tests {
 #[cfg(test)]
 mod budget_tests {
    use super::*;
-
-    #[test]
-    fn tile_metadata_copies_are_budgeted() {
-        assert!(tile_metadata_fits(64, 1 << 20));
-        assert!(!tile_metadata_fits(4096, 1 << 20));
-        assert!(!tile_metadata_fits(usize::MAX, 2));
-    }
-
    use deckcraft_bitstream::budget::DECODE_MEMORY_BUDGET;

    fn color(mono: bool) -> crate::header::ColorConfig {
@@ -360,10 +360,6 @@ pub struct RefInfo {
    pub lf_deltas: LoopFilterDeltas,
    pub seg_features: SegmentationFeatures,
    pub grain: FilmGrainParams,
-    /// The colour format the frame was decoded in (a later sequence header may change it).
-    pub subsampling_x: u8,
-    pub subsampling_y: u8,
-    pub mono_chrome: bool,
 }

 /// A parsed uncompressed frame header with its derived variables.
@@ -253,13 +253,6 @@ impl FrameState {
        self.lr = t.lr;
    }

-    /// Bytes of CDEF and loop-restoration metadata each parallel tile state copies whole.
-    pub fn tile_metadata_bytes(&self) -> usize {
-        let lr = &self.lr;
-        // 1 (type) + 6 (Wiener) + 1 (SGR set) + 2 (SGR weights) bytes per unit.
-        self.cdef.len() + lr.lr_type.iter().map(|v| v.len() * 10).sum::<usize>()
-    }
-
    /// Private buffers for the tile covering mode info rows [r0, r1) x columns [c0, c1); tiles
    /// on the right / bottom frame edge also cover the allocation margins.
    pub fn tile_state(&self, r0: usize, r1: usize, c0: usize, c1: usize) -> TileState {
@@ -80,12 +80,6 @@ pub(super) fn photo_album_edit(s: &mut Session, p: &Value) -> Result<Value> {
    let opts = album_opts(p)?;
    let items = album_items(p)?;
    let (id, ids) = album_target(s, p)?;
-    // The editor is seeded within the album limits; replacing the album from a trimmed seed would
-    // delete what it left out, so refuse rather than lose it.
-    let st = s.doc()?;
-    if items_from_slides(&st.doc, &album_slides(st, &ids)).1 {
-        return Err(bad("insert.photoAlbumEdit", "this album holds more than the editor can carry; editing it would delete the rest"));
-    }
    commit_album(s, items, opts, Some((id, ids)))
 }

@@ -551,19 +545,6 @@ fn album_target(s: &Session, p: &Value) -> Result<(u32, Vec<u64>)> {
    Err(bad("insert.photoAlbumEdit", "this slide is not part of a photo album"))
 }

-/// Whether a slide holds anything besides album items: shapes, notes, comments, a background, a
-/// transition, animations, a colour map or tags.
-fn has_slide_content(s: &deckcraft_model::Slide) -> bool {
-    !s.shapes.is_empty()
-        || !s.notes.text().trim().is_empty()
-        || !s.comments.is_empty()
-        || s.background.is_some()
-        || s.transition.is_some()
-        || !s.animations.is_empty()
-        || s.color_map.is_some()
-        || !s.tags.is_empty()
-}
-
 fn pic_count(slide: &deckcraft_model::Slide) -> usize {
    slide.shapes.iter().filter(|sh| matches!(sh.kind, ShapeKind::Picture { .. })).count()
 }
@@ -611,16 +592,9 @@ fn infer_album(slides: &[&deckcraft_model::Slide], theme_now: &str) -> (String,
    (layout, frame.into(), captions, any && gray, theme_now.to_string())
 }

-/// The album's items for the dialog, within the limits `insert.photoAlbum` itself takes (items,
-/// bytes per picture and in all), checked before a picture is encoded: an album slide set can
-/// name one large picture many times.
-///
-/// The flag is true when something was left out for a limit.
-fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_model::Slide]) -> (Vec<Value>, bool) {
+fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_model::Slide]) -> Vec<Value> {
    let mut items = Vec::new();
-    let mut total = 0usize;
-    let mut omitted = false;
-    'slides: for slide in slides {
+    for slide in slides {
        let pics: Vec<&deckcraft_model::Shape> = slide.shapes.iter().filter(|sh| matches!(sh.kind, ShapeKind::Picture { .. })).collect();
        if pics.is_empty() {
            let text = slide
@@ -631,27 +605,13 @@ fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_m
                .find(|t| !t.trim().is_empty())
                .unwrap_or_default();
            if !text.trim().is_empty() {
-                if items.len() >= ALBUM_MAX_ITEMS {
-                    omitted = true;
-                    break 'slides;
-                }
                items.push(json!({"text": text.trim()}));
-            } else if items.len() >= ALBUM_MAX_ITEMS && has_slide_content(slide) {
-                // Past the item limit, a slide with other content would be deleted by a replace.
-                omitted = true;
-                break 'slides;
            }
            continue;
        }
        for sh in pics {
            let ShapeKind::Picture { fill } = &sh.kind else { continue };
            let media = doc.media(fill.media);
-            let size = media.map_or(0, |m| m.data.len());
-            if items.len() >= ALBUM_MAX_ITEMS || size > ALBUM_MAX_BYTES || total.saturating_add(size) > ALBUM_MAX_TOTAL {
-                omitted = true;
-                break 'slides;
-            }
-            total += size;
            let name = if !sh.descr.is_empty() {
                sh.descr.clone()
            } else {
@@ -666,19 +626,14 @@ fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_m
            }));
        }
    }
-    (items, omitted)
-}
-
-/// The slides of album `ids` as the editor would seed them.
-fn album_slides<'a>(st: &'a crate::DocState, ids: &[u64]) -> Vec<&'a deckcraft_model::Slide> {
-    ids.iter().filter_map(|sid| u32::try_from(*sid).ok()).filter_map(|n| st.doc.slide(deckcraft_model::SlideId(n))).collect()
+    items
 }

 fn album_seed(s: &Session) -> Result<Value> {
    let (id, ids) = album_target(s, &Value::Null)?;
    let st = s.doc()?;
-    let slides = album_slides(st, &ids);
-    let (items, _) = items_from_slides(&st.doc, &slides);
+    let slides: Vec<&deckcraft_model::Slide> =
+        ids.iter().filter_map(|sid| u32::try_from(*sid).ok()).filter_map(|n| st.doc.slide(deckcraft_model::SlideId(n))).collect();
    let theme_now = st.doc.masters.first().map(|m| m.theme.name.clone()).filter(|n| !n.is_empty()).unwrap_or_else(|| "DeckCraft".into());
    let inferred = infer_album(&slides, &theme_now);
    let mark = slides.first().and_then(|sl| sl.raw_ext.as_deref().and_then(parse_album_mark));
@@ -700,7 +655,7 @@ fn album_seed(s: &Session) -> Result<Value> {
        "captions": captions,
        "grayscale": grayscale,
        "theme": theme,
-        "items": items,
+        "items": items_from_slides(&st.doc, &slides),
    }))
 }

@@ -767,96 +722,3 @@ fn insert_album(s: &mut Session, items: Vec<AlbumItem>, opts: &AlbumOpts, at: Op
    s.execute("slide.go", &json!({"index": first}))?;
    Ok(json!({"slides": slides, "first": first, "pictures": pictures, "album": album_id}))
 }
-
-#[cfg(test)]
-mod seed_tests {
-    use std::sync::Arc;
-
-    use deckcraft_model::style::PictureFill;
-    use deckcraft_model::{Shape, ShapeId, defaults};
-
-    use super::*;
-
-    #[test]
-    fn reopening_an_album_seeds_at_most_the_items_an_album_takes() {
-        // One picture named by 500 shapes: the dialog gets 48 items, not 500 encoded copies.
-        let mut p = defaults::new_presentation(None);
-        let img = p.add_media("a.png", "image/png", vec![1; 64 * 1024]).unwrap();
-        let pic = |k: u32| Shape {
-            id: ShapeId(10_000 + k),
-            kind: ShapeKind::Picture { fill: PictureFill { media: img, ..Default::default() } },
-            ..Default::default()
-        };
-        Arc::make_mut(&mut p.slides[0]).shapes = (0..500).map(pic).collect();
-        let slides: Vec<&deckcraft_model::Slide> = p.slides.iter().map(|s| s.as_ref()).collect();
-        let (items, omitted) = items_from_slides(&p, &slides);
-        assert_eq!(items.len(), ALBUM_MAX_ITEMS);
-        assert!(omitted);
-        let few: Vec<&deckcraft_model::Slide> = Vec::new();
-        assert!(!items_from_slides(&p, &few).1);
-    }
-
-    /// An album too big for the editor's seed cannot be replaced from that seed: the replace would
-    /// delete what the seed left out.
-    #[test]
-    fn editing_an_album_the_editor_cannot_hold_is_refused() {
-        let mut s = crate::Session::new();
-        s.execute("file.new", &json!({})).unwrap();
-        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
-        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
-        let st = s.doc_mut().unwrap();
-        let doc = Arc::make_mut(&mut st.doc);
-        let mut extra = doc.slides.last().unwrap().as_ref().clone();
-        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
-        doc.slides.push(Arc::new(extra));
-        let n = doc.slides.len();
-        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
-        assert!(e.contains("delete the rest"), "{e}");
-        assert_eq!(s.doc().unwrap().doc.slides.len(), n);
-    }
-
-    /// Past the item limit, a slide holding only a drawing counts as content the replace would delete.
-    #[test]
-    fn editing_an_album_with_a_drawing_slide_past_the_limit_is_refused() {
-        let mut s = crate::Session::new();
-        s.execute("file.new", &json!({})).unwrap();
-        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
-        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
-        let st = s.doc_mut().unwrap();
-        let doc = Arc::make_mut(&mut st.doc);
-        let mut extra = doc.slides.last().unwrap().as_ref().clone();
-        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
-        extra.shapes = vec![Shape { id: ShapeId(90_000), ..Default::default() }];
-        doc.slides.push(Arc::new(extra));
-        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
-        assert!(e.contains("delete the rest"), "{e}");
-    }
-
-    /// Notes or comments on a shapeless slide past the limit are content a replace would delete.
-    #[test]
-    fn editing_an_album_with_a_notes_only_slide_past_the_limit_is_refused() {
-        let mut s = crate::Session::new();
-        s.execute("file.new", &json!({})).unwrap();
-        let texts: Vec<Value> = (0..ALBUM_MAX_ITEMS).map(|i| json!({"text": format!("t{i}")})).collect();
-        s.execute("insert.photoAlbum", &json!({"pictures": texts, "layout": "1"})).unwrap();
-        let st = s.doc_mut().unwrap();
-        let doc = Arc::make_mut(&mut st.doc);
-        let mut extra = doc.slides.last().unwrap().as_ref().clone();
-        extra.id = deckcraft_model::SlideId(doc.alloc_id().unwrap());
-        extra.shapes.clear();
-        extra.notes = deckcraft_model::text::TextBody::from_text("speaker notes");
-        doc.slides.push(Arc::new(extra));
-        let e = s.execute("insert.photoAlbumEdit", &json!({"pictures": [{"text": "x"}], "layout": "1"})).unwrap_err().to_string();
-        assert!(e.contains("delete the rest"), "{e}");
-    }
-
-    /// A shapeless slide with a background, transition, colour map or tags counts as content; a plain empty one does not.
-    #[test]
-    fn slide_level_settings_count_as_slide_content() {
-        use deckcraft_model::Slide;
-        assert!(!has_slide_content(&Slide::default()));
-        assert!(has_slide_content(&Slide { tags: vec![("k".into(), "v".into())], ..Default::default() }));
-        assert!(has_slide_content(&Slide { color_map: Some(vec![("bg1".into(), "lt1".into())]), ..Default::default() }));
-        assert!(has_slide_content(&Slide { transition: Some(Default::default()), ..Default::default() }));
-    }
-}
@@ -85,20 +85,14 @@ impl AutomationRoots {

    /// May the file or folder at `path` be read (or written)? `Err` says why not.
    pub fn check(&self, path: &str, access: Access) -> Result<(), String> {
-        self.check_path(Path::new(path), access)
-    }
-
-    /// [`Self::check`] for a path that may not be UTF-8: the checked path is the one opened.
-    pub fn check_path(&self, path: &Path, access: Access) -> Result<(), String> {
-        let path_text = path.display();
        let roots = match access {
            Access::Read => &self.read,
            Access::Write => &self.write,
        };
        if roots.is_empty() {
            return match access {
-                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path_text}")),
-                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path_text}")),
+                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path}")),
+                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path}")),
            };
        }
        let resolved = resolve(path)?;
@@ -107,8 +101,8 @@ impl AutomationRoots {
        }
        let roots = roots.iter().map(|root| root.shown.display().to_string()).collect::<Vec<_>>().join(", ");
        match access {
-            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path_text}")),
-            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path_text}")),
+            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path}")),
+            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path}")),
        }
    }
 }
@@ -197,23 +191,17 @@ pub fn check_write(path: &str) -> Result<(), String> {
    current().map_or(Ok(()), |r| r.check(path, Access::Write))
 }

-/// May `path` be written here? Always, without roots in force. For a path that may not be UTF-8.
-pub fn check_write_path(path: &Path) -> Result<(), String> {
-    current().map_or(Ok(()), |r| r.check_path(path, Access::Write))
-}
-
 /// `path` made absolute with its links followed; for a path that doesn't exist (yet), its nearest
 /// existing folder's links followed and the rest appended.
-fn resolve(path: &Path) -> Result<PathBuf, String> {
-    if path.as_os_str().is_empty() {
+fn resolve(path: &str) -> Result<PathBuf, String> {
+    if path.is_empty() {
        return Err("automation path rejected: path is empty".into());
    }
-    let shown = path.display();
    // Checked as given: making `…\NUL` absolute gives the device path `\\.\NUL` on Windows.
-    if cfg!(windows) && path.components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
-        return Err(format!("automation path rejected: reserved device names are not allowed: {shown}"));
+    if cfg!(windows) && Path::new(path).components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
+        return Err(format!("automation path rejected: reserved device names are not allowed: {path}"));
    }
-    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {shown}: {e}"))?;
+    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {path}: {e}"))?;
    // The names below the nearest existing folder, last first.
    let mut missing: Vec<OsString> = vec![];
    let mut at = absolute.as_path();
@@ -224,11 +212,11 @@ fn resolve(path: &Path) -> Result<PathBuf, String> {
                return Ok(found);
            }
            Err(e) => match std::fs::symlink_metadata(at) {
-                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {shown}")),
+                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {path}")),
                // There, yet its real path can't be had (no permission): nothing to compare.
-                Ok(_) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
+                Ok(_) => return Err(format!("automation path rejected: cannot resolve {path}: {e}")),
                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-                Err(e) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
+                Err(e) => return Err(format!("automation path rejected: cannot resolve {path}: {e}")),
            },
        }
        let parent = at.parent();
@@ -238,12 +226,12 @@ fn resolve(path: &Path) -> Result<PathBuf, String> {
                at = parent;
            }
            (Some(Component::ParentDir), _) => {
-                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {shown}"));
+                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {path}"));
            }
            // Down to the root (or drive) and it doesn't exist either.
            _ => {
                let e = std::io::Error::from(std::io::ErrorKind::NotFound);
-                return Err(format!("automation path rejected: cannot resolve {shown}: {e}"));
+                return Err(format!("automation path rejected: cannot resolve {path}: {e}"));
            }
        }
    }
@@ -699,8 +699,6 @@ pub fn add_user_word(word: &str) -> std::io::Result<()> {
        return Ok(());
    }
    let path = user_dictionary_path().ok_or_else(|| std::io::Error::new(std::io::ErrorKind::NotFound, "no folder for the user dictionary"))?;
-    // A confined automation client may write only inside its write roots, this file included.
-    crate::file_access::check_write_path(&path).map_err(|e| std::io::Error::new(std::io::ErrorKind::PermissionDenied, e))?;
    if let Some(d) = path.parent() {
        std::fs::create_dir_all(d)?;
    }
@@ -1022,20 +1020,6 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
        assert_eq!(w, vec!["check", "done"]);
    }

-    #[test]
-    fn a_confined_client_cannot_write_the_user_dictionary_outside_its_roots() {
-        let root = std::env::temp_dir().join(format!("deckcraft-dict-root-{}", std::process::id()));
-        std::fs::create_dir_all(&root).unwrap();
-        let roots = crate::file_access::AutomationRoots::new(std::slice::from_ref(&root), std::slice::from_ref(&root)).unwrap();
-        // The user dictionary is a file of its own outside `root`, not whatever HOME points at.
-        let outside = std::env::temp_dir().join(format!("deckcraft-dict-outside-{}", std::process::id()));
-        set_user_dictionary_path(outside.join("user.dic"));
-        let r = crate::file_access::confine(roots.as_ref(), || add_user_word("zqxconfinedword"));
-        assert_eq!(r.map_err(|e| e.kind()), Err(std::io::ErrorKind::PermissionDenied));
-        assert!(!outside.exists(), "the refused write created nothing");
-        let _ = std::fs::remove_dir_all(&root);
-    }
-
    #[test]
    fn a_long_paragraph_with_a_huge_language_is_checked_in_linear_work() {
        use deckcraft_model::{Paragraph, Run, RunProps};
@@ -169,14 +169,8 @@ impl FontDb {
                if bundled.contains(fam) {
                    continue;
                }
-                if self.is_loaded(fam) || (self.system_fallback_enabled() && self.has_family(fam)) {
-                    // With system fallback off, only a face that is already loaded: `face` could load more catalog files.
-                    let f = if self.system_fallback_enabled() {
-                        self.face(fam, style)
-                    } else {
-                        let Some(f) = self.find(fam, style) else { continue };
-                        f
-                    };
+                if self.is_loaded(fam) || self.has_family(fam) {
+                    let f = self.face(fam, style);
                    if f.family.eq_ignore_ascii_case(fam) && covers_cluster(&f, cluster) {
                        return f;
                    }
@@ -317,21 +311,4 @@ mod tests {
            assert!(c.windows(2).all(|w| w[0] <= w[1]));
        }
    }
-
-    /// With system fallback off, the automatic cascades (script families and symbol faces) load no
-    /// installed family: the result comes from what is already loaded.
-    #[cfg(not(target_arch = "wasm32"))]
-    #[test]
-    fn cascades_load_no_installed_family_when_system_fallback_is_off() {
-        let db = FontDb::with_font_dirs(Vec::new());
-        db.set_system_fallback(false);
-        let base = db.face(crate::DEFAULT_FAMILY, "Regular");
-        let loaded = |db: &FontDb| [b"Arab", b"Hebr", b"Thai", b"Deva"].into_iter().flat_map(|s| os_families(*s)).filter(|f| db.is_loaded(f)).count();
-        let before = loaded(&db);
-        for c in ['\u{0628}', '\u{05D0}', '\u{0E01}', '\u{0905}', '\u{2211}', '\u{2603}'] {
-            let f = db.cascade(&[c], std::slice::from_ref(&base), "Regular");
-            assert!(!f.family.is_empty());
-        }
-        assert_eq!(loaded(&db), before, "no installed family was loaded");
-    }
 }
@@ -976,17 +976,6 @@ impl FontDb {
        let _ = on;
    }

-    /// Whether automatic system-font lookups (fallback by character, symbol and script families)
-    /// may touch installed fonts. Lookups of a family the document or host names are not gated.
-    pub(crate) fn system_fallback_enabled(&self) -> bool {
-        #[cfg(not(target_arch = "wasm32"))]
-        {
-            self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).enabled
-        }
-        #[cfg(target_arch = "wasm32")]
-        false
-    }
-
    /// Process-wide database: the bundled fonts, then the installed system fonts, cataloged the
    /// first time a lookup by family name needs them (or ahead of time by
    /// [`FontDb::scan_in_background`]).
@@ -1298,7 +1287,7 @@ impl FontDb {
        Some(f)
    }

-    pub(crate) fn find(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
+    fn find(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
        if style.contains('{') {
            {
                let faces = self.read_faces();
@@ -1484,8 +1473,7 @@ impl FontDb {
        };
        #[cfg(not(target_arch = "wasm32"))]
        {
-            let cataloged: Vec<String> =
-                if self.system_fallback_enabled() { self.read_catalog().iter().map(|e| e.family.clone()).collect() } else { Vec::new() };
+            let cataloged: Vec<String> = self.read_catalog().iter().map(|e| e.family.clone()).collect();
            for fam in SYSTEM_FALLBACKS.iter().filter(|f| f.contains("Symbol")) {
                if !self.is_loaded(fam) && cataloged.iter().any(|f| f.eq_ignore_ascii_case(fam)) {
                    self.load_cataloged(fam);
@@ -425,11 +425,3 @@ fn the_font_scan_skips_fifos_folders_and_link_loops() {
    assert!(fifo || n >= 1);
    let _ = std::fs::remove_dir_all(&dir);
 }
-
-#[test]
-fn disabling_system_fallback_gates_automatic_family_loads() {
-    let db = FontDb::with_font_dirs(Vec::new());
-    assert!(cfg!(target_arch = "wasm32") || db.system_fallback_enabled());
-    db.set_system_fallback(false);
-    assert!(!db.system_fallback_enabled());
-}
@@ -404,36 +404,10 @@ impl Decoder {
            chroma_planes: if chroma == 0 { 0 } else { 2 },
            bytes_per_sample: 2,
        };
-        let frame_bytes = |f: &crate::picture::Frame| {
-            (f.width as u64)
-                .saturating_mul(f.height as u64)
-                .saturating_add((f.cwidth as u64).saturating_mul(f.cheight as u64).saturating_mul(2))
-                .saturating_mul(2)
-        };
-        // Output frames waiting to be returned stay allocated after they leave the DPB, at their
-        // own size: a resolution change in this call can leave pictures of the previous SPS.
-        let queued: u64 = self
-            .out_queue
-            .iter()
-            .filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame)) && !self.in_flight.iter().any(|f| Arc::ptr_eq(f, &o.frame)))
-            .map(|o| frame_bytes(&o.frame))
-            .fold(0, u64::saturating_add);
-        // Frames the DPB holds now count at their own size too (an SPS change flushes them into the
-        // queue before the new pictures are made): the DPB part is the larger of its new slots and that.
-        let held: u64 = self.dpb.entries.iter().map(|e| frame_bytes(&e.frame)).fold(0, u64::saturating_add);
-        // A queued frame still being decoded is one of the in-flight pictures already reserved, so the
-        // queue and the in-flight reservation overlap: charge the larger, not both.
        let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64;
-        let slots = shape.store_bytes(u64::from(sps.max_dec_pic_buffering));
-        let flight = shape.store_bytes(self.max_in_flight as u64);
-        let total = shape
-            .store_bytes(1)
-            .zip(slots)
-            .zip(flight)
-            .map(|((one, slots), flight)| slots.max(held).saturating_add(one).saturating_add(flight).saturating_add(queued));
        ensure!(
-            total.is_some_and(|b| b <= self.memory_budget),
-            "{}x{} pictures with {pictures} in the decoder and {queued} bytes queued exceed the memory budget",
+            shape.fits(pictures, self.memory_budget),
+            "{}x{} pictures with {pictures} in the decoder exceed the memory budget",
            sps.width,
            sps.height
        );
@@ -0,0 +1,13 @@
+[package]
+name = "deckcraft-isobmff"
+description = "Clean-room ISO BMFF (MP4) and QuickTime (MOV) demuxer and muxer"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+craft-media = { workspace = true, features = ["isobmff"] }
@@ -0,0 +1,6 @@
+//! ISO BMFF (MP4) and QuickTime (MOV) demuxer and muxer: a re-export of [`craft_media::isobmff`]
+//! from craft-libs. Supported boxes and limitations are in the craft-media README.
+
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
+pub use craft_media::isobmff::*;
@@ -0,0 +1,13 @@
+[package]
+name = "deckcraft-matroska"
+description = "Clean-room Matroska (MKV) and WebM demuxer and muxer"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+craft-media = { workspace = true, features = ["matroska"] }
@@ -0,0 +1,6 @@
+//! Matroska (MKV) and WebM demuxer and muxer: a re-export of [`craft_media::matroska`] from
+//! craft-libs. Supported elements and limitations are in the craft-media README.
+
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
+pub use craft_media::matroska::*;
@@ -16,12 +16,6 @@ const INVALID_REQUEST: i64 = -32600;
 const METHOD_NOT_FOUND: i64 = -32601;
 const INVALID_PARAMS: i64 = -32602;
 const INTERNAL_ERROR: i64 = -32603;
-
-/// Entries one batch (a JSON-RPC batch, or the `batch` tool's commands) may hold.
-pub(crate) const MAX_BATCH_ITEMS: usize = 1000;
-/// Bytes of results one batch may gather before the rest of it is refused: each result can copy
-/// much of the document (an inspection holds every note), so a batch holds at most this much.
-pub(crate) const MAX_BATCH_BYTES: usize = 64 << 20;
 const RESOURCE_NOT_FOUND: i64 = -32002;
 /// Keep request frames in step with the connected backend's reply limit.
 const MAX_FRAME_BYTES: usize = 16 * 1024 * 1024;
@@ -99,28 +93,8 @@ impl Server {
                // Batches were removed in 2025-06-18; still answer older clients sensibly.
                if batch.is_empty() {
                    Some(error(Value::Null, INVALID_REQUEST, "empty batch"))
-                } else if batch.len() > MAX_BATCH_ITEMS {
-                    Some(error(Value::Null, INVALID_REQUEST, format!("a batch holds at most {MAX_BATCH_ITEMS} messages")))
                } else {
-                    let mut used = 0usize;
-                    let mut replies: Vec<Value> = Vec::new();
-                    for m in batch {
-                        if used > MAX_BATCH_BYTES {
-                            // Not run: answer each remaining request with a short error.
-                            if let Some(id) = m.get("id").filter(|id| id.is_string() || id.is_number()) {
-                                replies.push(error(id.clone(), INTERNAL_ERROR, "the batch's replies passed 64 MiB; not run"));
-                            }
-                            continue;
-                        }
-                        if let Some(r) = self.handle(m) {
-                            used = used.saturating_add(r.to_string().len());
-                            replies.push(if used > MAX_BATCH_BYTES {
-                                error(r.get("id").cloned().unwrap_or(Value::Null), INTERNAL_ERROR, "the batch's replies passed 64 MiB; reply dropped")
-                            } else {
-                                r
-                            });
-                        }
-                    }
+                    let replies: Vec<Value> = batch.into_iter().filter_map(|m| self.handle(m)).collect();
                    (!replies.is_empty()).then_some(Value::Array(replies))
                }
            }
@@ -357,40 +357,21 @@ pub fn call_tool(b: &mut dyn Backend, name: &str, a: &Value) -> ToolResult {
            wrap(exec(b, c, a.get("params").cloned().unwrap_or(json!({}))))
        }
        "batch" => {
-            use crate::server::{MAX_BATCH_BYTES, MAX_BATCH_ITEMS};
            let keep = a.get("keepGoing").and_then(Value::as_bool).unwrap_or(false);
-            let commands = a.get("commands").and_then(Value::as_array).map(Vec::as_slice).unwrap_or_default();
-            if commands.len() > MAX_BATCH_ITEMS {
-                return ToolResult::error(format!("a batch holds at most {MAX_BATCH_ITEMS} commands"));
-            }
            let mut out = vec![];
-            let mut used = 0usize;
-            for c in commands {
+            for c in a.get("commands").and_then(Value::as_array).cloned().unwrap_or_default() {
                let id = c.get("command").and_then(Value::as_str).unwrap_or("");
-                let (entry, failed) = match exec(b, id, c.get("params").cloned().unwrap_or(json!({}))) {
-                    Ok(v) => (json!({"command": id, "ok": true, "result": v}), false),
-                    Err(e) => (json!({"command": id, "ok": false, "error": e}), true),
-                };
-                // What the reply carries: the entry as text, escaped again inside the JSON-RPC reply.
-                // Failures count too: with keepGoing, a remote backend's large errors add up.
-                used = used.saturating_add(json!(entry.to_string()).to_string().len());
-                if used > MAX_BATCH_BYTES {
-                    let shown: String = id.chars().take(128).collect();
-                    out.push(json!({"command": shown, "ok": false, "error": "the batch's results passed 64 MiB; stopped here"}));
-                    return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
-                }
-                out.push(entry);
-                if failed && !keep {
-                    return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
+                match exec(b, id, c.get("params").cloned().unwrap_or(json!({}))) {
+                    Ok(v) => out.push(json!({"command": id, "ok": true, "result": v})),
+                    Err(e) => {
+                        out.push(json!({"command": id, "ok": false, "error": e}));
+                        if !keep {
+                            return ToolResult { content: vec![json!({"type": "text", "text": Value::Array(out).to_string()})], is_error: true };
+                        }
+                    }
                }
            }
-            // The reply is pretty-printed, which is longer than the compact entries counted above.
-            let reply = ToolResult::json(&Value::Array(out));
-            let text = reply.content[0]["text"].as_str().unwrap_or_default();
-            if json!(text).to_string().len() > MAX_BATCH_BYTES {
-                return ToolResult::error("the batch's results passed 64 MiB; nothing is returned");
-            }
-            reply
+            ToolResult::json(&Value::Array(out))
        }
        "new_presentation" => wrap(exec(b, "file.new", a)),
        "open_presentation" => wrap(exec(b, "file.open", a)),
@@ -1,70 +0,0 @@
-//! A batch (JSON-RPC or the `batch` tool) is bounded in entries and in the bytes of results it
-//! gathers, so a short request cannot copy a large document into memory hundreds of times.
-
-use deckcraft_mcp::{Headless, Server};
-use serde_json::{Value, json};
-
-fn server_with_notes(bytes: usize) -> Server {
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let line = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "run_command", "arguments": {"command": "slide.notes", "params": {"text": "n".repeat(bytes)}}}});
-    let reply: Value = serde_json::from_str(&server.handle_line(&line.to_string()).unwrap()).unwrap();
-    assert_ne!(reply["result"]["isError"], true, "{reply}");
-    server
-}
-
-#[test]
-fn json_rpc_batches_are_bounded_in_entries_and_reply_bytes() {
-    let mut server = server_with_notes(1 << 20);
-    let ping = |i: usize| json!({"jsonrpc": "2.0", "id": i, "method": "ping"});
-    let too_many: Vec<Value> = (0..1001).map(ping).collect();
-    let reply: Value = serde_json::from_str(&server.handle_line(&Value::Array(too_many).to_string()).unwrap()).unwrap();
-    assert_eq!(reply["error"]["code"], -32600, "{reply}");
-    // 100 inspections of a slide with 1 MB of notes: about 64 are answered, the rest refused.
-    let inspect = |i: usize| json!({"jsonrpc": "2.0", "id": i, "method": "tools/call", "params": {"name": "inspect_slide", "arguments": {}}});
-    let line = Value::Array((0..100).map(inspect).collect()).to_string();
-    let reply = server.handle_line(&line).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    let replies: Vec<Value> = serde_json::from_str(&reply).unwrap();
-    assert_eq!(replies.len(), 100, "every request is answered");
-    assert!(replies.last().unwrap()["error"]["message"].as_str().unwrap().contains("64 MiB"));
-}
-
-#[test]
-fn the_batch_tool_is_bounded_in_commands_and_result_bytes() {
-    let mut server = server_with_notes(1 << 20);
-    let call = |server: &mut Server, commands: Vec<Value>| {
-        let line = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-        let reply: Value = serde_json::from_str(&server.handle_line(&line.to_string()).unwrap()).unwrap();
-        (reply["result"]["isError"] == true, reply["result"]["content"][0]["text"].as_str().unwrap_or_default().to_string())
-    };
-    let (err, text) = call(&mut server, vec![json!({"command": "document.inspect"}); 1001]);
-    assert!(err && text.contains("at most 1000"), "{text}");
-    let (err, text) = call(&mut server, vec![json!({"command": "slide.inspect"}); 100]);
-    assert!(err && text.contains("64 MiB"), "{}", &text[text.len().saturating_sub(200)..]);
-    assert!(text.len() < (64 << 20) + (4 << 20));
-}
-
-#[test]
-fn the_batch_tool_charges_the_escaped_reply() {
-    // Quotes escape twice on the way out (`\\\"`), so 30 results of ~2 MiB serialize to ~120 MiB.
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let notes = json!({"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "run_command", "arguments": {"command": "slide.notes", "params": {"text": "\"".repeat(1 << 20)}}}});
-    server.handle_line(&notes.to_string()).unwrap();
-    let commands = vec![json!({"command": "slide.inspect"}); 30];
-    let line = json!({"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-    let reply = server.handle_line(&line.to_string()).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    assert!(reply.contains("64 MiB"));
-}
-
-#[test]
-fn the_batch_tool_charges_failures_too() {
-    // Each unknown command's error echoes its ~1 MiB id; with keepGoing none of them is a result.
-    let mut server = Server::new(Box::new(Headless::with_document()));
-    let id = "x".repeat(1 << 20);
-    let commands = vec![json!({"command": id}); 70];
-    let line = json!({"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "batch", "arguments": {"commands": commands, "keepGoing": true}}});
-    let reply = server.handle_line(&line.to_string()).unwrap();
-    assert!(reply.len() < (64 << 20) + (4 << 20), "{} bytes", reply.len());
-    assert!(reply.contains("64 MiB"));
-}
@@ -1,5 +1,3 @@
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md).
 #[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 mod automation_roots;
-#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-mod batch_budget;
@@ -9,9 +9,10 @@ description = "DeckCraft media: probing, audio decoding (MP3, AAC/M4A, WAV, AIFF
 workspace = true

 [dependencies]
-# Containers (MP4/MOV, Matroska/WebM, Ogg) and the Opus decoder, shared with the other Craft apps.
-craft-media = { workspace = true, features = ["isobmff", "matroska", "ogg"] }
-craft-audio = { workspace = true }
+deckcraft-isobmff = { workspace = true }
+deckcraft-matroska = { workspace = true }
+deckcraft-ogg = { workspace = true }
+deckcraft-opus = { workspace = true }
 deckcraft-h264 = { workspace = true }
 deckcraft-hevc = { workspace = true }
 deckcraft-vp9 = { workspace = true }
@@ -91,15 +91,15 @@ pub fn decode(bytes: &Bytes) -> Result<Pcm> {
 /// Ogg Opus with our decoder; `None` when the file holds no Opus stream.
 fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
    let src: &[u8] = bytes;
-    let file = craft_media::ogg::open(src).ok()?;
-    let s = file.stream_of(craft_media::ogg::Codec::Opus)?;
+    let file = deckcraft_ogg::open(src).ok()?;
+    let s = file.stream_of(deckcraft_ogg::Codec::Opus)?;
    let stream = file.streams.get(s)?;
    Some((|| {
        let head = stream.headers.first().ok_or(MediaError::Corrupt("Opus header missing".into()))?;
-        let mut dec = craft_audio::opus::Decoder::new(head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+        let mut dec = deckcraft_opus::Decoder::new(head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
        dec.set_trim_pre_skip(true);
        let channels = dec.channels() as u16;
-        let timing = craft_media::ogg::OpusTiming::of(stream, dec.pre_skip() as u32);
+        let timing = deckcraft_ogg::OpusTiming::of(stream, dec.pre_skip() as u32).map_err(|e| MediaError::Corrupt(e.to_string()))?;
        let mut out = Vec::new();
        for i in 0..stream.packets.len() {
            if MAX_PCM_SAMPLES.saturating_sub(out.len()) < channels.max(1) as usize {
@@ -115,8 +115,7 @@ fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
            }
        }
        // End trimming (RFC 7845 §4.5).
-        // the timing saturates on a hostile granule, so this product must too
-        let total = usize::try_from(timing.total).unwrap_or(0).saturating_mul(channels.max(1) as usize);
+        let total = timing.total.max(0) as usize * channels.max(1) as usize;
        if total > 0 && total < out.len() {
            out.truncate(total);
        }
@@ -127,13 +126,13 @@ fn decode_ogg_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
 /// WebM / Matroska Opus with our decoder; `None` when there is no Opus track.
 fn decode_mkv_opus(bytes: &Bytes) -> Option<Result<Pcm>> {
    let src: &[u8] = bytes;
-    let file = craft_media::matroska::open(src).ok()?;
+    let file = deckcraft_matroska::open(src).ok()?;
    let (ti, head) = file.tracks.iter().enumerate().find_map(|(i, t)| match &t.codec {
-        craft_media::matroska::Codec::Opus { head } => Some((i, head.clone())),
+        deckcraft_matroska::Codec::Opus { head } => Some((i, head.clone())),
        _ => None,
    })?;
    Some((|| {
-        let mut dec = craft_audio::opus::Decoder::new(&head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+        let mut dec = deckcraft_opus::Decoder::new(&head).map_err(|e| MediaError::Corrupt(e.to_string()))?;
        dec.set_trim_pre_skip(true);
        let channels = dec.channels() as u16;
        let mut out = Vec::new();
@@ -106,9 +106,9 @@ fn codec_label(short: &str) -> String {
 }

 fn probe_mp4(bytes: &Bytes) -> Result<MediaInfo> {
-    use craft_media::isobmff::{CodecConfig, TrackKind};
+    use deckcraft_isobmff::{CodecConfig, TrackKind};
    let src: &[u8] = bytes;
-    let f = craft_media::isobmff::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+    let f = deckcraft_isobmff::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
    let mut info = MediaInfo { container: if f.is_quicktime { "mov" } else { "mp4" }, ..Default::default() };
    let mut dur = if f.timescale > 0 { f.duration as f64 / f.timescale as f64 } else { 0.0 };
    if let Some(ti) = f.track_of_kind(TrackKind::Video) {
@@ -146,9 +146,9 @@ fn probe_mp4(bytes: &Bytes) -> Result<MediaInfo> {
 }

 fn probe_mkv(bytes: &Bytes) -> Result<MediaInfo> {
-    use craft_media::matroska::{Codec, TrackKind};
+    use deckcraft_matroska::{Codec, TrackKind};
    let src: &[u8] = bytes;
-    let f = craft_media::matroska::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
+    let f = deckcraft_matroska::open(src).map_err(|e| MediaError::Corrupt(e.to_string()))?;
    let mut info = MediaInfo { container: if f.is_webm() { "webm" } else { "matroska" }, ..Default::default() };
    let dur = f.duration_ns().map(|n| n as f64 / 1e9).unwrap_or(0.0);
    info.duration_ms = ms(dur);
@@ -179,11 +179,11 @@ fn probe_mkv(bytes: &Bytes) -> Result<MediaInfo> {

 fn probe_ogg(bytes: &Bytes) -> Option<MediaInfo> {
    let src: &[u8] = bytes;
-    let f = craft_media::ogg::open(src).ok()?;
-    let s = f.stream_of(craft_media::ogg::Codec::Opus)?;
+    let f = deckcraft_ogg::open(src).ok()?;
+    let s = f.stream_of(deckcraft_ogg::Codec::Opus)?;
    let st = f.streams.get(s)?;
-    let head = craft_audio::opus::OpusHead::parse(st.headers.first()?).ok()?;
-    let timing = craft_media::ogg::OpusTiming::of(st, head.pre_skip as u32);
+    let head = deckcraft_opus::OpusHead::parse(st.headers.first()?).ok()?;
+    let timing = deckcraft_ogg::OpusTiming::of(st, head.pre_skip as u32).ok()?;
    Some(MediaInfo {
        container: "ogg",
        duration_ms: ms(timing.total as f64 / 48_000.0),
@@ -3,8 +3,8 @@

 use std::collections::VecDeque;

-use craft_media::isobmff::CodecConfig;
-use craft_media::matroska::Codec as MkvCodec;
+use deckcraft_isobmff::CodecConfig;
+use deckcraft_matroska::Codec as MkvCodec;

 use crate::yuv::{self, Matrix, Planes};
 use crate::{Bytes, Container, MediaError, Result};
@@ -257,8 +257,8 @@ struct Track {
 }

 enum Demux {
-    Mp4(Box<craft_media::isobmff::Mp4File>, usize),
-    Mkv(Box<craft_media::matroska::MkvFile>, usize),
+    Mp4(Box<deckcraft_isobmff::Mp4File>, usize),
+    Mkv(Box<deckcraft_matroska::MkvFile>, usize),
 }

 impl Demux {
@@ -273,8 +273,8 @@ impl Demux {
 fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
    match Container::sniff(bytes) {
        Container::Mp4 => {
-            let f = craft_media::isobmff::open(bytes).map_err(dec_err)?;
-            let ti = f.track_of_kind(craft_media::isobmff::TrackKind::Video).ok_or(MediaError::Missing("video track"))?;
+            let f = deckcraft_isobmff::open(bytes).map_err(dec_err)?;
+            let ti = f.track_of_kind(deckcraft_isobmff::TrackKind::Video).ok_or(MediaError::Missing("video track"))?;
            let t = &f.tracks[ti];
            let entry = t.entries.first().ok_or(MediaError::Missing("video track"))?;
            let codec: Box<dyn Codec> = match &entry.codec {
@@ -290,11 +290,11 @@ fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
            Ok((Demux::Mp4(Box::new(f), ti), track, codec))
        }
        Container::Matroska => {
-            let f = craft_media::matroska::open(bytes).map_err(dec_err)?;
+            let f = deckcraft_matroska::open(bytes).map_err(dec_err)?;
            let ti = f
                .tracks
                .iter()
-                .position(|t| t.kind == craft_media::matroska::TrackKind::Video && !t.samples.is_empty())
+                .position(|t| t.kind == deckcraft_matroska::TrackKind::Video && !t.samples.is_empty())
                .ok_or(MediaError::Missing("video track"))?;
            let t = &f.tracks[ti];
            let codec: Box<dyn Codec> = match &t.codec {
@@ -303,7 +303,7 @@ fn open_track(bytes: &[u8]) -> Result<(Demux, Track, Box<dyn Codec>)> {
                MkvCodec::Vp9 { .. } => Box::new(Vp9 { dec: deckcraft_vp9::Decoder::new() }),
                MkvCodec::Av1 { av1c } => Box::new(Av1 {
                    dec: deckcraft_av1::Decoder::new(),
-                    config_obus: craft_media::isobmff::Av1Config::parse(av1c).map(|c| c.config_obus).unwrap_or_default(),
+                    config_obus: deckcraft_isobmff::Av1Config::parse(av1c).map(|c| c.config_obus).unwrap_or_default(),
                    primed: false,
                }),
                other => return Err(MediaError::Unsupported(format!("{} video", mkv_codec_name(other)))),
@@ -166,52 +166,6 @@ fn ogg_opus() {
    check_tone("opus", &fixture("tone.opus"), 48_000, 1);
 }

-/// Ogg Opus timing saturates on a hostile granule position instead of failing, so the end-trim
-/// arithmetic on its total must not overflow either: a three-channel file that ends with a page
-/// carrying the largest granule still probes and decodes.
-#[test]
-fn ogg_opus_with_a_huge_granule_does_not_overflow() {
-    fn seal(mut page: Vec<u8>) -> Vec<u8> {
-        page[22..26].fill(0);
-        let crc = craft_media::ogg::crc32(&page);
-        page[22..26].copy_from_slice(&crc.to_le_bytes());
-        page
-    }
-    let f = fixture("tone.opus");
-    let mut pages: Vec<Vec<u8>> = Vec::new();
-    let mut at = 0;
-    while at + 27 <= f.len() && &f[at..at + 4] == b"OggS" {
-        let nseg = f[at + 26] as usize;
-        let end = at + 27 + nseg + f[at + 27..at + 27 + nseg].iter().map(|&b| b as usize).sum::<usize>();
-        pages.push(f[at..end].to_vec());
-        at = end;
-    }
-    assert_eq!(at, f.len(), "the fixture is whole pages");
-    // an OpusHead for three channels (mapping family 1), each playing the one mono stream
-    let head = pages[0][28..].to_vec();
-    let mut first = pages[0][..26].to_vec();
-    first.extend_from_slice(&[1, 24]);
-    first.extend_from_slice(&head[..9]);
-    first.push(3);
-    first.extend_from_slice(&head[10..18]);
-    first.extend_from_slice(&[1, 1, 0, 0, 0, 0]);
-    pages[0] = seal(first);
-    // the last page once more, as the next page of the stream, with the largest granule
-    let last = pages.len() - 1;
-    let mut extra = pages[last].clone();
-    pages[last][5] &= !0x04;
-    pages[last] = seal(pages[last].clone());
-    extra[6..14].copy_from_slice(&i64::MAX.to_le_bytes());
-    let seq = u32::from_le_bytes([extra[18], extra[19], extra[20], extra[21]]) + 1;
-    extra[18..22].copy_from_slice(&seq.to_le_bytes());
-    pages.push(seal(extra));
-    let b: Bytes = Arc::new(pages.concat());
-    assert!(probe(&b).is_ok_and(|i| i.duration_ms > 1 << 40), "the granule is taken at its word");
-    let p = audio::decode(&b).expect("decode");
-    assert_eq!(p.channels, 3);
-    assert!(!p.samples.is_empty());
-}
-
 #[test]
 fn wma_is_probed_but_not_decoded() {
    let b = fixture("tone.wma");
@@ -0,0 +1,14 @@
+[package]
+name = "deckcraft-metafile"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "DeckCraft metafiles (ported from WordCraft): parses Windows WMF and EMF records into a neutral vector model (paths and bitmaps)"
+
+[lints]
+workspace = true
+
+[dependencies]
+kurbo = { workspace = true }
+thiserror = { workspace = true }
+image = { workspace = true }
@@ -0,0 +1,59 @@
+//! Bounds-checked little-endian access to hostile input. Every read returns `None` past the end, so
+//! a truncated or lying size field stops the parse instead of panicking.
+
+#[derive(Clone, Copy)]
+pub(crate) struct Bytes<'a>(pub(crate) &'a [u8]);
+
+impl<'a> Bytes<'a> {
+    pub fn slice(&self, off: usize, len: usize) -> Option<&'a [u8]> {
+        self.0.get(off..off.checked_add(len)?)
+    }
+
+    pub fn tail(&self, off: usize) -> Option<Bytes<'a>> {
+        self.0.get(off..).map(Bytes)
+    }
+
+    fn arr<const N: usize>(&self, off: usize) -> Option<[u8; N]> {
+        self.slice(off, N)?.try_into().ok()
+    }
+
+    pub fn u16(&self, off: usize) -> Option<u16> {
+        Some(u16::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn i16(&self, off: usize) -> Option<i16> {
+        Some(i16::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn u32(&self, off: usize) -> Option<u32> {
+        Some(u32::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn i32(&self, off: usize) -> Option<i32> {
+        Some(i32::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn f32(&self, off: usize) -> Option<f32> {
+        Some(f32::from_le_bytes(self.arr(off)?))
+    }
+
+    /// `n` consecutive (x, y) pairs of 16- or 32-bit signed integers starting at `off`.
+    pub fn points(&self, off: usize, n: usize, wide: bool) -> Option<Vec<(f64, f64)>> {
+        let sz = if wide { 8 } else { 4 };
+        let raw = self.slice(off, n.checked_mul(sz)?)?;
+        let mut out = Vec::with_capacity(n);
+        for c in raw.chunks_exact(sz) {
+            let p = if wide {
+                let x = i32::from_le_bytes(c.get(0..4)?.try_into().ok()?);
+                let y = i32::from_le_bytes(c.get(4..8)?.try_into().ok()?);
+                (f64::from(x), f64::from(y))
+            } else {
+                let x = i16::from_le_bytes(c.get(0..2)?.try_into().ok()?);
+                let y = i16::from_le_bytes(c.get(2..4)?.try_into().ok()?);
+                (f64::from(x), f64::from(y))
+            };
+            out.push(p);
+        }
+        Some(out)
+    }
+}
@@ -0,0 +1,193 @@
+//! Clipping regions for EMF and WMF (MS-EMF 2.3.12, MS-WMF 2.3.5).
+//!
+//! A region is a set of axis-aligned rectangles in device units: `None` is the default clip (the
+//! whole surface), `Some([])` draws nothing, and `Some(rects)` is their union. That is how GDI
+//! stores a region (`RGNDATA` is a list of rectangles). Counts are capped so a hostile file cannot
+//! grow the set without bound; past the cap, extra rectangles are dropped, which can only hide
+//! drawing.
+
+/// Rectangles kept from one region. Past this, further rectangles are dropped.
+pub(crate) const MAX_CLIP_RECTS: usize = 64;
+
+pub(crate) const RGN_AND: u32 = 1;
+pub(crate) const RGN_OR: u32 = 2;
+pub(crate) const RGN_XOR: u32 = 3;
+pub(crate) const RGN_DIFF: u32 = 4;
+pub(crate) const RGN_COPY: u32 = 5;
+
+/// A rectangle `[x0, y0, x1, y1]` with a positive area, or none.
+pub(crate) fn normalize(rect: [f64; 4]) -> Option<[f64; 4]> {
+    let [l, t, r, b] = rect;
+    if ![l, t, r, b].iter().all(|v| v.is_finite()) {
+        return None;
+    }
+    let (x0, x1) = (l.min(r), l.max(r));
+    let (y0, y1) = (t.min(b), t.max(b));
+    (x1 - x0 > 1e-6 && y1 - y0 > 1e-6).then_some([x0, y0, x1, y1])
+}
+
+fn intersection(a: [f64; 4], b: [f64; 4]) -> Option<[f64; 4]> {
+    let (x0, y0) = (a[0].max(b[0]), a[1].max(b[1]));
+    let (x1, y1) = (a[2].min(b[2]), a[3].min(b[3]));
+    (x1 - x0 > 1e-6 && y1 - y0 > 1e-6 && [x0, y0, x1, y1].iter().all(|v| v.is_finite())).then_some([x0, y0, x1, y1])
+}
+
+/// `a` with `b` removed, as up to four rectangles.
+fn subtract_one(a: [f64; 4], b: [f64; 4]) -> Vec<[f64; 4]> {
+    let Some(i) = intersection(a, b) else { return vec![a] };
+    let mut out = Vec::new();
+    if i[1] > a[1]
+        && let Some(r) = normalize([a[0], a[1], a[2], i[1]])
+    {
+        out.push(r);
+    }
+    if i[3] < a[3]
+        && let Some(r) = normalize([a[0], i[3], a[2], a[3]])
+    {
+        out.push(r);
+    }
+    if i[0] > a[0]
+        && let Some(r) = normalize([a[0], i[1], i[0], i[3]])
+    {
+        out.push(r);
+    }
+    if i[2] < a[2]
+        && let Some(r) = normalize([i[2], i[1], a[2], i[3]])
+    {
+        out.push(r);
+    }
+    out
+}
+
+fn cap(mut rects: Vec<[f64; 4]>) -> Vec<[f64; 4]> {
+    rects.truncate(MAX_CLIP_RECTS);
+    rects
+}
+
+fn subtract_all(subject: Vec<[f64; 4]>, cuts: &[[f64; 4]]) -> Vec<[f64; 4]> {
+    let mut cur = subject;
+    for cut in cuts {
+        let mut next = Vec::new();
+        for s in cur {
+            for piece in subtract_one(s, *cut) {
+                if next.len() >= MAX_CLIP_RECTS {
+                    return next;
+                }
+                next.push(piece);
+            }
+        }
+        cur = next;
+    }
+    cur
+}
+
+/// Intersects the current region with one rectangle.
+pub(crate) fn intersect(current: Option<Vec<[f64; 4]>>, rect: [f64; 4]) -> Option<Vec<[f64; 4]>> {
+    let Some(rect) = normalize(rect) else { return Some(Vec::new()) };
+    Some(match current {
+        None => vec![rect],
+        Some(rects) => cap(rects.iter().filter_map(|r| intersection(*r, rect)).collect()),
+    })
+}
+
+/// Removes one rectangle. `surface` is the device bounds, used when the clip is still the default
+/// (the whole surface) so the remainder can be named.
+pub(crate) fn exclude(current: Option<Vec<[f64; 4]>>, rect: [f64; 4], surface: Option<[f64; 4]>) -> Option<Vec<[f64; 4]>> {
+    let Some(rect) = normalize(rect) else { return current };
+    match current {
+        Some(rects) => Some(subtract_all(rects, &[rect])),
+        None => surface.and_then(normalize).map(|s| subtract_all(vec![s], &[rect])),
+    }
+}
+
+/// Combines `incoming` with the current region in a region mode (`RGN_*`). An unknown mode leaves
+/// the region as it was. `RGN_COPY` replaces it. An `RGN_OR` or `RGN_XOR` against the default clip
+/// stays the default clip: the whole surface already covers the incoming rectangles.
+pub(crate) fn combine(current: Option<Vec<[f64; 4]>>, incoming: Vec<[f64; 4]>, mode: u32, surface: Option<[f64; 4]>) -> Option<Vec<[f64; 4]>> {
+    let incoming: Vec<[f64; 4]> = cap(incoming.iter().copied().filter_map(normalize).collect());
+    match mode {
+        RGN_COPY => Some(incoming),
+        RGN_AND => match current {
+            None => Some(incoming),
+            Some(rects) => {
+                let mut out = Vec::new();
+                for a in &rects {
+                    for b in &incoming {
+                        if out.len() >= MAX_CLIP_RECTS {
+                            return Some(out);
+                        }
+                        if let Some(r) = intersection(*a, *b) {
+                            out.push(r);
+                        }
+                    }
+                }
+                Some(out)
+            }
+        },
+        RGN_OR => match current {
+            None => None,
+            Some(mut rects) => {
+                rects.extend(incoming);
+                Some(cap(rects))
+            }
+        },
+        RGN_DIFF => match current {
+            Some(rects) => Some(subtract_all(rects, &incoming)),
+            None => surface.and_then(normalize).map(|s| subtract_all(vec![s], &incoming)),
+        },
+        RGN_XOR => {
+            let base = current?;
+            let mut out = subtract_all(base.clone(), &incoming);
+            let rest = subtract_all(incoming, &base);
+            for r in rest {
+                if out.len() >= MAX_CLIP_RECTS {
+                    break;
+                }
+                out.push(r);
+            }
+            Some(out)
+        }
+        _ => current,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn intersect_shrinks_to_the_overlap() {
+        let r = intersect(None, [0.0, 0.0, 100.0, 50.0]);
+        let r = intersect(r, [40.0, 10.0, 80.0, 40.0]);
+        assert_eq!(r, Some(vec![[40.0, 10.0, 80.0, 40.0]]));
+        assert_eq!(intersect(r, [0.0, 0.0, 10.0, 10.0]), Some(vec![]));
+        assert_eq!(intersect(Some(vec![[0.0, 0.0, 10.0, 20.0]]), [40.0, 0.0, 80.0, 20.0]), Some(vec![]));
+    }
+
+    #[test]
+    fn modes_copy_and_or_diff_and_xor() {
+        let a = Some(vec![[0.0, 0.0, 100.0, 40.0]]);
+        assert_eq!(combine(a.clone(), vec![[10.0, 10.0, 30.0, 20.0]], RGN_COPY, None), Some(vec![[10.0, 10.0, 30.0, 20.0]]));
+        let and = combine(a.clone(), vec![[50.0, 0.0, 150.0, 40.0]], RGN_AND, None);
+        assert_eq!(and, Some(vec![[50.0, 0.0, 100.0, 40.0]]));
+        let or = combine(a.clone(), vec![[200.0, 0.0, 210.0, 10.0]], RGN_OR, None).unwrap();
+        assert_eq!(or.len(), 2);
+        let diff = combine(a.clone(), vec![[20.0, 0.0, 40.0, 40.0]], RGN_DIFF, None).unwrap();
+        assert_eq!(diff, vec![[0.0, 0.0, 20.0, 40.0], [40.0, 0.0, 100.0, 40.0]]);
+        let xor = combine(a, vec![[80.0, 0.0, 120.0, 40.0]], RGN_XOR, None).unwrap();
+        assert!(xor.contains(&[0.0, 0.0, 80.0, 40.0]));
+        assert!(xor.contains(&[100.0, 0.0, 120.0, 40.0]));
+    }
+
+    #[test]
+    fn excluding_from_the_default_clip_uses_the_surface() {
+        let r = exclude(None, [10.0, 0.0, 20.0, 40.0], Some([0.0, 0.0, 40.0, 40.0])).unwrap();
+        assert_eq!(r, vec![[0.0, 0.0, 10.0, 40.0], [20.0, 0.0, 40.0, 40.0]]);
+        assert_eq!(exclude(None, [10.0, 0.0, 20.0, 40.0], None), None);
+    }
+
+    #[test]
+    fn a_zero_area_rectangle_clears_an_intersection() {
+        assert_eq!(intersect(Some(vec![[0.0, 0.0, 10.0, 10.0]]), [5.0, 5.0, 5.0, 8.0]), Some(vec![]));
+    }
+}
@@ -0,0 +1,357 @@
+//! Clipping drawn output to a convex device polygon (EMF+ clip rectangles, and clip paths and
+//! regions that are convex; others are reduced to their bounding rectangle). Shapes wholly inside
+//! pass unchanged; shapes crossing the edge are flattened and cut: fills with Sutherland–Hodgman
+//! per subpath, outlines with Cyrus–Beck per segment. Bitmaps are cropped (and masked outside a
+//! non-rectangular polygon) and text gets the polygon's bounding rectangle.
+
+use crate::canvas::Raw;
+use crate::dib::Rgba;
+use crate::geom::{Op, P};
+
+/// Line segments per Bézier when a crossing shape is flattened.
+const CURVE_STEPS: usize = 16;
+
+/// Point-against-edge tests one clipped item may cost (all its subpaths together); an item over
+/// it is dropped, as a single polygon over it already was.
+const MAX_CLIP_WORK: usize = 1_000_000;
+
+/// The same allowance for intersecting two clip regions, a budget of its own: two convex
+/// 1,000-gons cost about 1.5 million tests once the cut polygon has grown.
+pub(crate) const MAX_AREA_CLIP_WORK: usize = 4 * MAX_CLIP_WORK;
+
+/// The bounding box `[l, t, r, b]` of the points in `ops` (control points included).
+pub(crate) fn ops_bbox(ops: &[Op]) -> Option<[f64; 4]> {
+    let mut b: Option<[f64; 4]> = None;
+    let mut add = |p: P| {
+        let v = b.get_or_insert([p.0, p.1, p.0, p.1]);
+        *v = [v[0].min(p.0), v[1].min(p.1), v[2].max(p.0), v[3].max(p.1)];
+    };
+    for op in ops {
+        match *op {
+            Op::M(p) | Op::L(p) => add(p),
+            Op::C(a, c, d) => {
+                add(a);
+                add(c);
+                add(d);
+            }
+            Op::Z => {}
+        }
+    }
+    b
+}
+
+pub(crate) fn intersect(a: [f64; 4], b: [f64; 4]) -> [f64; 4] {
+    let r = [a[0].max(b[0]), a[1].max(b[1]), a[2].min(b[2]), a[3].min(b[3])];
+    // An empty intersection stays empty (zero size) so it clips everything away.
+    if r[2] < r[0] || r[3] < r[1] { [r[0], r[1], r[0], r[1]] } else { r }
+}
+
+/// A rectangle `[l, t, r, b]` as a polygon.
+pub(crate) fn rect_poly([l, t, r, b]: [f64; 4]) -> Vec<P> {
+    vec![(l, t), (r, t), (r, b), (l, b)]
+}
+
+/// The bounding box of a point list.
+pub(crate) fn pts_bbox(pts: &[P]) -> Option<[f64; 4]> {
+    let (&f, rest) = pts.split_first()?;
+    Some(rest.iter().fold([f.0, f.1, f.0, f.1], |v, p| [v[0].min(p.0), v[1].min(p.1), v[2].max(p.0), v[3].max(p.1)]))
+}
+
+fn cross(a: P, b: P, p: P) -> f64 {
+    (b.0 - a.0) * (p.1 - a.1) - (b.1 - a.1) * (p.0 - a.0)
+}
+
+/// A convex clip polygon with positive orientation, or None when `pts` is not convex (or
+/// degenerate); duplicate and collinear points are dropped.
+pub(crate) fn convex(pts: &[P]) -> Option<Vec<P>> {
+    let mut v: Vec<P> = Vec::with_capacity(pts.len());
+    for &p in pts {
+        if !(p.0.is_finite() && p.1.is_finite()) {
+            return None;
+        }
+        if v.last().is_none_or(|q: &P| (q.0 - p.0).abs() > 1e-9 || (q.1 - p.1).abs() > 1e-9) {
+            v.push(p);
+        }
+    }
+    while v.len() > 1 && v.first() == v.last() {
+        v.pop();
+    }
+    let area: f64 = (0..v.len()).map(|i| cross((0.0, 0.0), v[i], v[(i + 1) % v.len()])).sum();
+    if v.len() < 3 || area.abs() < 1e-12 {
+        return None;
+    }
+    if area < 0.0 {
+        v.reverse();
+    }
+    let n = v.len();
+    let mut out = Vec::with_capacity(n);
+    for i in 0..n {
+        let c = cross(v[(i + n - 1) % n], v[i], v[(i + 1) % n]);
+        if c < -1e-9 * (1.0 + area.abs()) {
+            return None;
+        }
+        if c.abs() > 1e-12 {
+            out.push(v[i]);
+        }
+    }
+    (out.len() >= 3).then_some(out)
+}
+
+fn inside_poly(clip: &[P], p: P) -> bool {
+    (0..clip.len()).all(|i| cross(clip[i], clip[(i + 1) % clip.len()], p) >= -1e-9)
+}
+
+/// Whether the clip polygon is an axis-aligned rectangle.
+fn is_rect(clip: &[P]) -> bool {
+    pts_bbox(clip).is_some_and(|b| clip.len() == 4 && clip.iter().all(|p| (p.0 == b[0] || p.0 == b[2]) && (p.1 == b[1] || p.1 == b[3])))
+}
+
+/// Sutherland–Hodgman: `poly` cut by convex `clip`, charging each point visited against each clip
+/// edge to `budget`: the polygon
+/// can gain a vertex at every edge, so its cost isn't known from its input size alone. `None`
+/// once the budget is spent.
+pub(crate) fn clip_polygon_within(poly: &[P], clip: &[P], budget: &mut usize) -> Option<Vec<P>> {
+    let mut poly = poly.to_vec();
+    for i in 0..clip.len() {
+        // The work actually done: this edge visits the polygon as it now stands.
+        if poly.len() > *budget {
+            return None;
+        }
+        *budget -= poly.len();
+        let (a, b) = (clip[i], clip[(i + 1) % clip.len()]);
+        let keep = |p: P| cross(a, b, p) >= 0.0;
+        let cut = |p: P, q: P| {
+            let (cp, cq) = (cross(a, b, p), cross(a, b, q));
+            let t = cp / (cp - cq);
+            (p.0 + (q.0 - p.0) * t, p.1 + (q.1 - p.1) * t)
+        };
+        let mut next = Vec::with_capacity(poly.len() + 4);
+        for j in 0..poly.len() {
+            let (p, q) = (poly[(j + poly.len() - 1) % poly.len()], poly[j]);
+            match (keep(p), keep(q)) {
+                (true, true) => next.push(q),
+                (true, false) => next.push(cut(p, q)),
+                (false, true) => {
+                    next.push(cut(p, q));
+                    next.push(q);
+                }
+                (false, false) => {}
+            }
+        }
+        poly = next;
+        if poly.is_empty() {
+            break;
+        }
+    }
+    Some(poly)
+}
+
+fn disjoint(b: [f64; 4], c: [f64; 4]) -> bool {
+    b[2] < c[0] || b[0] > c[2] || b[3] < c[1] || b[1] > c[3] || c[2] <= c[0] || c[3] <= c[1]
+}
+
+fn bbox_inside(b: [f64; 4], clip: &[P]) -> bool {
+    rect_poly(b).into_iter().all(|p| inside_poly(clip, p))
+}
+
+/// Clips one drawn item to a convex device polygon; a shape that is both filled and stroked comes
+/// back as two items. An empty polygon clips everything away.
+pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
+    let Some(cb) = pts_bbox(clip).filter(|_| clip.len() >= 3) else { return Vec::new() };
+    match raw {
+        Raw::Path { ops, fill, stroke, even_odd, region } => {
+            let Some(b) = ops_bbox(&ops) else { return Vec::new() };
+            if bbox_inside(b, clip) {
+                return vec![Raw::Path { ops, fill, stroke, even_odd, region }];
+            }
+            if disjoint(b, cb) {
+                return Vec::new();
+            }
+            let subs = flatten(&ops);
+            // One allowance for the fill and the stroke together; the item goes once it is spent.
+            let mut budget = MAX_CLIP_WORK;
+            let mut out = Vec::new();
+            if fill.is_some() {
+                let Some(f) = clip_fill(&subs, clip, &mut budget) else { return Vec::new() };
+                if !f.is_empty() {
+                    out.push(Raw::Path { ops: f, fill, stroke: None, even_odd, region: region.clone() });
+                }
+            }
+            if stroke.is_some() {
+                let Some(s) = clip_stroke(&subs, clip, &mut budget) else { return Vec::new() };
+                if !s.is_empty() {
+                    out.push(Raw::Path { ops: s, fill: None, stroke, even_odd, region });
+                }
+            }
+            out
+        }
+        Raw::Pattern { ops, even_odd, tile, region } => {
+            let Some(b) = ops_bbox(&ops) else { return Vec::new() };
+            if bbox_inside(b, clip) {
+                return vec![Raw::Pattern { ops, even_odd, tile, region }];
+            }
+            if disjoint(b, cb) {
+                return Vec::new();
+            }
+            let subs = flatten(&ops);
+            let f = clip_fill(&subs, clip, &mut { MAX_CLIP_WORK }).unwrap_or_default();
+            if f.is_empty() { Vec::new() } else { vec![Raw::Pattern { ops: f, even_odd, tile, region }] }
+        }
+        Raw::Bitmap { rect, img, region } => crop(rect, img, clip).map(|(rect, img)| vec![Raw::Bitmap { rect, img, region }]).unwrap_or_default(),
+        Raw::Text { text: mut t, region } => {
+            // Text clips to a rectangle: the one around the polygon.
+            let cur = t.clip.map_or(cb, |[a, b, d, e]| intersect(cb, [f64::from(a), f64::from(b), f64::from(d), f64::from(e)]));
+            t.clip = Some(cur.map(|v| v as f32));
+            vec![Raw::Text { text: t, region }]
+        }
+    }
+}
+
+/// Subpaths as point lists with their closed flag.
+pub(crate) fn flatten(ops: &[Op]) -> Vec<(Vec<P>, bool)> {
+    let mut subs: Vec<(Vec<P>, bool)> = Vec::new();
+    for op in ops {
+        match *op {
+            Op::M(p) => subs.push((vec![p], false)),
+            Op::L(p) => match subs.last_mut() {
+                Some(s) => s.0.push(p),
+                None => subs.push((vec![p], false)),
+            },
+            Op::C(a, b, d) => {
+                let Some(s) = subs.last_mut() else { continue };
+                let Some(&p0) = s.0.last() else { continue };
+                for i in 1..=CURVE_STEPS {
+                    let t = i as f64 / CURVE_STEPS as f64;
+                    let u = 1.0 - t;
+                    let k = [u * u * u, 3.0 * u * u * t, 3.0 * u * t * t, t * t * t];
+                    s.0.push((k[0] * p0.0 + k[1] * a.0 + k[2] * b.0 + k[3] * d.0, k[0] * p0.1 + k[1] * a.1 + k[2] * b.1 + k[3] * d.1));
+                }
+            }
+            Op::Z => {
+                if let Some(s) = subs.last_mut() {
+                    s.1 = true;
+                    // Drawing after a close starts from the subpath's first point.
+                    let first = s.0.first().copied();
+                    if let Some(f) = first {
+                        subs.push((vec![f], false));
+                    }
+                }
+            }
+        }
+    }
+    subs.retain(|s| s.0.len() > 1);
+    subs
+}
+
+/// The clipped fill of every subpath, its clipping work charged to `budget` with that of the
+/// stroke: `None` (the whole item goes) once it is spent.
+fn clip_fill(subs: &[(Vec<P>, bool)], clip: &[P], budget: &mut usize) -> Option<Vec<Op>> {
+    let mut ops = Vec::new();
+    for (pts, _) in subs {
+        let poly = clip_polygon_within(pts, clip, budget)?;
+        if poly.len() >= 3 {
+            ops.push(Op::M(poly[0]));
+            ops.extend(poly[1..].iter().map(|p| Op::L(*p)));
+            ops.push(Op::Z);
+        }
+    }
+    Some(ops)
+}
+
+/// The clipped outline of every subpath; `None` once `budget` is spent.
+fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P], budget: &mut usize) -> Option<Vec<Op>> {
+    let mut ops = Vec::new();
+    for (pts, closed) in subs {
+        let mut pts = pts.clone();
+        if *closed && let Some(&f) = pts.first() {
+            pts.push(f);
+        }
+        let mut last: Option<P> = None;
+        for w in pts.windows(2) {
+            let Some((a, b)) = segment(w[0], w[1], clip, budget)? else {
+                last = None;
+                continue;
+            };
+            if last != Some(a) {
+                ops.push(Op::M(a));
+            }
+            ops.push(Op::L(b));
+            last = Some(b);
+        }
+    }
+    Some(ops)
+}
+
+/// Cyrus–Beck: the part of segment `a`–`b` inside convex `clip`, one unit of `budget` per clip edge
+/// visited; the outer `None` is a spent budget.
+fn segment(a: P, b: P, clip: &[P], budget: &mut usize) -> Option<Option<(P, P)>> {
+    let d = (b.0 - a.0, b.1 - a.1);
+    let (mut t0, mut t1) = (0.0f64, 1.0f64);
+    for i in 0..clip.len() {
+        *budget = budget.checked_sub(1)?;
+        let (e0, e1) = (clip[i], clip[(i + 1) % clip.len()]);
+        // Inside is cross(e0, e1, p) >= 0, linear in t along the segment.
+        let f0 = cross(e0, e1, a);
+        let df = (e1.0 - e0.0) * d.1 - (e1.1 - e0.1) * d.0;
+        if df == 0.0 {
+            if f0 < 0.0 {
+                return Some(None);
+            }
+        } else {
+            let t = -f0 / df;
+            if df > 0.0 {
+                t0 = t0.max(t);
+            } else {
+                t1 = t1.min(t);
+            }
+        }
+    }
+    Some((t0 <= t1).then_some(((a.0 + d.0 * t0, a.1 + d.1 * t0), (a.0 + d.0 * t1, a.1 + d.1 * t1))))
+}
+
+/// Crops a bitmap drawn into `rect` = `[x, y, w, h]` (device, positive extents) to the clip
+/// polygon's box; pixels outside a non-rectangular polygon turn transparent.
+fn crop(rect: [f64; 4], img: Rgba, clip: &[P]) -> Option<([f64; 4], Rgba)> {
+    let [x, y, w, h] = rect;
+    let b = [x, y, x + w, y + h];
+    if bbox_inside(b, clip) {
+        return Some((rect, img));
+    }
+    let c = pts_bbox(clip)?;
+    if disjoint(b, c) || w <= 0.0 || h <= 0.0 || img.w == 0 || img.h == 0 {
+        return None;
+    }
+    let i = intersect(b, c);
+    let (kx, ky) = (img.w as f64 / w, img.h as f64 / h);
+    let x0 = (((i[0] - x) * kx).floor().max(0.0) as usize).min(img.w);
+    let x1 = (((i[2] - x) * kx).ceil().max(0.0) as usize).min(img.w);
+    let y0 = (((i[1] - y) * ky).floor().max(0.0) as usize).min(img.h);
+    let y1 = (((i[3] - y) * ky).ceil().max(0.0) as usize).min(img.h);
+    if x1 <= x0 || y1 <= y0 {
+        return None;
+    }
+    let mask = !is_rect(clip);
+    let total_pixels = (x1 - x0).saturating_mul(y1 - y0);
+    if mask && total_pixels.saturating_mul(clip.len()) > 5_000_000 {
+        return None;
+    }
+    let mut px = Vec::with_capacity((x1 - x0) * (y1 - y0) * 4);
+    for row in y0..y1 {
+        // Rows are top-down unless the image says otherwise.
+        let r = if img.bottom_up { img.h - 1 - row } else { row };
+        let s = (r * img.w + x0) * 4;
+        let start = px.len();
+        px.extend_from_slice(img.px.get(s..s + (x1 - x0) * 4)?);
+        if mask {
+            let cy = y + (row as f64 + 0.5) / ky;
+            for (k, p) in px[start..].as_chunks_mut::<4>().0.iter_mut().enumerate() {
+                let cx = x + ((x0 + k) as f64 + 0.5) / kx;
+                if !inside_poly(clip, (cx, cy)) {
+                    p[3] = 0;
+                }
+            }
+        }
+    }
+    let out = [x + x0 as f64 / kx, y + y0 as f64 / ky, (x1 - x0) as f64 / kx, (y1 - y0) as f64 / ky];
+    Some((out, Rgba { w: x1 - x0, h: y1 - y0, bottom_up: false, px }))
+}
@@ -0,0 +1,259 @@
+//! Device-independent bitmaps. BITMAPINFOHEADER DIBs at 1/4/8/16/24/32 bpp with BI_RGB or BI_BITFIELDS
+//! decode to RGBA8 rows, top-down. Compressed (RLE, JPEG, PNG) and V4/V5-only features are not decoded.
+
+use crate::{MAX_PIXELS, bytes::Bytes};
+
+const BI_RGB: u32 = 0;
+const BI_BITFIELDS: u32 = 3;
+/// Most palette entries a DIB can carry (the colour table never exceeds 2^8).
+const MAX_PALETTE: usize = 256;
+const ROP_SRCAND: u32 = 0x0088_00C6;
+const ROP_SRCPAINT: u32 = 0x00EE_0086;
+const ROP_SRCINVERT: u32 = 0x0066_0046;
+
+/// A decoded picture. `bottom_up` records the DIB's native row order, which source rectangles use.
+pub(crate) struct Rgba {
+    pub w: usize,
+    pub h: usize,
+    pub bottom_up: bool,
+    pub px: Vec<u8>,
+}
+
+/// How a decoded bitmap combines with the destination.
+#[derive(Clone, Copy)]
+pub(crate) enum Blend {
+    /// A raster operation (BITBLT, STRETCHDIB and friends).
+    Rop(u32),
+    /// EMR_ALPHABLEND: a constant alpha (0..=255), times the per-pixel alpha when `per_pixel` is set
+    /// (AC_SRC_ALPHA: the source colours are premultiplied by it).
+    Alpha { constant: u8, per_pixel: bool },
+}
+
+impl Blend {
+    /// Whether the decoder must keep the 32-bit alpha byte of each pixel.
+    pub fn per_pixel(self) -> bool {
+        matches!(self, Blend::Alpha { per_pixel: true, .. })
+    }
+}
+
+struct Header {
+    w: usize,
+    h: usize,
+    top_down: bool,
+    bpp: usize,
+    masks: [u32; 3],
+    pal_off: usize,
+    pal_n: usize,
+}
+
+impl Header {
+    fn read(info: Bytes) -> Option<Header> {
+        let size = info.u32(0)? as usize;
+        let w = info.i32(4)?;
+        let h = info.i32(8)?;
+        let bpp = info.u16(14)? as usize;
+        let comp = info.u32(16)?;
+        let clr_used = info.u32(32)? as usize;
+        if size < 40 || w <= 0 || h == 0 || !matches!(bpp, 1 | 4 | 8 | 16 | 24 | 32) || !matches!(comp, BI_RGB | BI_BITFIELDS) {
+            return None;
+        }
+        let masks = if comp == BI_BITFIELDS {
+            [info.u32(40)?, info.u32(44)?, info.u32(48)?]
+        } else if bpp == 16 {
+            [0x7C00, 0x03E0, 0x001F]
+        } else {
+            [0xFF_0000, 0xFF00, 0xFF]
+        };
+        let masks_len = if comp == BI_BITFIELDS && size == 40 { 12 } else { 0 };
+        let pal_off = size.checked_add(masks_len)?;
+        // Indexed formats take 2^bpp entries when clrUsed is 0. Deeper formats carry only the
+        // entries clrUsed names (WMF DIBs can have them), still capped.
+        let pal_n = match (bpp <= 8, clr_used) {
+            (true, 0) => 1usize << bpp,
+            (true, n) => n.min(1usize << bpp),
+            (false, n) => n.min(MAX_PALETTE),
+        };
+        Some(Header { w: w as usize, h: h.unsigned_abs() as usize, top_down: h < 0, bpp, masks, pal_off, pal_n })
+    }
+}
+
+/// Byte length of the info part (header, masks, palette) of a DIB, so the pixel bits follow it.
+pub(crate) fn info_len(dib: Bytes) -> Option<usize> {
+    let h = Header::read(dib)?;
+    h.pal_off.checked_add(h.pal_n.checked_mul(4)?)
+}
+
+/// Decodes a DIB given as its info part (header plus masks and palette) and its pixel bits. The
+/// 32-bit alpha byte is kept only when `keep_alpha` is set (per-pixel alpha blends); otherwise pixels
+/// are opaque.
+pub(crate) fn decode(info: Bytes, bits: Bytes, keep_alpha: bool) -> Option<Rgba> {
+    let hd = Header::read(info)?;
+    let pixels = hd.w.checked_mul(hd.h)?;
+    if pixels == 0 || pixels > MAX_PIXELS {
+        return None;
+    }
+    let stride = hd.w.checked_mul(hd.bpp)?.checked_add(31)? / 32 * 4;
+    let data = bits.slice(0, stride.checked_mul(hd.h)?)?;
+    let pal = info.slice(hd.pal_off, hd.pal_n * 4)?;
+    let mut px = vec![0u8; pixels * 4];
+    for y in 0..hd.h {
+        let src_row = if hd.top_down { y } else { hd.h - 1 - y };
+        let row = src_row * stride;
+        for x in 0..hd.w {
+            let p = pixel(data, row, x, &hd, pal, keep_alpha)?;
+            let o = (y * hd.w + x) * 4;
+            px.get_mut(o..o + 4)?.copy_from_slice(&p);
+        }
+    }
+    Some(Rgba { w: hd.w, h: hd.h, bottom_up: !hd.top_down, px })
+}
+
+fn pixel(data: &[u8], row: usize, x: usize, hd: &Header, pal: &[u8], keep_alpha: bool) -> Option<[u8; 4]> {
+    let [m_r, m_g, m_b] = hd.masks;
+    let [r, g, b] = match hd.bpp {
+        1 => {
+            let b = *data.get(row + x / 8)?;
+            palette(pal, usize::from((b >> (7 - x % 8)) & 1))
+        }
+        4 => {
+            let b = *data.get(row + x / 2)?;
+            palette(pal, usize::from(if x.is_multiple_of(2) { b >> 4 } else { b & 0x0F }))
+        }
+        8 => palette(pal, usize::from(*data.get(row + x)?)),
+        24 => {
+            let [b, g, r] = data.get(row + x * 3..row + x * 3 + 3)?.try_into().ok()?;
+            [r, g, b]
+        }
+        16 => {
+            let o = row + x * 2;
+            let v = u32::from(u16::from_le_bytes(data.get(o..o + 2)?.try_into().ok()?));
+            [field(v, m_r), field(v, m_g), field(v, m_b)]
+        }
+        _ => {
+            let o = row + x * 4;
+            let v = u32::from_le_bytes(data.get(o..o + 4)?.try_into().ok()?);
+            let a = if keep_alpha { (v >> 24) as u8 } else { 255 };
+            return Some([field(v, m_r), field(v, m_g), field(v, m_b), a]);
+        }
+    };
+    Some([r, g, b, 255])
+}
+
+/// Palette entries are BGRX quads; an index past the table reads as black rather than failing the image.
+fn palette(pal: &[u8], i: usize) -> [u8; 3] {
+    pal.get(i * 4..i * 4 + 4).and_then(|c| <[u8; 4]>::try_from(c).ok()).map_or([0, 0, 0], |c| [c[2], c[1], c[0]])
+}
+
+/// Extracts one channel from a masked pixel value and scales it to 8 bits.
+fn field(v: u32, mask: u32) -> u8 {
+    if mask == 0 {
+        return 0;
+    }
+    let shift = mask.trailing_zeros();
+    let max = u64::from(mask >> shift);
+    let val = u64::from((v & mask) >> shift);
+    ((val * 255 + max / 2) / max) as u8
+}
+
+/// Clips a source rectangle `src` = `[x, y, w, h]` to the bitmap and returns the cropped pixels (top-down)
+/// with the part of the destination `dst` that they fill. `src` is in DIB pixel coordinates (`y` counted
+/// from the DIB's origin, so bottom-up images count from the bottom); a non-positive source size means the
+/// whole bitmap. Clipping shrinks the destination by the same ratio and shifts it by the clipped-off part,
+/// so the rest of the image keeps its place. A negative destination extent is kept (the caller mirrors).
+pub(crate) fn clip_blit(img: &Rgba, src: [i64; 4], dst: [f64; 4]) -> Option<(Rgba, [f64; 4])> {
+    let (iw, ih) = (img.w as i64, img.h as i64);
+    let [sx, sy, sw, sh] = if src[2] > 0 && src[3] > 0 { src } else { [0, 0, iw, ih] };
+    // The request's top row in top-down order.
+    let top = if img.bottom_up { ih.saturating_sub(sy).saturating_sub(sh) } else { sy };
+    let (x0, x1) = (sx.max(0), sx.saturating_add(sw).min(iw));
+    let (r0, r1) = (top.max(0), top.saturating_add(sh).min(ih));
+    if x1 <= x0 || r1 <= r0 {
+        return None;
+    }
+    let (kx, ky) = (dst[2] / sw as f64, dst[3] / sh as f64);
+    let out = [dst[0] + (x0 - sx) as f64 * kx, dst[1] + (r0 - top) as f64 * ky, (x1 - x0) as f64 * kx, (r1 - r0) as f64 * ky];
+    let (x0, x1, r0, r1) = (x0 as usize, x1 as usize, r0 as usize, r1 as usize);
+    let (ow, oh) = (x1 - x0, r1 - r0);
+    let mut px = Vec::with_capacity(ow * oh * 4);
+    for row in r0..r1 {
+        let s = (row * img.w + x0) * 4;
+        px.extend_from_slice(img.px.get(s..s + ow * 4)?);
+    }
+    Some((Rgba { w: ow, h: oh, bottom_up: false, px }, out))
+}
+
+/// Applies a blend to decoded pixels before they are drawn. The picture has no destination pixels, so
+/// raster operations are drawn as they look over white paper: SRCAND (destination AND source) leaves
+/// white source pixels out and draws the rest; SRCPAINT and SRCINVERT leave black ones out. Other
+/// operations draw the source as copied. Constant alpha scales every pixel's alpha, after a
+/// per-pixel (premultiplied) source is made straight.
+pub(crate) fn prepare(img: &mut Rgba, blend: Blend) {
+    match blend {
+        Blend::Rop(ROP_SRCAND) => clear_where(img, [255, 255, 255]),
+        Blend::Rop(ROP_SRCPAINT | ROP_SRCINVERT) => clear_where(img, [0, 0, 0]),
+        Blend::Rop(_) => {}
+        Blend::Alpha { constant, per_pixel } => {
+            for p in img.px.as_chunks_mut::<4>().0 {
+                if per_pixel {
+                    unpremultiply(p);
+                }
+                p[3] = (u16::from(p[3]) * u16::from(constant) / 255) as u8;
+            }
+        }
+    }
+}
+
+/// Makes the pixels of colour `rgb` transparent: where a raster operation keeps the destination.
+fn clear_where(img: &mut Rgba, rgb: [u8; 3]) {
+    for p in img.px.as_chunks_mut::<4>().0 {
+        if p[..3] == rgb {
+            p[3] = 0;
+        }
+    }
+}
+
+/// AC_SRC_ALPHA sources are premultiplied; the model holds straight RGBA, so divide the colour by the
+/// alpha (rounded, capped at 255). A transparent pixel keeps its colour bytes.
+fn unpremultiply(p: &mut [u8; 4]) {
+    let a = u32::from(p[3]);
+    if a == 0 || a == 255 {
+        return;
+    }
+    for c in &mut p[..3] {
+        *c = ((u32::from(*c) * 255 + a / 2) / a).min(255) as u8;
+    }
+}
+
+/// Mirrors a decoded image left-right and/or top-bottom. Rows come from the buffer as chunks, so a
+/// short buffer flips only the rows it has.
+pub(crate) fn flip(img: &mut Rgba, horizontal: bool, vertical: bool) {
+    let (w, h) = (img.w, img.h);
+    if w == 0 || h == 0 {
+        return;
+    }
+    let row = w * 4;
+    if horizontal {
+        for line in img.px.chunks_exact_mut(row) {
+            for x in 0..w / 2 {
+                for c in 0..4 {
+                    line.swap(x * 4 + c, (w - 1 - x) * 4 + c);
+                }
+            }
+        }
+    }
+    if vertical {
+        // Rows the buffer actually holds: a short buffer flips only those.
+        let n = h.min(img.px.len() / row);
+        for y in 0..n / 2 {
+            swap_rows(&mut img.px, y * row, (n - 1 - y) * row, row);
+        }
+    }
+}
+
+/// Swaps the `len` bytes at `a` with those at `b` (`a < b`); does nothing when either is out of range.
+fn swap_rows(px: &mut [u8], a: usize, b: usize, len: usize) {
+    let Some((head, tail)) = px.split_at_mut_checked(b) else { return };
+    if let (Some(top), Some(bottom)) = (head.get_mut(a..a.saturating_add(len)), tail.get_mut(..len)) {
+        top.swap_with_slice(bottom);
+    }
+}
@@ -0,0 +1,478 @@
+//! EMF reader (MS-EMF). Records are (type, size in bytes) followed by a payload; offsets inside a
+//! record (bitmap info and bits) are relative to the record start, so each handler reads the record slice.
+
+use std::sync::Arc;
+
+use crate::bytes::Bytes;
+use crate::canvas::{BS_HATCHED, BS_NULL, Brush, Canvas, LogFont, Obj, PS_NULL, PS_STYLE_MASK, Pen, Xform, colorref};
+use crate::dib::{self, Blend};
+use crate::geom::{self, ArcKind, P};
+use crate::text::{ETO_GLYPH_INDEX, ETO_PDY, Font, MAX_CHARS, decode_bytes, decode_utf16};
+use crate::{Error, Frame, MAX_PATH_OPS};
+
+/// ExtTextOut options: no rectangle in the record (EMR_SMALLTEXTOUT, EmrText), and 8-bit
+/// characters (EMR_SMALLTEXTOUT).
+const ETO_NO_RECT: u32 = 0x0100;
+const ETO_SMALL_CHARS: u32 = 0x0200;
+
+const EMF_SIGNATURE: u32 = 0x464D_4520;
+/// Hundredths of a millimetre to points.
+const HMM_TO_PT: f64 = 72.0 / 2540.0;
+/// SRCCOPY, the plain copy of a bitmap.
+const SRCCOPY: u32 = 0x00CC_0020;
+/// LogPenEx pen type bits; PS_COSMETIC pens are one device pixel wide.
+const PS_TYPE_MASK: u32 = 0x000F_0000;
+const PS_COSMETIC: u32 = 0;
+
+pub(crate) fn is_emf(b: Bytes) -> bool {
+    b.u32(0) == Some(1) && b.u32(40) == Some(EMF_SIGNATURE)
+}
+
+/// The picture frame: `rclFrame` (0.01 mm) mapped to device units through `szlDevice` and
+/// `szlMillimeters`, sized in points. Without a usable frame, the device bounds stand in (1 unit = 1 point).
+pub(crate) fn parse(input: Bytes) -> Result<(Canvas, Option<Frame>), Error> {
+    if !is_emf(input) {
+        return Err(Error::BadHeader);
+    }
+    let hsize = input.u32(4).ok_or(Error::BadHeader)? as usize;
+    let bounds = rect32(input, 8).ok_or(Error::BadHeader)?;
+    let [l, t, r, b] = bounds;
+    let frame = frame_from_header(input).or_else(|| (r > l && b > t).then_some(Frame { rect: [l, t, r - l, b - t], size: None }));
+    let mut cv = Canvas::new();
+    if r > l && b > t {
+        cv.set_clip_surface([l, t, r, b]);
+    }
+    if let Some(px_mm) = device_px_per_mm(input) {
+        cv.set_device_mm(px_mm);
+    }
+    let mut plus = crate::emfplus::Plus::new();
+    plus.frame = frame.as_ref().map(|f| f.rect);
+    let mut parsed = 0usize;
+    let mut pos = hsize.max(88);
+    while !cv.full() {
+        let (Some(typ), Some(size)) = (input.u32(pos), pos.checked_add(4).and_then(|o| input.u32(o))) else { break };
+        let size = size as usize;
+        if size < 8 || !size.is_multiple_of(4) {
+            break;
+        }
+        let Some(rec) = input.slice(pos, size) else { break };
+        if typ == 14 {
+            break;
+        }
+        if typ == 70 && Bytes(rec).u32(12) == Some(crate::emfplus::EMF_PLUS) {
+            if let Some(data) = Bytes(rec).tail(16) {
+                plus.comment(&mut cv, data);
+            }
+        } else {
+            record(&mut cv, typ, Bytes(rec));
+        }
+        parsed += 1;
+        let Some(next) = pos.checked_add(size) else { break };
+        pos = next;
+    }
+    if parsed == 0 {
+        return Err(Error::NoRecords);
+    }
+    Ok((cv, frame))
+}
+
+/// Device pixels per millimetre on each axis, from `szlDevice` (72) and `szlMillimeters` (80).
+fn device_px_per_mm(input: Bytes) -> Option<(f64, f64)> {
+    let (dw, dh) = (input.i32(72)?, input.i32(76)?);
+    let (mw, mh) = (input.i32(80)?, input.i32(84)?);
+    (dw > 0 && dh > 0 && mw > 0 && mh > 0).then(|| (f64::from(dw) / f64::from(mw), f64::from(dh) / f64::from(mh)))
+}
+
+/// The frame from `rclFrame` (offset 24), `szlDevice` (72) and `szlMillimeters` (80) in the header.
+fn frame_from_header(input: Bytes) -> Option<Frame> {
+    let [fl, ft, fr, fb] = rect32(input, 24)?;
+    if fr <= fl || fb <= ft {
+        return None;
+    }
+    // Device units per hundredth of a millimetre.
+    let (px_mm_x, px_mm_y) = device_px_per_mm(input)?;
+    let (sx, sy) = (px_mm_x / 100.0, px_mm_y / 100.0);
+    let rect = [fl * sx, ft * sy, (fr - fl) * sx, (fb - ft) * sy];
+    Some(Frame { rect, size: Some(((fr - fl) * HMM_TO_PT, (fb - ft) * HMM_TO_PT)) })
+}
+
+fn record(cv: &mut Canvas, typ: u32, r: Bytes) {
+    if cv.full() {
+        return;
+    }
+    let _ = match typ {
+        9 => xy32(r, 8).map(|p| cv.set_window_ext(p)),
+        10 => xy32(r, 8).map(|p| cv.set_window_org(p)),
+        11 => xy32(r, 8).map(|p| cv.set_viewport_ext(p)),
+        12 => xy32(r, 8).map(|p| cv.set_viewport_org(p)),
+        17 => r.u32(8).map(|m| cv.set_map_mode(m)),
+        19 => r.u32(8).map(|m| cv.set_polyfill(m)),
+        20 => r.u32(8).map(|m| cv.set_rop2(m)),
+        33 => {
+            cv.save_dc();
+            Some(())
+        }
+        34 => r.i32(8).map(|n| cv.restore_dc(n)),
+        35 => xform(r, 8).map(|x| cv.modify_world(x, 4)),
+        36 => xform(r, 8).zip(r.u32(32)).map(|(x, m)| cv.modify_world(x, m)),
+        37 => r.u32(8).map(|i| cv.select(i)),
+        38 => create_pen(cv, r),
+        95 => create_ext_pen(cv, r),
+        39 => create_brush(cv, r),
+        93 | 94 => create_dib_brush(cv, r, typ == 93),
+        82 => create_font(cv, r),
+        18 => r.u32(8).map(|m| cv.set_bk_mode(m)),
+        22 => r.u32(8).map(|a| cv.set_text_align(a)),
+        24 => r.u32(8).map(|c| cv.set_text_color(c)),
+        25 => r.u32(8).map(|c| cv.set_bk_color(c)),
+        83 | 84 => ext_text_out(cv, r, typ == 84),
+        108 => small_text_out(cv, r),
+        40 => r.u32(8).map(|i| cv.delete_object(i)),
+        29 => rect32(r, 8).map(|rect| cv.exclude_clip_rect(rect)),
+        30 => rect32(r, 8).map(|rect| cv.intersect_clip_rect(rect)),
+        75 => ext_select_clip(cv, r),
+        27 => xy32(r, 8).map(|p| cv.move_to(p)),
+        54 => xy32(r, 8).map(|p| cv.line_to(p)),
+        42 => rect32(r, 8).map(|[l, t, rr, b]| cv.shape(&geom::ellipse(l, t, rr, b), true, true)),
+        43 => rect32(r, 8).map(|[l, t, rr, b]| cv.shape(&geom::rect(l, t, rr, b), true, true)),
+        44 => {
+            let (cw, ch) = (r.i32(24), r.i32(28));
+            let (Some(cw), Some(ch)) = (cw, ch) else { return };
+            rect32(r, 8).map(|[l, t, rr, b]| {
+                cv.shape(&geom::round_rect(l, t, rr, b, f64::from(cw), f64::from(ch)), true, true);
+            })
+        }
+        45..=47 => arc32(r).map(|(bounds, s, e)| {
+            let kind = match typ {
+                45 => ArcKind::Arc,
+                46 => ArcKind::Chord,
+                _ => ArcKind::Pie,
+            };
+            let [l, t, rr, b] = bounds;
+            cv.shape(&geom::arc_shape(l, t, rr, b, s, e, kind), kind != ArcKind::Arc, true);
+        }),
+        4 | 87 => counted(r, typ == 4).map(|pts| cv.poly(&pts, false, false, true)),
+        3 | 86 => counted(r, typ == 3).map(|pts| cv.poly(&pts, true, true, true)),
+        6 | 89 => counted(r, typ == 6).map(|pts| cv.line_chain(&pts, false, true)),
+        // POLYBEZIER starts its own figure at the first point and leaves the current point alone;
+        // POLYBEZIERTO continues from the current point.
+        2 | 85 => counted(r, typ == 2).and_then(|pts| {
+            let from = *pts.first()?;
+            cv.bezier(from, pts.get(1..)?);
+            Some(())
+        }),
+        5 | 88 => counted(r, typ == 5).map(|pts| cv.bezier_to(&pts)),
+        7 | 90 => poly_groups(r, typ == 7).map(|(counts, pts)| cv.shape(&geom::subpaths(&pts, &counts, false), false, true)),
+        8 | 91 => poly_groups(r, typ == 8).map(|(counts, pts)| cv.shape(&geom::subpaths(&pts, &counts, true), true, true)),
+        59 => {
+            cv.begin_path();
+            Some(())
+        }
+        60 => {
+            cv.end_path();
+            Some(())
+        }
+        61 => {
+            cv.close_figure();
+            Some(())
+        }
+        62 => {
+            cv.paint_path(true, false);
+            Some(())
+        }
+        63 => {
+            cv.paint_path(true, true);
+            Some(())
+        }
+        64 => {
+            cv.paint_path(false, true);
+            Some(())
+        }
+        76 | 77 => bitblt(cv, r, typ == 77),
+        80 => set_dibits(cv, r),
+        81 => stretch_dibits(cv, r),
+        114 => alphablend(cv, r),
+        _ => Some(()),
+    };
+}
+
+/// EMR_EXTSELECTCLIPRGN: `cbRgnData` bytes of `RGNDATA` (rectangles in logical units) and a region
+/// mode. No region data selects the default clip.
+fn ext_select_clip(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let cb = r.u32(8)? as usize;
+    let mode = r.u32(12)?;
+    if cb == 0 {
+        cv.reset_clip();
+        return Some(());
+    }
+    let header = 16;
+    if cb < 32 {
+        return Some(());
+    }
+    // RDH_RECTANGLES is the only region type GDI writes.
+    if r.u32(header + 4)? != 1 {
+        return Some(());
+    }
+    let n = (r.u32(header + 8)? as usize).min(crate::clip::MAX_CLIP_RECTS);
+    let end = header.checked_add(cb)?;
+    let mut rects = Vec::new();
+    for i in 0..n {
+        let o = header + 32 + i * 16;
+        if o + 16 > end {
+            break;
+        }
+        rects.push(rect32(r, o)?);
+    }
+    cv.select_clip_rects(&rects, mode);
+    Some(())
+}
+
+/// Two little-endian i32 values at `off`, as a point.
+fn xy32(r: Bytes, off: usize) -> Option<P> {
+    Some((f64::from(r.i32(off)?), f64::from(r.i32(off + 4)?)))
+}
+
+/// RECTL (left, top, right, bottom) as i32 values widened to f64.
+fn rect32(r: Bytes, off: usize) -> Option<[f64; 4]> {
+    Some([f64::from(r.i32(off)?), f64::from(r.i32(off + 4)?), f64::from(r.i32(off + 8)?), f64::from(r.i32(off + 12)?)])
+}
+
+/// An i32 field as f64; 0 past the end.
+fn i32s(r: Bytes, off: usize) -> f64 {
+    r.i32(off).map_or(0.0, f64::from)
+}
+
+/// XFORM: six f32 values in M11, M12, M21, M22, Dx, Dy order.
+fn xform(r: Bytes, off: usize) -> Option<Xform> {
+    let mut x = [0.0f64; 6];
+    for (i, v) in x.iter_mut().enumerate() {
+        *v = f64::from(r.f32(off + i * 4)?);
+    }
+    Some(x)
+}
+
+/// ARC, CHORD, PIE: bounds at 8, start point at 24, end point at 32.
+fn arc32(r: Bytes) -> Option<([f64; 4], P, P)> {
+    Some((rect32(r, 8)?, xy32(r, 24)?, xy32(r, 32)?))
+}
+
+/// A point count from a record, rejected when it exceeds the path budget (before any allocation).
+fn budget(n: u32) -> Option<usize> {
+    let n = n as usize;
+    (n <= MAX_PATH_OPS).then_some(n)
+}
+
+/// Point count at 24, then the points (32-bit or 16-bit) at 28.
+fn counted(r: Bytes, wide: bool) -> Option<Vec<P>> {
+    let n = budget(r.u32(24)?)?;
+    r.tail(28)?.points(0, n, wide)
+}
+
+/// Subpath count at 24, total point count at 28, per-subpath counts at 32, then the points.
+fn poly_groups(r: Bytes, wide: bool) -> Option<(Vec<usize>, Vec<P>)> {
+    let n = budget(r.u32(24)?)?;
+    // The record must hold the n counts before anything is allocated for them.
+    let raw = r.slice(32, n.checked_mul(4)?)?;
+    let counts: Vec<usize> = raw.as_chunks::<4>().0.iter().map(|c| u32::from_le_bytes(*c) as usize).collect();
+    let total = counts.iter().try_fold(0usize, |a, c| a.checked_add(*c))?;
+    let total = budget(u32::try_from(total).ok()?)?;
+    let pts = r.tail(n.checked_mul(4)?.checked_add(32)?)?.points(0, total, wide)?;
+    Some((counts, pts))
+}
+
+/// EMR_CREATEPEN: handle, LogPen (style, width x/y, colour).
+fn create_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let style = r.u32(12)?;
+    let width = r.i32(16)?;
+    let color = r.u32(24)?;
+    cv.add_object(Some(slot), Obj::Pen(Pen { style, width: f64::from(width), color: colorref(color) }));
+    Some(())
+}
+
+/// EMR_EXTCREATEPEN: handle, bitmap offsets (unused), LogPenEx (style, width, brush style, colour).
+/// A cosmetic pen's width is in device pixels (always 1), so it is a hairline; a BS_NULL brush draws
+/// no line at all.
+fn create_ext_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let (style, width, brush, color) = (r.u32(28)?, r.u32(32)?, r.u32(36)?, r.u32(40)?);
+    let width = if style & PS_TYPE_MASK == PS_COSMETIC { 0.0 } else { f64::from(width) };
+    let style = if brush == BS_NULL { PS_NULL } else { style & PS_STYLE_MASK };
+    cv.add_object(Some(slot), Obj::Pen(Pen { style, width, color: colorref(color) }));
+    Some(())
+}
+
+/// EMR_CREATEBRUSHINDIRECT: handle, LogBrush32 (style, colour, hatch).
+fn create_brush(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let style = r.u32(12)?;
+    let color = r.u32(16)?;
+    let mut b = Brush::new(style, colorref(color));
+    if style == BS_HATCHED {
+        b.hatch = r.u32(20).unwrap_or(0);
+    }
+    cv.add_object(Some(slot), Obj::Brush(b));
+    Some(())
+}
+
+/// EMR_CREATEDIBPATTERNBRUSHPT (94) and EMR_CREATEMONOBRUSH (93): handle, colour usage, then the
+/// bitmap info and bits as offset/size pairs. A mono brush (or one whose palette holds indices,
+/// DIB_PAL_COLORS) takes the text and background colours. An undecodable bitmap leaves the slot
+/// empty.
+fn create_dib_brush(cv: &mut Canvas, r: Bytes, mono: bool) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let usage = r.u32(12)?;
+    let (bo, bl) = (r.u32(16)? as usize, r.u32(20)? as usize);
+    let (po, pl) = (r.u32(24)? as usize, r.u32(28)? as usize);
+    let img = dib::decode(Bytes(r.slice(bo, bl)?), Bytes(r.slice(po, pl)?), false)?;
+    let b = Brush::pattern(img, mono || usage == 1)?;
+    cv.add_object(Some(slot), Obj::Brush(b));
+    Some(())
+}
+
+/// EMR_EXTCREATEFONTINDIRECTW: handle, then a LogFont (MS-EMF 2.2.13): height, width, escapement,
+/// orientation, weight (i32 each), italic, underline, strike-out, charset and four more bytes, then
+/// the face name in 32 UTF-16 units (NUL-terminated).
+fn create_font(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let height = r.i32(12)?;
+    let width = r.i32(16).unwrap_or(0);
+    let escapement = r.i32(20).unwrap_or(0);
+    let weight = r.i32(28).unwrap_or(0);
+    let byte = |o: usize| r.0.get(o).copied().unwrap_or(0);
+    let units: Vec<u16> = (0..32).map_while(|i| r.u16(40 + 2 * i)).take_while(|u| *u != 0).collect();
+    let (family, _) = decode_utf16(&units, &[]);
+    let font = Font {
+        family: family.trim().to_string(),
+        height: height as f32,
+        width: width as f32,
+        weight: weight.clamp(0, 1000) as u16,
+        italic: byte(32) != 0,
+        underline: byte(33) != 0,
+        strike: byte(34) != 0,
+        charset: byte(35),
+    };
+    cv.add_object(Some(slot), Obj::Font(Arc::new(LogFont { font, escapement: f64::from(escapement) })));
+    Some(())
+}
+
+/// The dx array at `off` for `n` characters: i32 advances, or (dx, dy) pairs under ETO_PDY (only
+/// dx is used). Empty when absent or short.
+fn dx_array(r: Bytes, off: usize, n: usize, opts: u32) -> Vec<f32> {
+    let step = if opts & ETO_PDY != 0 { 8 } else { 4 };
+    if off == 0 {
+        return Vec::new();
+    }
+    let dx: Vec<f32> = (0..n).map_while(|i| r.i32(off.checked_add(i.checked_mul(step)?)?)).map(|v| v as f32).collect();
+    if dx.len() == n { dx } else { Vec::new() }
+}
+
+/// EMR_EXTTEXTOUTA (83) and EMR_EXTTEXTOUTW (84): bounds, graphics mode and scales, then an EmrText
+/// at 36: reference point, character count, string offset, options, the rectangle (absent under
+/// ETO_NO_RECT) and the dx offset. Offsets count from the record start. Glyph-index strings name
+/// glyphs of a font the reader cannot match, so they are left out.
+fn ext_text_out(cv: &mut Canvas, r: Bytes, wide: bool) -> Option<()> {
+    let at = xy32(r, 36)?;
+    let n = (r.u32(44)? as usize).min(MAX_CHARS);
+    let off = r.u32(48)? as usize;
+    let opts = r.u32(52)?;
+    let (rect, dx_off) = if opts & ETO_NO_RECT != 0 { (None, r.u32(56)?) } else { (rect32(r, 56), r.u32(72)?) };
+    if opts & ETO_GLYPH_INDEX != 0 {
+        return None;
+    }
+    let dx = dx_array(r, dx_off as usize, n, opts);
+    let (text, dx) = if wide {
+        let raw = r.slice(off, n.checked_mul(2)?)?;
+        let units: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_le_bytes(*c)).collect();
+        decode_utf16(&units, &dx)
+    } else {
+        decode_bytes(r.slice(off, n)?, cv.font_charset(), &dx)
+    };
+    cv.text(at, text, dx, opts, rect);
+    Some(())
+}
+
+/// EMR_SMALLTEXTOUT (MS-EMF 2.3.5.37): x, y, character count, options, graphics mode, scales, the
+/// bounds (absent under ETO_NO_RECT), then the characters: 8-bit under ETO_SMALL_CHARS, else UTF-16.
+fn small_text_out(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let at = xy32(r, 8)?;
+    let n = (r.u32(16)? as usize).min(MAX_CHARS);
+    let opts = r.u32(20)?;
+    if opts & ETO_GLYPH_INDEX != 0 {
+        return None;
+    }
+    let (rect, off) = if opts & ETO_NO_RECT != 0 { (None, 36) } else { (rect32(r, 36), 52) };
+    let (text, _) = if opts & ETO_SMALL_CHARS != 0 {
+        decode_bytes(r.slice(off, n)?, cv.font_charset(), &[])
+    } else {
+        let raw = r.slice(off, n.checked_mul(2)?)?;
+        let units: Vec<u16> = raw.as_chunks::<2>().0.iter().map(|c| u16::from_le_bytes(*c)).collect();
+        decode_utf16(&units, &[])
+    };
+    cv.text(at, text, Vec::new(), opts, rect);
+    Some(())
+}
+
+/// BITBLT (76) and STRETCHBLT (77): dest at 24..40, rop at 40, source x/y at 44, bmi at 84, bits at
+/// 92; STRETCHBLT adds the source w/h at 100. A source-less rop fills the destination instead.
+fn bitblt(cv: &mut Canvas, r: Bytes, stretch: bool) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 32), i32s(r, 36)];
+    let rop = r.u32(40)?;
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let (sw, sh) = if stretch { (i32s(r, 100), i32s(r, 104)) } else { (dst[2], dst[3]) };
+    let src = [i32s(r, 44), i32s(r, 48), sw, sh];
+    blit(cv, r, dst, src, (84, 92), Blend::Rop(rop))
+}
+
+/// ALPHABLEND: laid out like STRETCHBLT, with a BLENDFUNCTION at 40. Constant alpha at 42 applies to
+/// every pixel; AlphaFormat at 43 with AC_SRC_ALPHA (1) also uses the per-pixel alpha.
+fn alphablend(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 32), i32s(r, 36)];
+    let constant = *r.0.get(42)?;
+    let per_pixel = (*r.0.get(43)? & 0x01) != 0;
+    let src = [i32s(r, 44), i32s(r, 48), i32s(r, 100), i32s(r, 104)];
+    blit(cv, r, dst, src, (84, 92), Blend::Alpha { constant, per_pixel })
+}
+
+/// STRETCHDIBITS: dest x/y at 24, src x/y/w/h at 32..48, bmi offset/size at 48, bits at 56, rop at 68,
+/// dest w/h at 72.
+fn stretch_dibits(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 72), i32s(r, 76)];
+    let src = [i32s(r, 32), i32s(r, 36), i32s(r, 40), i32s(r, 44)];
+    let rop = r.u32(68)?;
+    blit(cv, r, dst, src, (48, 56), Blend::Rop(rop))
+}
+
+/// SETDIBITSTODEVICE (MS-EMF 2.3.1.5): dest x/y at 24, src x/y at 32, size (cxSrc, cySrc) at 40, bmi
+/// at 48, bits at 56, start scan at 68. The image keeps its own size; the bits begin at scan line
+/// `iStartScan`, so the source y counts from there.
+fn set_dibits(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let (cx, cy) = (i32s(r, 40), i32s(r, 44));
+    if cx <= 0.0 || cy <= 0.0 {
+        return None;
+    }
+    let dst = [i32s(r, 24), i32s(r, 28), cx, cy];
+    let src = [i32s(r, 32), i32s(r, 36) - f64::from(r.u32(68)?), cx, cy];
+    blit(cv, r, dst, src, (48, 56), Blend::Rop(SRCCOPY))
+}
+
+/// Decodes the bitmap at `at` = (offset of the bmi offset/length pair, offset of the bits pair), both
+/// inside the record, and stretches the source rectangle `src` into `dst`. Both are `[x, y, w, h]`; a
+/// non-positive source size means the whole bitmap. `blend` decides how it combines.
+fn blit(cv: &mut Canvas, r: Bytes, dst: [f64; 4], src: [f64; 4], at: (usize, usize), blend: Blend) -> Option<()> {
+    let (bo, bl) = (r.u32(at.0)? as usize, r.u32(at.0 + 4)? as usize);
+    let (po, pl) = (r.u32(at.1)? as usize, r.u32(at.1 + 4)? as usize);
+    if pl == 0 {
+        return None;
+    }
+    let info = Bytes(r.slice(bo, bl)?);
+    let pixels = Bytes(r.slice(po, pl)?);
+    let mut img = dib::decode(info, pixels, blend.per_pixel())?;
+    dib::prepare(&mut img, blend);
+    let (img, dst) = dib::clip_blit(&img, src.map(|v| v as i64), dst)?;
+    cv.bitmap(dst, img);
+    Some(())
+}
@@ -0,0 +1,118 @@
+//! Path operations in `f64` and the shape builders that turn WMF/EMF rectangles, ellipses and arcs
+//! into cubic Béziers (the classic 4/3·tan(Δ/4) approximation, at most 90° per piece).
+
+use std::f64::consts::{FRAC_PI_2, PI, TAU};
+
+pub(crate) type P = (f64, f64);
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Op {
+    M(P),
+    L(P),
+    C(P, P, P),
+    Z,
+}
+
+pub(crate) fn rect(l: f64, t: f64, r: f64, b: f64) -> Vec<Op> {
+    vec![Op::M((l, t)), Op::L((r, t)), Op::L((r, b)), Op::L((l, b)), Op::Z]
+}
+
+/// Corner radii are half the EMF/WMF corner ellipse size, clamped so the corners never overlap.
+pub(crate) fn round_rect(l: f64, t: f64, r: f64, b: f64, ew: f64, eh: f64) -> Vec<Op> {
+    // Reversed corners (right < left, bottom < top) describe the same rectangle.
+    let (l, r) = (l.min(r), l.max(r));
+    let (t, b) = (t.min(b), t.max(b));
+    let rx = (ew / 2.0).abs().min((r - l) / 2.0);
+    let ry = (eh / 2.0).abs().min((b - t) / 2.0);
+    let mut ops = vec![Op::M((l + rx, t)), Op::L((r - rx, t))];
+    ops.extend(arc(r - rx, t + ry, rx, ry, -FRAC_PI_2, FRAC_PI_2));
+    ops.push(Op::L((r, b - ry)));
+    ops.extend(arc(r - rx, b - ry, rx, ry, 0.0, FRAC_PI_2));
+    ops.push(Op::L((l + rx, b)));
+    ops.extend(arc(l + rx, b - ry, rx, ry, FRAC_PI_2, FRAC_PI_2));
+    ops.push(Op::L((l, t + ry)));
+    ops.extend(arc(l + rx, t + ry, rx, ry, PI, FRAC_PI_2));
+    ops.push(Op::Z);
+    ops
+}
+
+pub(crate) fn ellipse(l: f64, t: f64, r: f64, b: f64) -> Vec<Op> {
+    let (cx, cy, rx, ry) = center(l, t, r, b);
+    let mut ops = vec![Op::M((cx + rx, cy))];
+    ops.extend(arc(cx, cy, rx, ry, 0.0, TAU));
+    ops.push(Op::Z);
+    ops
+}
+
+/// Which closed or open shape an ARC/CHORD/PIE record draws.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ArcKind {
+    Arc,
+    Chord,
+    Pie,
+}
+
+/// ARC, CHORD and PIE: the arc runs counter-clockwise on screen from the start point to the end point.
+pub(crate) fn arc_shape(l: f64, t: f64, r: f64, b: f64, s: P, e: P, kind: ArcKind) -> Vec<Op> {
+    let (cx, cy, rx, ry) = center(l, t, r, b);
+    let ang = |p: P| ((p.1 - cy) / ry.max(f64::MIN_POSITIVE)).atan2((p.0 - cx) / rx.max(f64::MIN_POSITIVE));
+    let (a0, a1) = (ang(s), ang(e));
+    let mut d = (a0 - a1).rem_euclid(TAU);
+    if d < 1e-12 {
+        d = TAU;
+    }
+    let sweep = -d;
+    let start = (cx + rx * a0.cos(), cy + ry * a0.sin());
+    let mut ops = if kind == ArcKind::Pie { vec![Op::M((cx, cy)), Op::L(start)] } else { vec![Op::M(start)] };
+    ops.extend(arc(cx, cy, rx, ry, a0, sweep));
+    match kind {
+        ArcKind::Arc => {}
+        ArcKind::Chord => ops.push(Op::Z),
+        ArcKind::Pie => ops.extend([Op::L((cx, cy)), Op::Z]),
+    }
+    ops
+}
+
+fn center(l: f64, t: f64, r: f64, b: f64) -> (f64, f64, f64, f64) {
+    ((l + r) / 2.0, (t + b) / 2.0, (r - l).abs() / 2.0, (b - t).abs() / 2.0)
+}
+
+/// Cubic pieces along an ellipse from parameter `a0` over signed `sweep` radians. The current point
+/// must already be at `(cx + rx cos a0, cy + ry sin a0)`.
+fn arc(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, sweep: f64) -> Vec<Op> {
+    let n = ((sweep.abs() / FRAC_PI_2).ceil() as usize).clamp(1, 8);
+    let step = sweep / n as f64;
+    let k = 4.0 / 3.0 * (step / 4.0).tan();
+    let pt = |t: f64| (cx + rx * t.cos(), cy + ry * t.sin());
+    let mut ops = Vec::with_capacity(n);
+    for i in 0..n {
+        let t0 = a0 + step * i as f64;
+        let t1 = t0 + step;
+        let (p0, p3) = (pt(t0), pt(t1));
+        let c1 = (p0.0 - k * rx * t0.sin(), p0.1 + k * ry * t0.cos());
+        let c2 = (p3.0 + k * rx * t1.sin(), p3.1 - k * ry * t1.cos());
+        ops.push(Op::C(c1, c2, p3));
+    }
+    ops
+}
+
+/// Consecutive subpaths: `counts[i]` points each, taken in order from `pts`. Counts that run past the
+/// point list are cut short rather than failing the whole record.
+pub(crate) fn subpaths(pts: &[P], counts: &[usize], close: bool) -> Vec<Op> {
+    let mut ops = Vec::with_capacity(pts.len() + counts.len());
+    let mut at = 0usize;
+    for &c in counts {
+        let end = at.saturating_add(c).min(pts.len());
+        let Some((first, rest)) = pts.get(at..end).and_then(|s| s.split_first()) else {
+            at = end;
+            continue;
+        };
+        ops.push(Op::M(*first));
+        ops.extend(rest.iter().map(|p| Op::L(*p)));
+        if close {
+            ops.push(Op::Z);
+        }
+        at = end;
+    }
+    ops
+}
@@ -0,0 +1,306 @@
+//! DeckCraft metafiles (ported from WordCraft's `crates/metafile`): reads Windows Metafiles (WMF)
+//! and Enhanced Metafiles (EMF) into a neutral vector model of filled and stroked paths, pattern
+//! fills, RGBA bitmaps and text strings, in a picture frame with y down.
+//!
+//! Text stays font-agnostic: a [`Text`] item names the font the file asks for and carries the
+//! string, its advances and alignment; the renderer resolves the font and draws the glyphs.
+//!
+//! The reader is pure Rust over byte slices (no file system), so it builds for wasm. Every read is
+//! bounds-checked and every count is capped; hostile input yields a shorter picture or an [`Error`],
+//! never a panic.
+//!
+//! Records follow MS-WMF and MS-EMF. Rectangle clip regions (`INTERSECTCLIPRECT`,
+//! `EXCLUDECLIPRECT`, `EXTSELECTCLIPRGN`) limit what later records draw. Records outside the
+//! supported set are skipped silently.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+#![forbid(unsafe_code)]
+
+mod bytes;
+mod canvas;
+mod clip;
+mod cliprect;
+mod dib;
+mod emf;
+mod emfplus;
+mod geom;
+mod place;
+mod text;
+mod wmf;
+
+#[cfg(test)]
+mod tests;
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use bytes::Bytes;
+use canvas::Raw;
+use geom::{Op, P};
+pub use place::{MAX_BITMAP_SIDE, PlacedItem};
+pub use text::{Font, HAlign, SYMBOL_CHARSET, Text, VAlign};
+
+/// Items kept from one file. Past the cap the parse stops and keeps what it has.
+pub(crate) const MAX_ITEMS: usize = 200_000;
+/// Object table slots (WMF handles, EMF object indices).
+pub(crate) const MAX_OBJECTS: usize = 4096;
+/// Largest bitmap in pixels (about 40 megapixels, 160 MB of RGBA).
+pub(crate) const MAX_PIXELS: usize = 40_000_000;
+/// DC save-stack depth.
+pub(crate) const MAX_STACK: usize = 1024;
+/// Points in one open path bracket.
+pub(crate) const MAX_PATH_OPS: usize = 2_000_000;
+/// Bytes of path ops and pixels kept from one file (about 256 MB).
+pub(crate) const MAX_BYTES: usize = 256 * 1024 * 1024;
+
+/// A parsed metafile. Items use coordinates in `0..width` and `0..height`, y down.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Picture {
+    /// Size of the drawing in its own units: points for placeable WMF and EMF (from the frame), device
+    /// or logical units otherwise.
+    pub width: f32,
+    pub height: f32,
+    pub items: Vec<Item>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Item {
+    /// A filled and/or stroked path, in picture coordinates.
+    Path {
+        segs: Vec<Seg>,
+        fill: Option<[u8; 4]>,
+        /// Colour and width in picture units.
+        stroke: Option<([u8; 4], f32)>,
+        even_odd: bool,
+        /// Clip region in picture units, each rectangle `[x0, y0, x1, y1]`. None is the default clip.
+        region: Option<Vec<[f32; 4]>>,
+    },
+    /// A bitmap stretched into `rect` = `[x, y, w, h]` (picture units), RGBA8 rows top-down.
+    Bitmap {
+        rect: [f32; 4],
+        width: u32,
+        height: u32,
+        rgba: Vec<u8>,
+        /// Clip region in picture units. None is the default clip.
+        region: Option<Vec<[f32; 4]>>,
+    },
+    /// A path filled with a repeating tile (pattern and hatch brushes). Items filled with the same
+    /// brush share its tile.
+    Pattern {
+        segs: Vec<Seg>,
+        even_odd: bool,
+        tile: Arc<Tile>,
+        /// Clip region in picture units. None is the default clip.
+        region: Option<Vec<[f32; 4]>>,
+    },
+    /// A text string.
+    Text(Box<Text>),
+}
+
+/// A brush tile: RGBA8 rows top-down (transparent where the brush leaves the background), each
+/// pixel `cell` picture units, with a tile's top-left corner at `origin`.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Tile {
+    pub width: u32,
+    pub height: u32,
+    pub rgba: Vec<u8>,
+    pub cell: [f32; 2],
+    pub origin: [f32; 2],
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Seg {
+    Move(f32, f32),
+    Line(f32, f32),
+    Cubic(f32, f32, f32, f32, f32, f32),
+    Close,
+}
+
+#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq)]
+pub enum Error {
+    #[error("not a WMF or EMF file")]
+    NotMetafile,
+    #[error("metafile header is truncated or invalid")]
+    BadHeader,
+    #[error("metafile has no readable records")]
+    NoRecords,
+}
+
+/// The picture frame in device units (`rect` = `[x, y, w, h]`) and, when the file states one, its
+/// size in picture units.
+pub(crate) struct Frame {
+    pub rect: [f64; 4],
+    pub size: Option<(f64, f64)>,
+}
+
+/// Parses a WMF (placeable or plain) or EMF file.
+pub fn parse(bytes: &[u8]) -> Result<Picture, Error> {
+    let b = Bytes(bytes);
+    let (cv, frame) = if emf::is_emf(b) {
+        emf::parse(b)?
+    } else if wmf::is_wmf(b) {
+        // A WMF converted from an EMF can carry the original in MFCOMMENT escapes; PowerPoint draws
+        // the WMF's own records (its dx rounding shows), so the copy is not used.
+        wmf::parse(b)?
+    } else {
+        return Err(Error::NotMetafile);
+    };
+    Ok(build(cv.items, frame))
+}
+
+/// True when the bytes start like a WMF (placeable or plain header) or an EMF.
+pub fn is_metafile(bytes: &[u8]) -> bool {
+    let b = Bytes(bytes);
+    emf::is_emf(b) || wmf::is_wmf(b)
+}
+
+/// Maps device-space output into the picture frame. Without a usable frame the frame is the bounding
+/// box of the drawing, so the origin is still the top-left of what was drawn.
+fn build(raw: Vec<Raw>, frame: Option<Frame>) -> Picture {
+    let frame = frame.filter(|f| f.rect.iter().all(|v| v.is_finite()) && f.rect[2] > 0.0 && f.rect[3] > 0.0);
+    let (rect, size) = match frame {
+        Some(f) => (f.rect, f.size.unwrap_or((f.rect[2], f.rect[3]))),
+        None => match bbox(&raw) {
+            Some([x0, y0, x1, y1]) => ([x0, y0, x1 - x0, y1 - y0], (x1 - x0, y1 - y0)),
+            None => return Picture { width: 0.0, height: 0.0, items: Vec::new() },
+        },
+    };
+    let sx = if rect[2] > 0.0 { size.0 / rect[2] } else { 1.0 };
+    let sy = if rect[3] > 0.0 { size.1 / rect[3] } else { 1.0 };
+    let tf = move |p: P| ((p.0 - rect[0]) * sx, (p.1 - rect[1]) * sy);
+    let stroke_scale = (sx + sy) / 2.0;
+    // No stroke is wider than the picture's diagonal: anything wider is a mapping artefact.
+    let diag = size.0.hypot(size.1);
+    // Tiles shared by several fills stay shared.
+    let mut tiles: HashMap<*const canvas::RawTile, (Arc<canvas::RawTile>, Arc<Tile>)> = HashMap::new();
+    let items = raw.into_iter().filter_map(|r| match r {
+        Raw::Path { ops, fill, stroke, even_odd, region } => {
+            let segs = ops.iter().map(|op| seg(op, tf)).collect::<Option<Vec<Seg>>>()?;
+            if segs.len() < 2 {
+                return None;
+            }
+            let stroke = stroke.and_then(|(c, w)| Some((c, f((w * stroke_scale).min(diag))?)));
+            Some(Item::Path { segs, fill, stroke, even_odd, region: map_region(region, &tf)? })
+        }
+        Raw::Bitmap { rect: r, img, region } => {
+            let (x, y) = tf((r[0], r[1]));
+            let rect = [f(x)?, f(y)?, f(r[2] * sx)?, f(r[3] * sy)?];
+            Some(Item::Bitmap { rect, width: img.w as u32, height: img.h as u32, rgba: img.px, region: map_region(region, &tf)? })
+        }
+        Raw::Pattern { ops, even_odd, tile, region } => {
+            let segs = ops.iter().map(|op| seg(op, tf)).collect::<Option<Vec<Seg>>>()?;
+            if segs.len() < 2 {
+                return None;
+            }
+            let key = Arc::as_ptr(&tile);
+            let tile = match tiles.get(&key) {
+                Some((_, t)) => t.clone(),
+                None => {
+                    let (ox, oy) = tf((0.0, 0.0));
+                    let t = Arc::new(Tile {
+                        width: u32::try_from(tile.w).ok()?,
+                        height: u32::try_from(tile.h).ok()?,
+                        rgba: tile.px.clone(),
+                        cell: [f(tile.cell * sx)?, f(tile.cell * sy)?],
+                        origin: [f(ox)?, f(oy)?],
+                    });
+                    // The raw tile is kept with its key, so the address is never reused by another.
+                    tiles.insert(key, (tile.clone(), t.clone()));
+                    t
+                }
+            };
+            Some(Item::Pattern { segs, even_odd, tile, region: map_region(region, &tf)? })
+        }
+        Raw::Text { mut text, region } => {
+            // Device to picture: scale by (sx, sy) after moving the frame's corner to the origin.
+            let [a, b, c, d, e, g] = text.transform;
+            let (e, g) = tf((e, g));
+            text.transform = [a * sx, b * sy, c * sx, d * sy, e, g];
+            if !text.transform.iter().all(|v| v.is_finite()) {
+                return None;
+            }
+            if let Some([x0, y0, x1, y1]) = text.clip {
+                let (p, q) = (tf((f64::from(x0), f64::from(y0))), tf((f64::from(x1), f64::from(y1))));
+                text.clip = Some([f(p.0.min(q.0))?, f(p.1.min(q.1))?, f(p.0.max(q.0))?, f(p.1.max(q.1))?]);
+            }
+            text.region = map_region(region, &tf)?;
+            Some(Item::Text(text))
+        }
+    });
+    let items = items.collect();
+    Picture { width: f(size.0).unwrap_or(0.0), height: f(size.1).unwrap_or(0.0), items }
+}
+
+fn map_region(region: Option<Vec<[f64; 4]>>, tf: &impl Fn(P) -> P) -> Option<Option<Vec<[f32; 4]>>> {
+    let Some(rects) = region else { return Some(None) };
+    let mut out = Vec::with_capacity(rects.len());
+    for [x0, y0, x1, y1] in rects {
+        let (p, q) = (tf((x0, y0)), tf((x1, y1)));
+        out.push([f(p.0.min(q.0))?, f(p.1.min(q.1))?, f(p.0.max(q.0))?, f(p.1.max(q.1))?]);
+    }
+    Some(Some(out))
+}
+
+fn f(v: f64) -> Option<f32> {
+    let v = v as f32;
+    v.is_finite().then_some(v)
+}
+
+fn seg(op: &Op, tf: impl Fn(P) -> P) -> Option<Seg> {
+    let pt = |p: P| {
+        let (x, y) = tf(p);
+        Some((f(x)?, f(y)?))
+    };
+    Some(match *op {
+        Op::M(p) => {
+            let (x, y) = pt(p)?;
+            Seg::Move(x, y)
+        }
+        Op::L(p) => {
+            let (x, y) = pt(p)?;
+            Seg::Line(x, y)
+        }
+        Op::C(a, b, c) => {
+            let (x1, y1) = pt(a)?;
+            let (x2, y2) = pt(b)?;
+            let (x3, y3) = pt(c)?;
+            Seg::Cubic(x1, y1, x2, y2, x3, y3)
+        }
+        Op::Z => Seg::Close,
+    })
+}
+
+/// Bounding box `[x0, y0, x1, y1]` over the finite points of the output.
+fn bbox(raw: &[Raw]) -> Option<[f64; 4]> {
+    let mut b: Option<[f64; 4]> = None;
+    let mut grow = |p: P| {
+        if p.0.is_finite() && p.1.is_finite() {
+            b = Some(match b {
+                None => [p.0, p.1, p.0, p.1],
+                Some([x0, y0, x1, y1]) => [x0.min(p.0), y0.min(p.1), x1.max(p.0), y1.max(p.1)],
+            });
+        }
+    };
+    for r in raw {
+        match r {
+            Raw::Path { ops, .. } | Raw::Pattern { ops, .. } => {
+                for op in ops {
+                    match *op {
+                        Op::M(p) | Op::L(p) => grow(p),
+                        Op::C(a, c, d) => {
+                            grow(a);
+                            grow(c);
+                            grow(d);
+                        }
+                        Op::Z => {}
+                    }
+                }
+            }
+            Raw::Bitmap { rect, .. } => {
+                grow((rect[0], rect[1]));
+                grow((rect[0] + rect[2], rect[1] + rect[3]));
+            }
+            Raw::Text { text: t, .. } => grow((t.transform[4], t.transform[5])),
+        }
+    }
+    b
+}
@@ -0,0 +1,195 @@
+//! Placing a picture on a target (a page or a device): the fitted transform, paths as kurbo paths in
+//! target units and bitmaps as target rectangles. The rasteriser and the PDF writer only paint the result.
+
+use std::sync::Arc;
+
+use kurbo::{Affine, BezPath, Rect, Shape};
+
+use crate::{Item, Picture, Seg};
+
+/// Largest bitmap side the renderers draw: within the PDF image limit and the rasteriser's 16-bit sides.
+pub const MAX_BITMAP_SIDE: u32 = 30_000;
+/// Placed coordinates past this (target units) are far off any page; such items are left out.
+const MAX_COORD: f64 = 1e6;
+/// Smallest placed bitmap side (target units), so the stretch onto it is never singular.
+const MIN_BITMAP_SIDE: f64 = 1e-6;
+/// Maximum aggregate path elements retained in placed output.
+const MAX_PLACED_ELEMENTS: usize = 500_000;
+
+/// One item of a placed picture, in target units.
+pub enum PlacedItem {
+    /// A filled and/or stroked path. The stroke width is in target units; 0 is a cosmetic hairline that
+    /// the renderer draws at its minimum width.
+    Path { path: BezPath, fill: Option<[u8; 4]>, stroke: Option<([u8; 4], f64)>, even_odd: bool, region: Option<Arc<BezPath>> },
+    /// `Picture::items[index]`, a bitmap, stretched into `rect`.
+    Bitmap { index: usize, rect: Rect, region: Option<Arc<BezPath>> },
+    /// `Picture::items[index]`, a pattern fill: `path` (target units) filled with the item's tile
+    /// repeated; `tile` maps tile pixels to target units.
+    Pattern { index: usize, path: BezPath, even_odd: bool, tile: Affine, region: Option<Arc<BezPath>> },
+    /// `Picture::items[index]`, a text string: `transform` maps its text space to target units;
+    /// `clip` (target units) bounds what it draws. `region` is the device-context clip.
+    Text { index: usize, transform: Affine, clip: Option<Rect>, region: Option<Arc<BezPath>> },
+}
+
+impl Picture {
+    /// Whether the picture has a finite, positive size, so it can be fitted into a frame.
+    pub fn has_size(&self) -> bool {
+        self.width.is_finite() && self.height.is_finite() && self.width > 0.0 && self.height > 0.0
+    }
+
+    /// The transform that fits the picture into `r` with the crop fractions `crop` (left, top, right,
+    /// bottom) removed first: the visible part fills `r`. None for a degenerate size.
+    pub fn fit(&self, r: Rect, crop: [f32; 4]) -> Option<Affine> {
+        let [cl, ct, cr, cb] = crop.map(|v| if v.is_finite() { f64::from(v.clamp(0.0, 0.95)) } else { 0.0 });
+        let (w, h) = (f64::from(self.width), f64::from(self.height));
+        let sx = r.width() / (w * (1.0 - cl - cr).max(0.05));
+        let sy = r.height() / (h * (1.0 - ct - cb).max(0.05));
+        (sx.is_finite() && sy.is_finite() && sx > 0.0 && sy > 0.0)
+            .then(|| Affine::translate((r.x0 - cl * w * sx, r.y0 - ct * h * sy)) * Affine::scale_non_uniform(sx, sy))
+    }
+
+    /// The items placed into `r` with `crop` applied. Items that are not finite or reach past ±1e6
+    /// target units are left out (they are far off any page), as are bitmaps with no area. Stroke
+    /// widths are scaled to target units (along the mean axis scale, so a non-uniform fit keeps
+    /// strokes even).
+    pub fn place(&self, r: Rect, crop: [f32; 4]) -> Vec<PlacedItem> {
+        let Some(tf) = self.fit(r, crop) else { return Vec::new() };
+        let c = tf.as_coeffs();
+        let k = (c[0].abs() + c[3].abs()) / 2.0;
+        let mut out = Vec::with_capacity(self.items.len());
+        let mut total_elements = 0usize;
+        let mut cached_region: Option<(*const [f32; 4], usize, Option<Option<Arc<BezPath>>>)> = None;
+        let mut get_region = |reg: &Option<Vec<[f32; 4]>>| -> Option<Option<Arc<BezPath>>> {
+            let (ptr, len) = match reg {
+                None => (std::ptr::null(), 0),
+                Some(v) => (v.as_ptr(), v.len()),
+            };
+            if let Some((c_ptr, c_len, ref res)) = cached_region
+                && c_ptr == ptr
+                && c_len == len
+            {
+                return res.clone();
+            }
+            let res = placed_region(&tf, reg);
+            cached_region = Some((ptr, len, res.clone()));
+            res
+        };
+
+        for (index, item) in self.items.iter().enumerate() {
+            if total_elements >= MAX_PLACED_ELEMENTS {
+                break;
+            }
+            match item {
+                Item::Path { segs, fill, stroke, even_odd, region } => {
+                    let path = tf * bez(segs);
+                    let Some(region) = get_region(region) else { continue };
+                    if in_range(path.bounding_box()) {
+                        total_elements = total_elements.saturating_add(path.elements().len());
+                        let stroke = stroke.map(|(c, w)| (c, f64::from(w) * k));
+                        out.push(PlacedItem::Path { path, fill: *fill, stroke, even_odd: *even_odd, region });
+                    }
+                }
+                Item::Pattern { segs, even_odd, tile: t, region } => {
+                    let path = tf * bez(segs);
+                    let Some(region) = get_region(region) else { continue };
+                    let tile = tf
+                        * Affine::translate((f64::from(t.origin[0]), f64::from(t.origin[1])))
+                        * Affine::scale_non_uniform(f64::from(t.cell[0]), f64::from(t.cell[1]));
+                    let det = tile.determinant();
+                    if in_range(path.bounding_box()) && det.is_finite() && det.abs() > 1e-12 {
+                        total_elements = total_elements.saturating_add(path.elements().len());
+                        out.push(PlacedItem::Pattern { index, path, even_odd: *even_odd, tile, region });
+                    }
+                }
+                Item::Text(t) => {
+                    let transform = tf * Affine::new(t.transform);
+                    let Some(region) = get_region(&t.region) else { continue };
+                    let clip =
+                        t.clip.map(|[x0, y0, x1, y1]| tf.transform_rect_bbox(Rect::new(f64::from(x0), f64::from(y0), f64::from(x1), f64::from(y1))));
+                    let c = transform.as_coeffs();
+                    let origin = Rect::new(c[4], c[5], c[4], c[5]);
+                    if in_range(origin) && c.iter().all(|v| v.is_finite() && v.abs() <= MAX_COORD) && clip.is_none_or(in_range) {
+                        out.push(PlacedItem::Text { index, transform, clip, region });
+                    }
+                }
+                Item::Bitmap { rect: [x, y, w, h], region, .. } => {
+                    let (x0, y0) = (f64::from(*x), f64::from(*y));
+                    let rect = tf.transform_rect_bbox(Rect::new(x0, y0, x0 + f64::from(*w), y0 + f64::from(*h)));
+                    let Some(region) = get_region(region) else { continue };
+                    if in_range(rect) && rect.width() > MIN_BITMAP_SIDE && rect.height() > MIN_BITMAP_SIDE {
+                        out.push(PlacedItem::Bitmap { index, rect, region });
+                    }
+                }
+            }
+        }
+        out
+    }
+}
+
+impl Item {
+    /// Takes a bitmap's pixels out of the item (its geometry stays) and returns them as (width, height,
+    /// RGBA) when a renderer can draw them: both sides in 1..=[`MAX_BITMAP_SIDE`] and exactly that many
+    /// pixels. None for paths and for bitmaps that cannot be drawn.
+    pub fn take_pixels(&mut self) -> Option<(u32, u32, Vec<u8>)> {
+        let Item::Bitmap { width, height, rgba, .. } = self else { return None };
+        let (w, h, px) = (*width, *height, std::mem::take(rgba));
+        let sides = (1..=MAX_BITMAP_SIDE).contains(&w) && (1..=MAX_BITMAP_SIDE).contains(&h);
+        (sides && px.len() == (w as usize).saturating_mul(h as usize).saturating_mul(4)).then_some((w, h, px))
+    }
+}
+
+/// The device-context clip in target units. `Some(None)` is the default clip. `None` means the
+/// region does not meet the page, so the item draws nothing.
+fn placed_region(tf: &Affine, region: &Option<Vec<[f32; 4]>>) -> Option<Option<Arc<BezPath>>> {
+    let Some(rects) = region else { return Some(None) };
+    let mut path = BezPath::new();
+    for [x0, y0, x1, y1] in rects {
+        let r = tf.transform_rect_bbox(Rect::new(f64::from(*x0), f64::from(*y0), f64::from(*x1), f64::from(*y1)));
+        if in_range(r) && r.width() > 1e-9 && r.height() > 1e-9 {
+            path.extend(r.to_path(0.1));
+        }
+    }
+    (!path.is_empty()).then_some(Some(Arc::new(path)))
+}
+
+/// Segments as a kurbo path. A segment after a close opens a new subpath at the last start point.
+fn bez(segs: &[Seg]) -> BezPath {
+    let mut p = BezPath::new();
+    let mut start = (0.0, 0.0);
+    let mut open = false;
+    for s in segs {
+        match *s {
+            Seg::Move(x, y) => {
+                start = (f64::from(x), f64::from(y));
+                p.move_to(start);
+                open = true;
+            }
+            Seg::Line(x, y) => {
+                if !open {
+                    p.move_to(start);
+                }
+                p.line_to((f64::from(x), f64::from(y)));
+                open = true;
+            }
+            Seg::Cubic(a, b, c, d, e, f) => {
+                if !open {
+                    p.move_to(start);
+                }
+                p.curve_to((f64::from(a), f64::from(b)), (f64::from(c), f64::from(d)), (f64::from(e), f64::from(f)));
+                open = true;
+            }
+            Seg::Close => {
+                if open {
+                    p.close_path();
+                }
+                open = false;
+            }
+        }
+    }
+    p
+}
+
+/// Whether a placed box is finite and within ±[`MAX_COORD`].
+fn in_range(b: Rect) -> bool {
+    [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() < MAX_COORD)
+}
@@ -0,0 +1,203 @@
+//! Text records: the font (LOGFONT), the text string decoded from its character set, and the
+//! neutral [`Text`] item. The metafile crate knows no fonts, so measuring, alignment against the
+//! font's metrics and glyph drawing are left to the renderer.
+
+/// A font chosen by a CREATEFONTINDIRECT record (MS-WMF 2.2.1.2 Font, MS-EMF 2.2.13 LogFont).
+#[derive(Debug, Clone, PartialEq, Default)]
+pub struct Font {
+    /// The face name the file asks for (`"Arial"`, `"Wingdings"`); may be empty.
+    pub family: String,
+    /// LOGFONT height in text units: negative is the character (em) height, positive the cell
+    /// height (ascent plus descent), 0 the default size.
+    pub height: f32,
+    /// Average character width in text units; 0 keeps the font's own proportions.
+    pub width: f32,
+    /// 100..=900 (400 regular, 700 bold); 0 is the default weight.
+    pub weight: u16,
+    pub italic: bool,
+    pub underline: bool,
+    pub strike: bool,
+    /// LOGFONT character set (0 ANSI, 2 SYMBOL, 238 EASTEUROPE…).
+    pub charset: u8,
+}
+
+/// SYMBOL_CHARSET: byte codes are the font's own symbol codes.
+pub const SYMBOL_CHARSET: u8 = 2;
+
+/// Where the reference point sits on the string horizontally (TA_LEFT, TA_CENTER, TA_RIGHT).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum HAlign {
+    #[default]
+    Left,
+    Center,
+    Right,
+}
+
+/// Where the reference point sits vertically (TA_TOP, TA_BASELINE, TA_BOTTOM): the top of the
+/// character cell, the baseline or the bottom of the cell.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum VAlign {
+    #[default]
+    Top,
+    Baseline,
+    Bottom,
+}
+
+/// One string drawn by EXTTEXTOUT, TEXTOUT or SMALLTEXTOUT.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Text {
+    /// Text space to picture space as affine coefficients `[a, b, c, d, e, f]` (`x' = a·x + c·y + e`,
+    /// `y' = b·x + d·y + f`, kurbo's order). Text space has x along the baseline and y down, in the
+    /// metafile's logical units, with the reference point at the origin. Escapement and the
+    /// mapping are folded in; glyphs are never mirrored.
+    pub transform: [f64; 6],
+    pub text: String,
+    /// Advance after each character of `text`, in text units (the dx array). Empty when the file
+    /// gives none: the font's own advances apply.
+    pub dx: Vec<f32>,
+    pub font: Font,
+    pub color: [u8; 4],
+    /// Colour filled behind the character cells (OPAQUE background mode); None when transparent.
+    pub background: Option<[u8; 4]>,
+    pub h_align: HAlign,
+    pub v_align: VAlign,
+    /// Clip rectangle `[x0, y0, x1, y1]` in picture units (ETO_CLIPPED).
+    pub clip: Option<[f32; 4]>,
+    /// Clip region from the device context, in picture units. None is the default clip. Drawn
+    /// together with [`Text::clip`] when both are set.
+    pub region: Option<Vec<[f32; 4]>>,
+}
+
+/// TA_UPDATECP: the string starts at the current position, which moves past it.
+pub(crate) const TA_UPDATECP: u32 = 0x0001;
+/// ETO_OPAQUE fills the rectangle with the background colour; ETO_CLIPPED clips the text to it.
+pub(crate) const ETO_OPAQUE: u32 = 0x0002;
+pub(crate) const ETO_CLIPPED: u32 = 0x0004;
+/// The string holds glyph indices, not characters (drawn only when the font matches).
+pub(crate) const ETO_GLYPH_INDEX: u32 = 0x0010;
+/// The dx array holds (dx, dy) pairs.
+pub(crate) const ETO_PDY: u32 = 0x2000;
+/// Longest string kept from one record.
+pub(crate) const MAX_CHARS: usize = 16_384;
+
+/// Horizontal and vertical alignment from a TA_* word (the vertical bits are 0 top, 8 bottom,
+/// 24 baseline; the horizontal ones 0 left, 2 right, 6 center).
+pub(crate) fn align(ta: u32) -> (HAlign, VAlign) {
+    let h = match ta & 0x06 {
+        6 => HAlign::Center,
+        2 => HAlign::Right,
+        _ => HAlign::Left,
+    };
+    let v = match ta & 0x18 {
+        0x18 => VAlign::Baseline,
+        0x08 => VAlign::Bottom,
+        _ => VAlign::Top,
+    };
+    (h, v)
+}
+
+/// Decodes 8-bit text in `charset` to one character per byte, and merges `dx` to match: a
+/// double-byte character set's lead and trail bytes become one blank (its glyphs are not
+/// decoded) whose advance is the sum of both. `dx` may be empty.
+pub(crate) fn decode_bytes(bytes: &[u8], charset: u8, dx: &[f32]) -> (String, Vec<f32>) {
+    let mut s = String::with_capacity(bytes.len());
+    let mut out_dx = Vec::with_capacity(dx.len().min(bytes.len()));
+    let dbcs = matches!(charset, 128 | 129 | 130 | 134 | 136);
+    let mut i = 0;
+    while let Some(&b) = bytes.get(i) {
+        let n = if dbcs && b >= 0x81 && i + 1 < bytes.len() { 2 } else { 1 };
+        let c = if n == 2 { ' ' } else { byte_char(b, charset) };
+        s.push(c);
+        if !dx.is_empty() {
+            out_dx.push((i..i + n).filter_map(|k| dx.get(k)).sum());
+        }
+        i += n;
+    }
+    (s, out_dx)
+}
+
+/// UTF-16 text to a string with one dx entry per character: a surrogate pair takes the sum of
+/// its two advances. Unpaired surrogates become U+FFFD.
+pub(crate) fn decode_utf16(units: &[u16], dx: &[f32]) -> (String, Vec<f32>) {
+    let mut s = String::with_capacity(units.len());
+    let mut out_dx = Vec::with_capacity(dx.len().min(units.len()));
+    let mut i = 0;
+    for r in char::decode_utf16(units.iter().copied()) {
+        let c = r.unwrap_or(char::REPLACEMENT_CHARACTER);
+        let n = c.len_utf16();
+        s.push(c);
+        if !dx.is_empty() {
+            out_dx.push((i..i + n).filter_map(|k| dx.get(k)).sum());
+        }
+        i += n;
+    }
+    (s, out_dx)
+}
+
+/// One byte in a single-byte Windows code page. Symbol fonts keep their codes in the private-use
+/// range (U+F000 + code), where symbol fonts map them.
+fn byte_char(b: u8, charset: u8) -> char {
+    if b < 0x80 && charset != SYMBOL_CHARSET {
+        return char::from(b);
+    }
+    let cp = match charset {
+        SYMBOL_CHARSET => 0xF000 | u32::from(b),
+        238 => high(b, &CP1250),
+        204 => high(b, &CP1251),
+        _ => high(b, &CP1252),
+    };
+    char::from_u32(cp).unwrap_or(char::REPLACEMENT_CHARACTER)
+}
+
+/// The code point of byte `b` (0x80..=0xFF) from a table of the upper half; 0 entries are
+/// undefined bytes, drawn as U+FFFD.
+fn high(b: u8, table: &[u16; 128]) -> u32 {
+    match table.get(usize::from(b.wrapping_sub(0x80))) {
+        Some(0) | None => 0xFFFD,
+        Some(v) => u32::from(*v),
+    }
+}
+
+/// Windows-1252 (Western) 0x80..=0xFF: the upper half of Latin-1 with typographic marks in 0x80..=0x9F.
+const CP1252: [u16; 128] = {
+    let mut t = [0u16; 128];
+    let low: [u16; 32] = [
+        0x20AC, 0, 0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021, 0x02C6, 0x2030, 0x0160, 0x2039, 0x0152, 0, 0x017D, 0, 0, 0x2018, 0x2019, 0x201C,
+        0x201D, 0x2022, 0x2013, 0x2014, 0x02DC, 0x2122, 0x0161, 0x203A, 0x0153, 0, 0x017E, 0x0178,
+    ];
+    let mut i = 0;
+    while i < 128 {
+        t[i] = if i < 32 { low[i] } else { 0x80 + i as u16 };
+        i += 1;
+    }
+    t
+};
+
+/// Windows-1250 (Central European) 0x80..=0xFF.
+const CP1250: [u16; 128] = [
+    0x20AC, 0, 0x201A, 0, 0x201E, 0x2026, 0x2020, 0x2021, 0, 0x2030, 0x0160, 0x2039, 0x015A, 0x0164, 0x017D, 0x0179, //
+    0, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0, 0x2122, 0x0161, 0x203A, 0x015B, 0x0165, 0x017E, 0x017A, //
+    0x00A0, 0x02C7, 0x02D8, 0x0141, 0x00A4, 0x0104, 0x00A6, 0x00A7, 0x00A8, 0x00A9, 0x015E, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x017B, //
+    0x00B0, 0x00B1, 0x02DB, 0x0142, 0x00B4, 0x00B5, 0x00B6, 0x00B7, 0x00B8, 0x0105, 0x015F, 0x00BB, 0x013D, 0x02DD, 0x013E, 0x017C, //
+    0x0154, 0x00C1, 0x00C2, 0x0102, 0x00C4, 0x0139, 0x0106, 0x00C7, 0x010C, 0x00C9, 0x0118, 0x00CB, 0x011A, 0x00CD, 0x00CE, 0x010E, //
+    0x0110, 0x0143, 0x0147, 0x00D3, 0x00D4, 0x0150, 0x00D6, 0x00D7, 0x0158, 0x016E, 0x00DA, 0x0170, 0x00DC, 0x00DD, 0x0162, 0x00DF, //
+    0x0155, 0x00E1, 0x00E2, 0x0103, 0x00E4, 0x013A, 0x0107, 0x00E7, 0x010D, 0x00E9, 0x0119, 0x00EB, 0x011B, 0x00ED, 0x00EE, 0x010F, //
+    0x0111, 0x0144, 0x0148, 0x00F3, 0x00F4, 0x0151, 0x00F6, 0x00F7, 0x0159, 0x016F, 0x00FA, 0x0171, 0x00FC, 0x00FD, 0x0163, 0x02D9,
+];
+
+/// Windows-1251 (Cyrillic) 0x80..=0xFF; 0xC0..=0xFF are А..я in order.
+const CP1251: [u16; 128] = {
+    let low: [u16; 64] = [
+        0x0402, 0x0403, 0x201A, 0x0453, 0x201E, 0x2026, 0x2020, 0x2021, 0x20AC, 0x2030, 0x0409, 0x2039, 0x040A, 0x040C, 0x040B, 0x040F, //
+        0x0452, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0, 0x2122, 0x0459, 0x203A, 0x045A, 0x045C, 0x045B, 0x045F, //
+        0x00A0, 0x040E, 0x045E, 0x0408, 0x00A4, 0x0490, 0x00A6, 0x00A7, 0x0401, 0x00A9, 0x0404, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x0407, //
+        0x00B0, 0x00B1, 0x0406, 0x0456, 0x0491, 0x00B5, 0x00B6, 0x00B7, 0x0451, 0x2116, 0x0454, 0x00BB, 0x0458, 0x0405, 0x0455, 0x0457,
+    ];
+    let mut t = [0u16; 128];
+    let mut i = 0;
+    while i < 128 {
+        t[i] = if i < 64 { low[i] } else { 0x0410 + (i as u16 - 64) };
+        i += 1;
+    }
+    t
+};
@@ -0,0 +1,383 @@
+//! WMF reader (MS-WMF). A file is an optional 22-byte placeable header, a 9-word standard header, then
+//! records of (size in 16-bit words, function, parameters). Parameters are read at byte 6 of each record.
+
+use std::sync::Arc;
+
+use crate::bytes::Bytes;
+use crate::canvas::{BS_HATCHED, Brush, Canvas, LogFont, Obj, Pen, colorref};
+use crate::dib;
+use crate::geom::{self, ArcKind, P};
+use crate::text::{ETO_CLIPPED, ETO_OPAQUE, Font, MAX_CHARS, decode_bytes};
+use crate::{Error, Frame, MAX_PATH_OPS};
+
+const PLACEABLE_KEY: u32 = 0x9AC6_CDD7;
+const DEFAULT_INCH: f64 = 1440.0;
+/// A placeable WMF plays into a target sized in points; brushes are laid out in 96-dpi pixels.
+const PT_PER_PX: f64 = 72.0 / 96.0;
+
+pub(crate) fn is_wmf(b: Bytes) -> bool {
+    if b.u32(0) == Some(PLACEABLE_KEY) {
+        return true;
+    }
+    matches!(b.u16(0), Some(1 | 2)) && b.u16(2) == Some(9) && matches!(b.u16(4), Some(0x100 | 0x300))
+}
+
+/// Reads all records. Returns the drawing state and the picture frame, or an error when no record
+/// could be read at all.
+pub(crate) fn parse(input: Bytes) -> Result<(Canvas, Option<Frame>), Error> {
+    let placeable = input.u32(0) == Some(PLACEABLE_KEY);
+    // Placeable bounds: logical corners (left, top, right, bottom) and their size in points.
+    let (hdr, bounds) = if placeable {
+        let [l, t, r, b] = [6, 8, 10, 12].map(|o| input.i16(o).map(f64::from));
+        let (Some(l), Some(t), Some(r), Some(b)) = (l, t, r, b) else { return Err(Error::BadHeader) };
+        let inch = input.u16(14).filter(|v| *v > 0).map_or(DEFAULT_INCH, f64::from);
+        let (w, h) = (r - l, b - t);
+        let bounds = (w > 0.0 && h > 0.0).then_some(([l, t, r, b], (w * 72.0 / inch, h * 72.0 / inch)));
+        (22, bounds)
+    } else {
+        (0, None)
+    };
+    let hsize = input.u16(hdr + 2).ok_or(Error::BadHeader)? as usize;
+    if hsize < 9 {
+        return Err(Error::BadHeader);
+    }
+    let mut pos = hdr.checked_add(hsize.checked_mul(2).ok_or(Error::BadHeader)?).ok_or(Error::BadHeader)?;
+    // Played into a target like Word does: the placeable bounds are the first window, the target (the
+    // picture size) the viewport. A plain WMF's target is its first window.
+    let mut cv = Canvas::new();
+    if let Some((c, size)) = bounds {
+        cv.play_into(Some([c[0], c[1], c[2] - c[0], c[3] - c[1]]), size);
+        cv.set_clip_surface([0.0, 0.0, size.0, size.1]);
+        cv.pattern_px = PT_PER_PX;
+    }
+    let mut player_viewport = bounds.is_some();
+    let mut parsed = 0usize;
+    while !cv.full() {
+        let (Some(words), Some(func)) = (input.u32(pos), pos.checked_add(4).and_then(|o| input.u16(o))) else { break };
+        let Some(len) = (words as usize).checked_mul(2).filter(|l| *l >= 6) else { break };
+        let Some(rec) = input.slice(pos, len) else { break };
+        if func == 0 {
+            break;
+        }
+        record(&mut cv, func, Bytes(rec));
+        if func == 0x020C && cv.window_set && !player_viewport && !cv.viewport_set {
+            let we = cv.map.window_ext();
+            cv.play_into(None, (we.0.abs(), we.1.abs()));
+            player_viewport = true;
+        }
+        parsed += 1;
+        let Some(next) = pos.checked_add(len) else { break };
+        pos = next;
+    }
+    if parsed == 0 {
+        return Err(Error::NoRecords);
+    }
+    let frame = match bounds {
+        // Played into its target: the frame is the target.
+        Some((_, size)) if !cv.viewport_set && cv.map.uses_extents() => Some(Frame { rect: [0.0, 0.0, size.0, size.1], size: Some(size) }),
+        // The file set its own viewport, so the drawing is in its device units and the logical bounds
+        // go through the final mapping.
+        Some((c, size)) => {
+            let (a, b) = (cv.map.device((c[0], c[1])), cv.map.device((c[2], c[3])));
+            let rect = [a.0.min(b.0), a.1.min(b.1), (b.0 - a.0).abs(), (b.1 - a.1).abs()];
+            (rect[2] > 0.0 && rect[3] > 0.0).then_some(Frame { rect, size: Some(size) })
+        }
+        None if player_viewport && !cv.viewport_set && cv.map.uses_extents() => {
+            let ve = cv.map.viewport_ext();
+            Some(Frame { rect: [0.0, 0.0, ve.0, ve.1], size: None })
+        }
+        None if cv.window_set => Some(Frame { rect: cv.map.window_rect(), size: None }),
+        None => None,
+    };
+    Ok((cv, frame))
+}
+
+fn record(cv: &mut Canvas, func: u16, r: Bytes) {
+    if cv.full() {
+        return;
+    }
+    let _ = match func {
+        0x0103 => r.u16(6).map(|m| cv.set_map_mode(u32::from(m))),
+        0x0106 => r.u16(6).map(|m| cv.set_polyfill(u32::from(m))),
+        0x0104 => r.u16(6).map(|m| cv.set_rop2(u32::from(m))),
+        // Y is stored before X in these records.
+        0x020B => xy16(r, 6).map(|p| cv.set_window_org(p)),
+        0x020C => xy16(r, 6).map(|p| cv.set_window_ext(p)),
+        0x020D => xy16(r, 6).map(|p| cv.set_viewport_org(p)),
+        0x020E => xy16(r, 6).map(|p| cv.set_viewport_ext(p)),
+        0x001E => {
+            cv.save_dc();
+            Some(())
+        }
+        0x0127 => r.i16(6).map(|n| cv.restore_dc(i32::from(n))),
+        0x0214 => xy16(r, 6).map(|p| cv.move_to(p)),
+        0x0213 => xy16(r, 6).map(|p| cv.line_to(p)),
+        0x0325 => counted_points(r).map(|pts| cv.poly(&pts, false, false, true)),
+        0x0324 => counted_points(r).map(|pts| cv.poly(&pts, true, true, true)),
+        0x0538 => polypolygon(r).map(|ops| cv.shape(&ops, true, true)),
+        0x041B => rect16(r, 6).map(|[l, t, rr, b]| cv.shape(&geom::rect(l, t, rr, b), true, true)),
+        0x061C => {
+            let [ew, eh] = [r.i16(8), r.i16(6)];
+            let (Some(ew), Some(eh)) = (ew, eh) else { return };
+            rect16(r, 10).map(|[l, t, rr, b]| {
+                cv.shape(&geom::round_rect(l, t, rr, b, f64::from(ew), f64::from(eh)), true, true);
+            })
+        }
+        0x0415 => rect16(r, 6).map(|rect| cv.exclude_clip_rect(rect)),
+        0x0416 => rect16(r, 6).map(|rect| cv.intersect_clip_rect(rect)),
+        0x0418 => rect16(r, 6).map(|[l, t, rr, b]| cv.shape(&geom::ellipse(l, t, rr, b), true, true)),
+        0x0817 | 0x081A | 0x0830 => arc16(r).map(|(bounds, s, e)| {
+            let kind = match func {
+                0x0817 => ArcKind::Arc,
+                0x081A => ArcKind::Pie,
+                _ => ArcKind::Chord,
+            };
+            let [l, t, rr, b] = bounds;
+            cv.shape(&geom::arc_shape(l, t, rr, b, s, e, kind), kind != ArcKind::Arc, true);
+        }),
+        0x02FA => create_pen(cv, r),
+        0x02FC => create_brush(cv, r),
+        0x02FB => {
+            let f = font(r).unwrap_or_default();
+            cv.add_object(None, Obj::Font(Arc::new(f)));
+            Some(())
+        }
+        0x0142 => {
+            // A pattern the reader cannot decode still takes its handle slot.
+            let b = dib_pattern_brush(r).map_or(Obj::Other, Obj::Brush);
+            cv.add_object(None, b);
+            Some(())
+        }
+        // Palettes, old-style pattern brushes and regions take a handle slot too, so later
+        // SELECTOBJECT handles count them; selecting one draws nothing.
+        0x00F7 | 0x01F9 | 0x06FF => {
+            cv.add_object(None, Obj::Other);
+            Some(())
+        }
+        0x0209 => r.u32(6).map(|c| cv.set_text_color(c)),
+        0x0201 => r.u32(6).map(|c| cv.set_bk_color(c)),
+        0x0102 => r.u16(6).map(|m| cv.set_bk_mode(u32::from(m))),
+        0x012E => r.u16(6).map(|a| cv.set_text_align(u32::from(a))),
+        0x0A32 => ext_text_out(cv, r),
+        0x0521 => text_out(cv, r),
+        // PATBLT: rop(4), height, width, y, x.
+        0x061D => r.u32(6).map(|rop| cv.fill_rop([i16s(r, 16), i16s(r, 14), i16s(r, 12), i16s(r, 10)], rop)),
+        0x012D => r.u16(6).map(|h| cv.select(wmf_handle(h))),
+        0x01F0 => r.u16(6).map(|h| cv.delete_object(u32::from(h))),
+        // STRETCHDIB: rop(4) usage(2) srcH srcW ySrc xSrc destH destW yDest xDest, then the DIB.
+        0x0F43 => {
+            let rop = r.u32(6).unwrap_or(0);
+            dib_blit(cv, r, 28, rop, [i16s(r, 26), i16s(r, 24), i16s(r, 22), i16s(r, 20)], [i16s(r, 18), i16s(r, 16), i16s(r, 14), i16s(r, 12)])
+        }
+        0x0B41 => dib_stretchblt(cv, r),
+        0x0940 => dib_bitblt(cv, r),
+        _ => Some(()),
+    };
+}
+
+/// A 16-bit WMF handle as a canvas object index: stock objects are `0x8000 | index`, which the
+/// canvas reads with the 32-bit stock flag.
+fn wmf_handle(h: u16) -> u32 {
+    let h = u32::from(h);
+    if h & 0x8000 != 0 { (h & 0x7FFF) | 0x8000_0000 } else { h }
+}
+
+/// An i16 field as f64; 0 past the end.
+fn i16s(r: Bytes, off: usize) -> f64 {
+    r.i16(off).map_or(0.0, f64::from)
+}
+
+/// CREATEPENINDIRECT: style, width (x, y), colour. Only the width's x component is used.
+fn create_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let style = r.u16(6)?;
+    let width = r.i16(8)?;
+    let color = r.u32(12)?;
+    cv.add_object(None, Obj::Pen(Pen { style: u32::from(style), width: f64::from(width), color: colorref(color) }));
+    Some(())
+}
+
+/// CREATEBRUSHINDIRECT: style, colour, hatch.
+fn create_brush(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let style = u32::from(r.u16(6)?);
+    let color = r.u32(8)?;
+    let mut b = Brush::new(style, colorref(color));
+    if style == BS_HATCHED {
+        b.hatch = u32::from(r.u16(12).unwrap_or(0));
+    }
+    cv.add_object(None, Obj::Brush(b));
+    Some(())
+}
+
+/// DIBCREATEPATTERNBRUSH: style, colour usage, then a DIB (MS-WMF 2.3.4.8). The DIB's own palette
+/// gives the colours; with DIB_PAL_COLORS (indices into a palette the reader does not keep) a
+/// monochrome DIB takes the text and background colours.
+fn dib_pattern_brush(r: Bytes) -> Option<Brush> {
+    let usage = r.u16(8)?;
+    let dib = r.tail(10)?;
+    let n = dib::info_len(dib)?;
+    let img = dib::decode(Bytes(dib.slice(0, n)?), dib.tail(n)?, false)?;
+    Brush::pattern(img, usage == 1)
+}
+
+/// Font object (MS-WMF 2.2.1.2): height, width, escapement, orientation, weight (i16 each), italic,
+/// underline, strike-out and charset bytes, three precision/quality bytes, pitch and family, then the
+/// face name (up to 32 bytes, NUL-terminated, in the font's character set).
+fn font(r: Bytes) -> Option<LogFont> {
+    let height = r.i16(6)?;
+    let width = r.i16(8).unwrap_or(0);
+    let escapement = r.i16(10).unwrap_or(0);
+    let weight = r.i16(14).unwrap_or(0);
+    let byte = |o: usize| r.0.get(o).copied().unwrap_or(0);
+    let charset = byte(19);
+    let name = r.0.get(24..).unwrap_or(&[]);
+    let name = name.get(..32).unwrap_or(name);
+    let name = name.split(|b| *b == 0).next().unwrap_or(&[]);
+    // Face names are plain ASCII in practice; other bytes go through the Western code page.
+    let (family, _) = decode_bytes(name, 0, &[]);
+    Some(LogFont {
+        font: Font {
+            family: family.trim().to_string(),
+            height: f32::from(height),
+            width: f32::from(width),
+            weight: weight.clamp(0, 1000) as u16,
+            italic: byte(16) != 0,
+            underline: byte(17) != 0,
+            strike: byte(18) != 0,
+            charset,
+        },
+        escapement: f64::from(escapement),
+    })
+}
+
+/// The charset of the selected font, for decoding 8-bit text.
+fn charset(cv: &Canvas) -> u8 {
+    cv.font_charset()
+}
+
+/// EXTTEXTOUT (MS-WMF 2.3.3.5): y, x, string length, options, the rectangle (left, top, right,
+/// bottom) when ETO_OPAQUE or ETO_CLIPPED is set, the string padded to a word, then an optional dx
+/// array of i16 advances.
+fn ext_text_out(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let (y, x) = (r.i16(6)?, r.i16(8)?);
+    let n = usize::from(r.u16(10)?).min(MAX_CHARS);
+    let opts = u32::from(r.u16(12)?);
+    let has_rect = opts & (ETO_OPAQUE | ETO_CLIPPED) != 0;
+    let rect = if has_rect { Some([i16s(r, 14), i16s(r, 16), i16s(r, 18), i16s(r, 20)]) } else { None };
+    let at = if has_rect { 22 } else { 14 };
+    // A string running past the record is cut to what the record holds.
+    let avail = r.0.len().saturating_sub(at);
+    let n = n.min(avail);
+    let bytes = r.slice(at, n)?;
+    let dx_at = at + n.next_multiple_of(2);
+    let dx: Vec<f32> = if r.0.len() >= dx_at + 2 * n { (0..n).filter_map(|i| r.i16(dx_at + 2 * i)).map(f32::from).collect() } else { Vec::new() };
+    let (text, dx) = decode_bytes(bytes, charset(cv), &dx);
+    cv.text((f64::from(x), f64::from(y)), text, dx, opts, rect);
+    Some(())
+}
+
+/// TEXTOUT (MS-WMF 2.3.3.20): string length, the string padded to a word, then y and x.
+fn text_out(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let n = usize::from(r.u16(6)?).min(MAX_CHARS);
+    let bytes = r.slice(8, n)?;
+    let at = 8 + n.next_multiple_of(2);
+    let (y, x) = (r.i16(at)?, r.i16(at + 2)?);
+    let (text, _) = decode_bytes(bytes, charset(cv), &[]);
+    cv.text((f64::from(x), f64::from(y)), text, Vec::new(), 0, None);
+    Some(())
+}
+
+/// (x, y) from a Y-then-X pair stored at `off`.
+fn xy16(r: Bytes, off: usize) -> Option<P> {
+    Some((f64::from(r.i16(off + 2)?), f64::from(r.i16(off)?)))
+}
+
+/// Rectangle stored as bottom, right, top, left (the order MS-WMF uses for RECTANGLE and ELLIPSE).
+fn rect16(r: Bytes, off: usize) -> Option<[f64; 4]> {
+    let (b, rr, t, l) = (r.i16(off)?, r.i16(off + 2)?, r.i16(off + 4)?, r.i16(off + 6)?);
+    Some([f64::from(l), f64::from(t), f64::from(rr), f64::from(b)])
+}
+
+/// ARC, PIE and CHORD: end Y, end X, start Y, start X, then the bounding rectangle (bottom, right, top, left).
+fn arc16(r: Bytes) -> Option<([f64; 4], P, P)> {
+    let end = xy16(r, 6)?;
+    let start = xy16(r, 10)?;
+    let bounds = rect16(r, 14)?;
+    Some((bounds, start, end))
+}
+
+/// A count of 16-bit points, then the points (POLYLINE, POLYGON).
+fn counted_points(r: Bytes) -> Option<Vec<P>> {
+    let n = r.u16(6)? as usize;
+    r.tail(8)?.points(0, n, false)
+}
+
+/// POLYPOLYGON: polygon count, one 16-bit point count per polygon, then all points.
+fn polypolygon(r: Bytes) -> Option<Vec<geom::Op>> {
+    let n = r.u16(6)? as usize;
+    let mut counts = Vec::with_capacity(n);
+    for i in 0..n {
+        counts.push(r.u16(i.checked_mul(2)?.checked_add(8)?)? as usize);
+    }
+    let total = counts.iter().try_fold(0usize, |a, c| a.checked_add(*c))?;
+    if total > MAX_PATH_OPS {
+        return None;
+    }
+    let pts = r.tail(n.checked_mul(2)?.checked_add(8)?)?.points(0, total, false)?;
+    Some(geom::subpaths(&pts, &counts, true))
+}
+
+/// Whether a DIBBITBLT or DIBSTRETCHBLT record carries a bitmap: without one it is exactly
+/// `(function >> 8) + 3` words long (MS-WMF 2.3.1.2, 2.3.1.3).
+fn has_bitmap(func: u16, r: Bytes) -> bool {
+    r.0.len() / 2 > usize::from(func >> 8) + 3
+}
+
+/// META_DIBBITBLT: rop(4), ySrc, xSrc, then height, width, yDest, xDest and the DIB at 22. The
+/// bitmap-less form has a reserved word before the height, so its fields sit 2 bytes later; it, or
+/// a source-less raster operation, fills the destination.
+fn dib_bitblt(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let rop = r.u32(6)?;
+    if !has_bitmap(0x0940, r) {
+        cv.fill_rop([i16s(r, 22), i16s(r, 20), i16s(r, 18), i16s(r, 16)], rop);
+        return Some(());
+    }
+    let dst = [i16s(r, 20), i16s(r, 18), i16s(r, 16), i16s(r, 14)];
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let src = [i16s(r, 12), i16s(r, 10), dst[2], dst[3]];
+    dib_blit(cv, r, 22, rop, dst, src)
+}
+
+/// META_DIBSTRETCHBLT: rop(4), srcH, srcW, ySrc, xSrc, then destH, destW, yDest, xDest and the DIB at
+/// 26. The bitmap-less form has a reserved word after xSrc, so the destination sits 2 bytes later;
+/// it, or a source-less raster operation, fills the destination.
+fn dib_stretchblt(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let rop = r.u32(6)?;
+    if !has_bitmap(0x0B41, r) {
+        cv.fill_rop([i16s(r, 26), i16s(r, 24), i16s(r, 22), i16s(r, 20)], rop);
+        return Some(());
+    }
+    let dst = [i16s(r, 24), i16s(r, 22), i16s(r, 20), i16s(r, 18)];
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let src = [i16s(r, 16), i16s(r, 14), i16s(r, 12), i16s(r, 10)];
+    dib_blit(cv, r, 26, rop, dst, src)
+}
+
+/// A DIB at `at`, stretched from source rectangle `src` into `dst` (both in logical units, pixels for `src`).
+/// The raster operation `rop` decides how the pixels combine (see [`dib::prepare`]).
+fn dib_blit(cv: &mut Canvas, r: Bytes, at: usize, rop: u32, dst: [f64; 4], src: [f64; 4]) -> Option<()> {
+    let dib = r.tail(at)?;
+    let n = dib::info_len(dib)?;
+    let info = dib.slice(0, n)?;
+    let bits = dib.tail(n)?;
+    let mut img = dib::decode(Bytes(info), bits, false)?;
+    dib::prepare(&mut img, dib::Blend::Rop(rop));
+    let (img, dst) = dib::clip_blit(&img, src.map(|v| v as i64), dst)?;
+    cv.bitmap(dst, img);
+    Some(())
+}
@@ -392,9 +392,6 @@ pub struct Chart {
    /// Original chart XML part kept for round-trip of unmodelled options.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub raw: Option<String>,
-    /// The chart was too large to model: `raw` and `kept` are written back unchanged on save.
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    pub verbatim: bool,
    /// Package parts the original chart still points at (embedded workbook, styles, drawings).
    /// The PPTX writer clears this before comparing modelled state. Native saves keep it too.
    #[serde(skip_serializing_if = "ChartKept::is_empty")]
@@ -488,7 +485,6 @@ impl Default for Chart {
            bin_count: None,
            bin_size: None,
            raw: None,
-            verbatim: false,
            kept: ChartKept::default(),
        }
    }
@@ -1315,7 +1311,6 @@ impl Chart {
            series: vec![],
            gap_width: 0.0,
            raw: None,
-            verbatim: false,
            subtotals: vec![],
            ..self.clone()
        };
@@ -0,0 +1,12 @@
+[package]
+name = "deckcraft-ogg"
+description = "Clean-room Ogg (RFC 3533) demuxer with Ogg Opus (RFC 7845) and Ogg Vorbis stream mapping"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
@@ -0,0 +1,581 @@
+//! Clean-room Ogg demuxer, written from RFC 3533 (the Ogg encapsulation format), RFC 7845 (Ogg
+//! Opus) and the Vorbis I specification's Ogg mapping (section A).
+//!
+//! [`open`] reads every page (capture pattern, header, lacing values, CRC-32 checked; damaged
+//! regions are skipped by searching for the next `OggS`), groups them by logical bitstream and
+//! assembles packets — including packets that continue across pages — as lists of byte ranges,
+//! with the granule position of the page each packet completes on. Codec headers (Opus:
+//! `OpusHead` + `OpusTags`; Vorbis: identification, comment, setup) are collected separately from
+//! the audio packets.
+//!
+//! [`OpusTiming`] implements RFC 7845 §4: packet start positions from granule positions and
+//! TOC-derived durations, the pre-skip, and end trimming of the final page, so a player can seek
+//! to any 48 kHz sample.
+//!
+//! Layer L0: no dependencies beyond `std`, no `unsafe`, builds for `wasm32-unknown-unknown`.
+
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
+use std::collections::HashMap;
+use std::fmt;
+use std::io;
+
+/// Random-access, read-only byte source (same shape as the other FilmCraft demuxers').
+pub trait ByteSource {
+    fn len(&self) -> u64;
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()>;
+    fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+impl ByteSource for [u8] {
+    fn len(&self) -> u64 {
+        <[u8]>::len(self) as u64
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        let eof = || io::Error::new(io::ErrorKind::UnexpectedEof, "read past end");
+        let a = usize::try_from(offset).map_err(|_| eof())?;
+        buf.copy_from_slice(self.get(a..a.checked_add(buf.len()).ok_or_else(eof)?).ok_or_else(eof)?);
+        Ok(())
+    }
+}
+
+impl ByteSource for Vec<u8> {
+    fn len(&self) -> u64 {
+        self.as_slice().len() as u64
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        self.as_slice().read_at(offset, buf)
+    }
+}
+
+impl<T: ByteSource + ?Sized> ByteSource for &T {
+    fn len(&self) -> u64 {
+        (**self).len()
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        (**self).read_at(offset, buf)
+    }
+}
+
+#[derive(Debug)]
+pub enum Error {
+    Io(io::Error),
+    /// No Ogg page found.
+    NotOgg,
+    Invalid(String),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Error::Io(e) => write!(f, "I/O error: {e}"),
+            Error::NotOgg => write!(f, "not an Ogg file"),
+            Error::Invalid(s) => write!(f, "invalid Ogg: {s}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+impl From<io::Error> for Error {
+    fn from(e: io::Error) -> Self {
+        Error::Io(e)
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+/// The capture pattern at the start of a file.
+pub fn sniff(head: &[u8]) -> bool {
+    head.len() >= 27 && &head[..4] == b"OggS" && head[4] == 0
+}
+
+/// CRC-32 of RFC 3533 §6: polynomial 0x04C11DB7, initial value 0, no reflection, no final XOR.
+pub fn crc32(data: &[u8]) -> u32 {
+    static TABLE: std::sync::OnceLock<[u32; 256]> = std::sync::OnceLock::new();
+    let t = TABLE.get_or_init(|| {
+        let mut t = [0u32; 256];
+        for (i, e) in t.iter_mut().enumerate() {
+            let mut r = (i as u32) << 24;
+            for _ in 0..8 {
+                r = if r & 0x8000_0000 != 0 { (r << 1) ^ 0x04C1_1DB7 } else { r << 1 };
+            }
+            *e = r;
+        }
+        t
+    });
+    data.iter().fold(0u32, |c, &b| (c << 8) ^ t[((c >> 24) as u8 ^ b) as usize])
+}
+
+/// The codec of a logical bitstream (from its first packet).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Codec {
+    Opus,
+    Vorbis,
+    Flac,
+    Theora,
+    Speex,
+    Unknown,
+}
+
+impl Codec {
+    fn of(first: &[u8]) -> Codec {
+        if first.starts_with(b"OpusHead") {
+            Codec::Opus
+        } else if first.starts_with(b"\x01vorbis") {
+            Codec::Vorbis
+        } else if first.starts_with(b"\x7fFLAC") {
+            Codec::Flac
+        } else if first.starts_with(b"\x80theora") {
+            Codec::Theora
+        } else if first.starts_with(b"Speex   ") {
+            Codec::Speex
+        } else {
+            Codec::Unknown
+        }
+    }
+    /// Header packets before the audio packets.
+    fn header_count(self) -> usize {
+        match self {
+            Codec::Opus => 2,
+            Codec::Vorbis | Codec::Theora => 3,
+            Codec::Speex => 2,
+            Codec::Flac | Codec::Unknown => 1,
+        }
+    }
+    pub fn name(self) -> &'static str {
+        match self {
+            Codec::Opus => "Opus",
+            Codec::Vorbis => "Vorbis",
+            Codec::Flac => "FLAC",
+            Codec::Theora => "Theora",
+            Codec::Speex => "Speex",
+            Codec::Unknown => "unknown",
+        }
+    }
+}
+
+/// A packet: its byte ranges (a packet may span pages) and the granule position of the page it
+/// completes on when it is that page's last completed packet.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Packet {
+    pub parts: Vec<(u64, u32)>,
+    pub size: u32,
+    /// Granule position of the completing page if this is the last packet completed on it.
+    pub granule: Option<i64>,
+    /// Index of the page (within the stream) the packet completes on.
+    pub page: u32,
+    /// The packet completes on the stream's end-of-stream page.
+    pub eos: bool,
+    /// The first bytes of the packet (TOC for Opus, packet type for Vorbis).
+    pub prefix: [u8; 2],
+}
+
+/// A logical bitstream.
+#[derive(Clone, Debug)]
+pub struct Stream {
+    pub serial: u32,
+    pub codec: Codec,
+    /// Codec header packets (contents).
+    pub headers: Vec<Vec<u8>>,
+    /// Data packets after the headers.
+    pub packets: Vec<Packet>,
+    pub pages: u32,
+    /// Granule position of the last page with one.
+    pub last_granule: Option<i64>,
+    pub saw_eos: bool,
+}
+
+/// An opened Ogg file.
+#[derive(Clone, Debug)]
+pub struct OggFile {
+    pub streams: Vec<Stream>,
+    /// Pages dropped for a bad CRC, lost sync, truncation…
+    pub warnings: Vec<String>,
+}
+
+/// Source bytes damage recovery may read per file: the windows the scan for the next capture
+/// pattern fills and the pages read only to find their CRC wrong.
+const RECOVERY_BUDGET: u64 = 32 << 20;
+/// Warnings kept per file (not counting the one about the budget); the rest are counted in one last entry.
+const MAX_WARNINGS: usize = 256;
+
+/// Record a warning, keeping at most `MAX_WARNINGS` and one entry saying the rest were dropped.
+fn warn(warnings: &mut Vec<String>, msg: String) {
+    match warnings.len().cmp(&MAX_WARNINGS) {
+        std::cmp::Ordering::Less => warnings.push(msg),
+        std::cmp::Ordering::Equal => warnings.push("further warnings omitted".into()),
+        std::cmp::Ordering::Greater => {}
+    }
+}
+
+struct Partial {
+    parts: Vec<(u64, u32)>,
+    size: u32,
+    prefix: Vec<u8>,
+}
+
+/// Read every page and assemble the packets of every logical bitstream.
+pub fn open(src: &(impl ByteSource + ?Sized)) -> Result<OggFile> {
+    let len = src.len();
+    let mut streams: Vec<Stream> = Vec::new();
+    let mut by_serial: HashMap<u32, usize> = HashMap::new();
+    let mut partial: HashMap<u32, Partial> = HashMap::new();
+    let mut warnings = Vec::new();
+    let mut pos = 0u64;
+    let mut found_any = false;
+    let mut hdr = [0u8; 27 + 255];
+    let mut scanner = CaptureScanner::new();
+    while pos + 27 <= len {
+        src.read_at(pos, &mut hdr[..27])?;
+        if &hdr[..4] != b"OggS" || hdr[4] != 0 {
+            match scanner.find(src, pos + 1, len)? {
+                Some(p) => {
+                    if found_any {
+                        warn(&mut warnings, format!("lost sync at byte {pos}; resumed at {p}"));
+                    }
+                    pos = p;
+                    continue;
+                }
+                None => break,
+            }
+        }
+        let nseg = hdr[26] as usize;
+        if pos + 27 + nseg as u64 > len {
+            warn(&mut warnings, format!("truncated page header at byte {pos}"));
+            break;
+        }
+        src.read_at(pos + 27, &mut hdr[27..27 + nseg])?;
+        let body_len: u64 = hdr[27..27 + nseg].iter().map(|&b| b as u64).sum();
+        let page_len = 27 + nseg as u64 + body_len;
+        if pos + page_len > len {
+            warn(&mut warnings, format!("truncated page at byte {pos}"));
+            break;
+        }
+        let mut page = vec![0u8; page_len as usize];
+        src.read_at(pos, &mut page)?;
+        let stored_crc = u32::from_le_bytes([page[22], page[23], page[24], page[25]]);
+        page[22..26].fill(0);
+        if crc32(&page) != stored_crc {
+            warn(&mut warnings, format!("bad CRC on page at byte {pos}"));
+            // a page read only to find it damaged is recovery work, charged like the scan's windows
+            if scanner.charge(page_len) {
+                break;
+            }
+            pos += 1;
+            continue;
+        }
+        found_any = true;
+        let flags = page[5];
+        let granule = i64::from_le_bytes(page[6..14].try_into().unwrap_or([0; 8]));
+        let serial = u32::from_le_bytes([page[14], page[15], page[16], page[17]]);
+        let lacing = page[27..27 + nseg].to_vec();
+        let body_off = pos + 27 + nseg as u64;
+        let si = *by_serial.entry(serial).or_insert_with(|| {
+            streams.push(Stream {
+                serial,
+                codec: Codec::Unknown,
+                headers: Vec::new(),
+                packets: Vec::new(),
+                pages: 0,
+                last_granule: None,
+                saw_eos: false,
+            });
+            streams.len() - 1
+        });
+        let st = &mut streams[si];
+        let page_index = st.pages;
+        st.pages += 1;
+        if flags & 0x04 != 0 {
+            st.saw_eos = true;
+        }
+        // a continued page without a pending packet (lost a page): drop the fragment
+        let continued = flags & 0x01 != 0;
+        if !continued && partial.remove(&serial).is_some() {
+            warn(&mut warnings, format!("incomplete packet before page at byte {pos}"));
+        }
+        let mut completed: Vec<Packet> = Vec::new();
+        let mut off = 0u64;
+        let mut seg_start = 0u64;
+        let mut skip_fragment = continued && !partial.contains_key(&serial);
+        for (k, &l) in lacing.iter().enumerate() {
+            off += l as u64;
+            if l < 255 || k + 1 == nseg {
+                let (a, n) = (seg_start, off - seg_start);
+                seg_start = off;
+                if skip_fragment {
+                    if l < 255 {
+                        skip_fragment = false;
+                    }
+                    continue;
+                }
+                let p = partial.entry(serial).or_insert_with(|| Partial { parts: Vec::new(), size: 0, prefix: Vec::new() });
+                if n > 0 {
+                    p.parts.push((body_off + a, n as u32));
+                    p.size += n as u32;
+                    let s = (body_off - pos + a) as usize;
+                    let need = 2usize.saturating_sub(p.prefix.len()).min(n as usize);
+                    p.prefix.extend_from_slice(&page[s..s + need]);
+                }
+                if l < 255
+                    && let Some(p) = partial.remove(&serial)
+                {
+                    let mut prefix = [0u8; 2];
+                    prefix[..p.prefix.len().min(2)].copy_from_slice(&p.prefix[..p.prefix.len().min(2)]);
+                    completed.push(Packet { parts: p.parts, size: p.size, granule: None, page: page_index, eos: flags & 0x04 != 0, prefix });
+                }
+            }
+        }
+        if granule != -1 {
+            st.last_granule = Some(granule);
+            if let Some(last) = completed.last_mut() {
+                last.granule = Some(granule);
+            }
+        }
+        for pk in completed {
+            if st.headers.is_empty() && st.packets.is_empty() {
+                let data = read_parts(src, &pk.parts)?;
+                st.codec = Codec::of(&data);
+            }
+            if st.headers.len() < st.codec.header_count() && st.packets.is_empty() {
+                st.headers.push(read_parts(src, &pk.parts)?);
+            } else {
+                st.packets.push(pk);
+            }
+        }
+        pos += page_len;
+    }
+    if !found_any {
+        return Err(Error::NotOgg);
+    }
+    if !partial.is_empty() {
+        warn(&mut warnings, "file ends inside a packet".into());
+    }
+    if scanner.spent() {
+        // once per file and last, so it is not subject to the cap on the others
+        warnings.push("recovery budget spent; the rest of the damaged data was not searched".into());
+    }
+    Ok(OggFile { streams, warnings })
+}
+
+struct CaptureScanner {
+    buf: Vec<u8>,
+    buf_start: u64,
+    budget: u64,
+}
+
+impl CaptureScanner {
+    fn new() -> Self {
+        Self { buf: Vec::new(), buf_start: 0, budget: RECOVERY_BUDGET }
+    }
+
+    /// Charge `bytes` of recovery work; true once the budget is spent.
+    fn charge(&mut self, bytes: u64) -> bool {
+        self.budget = self.budget.saturating_sub(bytes);
+        self.spent()
+    }
+
+    /// Nothing left to search with: fewer bytes than a capture pattern can still be charged for.
+    fn spent(&self) -> bool {
+        self.budget < 4
+    }
+
+    fn find(&mut self, src: &(impl ByteSource + ?Sized), from: u64, len: u64) -> Result<Option<u64>> {
+        let mut at = from;
+        while at + 4 <= len {
+            let buf_end = self.buf_start + self.buf.len() as u64;
+            if at >= self.buf_start && at + 4 <= buf_end {
+                let off = (at - self.buf_start) as usize;
+                if let Some(i) = self.buf[off..].windows(4).position(|w| w == b"OggS") {
+                    return Ok(Some(at + i as u64));
+                }
+                at = buf_end.saturating_sub(3);
+                continue;
+            }
+            if self.spent() {
+                return Ok(None);
+            }
+            let n = ((len - at) as usize).min(64 * 1024).min(usize::try_from(self.budget).unwrap_or(usize::MAX));
+            if n < 4 {
+                break;
+            }
+            self.buf.resize(n, 0);
+            src.read_at(at, &mut self.buf)?;
+            self.buf_start = at;
+            self.budget = self.budget.saturating_sub(n as u64);
+            if let Some(i) = self.buf.windows(4).position(|w| w == b"OggS") {
+                return Ok(Some(at + i as u64));
+            }
+            at += (n - 3) as u64;
+        }
+        Ok(None)
+    }
+}
+
+fn read_parts(src: &(impl ByteSource + ?Sized), parts: &[(u64, u32)]) -> Result<Vec<u8>> {
+    // Ranges come from a scan of some source; check them against this one before sizing a buffer.
+    let len = src.len();
+    if parts.iter().any(|&(o, n)| o.checked_add(u64::from(n)).is_none_or(|end| end > len)) {
+        return Err(Error::Invalid("packet range lies outside the source".into()));
+    }
+    let mut v = Vec::with_capacity(parts.iter().map(|p| p.1 as usize).sum());
+    for &(o, n) in parts {
+        let a = v.len();
+        v.resize(a + n as usize, 0);
+        src.read_at(o, &mut v[a..])?;
+    }
+    Ok(v)
+}
+
+impl OggFile {
+    /// The first stream of `codec`.
+    pub fn stream_of(&self, codec: Codec) -> Option<usize> {
+        self.streams.iter().position(|s| s.codec == codec)
+    }
+    /// The bytes of packet `i` of stream `s`.
+    pub fn read_packet(&self, src: &(impl ByteSource + ?Sized), s: usize, i: usize) -> Result<Vec<u8>> {
+        let p = self.streams.get(s).and_then(|st| st.packets.get(i)).ok_or_else(|| Error::Invalid(format!("no packet {i} in stream {s}")))?;
+        read_parts(src, &p.parts)
+    }
+}
+
+/// Duration of an Opus packet in 48 kHz samples from its TOC (RFC 6716 §3.1); `None` if invalid.
+pub fn opus_packet_samples(prefix: [u8; 2], size: u32) -> Option<u32> {
+    if size == 0 {
+        return None;
+    }
+    let toc = prefix[0];
+    let config = toc >> 3;
+    let frame = match config {
+        0..=11 => [480, 960, 1920, 2880][(config & 3) as usize],
+        12..=15 => [480, 960][(config & 1) as usize],
+        _ => [120, 240, 480, 960][(config & 3) as usize],
+    };
+    let frames = match toc & 3 {
+        0 => 1,
+        1 | 2 => 2,
+        _ => {
+            if size < 2 {
+                return None;
+            }
+            (prefix[1] & 0x3F) as u32
+        }
+    };
+    let n = frame * frames;
+    (n > 0 && n <= 5760).then_some(n)
+}
+
+/// RFC 7845 §4 timing of an Opus stream.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct OpusTiming {
+    pub pre_skip: u32,
+    /// Start of each packet's decoded output in output samples (48 kHz): 0 is the first sample
+    /// after the pre-skip; the pre-skip samples have negative positions.
+    pub starts: Vec<i64>,
+    /// Decoded samples of each packet.
+    pub durations: Vec<u32>,
+    /// Playable samples (end trimming applied).
+    pub total: i64,
+}
+
+fn timing_add(a: i64, b: i64) -> Result<i64> {
+    a.checked_add(b).ok_or_else(|| Error::Invalid("opus timing overflow".into()))
+}
+
+fn timing_sub(a: i64, b: i64) -> Result<i64> {
+    a.checked_sub(b).ok_or_else(|| Error::Invalid("opus timing overflow".into()))
+}
+
+impl OpusTiming {
+    /// Timing of the Opus stream `s` (`pre_skip` from its `OpusHead`).
+    ///
+    /// A granule or a run of packet durations that does not fit in `i64` is an error. Ordinary
+    /// files, including a truncated tail and end trimming, are unchanged.
+    pub fn of(stream: &Stream, pre_skip: u32) -> Result<OpusTiming> {
+        let durations: Vec<u32> = stream.packets.iter().map(|p| opus_packet_samples(p.prefix, p.size).unwrap_or(0)).collect();
+        let n = durations.len();
+        let mut ends: Vec<Option<i64>> = vec![None; n];
+        let mut i = 0;
+        let mut cursor: Option<i64> = None;
+        let mut trimmed_end: Option<i64> = None;
+        while i < n {
+            // packets completing on the same page: i..j, the last carries the page granule
+            let mut j = i;
+            while j < n && stream.packets[j].granule.is_none() {
+                j += 1;
+            }
+            if j == n {
+                // trailing packets without a granule (truncated file): continue from the cursor
+                let mut c = cursor.unwrap_or(0);
+                for k in i..n {
+                    c = timing_add(c, i64::from(durations[k]))?;
+                    ends[k] = Some(c);
+                }
+                cursor = Some(c);
+                break;
+            }
+            let Some(g) = stream.packets[j].granule else { break };
+            let sum = durations[i..=j].iter().try_fold(0i64, |a, &d| timing_add(a, i64::from(d)))?;
+            let forward = match cursor {
+                Some(c) => Some(timing_add(c, sum)?),
+                None => None,
+            };
+            let end = match forward {
+                // end trimming on the last page (RFC 7845 §4.5): keep the forward positions
+                Some(f) if stream.packets[j].eos && g < f => {
+                    trimmed_end = Some(g);
+                    f
+                }
+                Some(f) if f == g => f,
+                // first page, or a discontinuity: trust the granule
+                _ => g,
+            };
+            let mut e = end;
+            for k in (i..=j).rev() {
+                ends[k] = Some(e);
+                e = timing_sub(e, i64::from(durations[k]))?;
+            }
+            cursor = Some(end);
+            i = j + 1;
+        }
+        let mut raw_starts = Vec::with_capacity(n);
+        for (e, &d) in ends.iter().zip(&durations) {
+            raw_starts.push(timing_sub(e.unwrap_or(0), i64::from(d))?);
+        }
+        let base = raw_starts.first().copied().unwrap_or(0).max(0);
+        let shift = timing_add(base, i64::from(pre_skip))?;
+        let mut starts = Vec::with_capacity(n);
+        for s in &raw_starts {
+            starts.push(timing_sub(*s, shift)?);
+        }
+        let end_all = trimmed_end.or(cursor).unwrap_or(0);
+        let total = timing_sub(end_all, shift)?.max(0);
+        Ok(OpusTiming { pre_skip, starts, durations, total })
+    }
+}
+
+/// Vorbis identification header fields (Vorbis I §4.2.2).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct VorbisInfo {
+    pub channels: u8,
+    pub sample_rate: u32,
+    pub bitrate_nominal: i32,
+}
+
+impl VorbisInfo {
+    pub fn parse(h: &[u8]) -> Option<VorbisInfo> {
+        if h.len() < 30 || !h.starts_with(b"\x01vorbis") {
+            return None;
+        }
+        Some(VorbisInfo {
+            channels: h[11],
+            sample_rate: u32::from_le_bytes([h[12], h[13], h[14], h[15]]),
+            bitrate_nominal: i32::from_le_bytes([h[20], h[21], h[22], h[23]]),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests;
@@ -0,0 +1,307 @@
+//! Synthetic Ogg streams: a small page writer (RFC 3533) and Opus-like packets.
+
+use std::cell::Cell;
+use std::io;
+
+use super::{ByteSource, CaptureScanner, Codec, Error, OpusTiming, Packet, Stream, crc32, open, opus_packet_samples, sniff};
+
+/// Write one page holding `segments` (lacing already computed by `lace`).
+fn page(out: &mut Vec<u8>, flags: u8, granule: i64, serial: u32, seq: u32, lacing: &[u8], body: &[u8]) {
+    let start = out.len();
+    out.extend_from_slice(b"OggS");
+    out.push(0);
+    out.push(flags);
+    out.extend_from_slice(&granule.to_le_bytes());
+    out.extend_from_slice(&serial.to_le_bytes());
+    out.extend_from_slice(&seq.to_le_bytes());
+    out.extend_from_slice(&[0; 4]);
+    out.push(lacing.len() as u8);
+    out.extend_from_slice(lacing);
+    out.extend_from_slice(body);
+    let crc = crc32(&out[start..]);
+    out[start + 22..start + 26].copy_from_slice(&crc.to_le_bytes());
+}
+
+fn lace(packets: &[&[u8]], last_continues: bool) -> (Vec<u8>, Vec<u8>) {
+    let mut l = Vec::new();
+    let mut b = Vec::new();
+    for (i, p) in packets.iter().enumerate() {
+        let mut n = p.len();
+        while n >= 255 {
+            l.push(255);
+            n -= 255;
+        }
+        if !(last_continues && i + 1 == packets.len()) {
+            l.push(n as u8);
+        }
+        b.extend_from_slice(p);
+    }
+    (l, b)
+}
+
+fn opus_head(pre_skip: u16) -> Vec<u8> {
+    let mut h = b"OpusHead".to_vec();
+    h.push(1);
+    h.push(2);
+    h.extend_from_slice(&pre_skip.to_le_bytes());
+    h.extend_from_slice(&48_000u32.to_le_bytes());
+    h.extend_from_slice(&0i16.to_le_bytes());
+    h.push(0);
+    h
+}
+
+/// A CELT 20 ms packet (960 samples): TOC config 31, code 0.
+fn pkt(i: usize, len: usize) -> Vec<u8> {
+    let mut p = vec![0xF8];
+    p.extend((0..len.saturating_sub(1)).map(|k| (i * 7 + k) as u8));
+    p
+}
+
+/// Header pages, then pages of 3 packets each; the last page's granule trims `trim` samples.
+fn opus_file(npk: usize, pre_skip: u16, trim: i64) -> Vec<u8> {
+    let mut f = Vec::new();
+    let head = opus_head(pre_skip);
+    let (l, b) = lace(&[&head], false);
+    page(&mut f, 0x02, 0, 9, 0, &l, &b);
+    let tags = b"OpusTags\x00\x00\x00\x00\x00\x00\x00\x00".to_vec();
+    let (l, b) = lace(&[&tags], false);
+    page(&mut f, 0, 0, 9, 1, &l, &b);
+    let pkts: Vec<Vec<u8>> = (0..npk).map(|i| pkt(i, 40 + i % 5)).collect();
+    let mut done = 0;
+    for (seq, chunk) in (2..).zip(pkts.chunks(3)) {
+        done += chunk.len();
+        let last = done == npk;
+        let mut g = done as i64 * 960;
+        if last {
+            g -= trim;
+        }
+        let refs: Vec<&[u8]> = chunk.iter().map(Vec::as_slice).collect();
+        let (l, b) = lace(&refs, false);
+        page(&mut f, if last { 0x04 } else { 0 }, g, 9, seq, &l, &b);
+    }
+    f
+}
+
+#[test]
+fn crc_matches_known_value() {
+    // CRC-32/CKSUM parameters without its final XOR (check value 0x765E7680 ^ 0xFFFFFFFF)
+    assert_eq!(crc32(b"123456789"), 0x89A1_897F);
+    assert_eq!(crc32(b""), 0);
+    assert_ne!(crc32(b"OggS"), crc32(b"OggT"));
+}
+
+#[test]
+fn opus_pages_packets_and_timing() {
+    let f = opus_file(10, 312, 500);
+    assert!(sniff(&f));
+    let o = open(&f).unwrap();
+    assert!(o.warnings.is_empty(), "{:?}", o.warnings);
+    let s = o.stream_of(Codec::Opus).unwrap();
+    let st = &o.streams[s];
+    assert_eq!(st.headers.len(), 2);
+    assert_eq!(st.packets.len(), 10);
+    assert!(st.saw_eos);
+    assert_eq!(o.read_packet(&f, s, 4).unwrap(), pkt(4, 44));
+    let t = OpusTiming::of(st, 312).unwrap();
+    assert_eq!(t.durations, vec![960; 10]);
+    assert_eq!(t.starts[0], -312);
+    assert_eq!(t.starts[9], 9 * 960 - 312);
+    // end trimming: the last page granule is 500 short
+    assert_eq!(t.total, 10 * 960 - 500 - 312);
+}
+
+#[test]
+fn packets_spanning_pages() {
+    let mut f = Vec::new();
+    let head = opus_head(0);
+    let (l, b) = lace(&[&head], false);
+    page(&mut f, 0x02, 0, 1, 0, &l, &b);
+    let (l, b) = lace(&[b"OpusTags"], false);
+    page(&mut f, 0, 0, 1, 1, &l, &b);
+    let big = pkt(0, 700);
+    // first 510 bytes on one page (two 255 lacing values, packet continues), rest on the next
+    let (l, b) = (vec![255, 255], big[..510].to_vec());
+    page(&mut f, 0, -1, 1, 2, &l, &b);
+    let rest = &big[510..];
+    let small = pkt(1, 30);
+    let (l, b) = lace(&[rest, &small], false);
+    page(&mut f, 0x01 | 0x04, 1920, 1, 3, &l, &b);
+    let o = open(&f).unwrap();
+    let st = &o.streams[0];
+    assert_eq!(st.packets.len(), 2);
+    assert_eq!(st.packets[0].parts.len(), 2);
+    assert_eq!(o.read_packet(&f, 0, 0).unwrap(), big);
+    assert_eq!(o.read_packet(&f, 0, 1).unwrap(), small);
+    let t = OpusTiming::of(st, 0).unwrap();
+    assert_eq!(t.starts, vec![0, 960]);
+    assert_eq!(t.total, 1920);
+}
+
+#[test]
+fn corrupt_pages_are_skipped_and_truncation_is_safe() {
+    let f = opus_file(12, 312, 0);
+    // flip a byte inside the third data page's body: that page fails its CRC and is dropped
+    let mut g = f.clone();
+    let third = g.windows(4).enumerate().filter(|(_, w)| *w == b"OggS").map(|(i, _)| i).nth(4).unwrap();
+    g[third + 40] ^= 0xFF;
+    let o = open(&g).unwrap();
+    assert!(o.warnings.iter().any(|w| w.contains("CRC")), "{:?}", o.warnings);
+    assert_eq!(o.streams[0].packets.len(), 9);
+    let t = OpusTiming::of(&o.streams[0], 312).unwrap();
+    // the granules after the gap put the later packets at their true positions
+    assert_eq!(*t.starts.last().unwrap(), 11 * 960 - 312);
+    for cut in 0..f.len() {
+        if let Ok(o) = open(&f[..cut].to_vec()) {
+            for st in &o.streams {
+                let t = OpusTiming::of(st, 312).unwrap();
+                assert_eq!(t.starts.len(), st.packets.len());
+            }
+        }
+    }
+    let mut seed = 99u64;
+    for _ in 0..300 {
+        let mut g = f.clone();
+        seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+        let at = (seed >> 33) as usize % g.len();
+        g[at] = (seed >> 20) as u8;
+        if let Ok(o) = open(&g) {
+            for st in &o.streams {
+                let _ = OpusTiming::of(st, 312);
+            }
+        }
+    }
+    assert!(matches!(open(&b"not ogg at all, no capture pattern".to_vec()), Err(Error::NotOgg)));
+}
+
+#[test]
+fn opus_toc_durations() {
+    assert_eq!(opus_packet_samples([0x00, 0], 10), Some(480)); // SILK NB 10 ms
+    assert_eq!(opus_packet_samples([0x18, 0], 10), Some(2880)); // SILK NB 60 ms
+    assert_eq!(opus_packet_samples([0x78 | 1, 0], 10), Some(1920)); // hybrid 20 ms × 2
+    assert_eq!(opus_packet_samples([0x80 | 3, 6], 10), Some(720)); // CELT 2.5 ms × 6
+    assert_eq!(opus_packet_samples([0xF8 | 3, 7], 10), None); // 140 ms: invalid
+    assert_eq!(opus_packet_samples([0xF8, 0], 0), None);
+}
+
+#[test]
+fn opus_timing_includes_packets_after_the_last_known_granule() {
+    let f = opus_file(6, 312, 0);
+    let o = open(&f).unwrap();
+    let mut stream = o.streams[0].clone();
+    // Missing granules on complete-packet pages are non-conforming. The existing recovery
+    // fallback still assigns their packet positions; total must include the same samples.
+    stream.packets.last_mut().unwrap().granule = None;
+    let timing = OpusTiming::of(&stream, 312).unwrap();
+    assert_eq!(timing.starts, vec![-312, 648, 1608, 2568, 3528, 4488]);
+    assert_eq!(timing.total, 6 * 960 - 312);
+
+    // With no usable granule, every complete packet still contributes its TOC duration.
+    for packet in &mut stream.packets {
+        packet.granule = None;
+    }
+    let timing = OpusTiming::of(&stream, 312).unwrap();
+    assert_eq!(timing.starts, vec![-312, 648, 1608, 2568, 3528, 4488]);
+    assert_eq!(timing.total, 6 * 960 - 312);
+}
+
+#[test]
+fn opus_timing_rejects_a_granule_that_overflows() {
+    let packet = |granule: i64| Stream {
+        serial: 1,
+        codec: Codec::Opus,
+        headers: vec![],
+        packets: vec![Packet { parts: vec![], size: 10, granule: Some(granule), page: 0, eos: true, prefix: [0x00, 0] }],
+        pages: 1,
+        last_granule: Some(granule),
+        saw_eos: true,
+    };
+    let ok = OpusTiming::of(&packet(480), 0).unwrap();
+    assert_eq!(ok.starts, vec![0]);
+    assert_eq!(ok.total, 480);
+    assert!(OpusTiming::of(&packet(i64::MIN), 0).is_err());
+}
+
+/// A source that counts the bytes read from it.
+struct Counting<'a> {
+    data: &'a [u8],
+    read: Cell<u64>,
+}
+
+impl ByteSource for Counting<'_> {
+    fn len(&self) -> u64 {
+        self.data.len() as u64
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<()> {
+        self.read.set(self.read.get() + buf.len() as u64);
+        self.data.read_at(offset, buf)
+    }
+}
+
+/// A valid file followed by `len` bytes of 0xFF with a capture pattern every 64 bytes. Each one
+/// claims 255 full lacing values, so it reads as a page of about 64 KiB that fails its CRC.
+fn dense_fake_pages(len: usize) -> Vec<u8> {
+    let mut f = opus_file(6, 312, 0);
+    let start = f.len();
+    f.resize(start + len, 0xFF);
+    for at in (start..start + len - 64).step_by(64) {
+        f[at..at + 5].copy_from_slice(b"OggS\0");
+        f[at + 26] = 255;
+    }
+    f
+}
+
+#[test]
+fn recovery_reads_a_bounded_amount_of_a_damaged_file() {
+    let f = dense_fake_pages(1 << 20);
+    let src = Counting { data: &f, read: Cell::new(0) };
+    let o = open(&src).unwrap();
+    assert_eq!(o.streams[0].packets.len(), 6, "the good pages are kept");
+    let read = src.read.get();
+    assert!(read <= 40 << 20, "read {read} bytes of a {} byte file", f.len());
+    assert!(o.warnings.iter().any(|w| w.contains("recovery budget")), "{:?}", o.warnings);
+}
+
+#[test]
+fn warnings_are_capped() {
+    // 100,000 pages with no segments and a wrong CRC, 27 bytes each
+    let mut f = opus_file(6, 312, 0);
+    for _ in 0..100_000 {
+        let at = f.len();
+        f.extend_from_slice(b"OggS\0\0");
+        f.resize(at + 27, 0);
+        f[at + 22] = 1;
+    }
+    let o = open(&f).unwrap();
+    assert!(o.warnings.len() <= 257, "{} warnings", o.warnings.len());
+    assert!(o.warnings.iter().any(|w| w.contains("omitted")), "{:?}", o.warnings.last());
+}
+
+#[test]
+fn a_file_of_good_pages_is_not_charged_for_recovery() {
+    let f = opus_file(2000, 312, 0);
+    let src = Counting { data: &f, read: Cell::new(0) };
+    let o = open(&src).unwrap();
+    assert_eq!(o.streams[0].packets.len(), 2000);
+    assert!(o.warnings.is_empty(), "{:?}", o.warnings);
+}
+
+#[test]
+fn a_budget_too_small_to_search_is_spent() {
+    // 1 to 3 bytes left cannot hold a capture pattern: the scan would stop without saying why
+    let mut scanner = CaptureScanner::new();
+    assert!(!scanner.spent());
+    assert!(scanner.charge(super::RECOVERY_BUDGET - 3));
+    assert!(scanner.spent());
+    let f = opus_file(6, 312, 0);
+    assert_eq!(scanner.find(&f, 0, f.len() as u64).unwrap(), None);
+}
+
+#[test]
+fn read_packet_checks_its_ranges_against_the_source_before_allocating() {
+    let f = opus_file(10, 312, 500);
+    let o = open(&f).unwrap();
+    let s = o.stream_of(Codec::Opus).unwrap();
+    // The last packet lies past the end of a source cut short: an error, not a read of missing bytes.
+    let short = &f[..f.len() / 2];
+    assert!(matches!(o.read_packet(&short, s, 9), Err(Error::Invalid(_))));
+}
@@ -0,0 +1,12 @@
+[package]
+name = "deckcraft-opus"
+description = "Clean-room pure-Rust Opus decoder (RFC 6716 / RFC 8251; OpusHead, multistream surround)"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
@@ -0,0 +1,678 @@
+//! CELT layer decoder (RFC 6716 §4.3).
+
+pub(crate) mod bands;
+pub(crate) mod energy;
+pub(crate) mod mdct;
+pub(crate) mod rate;
+pub(crate) mod tables;
+
+use std::sync::OnceLock;
+
+use bands::{anti_collapse, denormalise_bands, quant_all_bands, renormalise_vector};
+use energy::{unquant_coarse_energy, unquant_energy_finalise, unquant_fine_energy};
+use mdct::ImdctScratch;
+use rate::{Mode, compute_allocation};
+use tables::{COMB_GAINS, EBANDS, MAX_LM, NB_EBANDS, OVERLAP, PREEMPH, SHORT_MDCT, SPREAD_ICDF, TAPSET_ICDF, TF_SELECT_TABLE, TRIM_ICDF};
+
+use crate::range::{BITRES, RangeDecoder};
+
+const DECODE_BUFFER_SIZE: usize = 2048;
+const COMBFILTER_MINPERIOD: i32 = 15;
+const PLC_PITCH_LAG_MAX: usize = 720;
+const PLC_PITCH_LAG_MIN: usize = 100;
+
+pub(crate) fn mode() -> &'static Mode {
+    static MODE: OnceLock<Mode> = OnceLock::new();
+    MODE.get_or_init(Mode::new)
+}
+
+/// CELT decoder state for one (mono or stereo) stream.
+pub struct CeltDecoder {
+    m: &'static Mode,
+    /// Output channels.
+    channels: usize,
+    /// Channels coded in the stream.
+    pub stream_channels: usize,
+    downsample: usize,
+    pub start: usize,
+    pub end: usize,
+    pub disable_inv: bool,
+    pub rng: u32,
+    loss_count: u32,
+    skip_plc: bool,
+    postfilter_period: i32,
+    postfilter_period_old: i32,
+    postfilter_gain: f32,
+    postfilter_gain_old: f32,
+    postfilter_tapset: usize,
+    postfilter_tapset_old: usize,
+    preemph_mem: [f32; 2],
+    decode_mem: Vec<f32>,
+    old_band_e: [f32; 2 * NB_EBANDS],
+    old_log_e: [f32; 2 * NB_EBANDS],
+    old_log_e2: [f32; 2 * NB_EBANDS],
+    background_log_e: [f32; 2 * NB_EBANDS],
+    // scratch
+    x: Vec<f32>,
+    freq: Vec<f32>,
+    imdct: ImdctScratch,
+    pcm_scratch: Vec<f32>,
+}
+
+/// Detects the silence flag, advancing the decoder to the end of the frame when set. Returns the flag and the new bit position.
+fn read_silence(dec: &mut RangeDecoder, total_bits_raw: i32) -> (bool, i32) {
+    let tell = dec.tell();
+    let silence = tell >= total_bits_raw || (tell == 1 && dec.bit_logp(15));
+    if silence {
+        // Pretend we've read all the remaining bits.
+        dec.skip_to_end(total_bits_raw);
+        return (true, total_bits_raw);
+    }
+    (false, tell)
+}
+
+struct PostfilterParams {
+    gain: f32,
+    pitch: i32,
+    tapset: usize,
+    tell: i32,
+}
+
+/// Reads the optional post-filter header (pitch, gain, tapset) at the start of a frame.
+fn read_postfilter_params(dec: &mut RangeDecoder, start: usize, tell: i32, total_bits_raw: i32) -> PostfilterParams {
+    let mut p = PostfilterParams { gain: 0.0, pitch: 0, tapset: 0, tell };
+    if start == 0 && tell + 16 <= total_bits_raw {
+        if dec.bit_logp(1) {
+            let octave = dec.uint(6);
+            p.pitch = ((16 << octave) + dec.bits(4 + octave)) as i32 - 1;
+            let qg = dec.bits(3);
+            if dec.tell() + 2 <= total_bits_raw {
+                p.tapset = dec.icdf(&TAPSET_ICDF, 2);
+            }
+            p.gain = 0.09375 * (qg + 1) as f32;
+        }
+        p.tell = dec.tell();
+    }
+    p
+}
+
+/// Decodes per-band dynamic allocation boosts. Returns the offsets, the fractional bit position and the remaining bit budget.
+fn decode_dynalloc(
+    dec: &mut RangeDecoder,
+    start: usize,
+    end: usize,
+    c: usize,
+    lm: usize,
+    cap: &[i32],
+    total_bits_raw: i32,
+) -> ([i32; NB_EBANDS], i32, i32) {
+    let mut offsets = [0i32; NB_EBANDS];
+    let mut dynalloc_logp = 6;
+    let mut total_bits = total_bits_raw << BITRES;
+    let mut tellf = dec.tell_frac() as i32;
+    for i in start..end {
+        let width = (c as i32 * (EBANDS[i + 1] - EBANDS[i])) << lm;
+        let quanta = (width << BITRES).min((6 << BITRES).max(width));
+        let mut loop_logp = dynalloc_logp;
+        let mut boost = 0;
+        while tellf + (loop_logp << BITRES) < total_bits && boost < cap[i] {
+            let flag = dec.bit_logp(loop_logp as u32);
+            tellf = dec.tell_frac() as i32;
+            if !flag {
+                break;
+            }
+            boost += quanta;
+            total_bits -= quanta;
+            loop_logp = 1;
+        }
+        offsets[i] = boost;
+        if boost > 0 {
+            dynalloc_logp = 2.max(dynalloc_logp - 1);
+        }
+    }
+    (offsets, tellf, total_bits)
+}
+
+impl CeltDecoder {
+    /// `sample_rate` is the output rate (48000, 24000, 16000, 12000 or 8000).
+    pub fn new(sample_rate: u32, channels: usize) -> CeltDecoder {
+        let downsample = (48000 / sample_rate) as usize;
+        let mut d = CeltDecoder {
+            m: mode(),
+            channels,
+            stream_channels: channels,
+            downsample,
+            start: 0,
+            end: NB_EBANDS,
+            disable_inv: channels == 1,
+            rng: 0,
+            loss_count: 0,
+            skip_plc: true,
+            postfilter_period: 0,
+            postfilter_period_old: 0,
+            postfilter_gain: 0.0,
+            postfilter_gain_old: 0.0,
+            postfilter_tapset: 0,
+            postfilter_tapset_old: 0,
+            preemph_mem: [0.0; 2],
+            decode_mem: vec![0.0; channels * (DECODE_BUFFER_SIZE + OVERLAP)],
+            old_band_e: [0.0; 2 * NB_EBANDS],
+            old_log_e: [0.0; 2 * NB_EBANDS],
+            old_log_e2: [0.0; 2 * NB_EBANDS],
+            background_log_e: [0.0; 2 * NB_EBANDS],
+            x: Vec::new(),
+            freq: Vec::new(),
+            imdct: ImdctScratch::default(),
+            pcm_scratch: Vec::new(),
+        };
+        d.reset();
+        d
+    }
+
+    /// `OPUS_RESET_STATE`.
+    pub fn reset(&mut self) {
+        self.rng = 0;
+        self.loss_count = 0;
+        self.skip_plc = true;
+        self.postfilter_period = 0;
+        self.postfilter_period_old = 0;
+        self.postfilter_gain = 0.0;
+        self.postfilter_gain_old = 0.0;
+        self.postfilter_tapset = 0;
+        self.postfilter_tapset_old = 0;
+        self.preemph_mem = [0.0; 2];
+        self.decode_mem.fill(0.0);
+        self.old_band_e = [0.0; 2 * NB_EBANDS];
+        self.old_log_e = [-28.0; 2 * NB_EBANDS];
+        self.old_log_e2 = [-28.0; 2 * NB_EBANDS];
+        self.background_log_e = [0.0; 2 * NB_EBANDS];
+    }
+
+    fn mem_len(&self) -> usize {
+        DECODE_BUFFER_SIZE + OVERLAP
+    }
+
+    /// Decodes one CELT frame of `frame_size` samples (at the output rate) into interleaved `pcm`
+    /// (`channels` wide). With `accum`, the output is added to `pcm`. `data = None` (or fewer than
+    /// two bytes) runs the packet-loss concealment.
+    pub fn decode(
+        &mut self,
+        data: Option<&[u8]>,
+        frame_size: usize,
+        pcm: &mut [f32],
+        accum: bool,
+        dec: Option<&mut RangeDecoder>,
+    ) -> Result<usize, crate::Error> {
+        let n_full = frame_size * self.downsample;
+        let lm = match n_full {
+            120 => 0,
+            240 => 1,
+            480 => 2,
+            960 => 3,
+            _ => return Err(crate::Error::InvalidArgument("CELT frame size")),
+        };
+        let data = match data {
+            Some(d) if d.len() > 1 => d,
+            _ => {
+                self.decode_lost(n_full, lm);
+                self.deemphasis(n_full, pcm, accum);
+                return Ok(frame_size);
+            }
+        };
+        if data.len() > 1275 {
+            return Err(crate::Error::InvalidPacket("CELT frame too long"));
+        }
+        match dec {
+            Some(d) => self.decode_frame(d, data.len(), n_full, lm),
+            None => {
+                let mut own = RangeDecoder::new(data);
+                self.decode_frame(&mut own, data.len(), n_full, lm)
+            }
+        }
+        self.deemphasis(n_full, pcm, accum);
+        Ok(frame_size)
+    }
+
+    fn decode_frame(&mut self, dec: &mut RangeDecoder, len: usize, n: usize, lm: usize) {
+        let cc = self.channels;
+        let c = self.stream_channels;
+        let m = self.m;
+        let mm = 1usize << lm;
+        let start = self.start;
+        let end = self.end;
+        let eff_end = end.min(NB_EBANDS);
+        if self.loss_count == 0 {
+            self.skip_plc = false;
+        }
+        if c == 1 {
+            for i in 0..NB_EBANDS {
+                self.old_band_e[i] = self.old_band_e[i].max(self.old_band_e[NB_EBANDS + i]);
+            }
+        }
+        let total_bits_raw = len as i32 * 8;
+        let (silence, mut tell) = read_silence(dec, total_bits_raw);
+        let pf = read_postfilter_params(dec, start, tell, total_bits_raw);
+        tell = pf.tell;
+        let (postfilter_gain, postfilter_pitch, postfilter_tapset) = (pf.gain, pf.pitch, pf.tapset);
+        let is_transient = if lm > 0 && tell + 3 <= total_bits_raw {
+            let t = dec.bit_logp(3);
+            tell = dec.tell();
+            t
+        } else {
+            false
+        };
+        let short_blocks = is_transient;
+        let intra = if tell + 3 <= total_bits_raw { dec.bit_logp(3) } else { false };
+        unquant_coarse_energy(start, end, &mut self.old_band_e, intra, dec, c, lm);
+        let mut tf_res = [0i32; NB_EBANDS];
+        tf_decode(start, end, is_transient, &mut tf_res, lm, dec);
+        tell = dec.tell();
+        let mut spread = 2usize;
+        if tell + 4 <= total_bits_raw {
+            spread = dec.icdf(&SPREAD_ICDF, 5);
+        }
+        let cap = m.init_caps(lm, c);
+        let (offsets, tellf, total_bits) = decode_dynalloc(dec, start, end, c, lm, &cap, total_bits_raw);
+        let alloc_trim = if tellf + (6 << BITRES) <= total_bits { dec.icdf(&TRIM_ICDF, 7) as i32 } else { 5 };
+        let mut bits = ((len as i32 * 8) << BITRES) - dec.tell_frac() as i32 - 1;
+        let anti_collapse_rsv = if is_transient && lm >= 2 && bits >= ((lm as i32 + 2) << BITRES) { 1 << BITRES } else { 0 };
+        bits -= anti_collapse_rsv;
+        let alloc = compute_allocation(m, start, end, &offsets, &cap, alloc_trim, bits, c, lm, dec);
+        unquant_fine_energy(start, end, &mut self.old_band_e, &alloc.fine_quant, dec, c);
+
+        // Shift the decode memory by one frame.
+        let ml = self.mem_len();
+        for ch in 0..cc {
+            let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+            mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
+        }
+
+        let mut collapse_masks = vec![0u32; c * NB_EBANDS];
+        let mut x = std::mem::take(&mut self.x);
+        x.clear();
+        x.resize(c * n, 0.0);
+        {
+            let (xa, xb) = x.split_at_mut(n);
+            let yb = if c == 2 { Some(xb) } else { None };
+            let mut seed = self.rng;
+            quant_all_bands(
+                m,
+                start,
+                end,
+                xa,
+                yb,
+                &mut collapse_masks,
+                &alloc.pulses,
+                short_blocks,
+                spread,
+                alloc.dual_stereo,
+                alloc.intensity,
+                &tf_res,
+                ((len as i32) * (8 << BITRES)) - anti_collapse_rsv,
+                alloc.balance,
+                dec,
+                lm,
+                alloc.coded_bands,
+                &mut seed,
+                self.disable_inv,
+            );
+            self.rng = seed;
+        }
+        let mut anti_collapse_on = false;
+        if anti_collapse_rsv > 0 {
+            anti_collapse_on = dec.bits(1) != 0;
+        }
+        let bits_left = len as i32 * 8 - dec.tell();
+        unquant_energy_finalise(start, end, &mut self.old_band_e, &alloc.fine_quant, &alloc.fine_priority, bits_left, dec, c);
+        if anti_collapse_on {
+            anti_collapse(
+                &mut x,
+                &collapse_masks,
+                lm,
+                c,
+                n,
+                start,
+                end,
+                &self.old_band_e,
+                &self.old_log_e,
+                &self.old_log_e2,
+                &alloc.pulses,
+                self.rng,
+            );
+        }
+        if silence {
+            for v in self.old_band_e[..c * NB_EBANDS].iter_mut() {
+                *v = -28.0;
+            }
+        }
+        self.synthesis(&x, n, start, eff_end, c, is_transient, lm, silence);
+        self.x = x;
+
+        // Post-filter.
+        for ch in 0..cc {
+            self.postfilter_period = self.postfilter_period.max(COMBFILTER_MINPERIOD);
+            self.postfilter_period_old = self.postfilter_period_old.max(COMBFILTER_MINPERIOD);
+            let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+            let off = DECODE_BUFFER_SIZE - n;
+            comb_filter(
+                mem,
+                off,
+                self.postfilter_period_old,
+                self.postfilter_period,
+                SHORT_MDCT,
+                self.postfilter_gain_old,
+                self.postfilter_gain,
+                self.postfilter_tapset_old,
+                self.postfilter_tapset,
+                &m.window,
+            );
+            if lm != 0 {
+                comb_filter(
+                    mem,
+                    off + SHORT_MDCT,
+                    self.postfilter_period,
+                    postfilter_pitch,
+                    n - SHORT_MDCT,
+                    self.postfilter_gain,
+                    postfilter_gain,
+                    self.postfilter_tapset,
+                    postfilter_tapset,
+                    &m.window,
+                );
+            }
+        }
+        self.postfilter_period_old = self.postfilter_period;
+        self.postfilter_gain_old = self.postfilter_gain;
+        self.postfilter_tapset_old = self.postfilter_tapset;
+        self.postfilter_period = postfilter_pitch;
+        self.postfilter_gain = postfilter_gain;
+        self.postfilter_tapset = postfilter_tapset;
+        if lm != 0 {
+            self.postfilter_period_old = self.postfilter_period;
+            self.postfilter_gain_old = self.postfilter_gain;
+            self.postfilter_tapset_old = self.postfilter_tapset;
+        }
+
+        if c == 1 {
+            let (a, b) = self.old_band_e.split_at_mut(NB_EBANDS);
+            b.copy_from_slice(a);
+        }
+        if !is_transient {
+            self.old_log_e2 = self.old_log_e;
+            self.old_log_e = self.old_band_e;
+            for i in 0..2 * NB_EBANDS {
+                self.background_log_e[i] = (self.background_log_e[i] + mm as f32 * 0.001).min(self.old_band_e[i]);
+            }
+        } else {
+            for i in 0..2 * NB_EBANDS {
+                self.old_log_e[i] = self.old_log_e[i].min(self.old_band_e[i]);
+            }
+        }
+        for ch in 0..2 {
+            for i in (0..start).chain(end..NB_EBANDS) {
+                self.old_band_e[ch * NB_EBANDS + i] = 0.0;
+                self.old_log_e[ch * NB_EBANDS + i] = -28.0;
+                self.old_log_e2[ch * NB_EBANDS + i] = -28.0;
+            }
+        }
+        self.rng = dec.rng();
+        self.loss_count = 0;
+    }
+
+    /// Denormalisation + IMDCT into the decode memory (`celt_synthesis`).
+    #[allow(clippy::too_many_arguments)]
+    fn synthesis(&mut self, x: &[f32], n: usize, start: usize, eff_end: usize, c: usize, is_transient: bool, lm: usize, silence: bool) {
+        let cc = self.channels;
+        let m = self.m;
+        let mm = 1usize << lm;
+        let (bcount, nb, shift) = if is_transient { (mm, SHORT_MDCT, MAX_LM) } else { (1, SHORT_MDCT << lm, MAX_LM - lm) };
+        let ml = self.mem_len();
+        let mut freq = std::mem::take(&mut self.freq);
+        freq.clear();
+        freq.resize(2 * n, 0.0);
+        let (f0, f1) = freq.split_at_mut(n);
+        let out_off = DECODE_BUFFER_SIZE - n;
+        if cc == 2 && c == 1 {
+            denormalise_bands(x, f0, &self.old_band_e, start, eff_end, mm, self.downsample, silence);
+            f1.copy_from_slice(f0);
+            for (ch, f) in [(0usize, &*f1), (1usize, &*f0)] {
+                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+                for b in 0..bcount {
+                    m.mdct[shift].backward(&f[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
+                }
+            }
+        } else if cc == 1 && c == 2 {
+            denormalise_bands(x, f0, &self.old_band_e, start, eff_end, mm, self.downsample, silence);
+            denormalise_bands(&x[n..], f1, &self.old_band_e[NB_EBANDS..], start, eff_end, mm, self.downsample, silence);
+            for i in 0..n {
+                f0[i] = 0.5 * (f0[i] + f1[i]);
+            }
+            let mem = &mut self.decode_mem[..ml];
+            for b in 0..bcount {
+                m.mdct[shift].backward(&f0[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
+            }
+        } else {
+            for ch in 0..cc {
+                denormalise_bands(&x[ch * n..], f0, &self.old_band_e[ch * NB_EBANDS..], start, eff_end, mm, self.downsample, silence);
+                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+                for b in 0..bcount {
+                    m.mdct[shift].backward(&f0[b..], bcount, &mut mem[out_off + nb * b..], &m.window, OVERLAP, &mut self.imdct);
+                }
+            }
+        }
+        self.freq = freq;
+    }
+
+    fn deemphasis(&mut self, n: usize, pcm: &mut [f32], accum: bool) {
+        let cc = self.channels;
+        let ml = self.mem_len();
+        let ds = self.downsample;
+        let out_off = DECODE_BUFFER_SIZE - n;
+        let mut scratch = std::mem::take(&mut self.pcm_scratch);
+        for ch in 0..cc {
+            let mem = &self.decode_mem[ch * ml + out_off..ch * ml + out_off + n];
+            let mut mstate = self.preemph_mem[ch];
+            scratch.clear();
+            for &v in mem {
+                let tmp = v + 1e-30 + mstate;
+                mstate = PREEMPH * tmp;
+                scratch.push(tmp);
+            }
+            self.preemph_mem[ch] = mstate;
+            for j in 0..n / ds {
+                let v = scratch[j * ds] * (1.0 / 32768.0);
+                let o = &mut pcm[j * cc + ch];
+                if accum {
+                    *o += v;
+                } else {
+                    *o = v;
+                }
+            }
+        }
+        self.pcm_scratch = scratch;
+    }
+
+    /// Packet-loss concealment: pitch-periodic extension for the first lost frames, then
+    /// decaying shaped noise.
+    fn decode_lost(&mut self, n: usize, lm: usize) {
+        let cc = self.channels;
+        let ml = self.mem_len();
+        let m = self.m;
+        let pitch_based = self.loss_count < 5 && self.start == 0 && !self.skip_plc;
+        if !pitch_based {
+            let decay = if self.loss_count == 0 { 1.5 } else { 0.5 };
+            for ch in 0..cc {
+                for i in self.start..self.end {
+                    let k = ch * NB_EBANDS + i;
+                    self.old_band_e[k] = self.background_log_e[k].max(self.old_band_e[k] - decay);
+                }
+            }
+            let mut seed = self.rng;
+            let mut x = std::mem::take(&mut self.x);
+            x.clear();
+            x.resize(cc * n, 0.0);
+            let eff_end = self.end.min(NB_EBANDS);
+            for ch in 0..cc {
+                for i in self.start..eff_end {
+                    let off = n * ch + ((EBANDS[i] as usize) << lm);
+                    let blen = ((EBANDS[i + 1] - EBANDS[i]) as usize) << lm;
+                    for v in x[off..off + blen].iter_mut() {
+                        seed = bands::lcg_rand(seed);
+                        *v = ((seed as i32) >> 20) as f32;
+                    }
+                    renormalise_vector(&mut x[off..off + blen], 1.0);
+                }
+            }
+            self.rng = seed;
+            for ch in 0..cc {
+                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+                mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
+            }
+            let saved_sc = self.stream_channels;
+            self.stream_channels = cc;
+            self.synthesis(&x, n, self.start, eff_end, cc, false, lm, false);
+            self.stream_channels = saved_sc;
+            self.x = x;
+        } else {
+            // Pitch search on the (mono-mixed) history.
+            let hist_len = 1024usize;
+            let base = DECODE_BUFFER_SIZE - hist_len;
+            let mut mono = vec![0f32; hist_len];
+            for ch in 0..cc {
+                for (i, v) in mono.iter_mut().enumerate() {
+                    *v += self.decode_mem[ch * ml + base + i];
+                }
+            }
+            let period = if self.loss_count == 0 { find_pitch(&mono) } else { self.postfilter_period_old.max(PLC_PITCH_LAG_MIN as i32) as usize };
+            let period = period.clamp(PLC_PITCH_LAG_MIN, PLC_PITCH_LAG_MAX);
+            // Remember the period for subsequent losses in the (otherwise unused) old period slot.
+            self.postfilter_period_old = period as i32;
+            let fade = 0.8f32.powi(self.loss_count as i32 + 1);
+            let mut ext = vec![0f32; n + OVERLAP];
+            for ch in 0..cc {
+                let mem = &mut self.decode_mem[ch * ml..(ch + 1) * ml];
+                // Energy decay across the last two periods.
+                let e1: f32 = mem[DECODE_BUFFER_SIZE - period..DECODE_BUFFER_SIZE].iter().map(|v| v * v).sum();
+                let e0: f32 = mem[DECODE_BUFFER_SIZE - 2 * period..DECODE_BUFFER_SIZE - period].iter().map(|v| v * v).sum();
+                let decay = if e0 > 0.0 { (e1 / e0).sqrt().min(1.0) } else { 0.0 };
+                let mut g = 1.0f32;
+                for (i, e) in ext.iter_mut().enumerate() {
+                    if i > 0 && i % period == 0 {
+                        g *= decay;
+                    }
+                    let src = DECODE_BUFFER_SIZE - period + (i % period);
+                    *e = mem[src] * g * fade;
+                }
+                mem.copy_within(n..DECODE_BUFFER_SIZE + OVERLAP / 2, 0);
+                let out_off = DECODE_BUFFER_SIZE - n;
+                // Cross-fade the start with the previous overlap so the transition is smooth.
+                mem[out_off..out_off + n].copy_from_slice(&ext[..n]);
+                let tail = &ext[n..n + OVERLAP];
+                for i in 0..OVERLAP / 2 {
+                    mem[DECODE_BUFFER_SIZE + i] = m.window[i] * tail[OVERLAP - 1 - i] + m.window[OVERLAP - 1 - i] * tail[i];
+                }
+            }
+        }
+        self.loss_count += 1;
+    }
+}
+
+fn find_pitch(x: &[f32]) -> usize {
+    let n = x.len();
+    let win = 512.min(n - PLC_PITCH_LAG_MAX);
+    let tgt = &x[n - win..];
+    let mut best = PLC_PITCH_LAG_MIN;
+    let mut best_score = f32::MIN;
+    let e_t: f32 = tgt.iter().map(|v| v * v).sum::<f32>() + 1e-9;
+    for lag in PLC_PITCH_LAG_MIN..=PLC_PITCH_LAG_MAX {
+        let src = &x[n - win - lag..n - lag];
+        let mut xy = 0f32;
+        let mut yy = 1e-9f32;
+        for (a, b) in tgt.iter().zip(src) {
+            xy += a * b;
+            yy += b * b;
+        }
+        let score = xy / (e_t * yy).sqrt();
+        if score > best_score {
+            best_score = score;
+            best = lag;
+        }
+    }
+    best
+}
+
+fn tf_decode(start: usize, end: usize, is_transient: bool, tf_res: &mut [i32; NB_EBANDS], lm: usize, dec: &mut RangeDecoder) {
+    let mut budget = dec.storage() as i32 * 8;
+    let mut tell = dec.tell();
+    let mut logp: u32 = if is_transient { 2 } else { 4 };
+    let tf_select_rsv = lm > 0 && tell + (logp as i32) < budget;
+    budget -= tf_select_rsv as i32;
+    let mut tf_changed = 0;
+    let mut curr = 0;
+    for r in tf_res.iter_mut().take(end).skip(start) {
+        if tell + logp as i32 <= budget {
+            curr ^= dec.bit_logp(logp) as i32;
+            tell = dec.tell();
+            tf_changed |= curr;
+        }
+        *r = curr;
+        logp = if is_transient { 4 } else { 5 };
+    }
+    let mut tf_select = 0;
+    let ti = 4 * is_transient as usize;
+    if tf_select_rsv && TF_SELECT_TABLE[lm][ti + tf_changed as usize] != TF_SELECT_TABLE[lm][ti + 2 + tf_changed as usize] {
+        tf_select = dec.bit_logp(1) as usize;
+    }
+    for r in tf_res.iter_mut().take(end).skip(start) {
+        *r = TF_SELECT_TABLE[lm][ti + 2 * tf_select + *r as usize] as i32;
+    }
+}
+
+/// Pitch post-filter (in place on `buf[off .. off + n]`, reading history before `off`).
+#[allow(clippy::too_many_arguments)]
+fn comb_filter(buf: &mut [f32], off: usize, t0: i32, t1: i32, n: usize, g0: f32, g1: f32, tapset0: usize, tapset1: usize, window: &[f32; OVERLAP]) {
+    if g0 == 0.0 && g1 == 0.0 {
+        return;
+    }
+    let t0 = t0.max(COMBFILTER_MINPERIOD) as usize;
+    let t1 = t1.max(COMBFILTER_MINPERIOD) as usize;
+    let g00 = g0 * COMB_GAINS[tapset0][0];
+    let g01 = g0 * COMB_GAINS[tapset0][1];
+    let g02 = g0 * COMB_GAINS[tapset0][2];
+    let g10 = g1 * COMB_GAINS[tapset1][0];
+    let g11 = g1 * COMB_GAINS[tapset1][1];
+    let g12 = g1 * COMB_GAINS[tapset1][2];
+    let mut x1 = buf[off + 1 - t1];
+    let mut x2 = buf[off - t1];
+    let mut x3 = buf[off - t1 - 1];
+    let mut x4 = buf[off - t1 - 2];
+    let overlap = if g0 == g1 && t0 == t1 && tapset0 == tapset1 { 0 } else { OVERLAP.min(n) };
+    let mut i = 0;
+    while i < overlap {
+        let p = off + i;
+        let x0 = buf[p + 2 - t1];
+        let f = window[i] * window[i];
+        let a = 1.0 - f;
+        buf[p] = buf[p]
+            + a * g00 * buf[p - t0]
+            + a * g01 * (buf[p + 1 - t0] + buf[p - t0 - 1])
+            + a * g02 * (buf[p + 2 - t0] + buf[p - t0 - 2])
+            + f * g10 * x2
+            + f * g11 * (x1 + x3)
+            + f * g12 * (x0 + x4);
+        x4 = x3;
+        x3 = x2;
+        x2 = x1;
+        x1 = x0;
+        i += 1;
+    }
+    if g1 == 0.0 {
+        return;
+    }
+    // Constant filter for the rest of the block.
+    let t = t1;
+    for i in overlap..n {
+        let p = off + i;
+        buf[p] = buf[p] + g10 * buf[p - t] + g11 * (buf[p + 1 - t] + buf[p - t - 1]) + g12 * (buf[p + 2 - t] + buf[p - t - 2]);
+    }
+}
@@ -0,0 +1,171 @@
+//! Band energy decoding: Laplace-coded coarse energy, fine energy and the final refinement
+//! (RFC 6716 §4.3.2).
+
+use super::rate::MAX_FINE_BITS;
+use super::tables::{BETA_COEF, BETA_INTRA, E_PROB_MODEL, NB_EBANDS, PRED_COEF, SMALL_ENERGY_ICDF};
+use crate::range::RangeDecoder;
+
+const LAPLACE_MINP: u32 = 1;
+const LAPLACE_NMIN: u32 = 16;
+
+fn laplace_get_freq1(fs0: u32, decay: u32) -> u32 {
+    let ft = 32768 - LAPLACE_MINP * (2 * LAPLACE_NMIN) - fs0;
+    (ft * (16384 - decay)) >> 15
+}
+
+/// Decodes a Laplace-distributed integer (`fs` = probability of 0 in Q15, `decay` in Q14).
+pub fn laplace_decode(dec: &mut RangeDecoder, mut fs: u32, decay: u32) -> i32 {
+    let mut val = 0i32;
+    let fm = dec.decode_bin(15);
+    let mut fl = 0u32;
+    if fm >= fs {
+        val += 1;
+        fl = fs;
+        fs = laplace_get_freq1(fs, decay) + LAPLACE_MINP;
+        while fs > LAPLACE_MINP && fm >= fl + 2 * fs {
+            fs *= 2;
+            fl += fs;
+            fs = (((fs - 2 * LAPLACE_MINP) * decay) >> 15) + LAPLACE_MINP;
+            val += 1;
+        }
+        if fs <= LAPLACE_MINP {
+            let di = (fm - fl) >> 1;
+            val += di as i32;
+            fl += 2 * di * LAPLACE_MINP;
+        }
+        if fm < fl + fs {
+            val = -val;
+        } else {
+            fl += fs;
+        }
+    }
+    dec.update_bin(fl, (fl + fs).min(32768), 15);
+    val
+}
+
+/// `unquant_coarse_energy`.
+#[allow(clippy::too_many_arguments)]
+pub fn unquant_coarse_energy(start: usize, end: usize, old_e: &mut [f32], intra: bool, dec: &mut RangeDecoder, c: usize, lm: usize) {
+    let prob = &E_PROB_MODEL[lm][intra as usize];
+    let (coef, beta) = if intra { (0.0, BETA_INTRA) } else { (PRED_COEF[lm], BETA_COEF[lm]) };
+    let budget = dec.storage() as i32 * 8;
+    let mut prev = [0f32; 2];
+    for i in start..end {
+        for ch in 0..c {
+            let tell = dec.tell();
+            let qi = if budget - tell >= 15 {
+                let pi = 2 * i.min(20);
+                laplace_decode(dec, (prob[pi] as u32) << 7, (prob[pi + 1] as u32) << 6)
+            } else if budget - tell >= 2 {
+                let q = dec.icdf(&SMALL_ENERGY_ICDF, 2) as i32;
+                (q >> 1) ^ -(q & 1)
+            } else if budget - tell >= 1 {
+                -(dec.bit_logp(1) as i32)
+            } else {
+                -1
+            };
+            let q = qi as f32;
+            let idx = i + ch * NB_EBANDS;
+            old_e[idx] = old_e[idx].max(-9.0);
+            let tmp = coef * old_e[idx] + prev[ch] + q;
+            old_e[idx] = tmp;
+            prev[ch] = prev[ch] + q - beta * q;
+        }
+    }
+}
+
+pub fn unquant_fine_energy(start: usize, end: usize, old_e: &mut [f32], fine_quant: &[i32; NB_EBANDS], dec: &mut RangeDecoder, c: usize) {
+    for i in start..end {
+        let fq = fine_quant[i];
+        if fq <= 0 {
+            continue;
+        }
+        for ch in 0..c {
+            let q2 = dec.bits(fq as u32);
+            let offset = (q2 as f32 + 0.5) * (1 << (14 - fq)) as f32 / 16384.0 - 0.5;
+            old_e[i + ch * NB_EBANDS] += offset;
+        }
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+pub fn unquant_energy_finalise(
+    start: usize,
+    end: usize,
+    old_e: &mut [f32],
+    fine_quant: &[i32; NB_EBANDS],
+    fine_priority: &[i32; NB_EBANDS],
+    mut bits_left: i32,
+    dec: &mut RangeDecoder,
+    c: usize,
+) {
+    for prio in 0..2 {
+        let mut i = start;
+        while i < end && bits_left >= c as i32 {
+            if fine_quant[i] >= MAX_FINE_BITS || fine_priority[i] != prio {
+                i += 1;
+                continue;
+            }
+            for ch in 0..c {
+                let q2 = dec.bits(1);
+                let offset = (q2 as f32 - 0.5) * (1 << (14 - fine_quant[i] - 1)) as f32 / 16384.0;
+                old_e[i + ch * NB_EBANDS] += offset;
+                bits_left -= 1;
+            }
+            i += 1;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::range::enc::RangeEncoder;
+
+    fn laplace_encode(e: &mut RangeEncoder, value: i32, mut fs: u32, decay: u32) {
+        let mut fl = 0u32;
+        let mut val = value;
+        if val != 0 {
+            let s: i32 = if val < 0 { -1 } else { 0 };
+            val = val.abs();
+            fl = fs;
+            fs = laplace_get_freq1(fs, decay);
+            let mut i = 1;
+            while fs > 0 && i < val {
+                fs *= 2;
+                fl += fs + 2 * LAPLACE_MINP;
+                fs = (fs * decay) >> 15;
+                i += 1;
+            }
+            if fs == 0 {
+                let ndi_max = (32768 - fl + LAPLACE_MINP - 1) as i32;
+                let ndi_max = (ndi_max - s) >> 1;
+                let di = (val - i).min(ndi_max - 1);
+                fl = (fl as i32 + (2 * di + 1 + s) * LAPLACE_MINP as i32) as u32;
+                fs = LAPLACE_MINP.min(32768 - fl);
+            } else {
+                fs += LAPLACE_MINP;
+                if s == 0 {
+                    fl += fs;
+                }
+            }
+        }
+        e.encode(fl, fl + fs, 32768);
+    }
+
+    #[test]
+    fn laplace_roundtrip() {
+        for &(fs, decay) in &[(72u32 << 7, 127u32 << 6), (24 << 7, 179 << 6), (177 << 7, 11 << 6)] {
+            let vals: Vec<i32> = (-12..=12).collect();
+            let mut e = RangeEncoder::new(400);
+            for &v in &vals {
+                laplace_encode(&mut e, v, fs, decay);
+            }
+            let buf = e.done();
+            let mut d = RangeDecoder::new(&buf);
+            for &v in &vals {
+                assert_eq!(laplace_decode(&mut d, fs, decay), v, "fs={fs} v={v}");
+            }
+        }
+    }
+}
@@ -0,0 +1,205 @@
+//! Inverse MDCT with the low-overlap window and in-place TDAC (RFC 6716 §4.3.7).
+//!
+//! The IMDCT is computed through an N/4-point complex FFT (pre-rotation, FFT, post-rotation),
+//! producing the N/2 "folded" time samples; the window overlap region is then unfolded against the
+//! folded tail of the previous block, which the caller keeps in place in the output buffer.
+
+#[derive(Clone, Copy, Default, Debug)]
+pub struct Cpx {
+    pub re: f32,
+    pub im: f32,
+}
+
+impl Cpx {
+    #[inline]
+    fn mul(self, o: Cpx) -> Cpx {
+        Cpx { re: self.re * o.re - self.im * o.im, im: self.re * o.im + self.im * o.re }
+    }
+    #[inline]
+    fn add(self, o: Cpx) -> Cpx {
+        Cpx { re: self.re + o.re, im: self.im + o.im }
+    }
+}
+
+/// Mixed-radix (2, 3, 4, 5) forward complex FFT, unscaled.
+pub struct Fft {
+    n: usize,
+    factors: Vec<usize>,
+    twiddle: Vec<Cpx>,
+}
+
+impl Fft {
+    pub fn new(n: usize) -> Fft {
+        let mut factors = Vec::new();
+        let mut m = n;
+        for p in [4usize, 2, 3, 5] {
+            while m.is_multiple_of(p) {
+                factors.push(p);
+                m /= p;
+            }
+        }
+        assert_eq!(m, 1, "unsupported FFT size {n}");
+        let twiddle = (0..n)
+            .map(|k| {
+                let ph = -2.0 * std::f64::consts::PI * k as f64 / n as f64;
+                Cpx { re: ph.cos() as f32, im: ph.sin() as f32 }
+            })
+            .collect();
+        Fft { n, factors, twiddle }
+    }
+
+    pub fn process(&self, data: &mut [Cpx], scratch: &mut Vec<Cpx>) {
+        scratch.clear();
+        scratch.extend_from_slice(&data[..self.n]);
+        self.rec(&mut data[..self.n], scratch, 1, self.n, 0, 1);
+    }
+
+    fn rec(&self, out: &mut [Cpx], inp: &[Cpx], in_stride: usize, n: usize, fi: usize, tw_stride: usize) {
+        let p = self.factors[fi];
+        let m = n / p;
+        if m == 1 {
+            for (i, o) in out.iter_mut().enumerate().take(p) {
+                *o = inp[i * in_stride];
+            }
+        } else {
+            for q in 0..p {
+                self.rec(&mut out[q * m..(q + 1) * m], &inp[q * in_stride..], in_stride * p, m, fi + 1, tw_stride * p);
+            }
+        }
+        let big = self.n;
+        let mut t = [Cpx::default(); 5];
+        for k in 0..m {
+            for q in 0..p {
+                let w = self.twiddle[(q * k * tw_stride) % big];
+                t[q] = out[q * m + k].mul(w);
+            }
+            for q2 in 0..p {
+                let mut acc = Cpx::default();
+                for (q, tq) in t.iter().enumerate().take(p) {
+                    let w = self.twiddle[((q * q2) % p) * (big / p)];
+                    acc = acc.add(tq.mul(w));
+                }
+                out[q2 * m + k] = acc;
+            }
+        }
+    }
+}
+
+pub struct Imdct {
+    /// Full MDCT length (2x the number of coefficients).
+    n: usize,
+    trig: Vec<f32>,
+    fft: Fft,
+}
+
+impl Imdct {
+    pub fn new(n: usize) -> Imdct {
+        let trig = (0..n / 2).map(|i| (2.0 * std::f64::consts::PI * (i as f64 + 0.125) / n as f64).cos() as f32).collect();
+        Imdct { n, trig, fft: Fft::new(n / 4) }
+    }
+
+    /// Inverse transform of `n/2` coefficients read from `input` at `stride`.
+    ///
+    /// Writes the folded block to `out[overlap/2 .. overlap/2 + n/2]` and unfolds the first
+    /// `overlap` samples against the previous block's folded tail already stored in
+    /// `out[0 .. overlap/2]`.
+    pub fn backward(&self, input: &[f32], stride: usize, out: &mut [f32], window: &[f32], overlap: usize, work: &mut ImdctScratch) {
+        let n2 = self.n >> 1;
+        let n4 = self.n >> 2;
+        let t = &self.trig;
+        let z = &mut work.z;
+        z.clear();
+        for i in 0..n4 {
+            let x1 = input[2 * i * stride];
+            let x2 = input[stride * (n2 - 1 - 2 * i)];
+            let yr = x2 * t[i] + x1 * t[n4 + i];
+            let yi = x1 * t[i] - x2 * t[n4 + i];
+            z.push(Cpx { re: yi, im: yr });
+        }
+        self.fft.process(z, &mut work.scratch);
+        let base = overlap >> 1;
+        let y = &mut out[base..base + n2];
+        for i in 0..n4.div_ceil(2) {
+            let front = z[i];
+            let back = z[n4 - 1 - i];
+            let (re, im) = (front.im, front.re);
+            let (t0, t1) = (t[i], t[n4 + i]);
+            let yr0 = re * t0 + im * t1;
+            let yi0 = re * t1 - im * t0;
+            let (re, im) = (back.im, back.re);
+            let (t0, t1) = (t[n4 - i - 1], t[n2 - i - 1]);
+            let yr1 = re * t0 + im * t1;
+            let yi1 = re * t1 - im * t0;
+            y[2 * i] = yr0;
+            y[n2 - 1 - 2 * i] = yi0;
+            y[n2 - 2 - 2 * i] = yr1;
+            y[2 * i + 1] = yi1;
+        }
+        // Mirror on both sides for TDAC.
+        for i in 0..overlap / 2 {
+            let x1 = out[overlap - 1 - i];
+            let x2 = out[i];
+            let w1 = window[i];
+            let w2 = window[overlap - 1 - i];
+            out[i] = x2 * w2 - x1 * w1;
+            out[overlap - 1 - i] = x2 * w1 + x1 * w2;
+        }
+    }
+}
+
+#[derive(Default)]
+pub struct ImdctScratch {
+    z: Vec<Cpx>,
+    scratch: Vec<Cpx>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn fft_matches_dft() {
+        for &n in &[60usize, 120, 240, 480] {
+            let fft = Fft::new(n);
+            let x: Vec<Cpx> = (0..n).map(|i| Cpx { re: ((i * 7) % 13) as f32 - 6.0, im: ((i * 3) % 5) as f32 - 2.0 }).collect();
+            let mut y = x.clone();
+            fft.process(&mut y, &mut Vec::new());
+            for k in [0, 1, 7, n / 2, n - 1] {
+                let mut acc = (0f64, 0f64);
+                for (i, v) in x.iter().enumerate() {
+                    let ph = -2.0 * std::f64::consts::PI * (i * k) as f64 / n as f64;
+                    acc.0 += v.re as f64 * ph.cos() - v.im as f64 * ph.sin();
+                    acc.1 += v.re as f64 * ph.sin() + v.im as f64 * ph.cos();
+                }
+                assert!((acc.0 - y[k].re as f64).abs() < 1e-2 && (acc.1 - y[k].im as f64).abs() < 1e-2, "n={n} k={k}");
+            }
+        }
+    }
+
+    /// The folded output must equal the direct IMDCT formula folded by TDAC symmetry.
+    #[test]
+    fn imdct_matches_direct_formula() {
+        let n = 240;
+        let n2 = n / 2;
+        let im = Imdct::new(n);
+        let x: Vec<f32> = (0..n2).map(|k| ((k * 37 % 11) as f32 - 5.0) / 5.0).collect();
+        let overlap = 0;
+        let mut out = vec![0f32; n2];
+        im.backward(&x, 1, &mut out, &[], overlap, &mut ImdctScratch::default());
+        // Direct IMDCT y[t] = sum X[k] cos(2pi/N (t + 1/2 + N/4)(k + 1/2)), t in 0..N.
+        let y: Vec<f64> = (0..n)
+            .map(|t| {
+                (0..n2)
+                    .map(|k| x[k] as f64 * (2.0 * std::f64::consts::PI / n as f64 * (t as f64 + 0.5 + n as f64 / 4.0) * (k as f64 + 0.5)).cos())
+                    .sum()
+            })
+            .collect();
+        // The folded half: out[i] relates to y in the middle half; check proportionality.
+        let mid: Vec<f64> = (0..n2).map(|i| y[n / 4 + i]).collect();
+        let dot: f64 = mid.iter().zip(&out).map(|(a, b)| a * *b as f64).sum();
+        let ea: f64 = mid.iter().map(|a| a * a).sum();
+        let eb: f64 = out.iter().map(|b| (*b as f64).powi(2)).sum();
+        let corr = dot.abs() / (ea.sqrt() * eb.sqrt());
+        assert!(corr > 0.999, "corr {corr}");
+    }
+}
@@ -0,0 +1,584 @@
+//! Pulse cache and bit allocation (RFC 6716 §4.3.3, §4.3.4.1).
+
+use super::tables::{ALLOC, EBANDS, LOG2_FRAC_TABLE, MAX_LM, NB_EBANDS, OVERLAP};
+use crate::range::{BITRES, RangeDecoder};
+
+const MAX_PSEUDO: i32 = 40;
+const LOG_MAX_PSEUDO: i32 = 6;
+pub const MAX_FINE_BITS: i32 = 8;
+const FINE_OFFSET: i32 = 21;
+pub const QTHETA_OFFSET: i32 = 4;
+pub const QTHETA_OFFSET_TWOPHASE: i32 = 16;
+const ALLOC_STEPS: i32 = 6;
+
+/// Number of pulses represented by pseudo-pulse index `i`.
+pub fn get_pulses(i: i32) -> i32 {
+    if i < 8 { i } else { (8 + (i & 7)) << ((i >> 3) - 1) }
+}
+
+/// Conservative (rounded up) log2 of `val` with `frac` fractional bits.
+pub fn log2_frac(mut val: u32, mut frac: u32) -> i32 {
+    let mut l = crate::range::ilog(val);
+    if val & val.wrapping_sub(1) != 0 {
+        if l > 16 {
+            val = ((val - 1) >> (l - 16)) + 1;
+        } else {
+            val <<= 16 - l;
+        }
+        let mut l = (l - 1) << frac;
+        loop {
+            let b = (val >> 16) as i32;
+            l += b << frac;
+            val = (val + b as u32) >> b;
+            val = (val * val + 0x7FFF) >> 15;
+            if frac == 0 {
+                break;
+            }
+            frac -= 1;
+        }
+        l + (val > 0x8000) as i32
+    } else {
+        l -= 1;
+        l << frac
+    }
+}
+
+/// PVQ codebook size V(N, K) as u128 (saturating far above 2^32).
+pub fn pvq_v(n: usize, k: usize) -> u128 {
+    // V(N,K) = V(N-1,K) + V(N,K-1) + V(N-1,K-1); computed row by row.
+    if k == 0 {
+        return 1;
+    }
+    if n == 0 {
+        return 0;
+    }
+    let mut row = vec![0u128; k + 1]; // V(0, k)
+    row[0] = 1;
+    for _ in 0..n {
+        let mut prev_diag = row[0]; // V(n-1, 0)
+        // V(n, 0) = 1
+        for kk in 1..=k {
+            let up = row[kk]; // V(n-1, kk)
+            let v = up.saturating_add(row[kk - 1]).saturating_add(prev_diag);
+            prev_diag = up;
+            row[kk] = v.min(u128::MAX >> 8);
+        }
+        row[0] = 1;
+    }
+    row[k]
+}
+
+fn fits_in32(n: usize, k: i32) -> bool {
+    pvq_v(n, k as usize) <= u32::MAX as u128
+}
+
+/// Precomputed per-mode data shared by all CELT decoders.
+pub struct Mode {
+    /// log2 of band width in 1/8 bits.
+    pub log_n: [i32; NB_EBANDS],
+    /// Index into `cache_bits` for `(LM+1)*NB_EBANDS + band` (-1 when unused).
+    pub cache_index: Vec<i16>,
+    /// `cache[0]` = max pseudo-pulses; `cache[k]` = bits(k) - 1 in 1/8 bits.
+    pub cache_bits: Vec<u8>,
+    /// Per-band maximum allocation: `[(2*LM + C-1)*NB_EBANDS + band]`.
+    pub caps: Vec<u8>,
+    pub window: [f32; OVERLAP],
+    pub mdct: [super::mdct::Imdct; MAX_LM + 1],
+}
+
+impl Mode {
+    pub fn new() -> Mode {
+        let mut log_n = [0i32; NB_EBANDS];
+        for (i, l) in log_n.iter_mut().enumerate() {
+            *l = log2_frac((EBANDS[i + 1] - EBANDS[i]) as u32, BITRES);
+        }
+        let (cache_index, cache_bits) = compute_pulse_cache(MAX_LM as i32);
+        let mut m = Mode {
+            log_n,
+            cache_index,
+            cache_bits,
+            caps: Vec::new(),
+            window: [0.0; OVERLAP],
+            mdct: [super::mdct::Imdct::new(1920), super::mdct::Imdct::new(960), super::mdct::Imdct::new(480), super::mdct::Imdct::new(240)],
+        };
+        m.caps = compute_caps(&m);
+        for i in 0..OVERLAP {
+            let x = std::f64::consts::FRAC_PI_2 * (i as f64 + 0.5) / OVERLAP as f64;
+            let s = x.sin();
+            m.window[i] = (std::f64::consts::FRAC_PI_2 * s * s).sin() as f32;
+        }
+        m
+    }
+
+    #[inline]
+    pub fn cache(&self, lm: i32, band: usize) -> &[u8] {
+        let idx = self.cache_index[((lm + 1) as usize) * NB_EBANDS + band];
+        &self.cache_bits[idx.max(0) as usize..]
+    }
+
+    pub fn bits2pulses(&self, band: usize, lm: i32, bits: i32) -> i32 {
+        let cache = self.cache(lm, band);
+        let mut lo = 0i32;
+        let mut hi = cache[0] as i32;
+        let bits = bits - 1;
+        for _ in 0..LOG_MAX_PSEUDO {
+            let mid = (lo + hi + 1) >> 1;
+            if cache[mid as usize] as i32 >= bits {
+                hi = mid;
+            } else {
+                lo = mid;
+            }
+        }
+        let lo_bits = if lo == 0 { -1 } else { cache[lo as usize] as i32 };
+        if bits - lo_bits <= cache[hi as usize] as i32 - bits { lo } else { hi }
+    }
+
+    pub fn pulses2bits(&self, band: usize, lm: i32, pulses: i32) -> i32 {
+        if pulses == 0 { 0 } else { self.cache(lm, band)[pulses as usize] as i32 + 1 }
+    }
+
+    /// Per-band allocation caps for this frame (`init_caps`).
+    pub fn init_caps(&self, lm: usize, c: usize) -> [i32; NB_EBANDS] {
+        let mut cap = [0i32; NB_EBANDS];
+        for (i, cp) in cap.iter_mut().enumerate() {
+            let n = (EBANDS[i + 1] - EBANDS[i]) << lm;
+            *cp = (self.caps[NB_EBANDS * (2 * lm + c - 1) + i] as i32 + 64) * c as i32 * n >> 2;
+        }
+        cap
+    }
+}
+
+fn compute_pulse_cache(lm_max: i32) -> (Vec<i16>, Vec<u8>) {
+    let nb = NB_EBANDS;
+    let rows = (lm_max + 2) as usize;
+    let mut index = vec![-1i16; nb * rows];
+    let mut entries: Vec<(usize, i32, usize)> = Vec::new(); // (N, K, offset)
+    let mut curr = 0usize;
+    for i in 0..rows {
+        for j in 0..nb {
+            let n = (((EBANDS[j + 1] - EBANDS[j]) << i) >> 1) as usize;
+            index[i * nb + j] = -1;
+            // Reuse the entry of an earlier band with the same size.
+            'search: for k in 0..=i {
+                for nn in 0..nb {
+                    if k == i && nn >= j {
+                        break;
+                    }
+                    if n == (((EBANDS[nn + 1] - EBANDS[nn]) << k) >> 1) as usize {
+                        index[i * nb + j] = index[k * nb + nn];
+                        break 'search;
+                    }
+                }
+            }
+            if index[i * nb + j] == -1 && n != 0 {
+                let mut k = 0;
+                while k < MAX_PSEUDO && fits_in32(n, get_pulses(k + 1)) {
+                    k += 1;
+                }
+                index[i * nb + j] = curr as i16;
+                entries.push((n, k, curr));
+                curr += (k + 1) as usize;
+            }
+        }
+    }
+    let mut bits = vec![0u8; curr];
+    for &(n, k, off) in &entries {
+        let maxk = get_pulses(k) as usize;
+        let tmp = required_bits(n, maxk, BITRES);
+        for j in 1..=k {
+            bits[off + j as usize] = (tmp[get_pulses(j) as usize] - 1) as u8;
+        }
+        bits[off] = k as u8;
+    }
+    (index, bits)
+}
+
+/// Bits (1/2^frac units, rounded up) needed for each K in `0..=maxk` for dimension `n`.
+fn required_bits(n: usize, maxk: usize, frac: u32) -> Vec<i32> {
+    let mut out = vec![0i32; maxk + 1];
+    if n == 1 {
+        for o in out.iter_mut().skip(1) {
+            *o = 1 << frac;
+        }
+    } else {
+        for (k, o) in out.iter_mut().enumerate().skip(1) {
+            let v = pvq_v(n, k);
+            *o = log2_frac(v as u32, frac);
+        }
+    }
+    out
+}
+
+fn compute_caps(m: &Mode) -> Vec<u8> {
+    let nb = NB_EBANDS;
+    let mut caps = vec![0u8; (MAX_LM + 1) * 2 * nb];
+    for i in 0..=MAX_LM as i32 {
+        for c in 1..=2i32 {
+            for j in 0..nb {
+                let mut n0 = EBANDS[j + 1] - EBANDS[j];
+                let max_bits = if n0 << i == 1 {
+                    c * (1 + MAX_FINE_BITS) << BITRES
+                } else {
+                    let mut lm0 = 0;
+                    if n0 > 2 {
+                        n0 >>= 1;
+                        lm0 -= 1;
+                    } else if n0 <= 1 {
+                        lm0 = i.min(1);
+                        n0 <<= lm0;
+                    }
+                    let pcache = m.cache(lm0, j);
+                    let mut mb = pcache[pcache[0] as usize] as i32 + 1;
+                    let mut n = n0;
+                    for k in 0..(i - lm0) {
+                        mb <<= 1;
+                        let offset = ((m.log_n[j] + ((lm0 + k) << BITRES)) >> 1) - QTHETA_OFFSET;
+                        let num = 459 * ((2 * n - 1) * offset + mb);
+                        let den = ((2 * n - 1) << 9) - 459;
+                        let qb = ((num + (den >> 1)) / den).min(57);
+                        mb += qb;
+                        n <<= 1;
+                    }
+                    if c == 2 {
+                        mb <<= 1;
+                        let offset = ((m.log_n[j] + (i << BITRES)) >> 1) - if n == 2 { QTHETA_OFFSET_TWOPHASE } else { QTHETA_OFFSET };
+                        let ndof = 2 * n - 1 - (n == 2) as i32;
+                        let p = if n == 2 { 512 } else { 487 };
+                        let num = p * (mb + ndof * offset);
+                        let den = (ndof << 9) - p;
+                        let qb = ((num + (den >> 1)) / den).min(if n == 2 { 64 } else { 61 });
+                        mb += qb;
+                    }
+                    let ndof = c * n + if c == 2 && n > 2 { 1 } else { 0 };
+                    let mut offset = ((m.log_n[j] + (i << BITRES)) >> 1) - FINE_OFFSET;
+                    if n == 2 {
+                        offset += (1 << BITRES) >> 2;
+                    }
+                    let num = mb + ndof * offset;
+                    let den = (ndof - 1) << BITRES;
+                    let qb = ((num + (den >> 1)) / den).min(MAX_FINE_BITS);
+                    mb += c * qb << BITRES;
+                    mb
+                };
+                let w = c * ((EBANDS[j + 1] - EBANDS[j]) << i);
+                let v = (4 * max_bits / w) - 64;
+                caps[((i * 2 + c - 1) as usize) * nb + j] = v.clamp(0, 255) as u8;
+            }
+        }
+    }
+    caps
+}
+
+/// Result of the allocation process.
+pub struct Allocation {
+    pub coded_bands: usize,
+    pub intensity: usize,
+    pub dual_stereo: bool,
+    pub balance: i32,
+    pub pulses: [i32; NB_EBANDS],
+    pub fine_quant: [i32; NB_EBANDS],
+    pub fine_priority: [i32; NB_EBANDS],
+}
+
+/// `clt_compute_allocation` (decoder side).
+#[allow(clippy::too_many_arguments)]
+pub fn compute_allocation(
+    m: &Mode,
+    start: usize,
+    end: usize,
+    offsets: &[i32; NB_EBANDS],
+    cap: &[i32; NB_EBANDS],
+    alloc_trim: i32,
+    total: i32,
+    c: usize,
+    lm: usize,
+    dec: &mut RangeDecoder,
+) -> Allocation {
+    let ci = c as i32;
+    let lmi = lm as i32;
+    let mut total = total.max(0);
+    let mut skip_start = start;
+    let skip_rsv = if total >= 1 << BITRES { 1 << BITRES } else { 0 };
+    total -= skip_rsv;
+    let mut intensity_rsv = 0;
+    let mut dual_stereo_rsv = 0;
+    if c == 2 {
+        intensity_rsv = LOG2_FRAC_TABLE[end - start];
+        if intensity_rsv > total {
+            intensity_rsv = 0;
+        } else {
+            total -= intensity_rsv;
+            dual_stereo_rsv = if total >= 1 << BITRES { 1 << BITRES } else { 0 };
+            total -= dual_stereo_rsv;
+        }
+    }
+    let mut bits1 = [0i32; NB_EBANDS];
+    let mut bits2 = [0i32; NB_EBANDS];
+    let mut thresh = [0i32; NB_EBANDS];
+    let mut trim_offset = [0i32; NB_EBANDS];
+    for j in start..end {
+        let w = EBANDS[j + 1] - EBANDS[j];
+        thresh[j] = (ci << BITRES).max((3 * w << lmi << BITRES) >> 4);
+        trim_offset[j] = ci * w * (alloc_trim - 5 - lmi) * (end as i32 - j as i32 - 1) * (1 << (lmi + BITRES as i32)) >> 6;
+        if w << lmi == 1 {
+            trim_offset[j] -= ci << BITRES;
+        }
+    }
+    let nb_alloc = ALLOC.len() as i32;
+    let mut lo = 1;
+    let mut hi = nb_alloc - 1;
+    loop {
+        let mut done = false;
+        let mut psum = 0;
+        let mid = (lo + hi) >> 1;
+        for j in (start..end).rev() {
+            let n = EBANDS[j + 1] - EBANDS[j];
+            let mut bitsj = ci * n * (ALLOC[mid as usize][j] as i32) << lmi >> 2;
+            if bitsj > 0 {
+                bitsj = (bitsj + trim_offset[j]).max(0);
+            }
+            bitsj += offsets[j];
+            if bitsj >= thresh[j] || done {
+                done = true;
+                psum += bitsj.min(cap[j]);
+            } else if bitsj >= ci << BITRES {
+                psum += ci << BITRES;
+            }
+        }
+        if psum > total {
+            hi = mid - 1;
+        } else {
+            lo = mid + 1;
+        }
+        if lo > hi {
+            break;
+        }
+    }
+    hi = lo;
+    lo -= 1;
+    for j in start..end {
+        let n = EBANDS[j + 1] - EBANDS[j];
+        let mut bits1j = ci * n * (ALLOC[lo as usize][j] as i32) << lmi >> 2;
+        let mut bits2j = if hi >= nb_alloc { cap[j] } else { ci * n * (ALLOC[hi as usize][j] as i32) << lmi >> 2 };
+        if bits1j > 0 {
+            bits1j = (bits1j + trim_offset[j]).max(0);
+        }
+        if bits2j > 0 {
+            bits2j = (bits2j + trim_offset[j]).max(0);
+        }
+        if lo > 0 {
+            bits1j += offsets[j];
+        }
+        bits2j += offsets[j];
+        if offsets[j] > 0 {
+            skip_start = j;
+        }
+        bits2j = (bits2j - bits1j).max(0);
+        bits1[j] = bits1j;
+        bits2[j] = bits2j;
+    }
+    interp_bits2pulses(m, start, end, skip_start, &bits1, &bits2, &thresh, cap, total, skip_rsv, intensity_rsv, dual_stereo_rsv, c, lm, dec)
+}
+
+#[allow(clippy::too_many_arguments)]
+fn interp_bits2pulses(
+    m: &Mode,
+    start: usize,
+    end: usize,
+    skip_start: usize,
+    bits1: &[i32; NB_EBANDS],
+    bits2: &[i32; NB_EBANDS],
+    thresh: &[i32; NB_EBANDS],
+    cap: &[i32; NB_EBANDS],
+    mut total: i32,
+    skip_rsv: i32,
+    mut intensity_rsv: i32,
+    mut dual_stereo_rsv: i32,
+    c: usize,
+    lm: usize,
+    dec: &mut RangeDecoder,
+) -> Allocation {
+    let ci = c as i32;
+    let alloc_floor = ci << BITRES;
+    let stereo = (c > 1) as i32;
+    let log_m = (lm as i32) << BITRES;
+    let mut lo = 0;
+    let mut hi = 1 << ALLOC_STEPS;
+    for _ in 0..ALLOC_STEPS {
+        let mid = (lo + hi) >> 1;
+        let mut psum = 0;
+        let mut done = false;
+        for j in (start..end).rev() {
+            let tmp = bits1[j] + (mid * bits2[j] >> ALLOC_STEPS);
+            if tmp >= thresh[j] || done {
+                done = true;
+                psum += tmp.min(cap[j]);
+            } else if tmp >= alloc_floor {
+                psum += alloc_floor;
+            }
+        }
+        if psum > total {
+            hi = mid;
+        } else {
+            lo = mid;
+        }
+    }
+    let mut bits = [0i32; NB_EBANDS];
+    let mut psum = 0;
+    let mut done = false;
+    for j in (start..end).rev() {
+        let mut tmp = bits1[j] + (lo * bits2[j] >> ALLOC_STEPS);
+        if tmp < thresh[j] && !done {
+            tmp = if tmp >= alloc_floor { alloc_floor } else { 0 };
+        } else {
+            done = true;
+        }
+        tmp = tmp.min(cap[j]);
+        bits[j] = tmp;
+        psum += tmp;
+    }
+    let s = start;
+    let mut coded_bands = end;
+    loop {
+        let j = coded_bands - 1;
+        if j <= skip_start {
+            total += skip_rsv;
+            break;
+        }
+        let mut left = total - psum;
+        let span = EBANDS[coded_bands] - EBANDS[s];
+        let percoeff = left / span;
+        left -= span * percoeff;
+        let rem = (left - (EBANDS[j] - EBANDS[s])).max(0);
+        let band_width = EBANDS[coded_bands] - EBANDS[j];
+        let mut band_bits = bits[j] + percoeff * band_width + rem;
+        if band_bits >= thresh[j].max(alloc_floor + (1 << BITRES)) {
+            if dec.bit_logp(1) {
+                break;
+            }
+            psum += 1 << BITRES;
+            band_bits -= 1 << BITRES;
+        }
+        psum -= bits[j] + intensity_rsv;
+        if intensity_rsv > 0 {
+            intensity_rsv = LOG2_FRAC_TABLE[j - s];
+        }
+        psum += intensity_rsv;
+        if band_bits >= alloc_floor {
+            psum += alloc_floor;
+            bits[j] = alloc_floor;
+        } else {
+            bits[j] = 0;
+        }
+        coded_bands -= 1;
+    }
+    let intensity = if intensity_rsv > 0 { s + dec.uint((coded_bands + 1 - s) as u32) as usize } else { 0 };
+    if intensity <= s {
+        total += dual_stereo_rsv;
+        dual_stereo_rsv = 0;
+    }
+    let dual_stereo = if dual_stereo_rsv > 0 { dec.bit_logp(1) } else { false };
+    let mut left = total - psum;
+    let span = EBANDS[coded_bands] - EBANDS[s];
+    let percoeff = left / span;
+    left -= span * percoeff;
+    for j in s..coded_bands {
+        bits[j] += percoeff * (EBANDS[j + 1] - EBANDS[j]);
+    }
+    for j in s..coded_bands {
+        let tmp = left.min(EBANDS[j + 1] - EBANDS[j]);
+        bits[j] += tmp;
+        left -= tmp;
+    }
+    let mut ebits = [0i32; NB_EBANDS];
+    let mut fine_priority = [0i32; NB_EBANDS];
+    let mut balance = 0;
+    for j in s..coded_bands {
+        let n0 = EBANDS[j + 1] - EBANDS[j];
+        let n = n0 << lm;
+        let bit = bits[j] + balance;
+        let mut excess;
+        if n > 1 {
+            excess = (bit - cap[j]).max(0);
+            bits[j] = bit - excess;
+            let den = ci * n + if c == 2 && n > 2 && !dual_stereo && j < intensity { 1 } else { 0 };
+            let nclogn = den * (m.log_n[j] + log_m);
+            let mut offset = (nclogn >> 1) - den * FINE_OFFSET;
+            if n == 2 {
+                offset += (den << BITRES) >> 2;
+            }
+            if bits[j] + offset < den * 2 << BITRES {
+                offset += nclogn >> 2;
+            } else if bits[j] + offset < den * 3 << BITRES {
+                offset += nclogn >> 3;
+            }
+            let mut eb = (bits[j] + offset + (den << (BITRES - 1))).max(0);
+            eb = (eb / den) >> BITRES;
+            if ci * eb > (bits[j] >> BITRES) {
+                eb = bits[j] >> stereo >> BITRES;
+            }
+            eb = eb.min(MAX_FINE_BITS);
+            ebits[j] = eb;
+            fine_priority[j] = (eb * (den << BITRES) >= bits[j] + offset) as i32;
+            bits[j] -= ci * eb << BITRES;
+        } else {
+            excess = (bit - (ci << BITRES)).max(0);
+            bits[j] = bit - excess;
+            ebits[j] = 0;
+            fine_priority[j] = 1;
+        }
+        if excess > 0 {
+            let extra_fine = (excess >> (stereo + BITRES as i32)).min(MAX_FINE_BITS - ebits[j]);
+            ebits[j] += extra_fine;
+            let extra_bits = extra_fine * ci << BITRES;
+            fine_priority[j] = (extra_bits >= excess - balance) as i32;
+            excess -= extra_bits;
+        }
+        balance = excess;
+    }
+    for j in coded_bands..end {
+        ebits[j] = bits[j] >> stereo >> BITRES;
+        bits[j] = 0;
+        fine_priority[j] = (ebits[j] < 1) as i32;
+    }
+    Allocation { coded_bands, intensity, dual_stereo, balance, pulses: bits, fine_quant: ebits, fine_priority }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn log2_frac_values() {
+        assert_eq!(log2_frac(1, 3), 0);
+        assert_eq!(log2_frac(2, 3), 8);
+        assert_eq!(log2_frac(4, 3), 16);
+        assert_eq!(log2_frac(6, 3), 21);
+        assert_eq!(log2_frac(18, 3), 34);
+        assert_eq!(log2_frac(22, 3), 36);
+    }
+
+    #[test]
+    fn pvq_counts() {
+        // V(N,1) = 2N, V(1,K) = 2 (K>0), V(2,K) = 4K.
+        assert_eq!(pvq_v(5, 1), 10);
+        assert_eq!(pvq_v(1, 7), 2);
+        assert_eq!(pvq_v(2, 9), 36);
+        assert_eq!(pvq_v(3, 2), 18);
+        assert_eq!(pvq_v(0, 0), 1);
+        assert_eq!(pvq_v(0, 3), 0);
+    }
+
+    #[test]
+    fn caps_match_reference_shape() {
+        let m = Mode::new();
+        // 1-bin bands at LM=0 (mono and stereo) are capped at 224.
+        assert!(m.caps[..8].iter().all(|&c| c == 224));
+        assert!(m.caps[21..29].iter().all(|&c| c == 224));
+        let first_rows: [u8; 42] = [
+            224, 224, 224, 224, 224, 224, 224, 224, 160, 160, 160, 160, 185, 185, 185, 178, 178, 168, 134, 61, 37, 224, 224, 224, 224, 224, 224, 224,
+            224, 240, 240, 240, 240, 207, 207, 207, 198, 198, 183, 144, 66, 40,
+        ];
+        assert_eq!(&m.caps[..42], &first_rows[..]);
+    }
+}
@@ -0,0 +1,130 @@
+//! Constant tables of the 48 kHz CELT mode (RFC 6716 §4.3).
+
+/// Number of energy bands.
+pub const NB_EBANDS: usize = 21;
+/// Band edges in units of 2.5 ms MDCT bins (Table 55).
+pub const EBANDS: [i32; NB_EBANDS + 1] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 12, 14, 16, 20, 24, 28, 34, 40, 48, 60, 78, 100];
+/// Overlap of the low-overlap window (samples at 48 kHz).
+pub const OVERLAP: usize = 120;
+/// Size of the shortest MDCT (2.5 ms).
+pub const SHORT_MDCT: usize = 120;
+/// Largest LM (20 ms frames).
+pub const MAX_LM: usize = 3;
+/// Pre-emphasis coefficient.
+pub const PREEMPH: f32 = 0.850_006_1;
+
+/// Static allocation table (Table 57), indexed `[quality][band]`, in 1/32 bit per MDCT bin.
+pub const ALLOC: [[u8; NB_EBANDS]; 11] = transpose([
+    [0, 90, 110, 118, 126, 134, 144, 152, 162, 172, 200],
+    [0, 80, 100, 110, 119, 127, 137, 145, 155, 165, 200],
+    [0, 75, 90, 103, 112, 120, 130, 138, 148, 158, 200],
+    [0, 69, 84, 93, 104, 114, 124, 132, 142, 152, 200],
+    [0, 63, 78, 86, 95, 103, 113, 123, 133, 143, 200],
+    [0, 56, 71, 80, 89, 97, 107, 117, 127, 137, 200],
+    [0, 49, 65, 75, 83, 91, 101, 111, 121, 131, 200],
+    [0, 40, 58, 70, 78, 85, 95, 105, 115, 125, 200],
+    [0, 34, 51, 65, 72, 78, 88, 98, 108, 118, 198],
+    [0, 29, 45, 59, 66, 72, 82, 92, 102, 112, 193],
+    [0, 20, 39, 53, 60, 66, 76, 86, 96, 106, 188],
+    [0, 18, 32, 47, 54, 60, 70, 80, 90, 100, 183],
+    [0, 10, 26, 40, 47, 54, 64, 74, 84, 94, 178],
+    [0, 0, 20, 31, 39, 47, 57, 67, 77, 87, 173],
+    [0, 0, 12, 23, 32, 41, 51, 61, 71, 81, 168],
+    [0, 0, 0, 15, 25, 35, 45, 55, 65, 75, 163],
+    [0, 0, 0, 4, 17, 29, 39, 49, 59, 69, 158],
+    [0, 0, 0, 0, 12, 23, 33, 43, 53, 63, 153],
+    [0, 0, 0, 0, 1, 16, 26, 36, 46, 56, 148],
+    [0, 0, 0, 0, 0, 10, 15, 20, 30, 45, 129],
+    [0, 0, 0, 0, 0, 1, 1, 1, 1, 20, 104],
+]);
+
+const fn transpose(t: [[u8; 11]; NB_EBANDS]) -> [[u8; NB_EBANDS]; 11] {
+    let mut out = [[0u8; NB_EBANDS]; 11];
+    let mut b = 0;
+    while b < NB_EBANDS {
+        let mut q = 0;
+        while q < 11 {
+            out[q][b] = t[b][q];
+            q += 1;
+        }
+        b += 1;
+    }
+    out
+}
+
+/// Mean band energy (log2 domain) removed before coarse quantisation.
+pub const E_MEANS: [f32; 25] = [
+    6.4375, 6.25, 5.75, 5.3125, 5.0625, 4.8125, 4.5, 4.375, 4.875, 4.6875, 4.5625, 4.4375, 4.875, 4.625, 4.3125, 4.5, 4.375, 4.625, 4.75, 4.4375,
+    3.75, 3.75, 3.75, 3.75, 3.75,
+];
+
+/// Inter-frame prediction coefficient (alpha) per LM, Q15.
+pub const PRED_COEF: [f32; 4] = [29440.0 / 32768.0, 26112.0 / 32768.0, 21248.0 / 32768.0, 16384.0 / 32768.0];
+/// Inter-band prediction coefficient (beta) per LM for inter frames, Q15.
+pub const BETA_COEF: [f32; 4] = [30147.0 / 32768.0, 22282.0 / 32768.0, 12124.0 / 32768.0, 6554.0 / 32768.0];
+/// Beta for intra frames.
+pub const BETA_INTRA: f32 = 4915.0 / 32768.0;
+
+/// Laplace model parameters for coarse energy: `[LM][intra][2*band + {0: prob, 1: decay}]`.
+pub const E_PROB_MODEL: [[[u8; 42]; 2]; 4] = [
+    [
+        [
+            72, 127, 65, 129, 66, 128, 65, 128, 64, 128, 62, 128, 64, 128, 64, 128, 92, 78, 92, 79, 92, 78, 90, 79, 116, 41, 115, 40, 114, 40, 132,
+            26, 132, 26, 145, 17, 161, 12, 176, 10, 177, 11,
+        ],
+        [
+            24, 179, 48, 138, 54, 135, 54, 132, 53, 134, 56, 133, 55, 132, 55, 132, 61, 114, 70, 96, 74, 88, 75, 88, 87, 74, 89, 66, 91, 67, 100, 59,
+            108, 50, 120, 40, 122, 37, 97, 43, 78, 50,
+        ],
+    ],
+    [
+        [
+            83, 78, 84, 81, 88, 75, 86, 74, 87, 71, 90, 73, 93, 74, 93, 74, 109, 40, 114, 36, 117, 34, 117, 34, 143, 17, 145, 18, 146, 19, 162, 12,
+            165, 10, 178, 7, 189, 6, 190, 8, 177, 9,
+        ],
+        [
+            23, 178, 54, 115, 63, 102, 66, 98, 69, 99, 74, 89, 71, 91, 73, 91, 78, 89, 86, 80, 92, 66, 93, 64, 102, 59, 103, 60, 104, 60, 117, 52,
+            123, 44, 138, 35, 133, 31, 97, 38, 77, 45,
+        ],
+    ],
+    [
+        [
+            61, 90, 93, 60, 105, 42, 107, 41, 110, 45, 116, 38, 113, 38, 112, 38, 124, 26, 132, 27, 136, 19, 140, 20, 155, 14, 159, 16, 158, 18, 170,
+            13, 177, 10, 187, 8, 192, 6, 175, 9, 159, 10,
+        ],
+        [
+            21, 178, 59, 110, 71, 86, 75, 85, 84, 83, 91, 66, 88, 73, 87, 72, 92, 75, 98, 72, 105, 58, 107, 54, 115, 52, 114, 55, 112, 56, 129, 51,
+            132, 40, 150, 33, 140, 29, 98, 35, 77, 42,
+        ],
+    ],
+    [
+        [
+            42, 121, 96, 66, 108, 43, 111, 40, 117, 44, 123, 32, 120, 36, 119, 33, 127, 33, 134, 34, 139, 21, 147, 23, 152, 20, 158, 25, 154, 26,
+            166, 21, 173, 16, 184, 13, 184, 10, 150, 13, 139, 15,
+        ],
+        [
+            22, 178, 63, 114, 74, 82, 84, 83, 92, 82, 103, 62, 96, 72, 96, 67, 101, 73, 107, 72, 113, 55, 118, 52, 125, 52, 118, 52, 117, 55, 135,
+            49, 137, 39, 157, 32, 145, 29, 97, 33, 77, 40,
+        ],
+    ],
+];
+
+/// Inverse CDF for coarse energy when only a few bits remain.
+pub const SMALL_ENERGY_ICDF: [u8; 3] = [2, 1, 0];
+/// Conservative log2 in 1/8 bits of the number of coded bands (intensity reservation).
+pub const LOG2_FRAC_TABLE: [i32; 24] = [0, 8, 13, 16, 19, 21, 23, 24, 26, 27, 28, 29, 30, 31, 32, 32, 33, 34, 34, 35, 36, 36, 37, 37];
+/// TF resolution changes: `[LM][4*transient + 2*tf_select + tf_flag]`.
+pub const TF_SELECT_TABLE: [[i8; 8]; 4] =
+    [[0, -1, 0, -1, 0, -1, 0, -1], [0, -1, 0, -2, 1, 0, 1, -1], [0, -2, 0, -3, 2, 0, 1, -1], [0, -2, 0, -3, 3, 0, 1, -1]];
+/// Spreading decision `{7, 2, 21, 2}/32`.
+pub const SPREAD_ICDF: [u8; 4] = [25, 23, 2, 0];
+/// Allocation trim (Table 58).
+pub const TRIM_ICDF: [u8; 11] = [126, 124, 119, 109, 87, 41, 19, 9, 4, 2, 0];
+/// Post-filter tapset `{2, 1, 1}/4`.
+pub const TAPSET_ICDF: [u8; 3] = [2, 1, 0];
+/// Post-filter tap gains per tapset.
+pub const COMB_GAINS: [[f32; 3]; 3] =
+    [[0.306_640_62, 0.217_041_02, 0.129_638_67], [0.463_867_2, 0.268_066_4, 0.0], [0.799_804_7, 0.100_097_656, 0.0]];
+
+/// Hadamard "sequency" ordering for 2, 4, 8 and 16 blocks, concatenated.
+pub const ORDERY: [usize; 30] = [1, 0, 3, 0, 2, 1, 7, 0, 4, 3, 6, 1, 5, 2, 15, 0, 8, 7, 12, 3, 11, 4, 14, 1, 9, 6, 13, 2, 10, 5];
@@ -0,0 +1,477 @@
+//! Single-stream Opus decoder: mode switching, hybrid summation, redundancy and transitions
+//! (RFC 6716 §4, §4.5).
+
+use crate::celt::CeltDecoder;
+use crate::celt::tables::OVERLAP;
+use crate::packet::{Bandwidth, Mode, Packet};
+use crate::range::RangeDecoder;
+use crate::silk::{LostFlag, SilkDecoder};
+use crate::{Error, Result};
+
+/// Output sample rates supported by the decoder.
+pub const SAMPLE_RATES: [u32; 5] = [8000, 12000, 16000, 24000, 48000];
+
+/// Decoder for one elementary Opus stream (mono or stereo), like `OpusDecoder`.
+pub struct StreamDecoder {
+    rate: u32,
+    channels: usize,
+    celt: CeltDecoder,
+    silk: SilkDecoder,
+    stream_channels: usize,
+    bandwidth: Bandwidth,
+    mode: Option<Mode>,
+    prev_mode: Option<Mode>,
+    frame_size: usize,
+    prev_redundancy: bool,
+    last_packet_duration: usize,
+    range_final: u32,
+    /// Output gain in Q8 dB (OpusHead output gain).
+    gain_q8: i16,
+}
+
+impl StreamDecoder {
+    /// Creates a decoder producing `channels` (1 or 2) at `rate` (8/12/16/24/48 kHz).
+    pub fn new(rate: u32, channels: usize) -> Result<StreamDecoder> {
+        if !SAMPLE_RATES.contains(&rate) {
+            return Err(Error::InvalidArgument("sample rate must be 8000, 12000, 16000, 24000 or 48000"));
+        }
+        if !(1..=2).contains(&channels) {
+            return Err(Error::InvalidArgument("channels must be 1 or 2"));
+        }
+        Ok(StreamDecoder {
+            rate,
+            channels,
+            celt: CeltDecoder::new(rate, channels),
+            silk: SilkDecoder::new(rate, channels),
+            stream_channels: channels,
+            bandwidth: Bandwidth::Fullband,
+            mode: None,
+            prev_mode: None,
+            frame_size: rate as usize / 400,
+            prev_redundancy: false,
+            last_packet_duration: 0,
+            range_final: 0,
+            gain_q8: 0,
+        })
+    }
+
+    pub fn sample_rate(&self) -> u32 {
+        self.rate
+    }
+
+    pub fn channels(&self) -> usize {
+        self.channels
+    }
+
+    /// Final range coder state of the last decoded frame (for conformance checks).
+    pub fn final_range(&self) -> u32 {
+        self.range_final
+    }
+
+    /// Duration (samples per channel) of the last decoded packet.
+    pub fn last_packet_duration(&self) -> usize {
+        self.last_packet_duration
+    }
+
+    /// Sets the output gain in Q8 dB (as in the OpusHead header).
+    pub fn set_gain_q8(&mut self, gain: i16) {
+        self.gain_q8 = gain;
+    }
+
+    /// Disables the 180-degree intensity-stereo phase inversion (RFC 8251 §10).
+    pub fn set_phase_inversion_disabled(&mut self, disabled: bool) {
+        self.celt.disable_inv = disabled;
+    }
+
+    /// `OPUS_RESET_STATE`.
+    pub fn reset(&mut self) {
+        self.celt.reset();
+        self.silk.reset();
+        self.stream_channels = self.channels;
+        self.bandwidth = Bandwidth::Fullband;
+        self.mode = None;
+        self.prev_mode = None;
+        self.frame_size = self.rate as usize / 400;
+        self.prev_redundancy = false;
+        self.last_packet_duration = 0;
+        self.range_final = 0;
+    }
+
+    /// Decodes a packet into interleaved samples appended to `out`. `None` conceals one lost
+    /// packet of the last packet's duration. Returns samples per channel.
+    pub fn decode_interleaved(&mut self, packet: Option<&[u8]>, out: &mut Vec<f32>) -> Result<usize> {
+        match packet {
+            Some(p) if !p.is_empty() => self.decode_packet(p, out),
+            _ => {
+                let n = if self.last_packet_duration > 0 { self.last_packet_duration } else { self.rate as usize / 50 };
+                self.conceal(n, out)
+            }
+        }
+    }
+
+    /// Conceals `n` samples (a multiple of 2.5 ms).
+    pub fn conceal(&mut self, n: usize, out: &mut Vec<f32>) -> Result<usize> {
+        let f2_5 = self.rate as usize / 400;
+        if n == 0 || !n.is_multiple_of(f2_5) {
+            return Err(Error::InvalidArgument("concealment length must be a multiple of 2.5 ms"));
+        }
+        let start = out.len();
+        out.resize(start + n * self.channels, 0.0);
+        let mut done = 0;
+        while done < n {
+            let r = self.decode_frame(None, &mut out[start + done * self.channels..], n - done, false)?;
+            done += r;
+        }
+        self.last_packet_duration = n;
+        Ok(n)
+    }
+
+    /// Decodes the in-band FEC (LBRR) of `packet` for the previous (lost) packet of `n` samples.
+    pub fn decode_fec(&mut self, packet: &[u8], n: usize, out: &mut Vec<f32>) -> Result<usize> {
+        let p = Packet::parse(packet)?;
+        let pfs = p.toc.frame_samples(self.rate);
+        if n < pfs || p.toc.mode == Mode::CeltOnly || self.mode == Some(Mode::CeltOnly) {
+            return self.conceal(n, out);
+        }
+        let start = out.len();
+        if n > pfs {
+            self.conceal(n - pfs, out)?;
+        }
+        self.mode = Some(p.toc.mode);
+        self.bandwidth = p.toc.bandwidth;
+        self.frame_size = pfs;
+        self.stream_channels = p.toc.channels();
+        let off = out.len();
+        out.resize(off + pfs * self.channels, 0.0);
+        self.decode_frame(Some(p.frames[0]), &mut out[off..], pfs, true)?;
+        self.last_packet_duration = n;
+        debug_assert_eq!(out.len() - start, n * self.channels);
+        Ok(n)
+    }
+
+    fn decode_packet(&mut self, data: &[u8], out: &mut Vec<f32>) -> Result<usize> {
+        let p = Packet::parse(data)?;
+        let fs = p.toc.frame_samples(self.rate);
+        self.mode = Some(p.toc.mode);
+        self.bandwidth = p.toc.bandwidth;
+        self.frame_size = fs;
+        self.stream_channels = p.toc.channels();
+        let start = out.len();
+        out.resize(start + fs * p.frames.len() * self.channels, 0.0);
+        let mut nb = 0;
+        for f in &p.frames {
+            let r = self.decode_frame(Some(f), &mut out[start + nb * self.channels..], fs, false)?;
+            nb += r;
+        }
+        out.truncate(start + nb * self.channels);
+        self.last_packet_duration = nb;
+        Ok(nb)
+    }
+
+    /// `opus_decode_frame`: decodes one frame (or conceals when `data` is `None`/≤1 byte).
+    fn decode_frame(&mut self, data: Option<&[u8]>, pcm: &mut [f32], frame_size: usize, fec: bool) -> Result<usize> {
+        let ch = self.channels;
+        let fs = self.rate as usize;
+        let f20 = fs / 50;
+        let f10 = f20 >> 1;
+        let f5 = f10 >> 1;
+        let f2_5 = f5 >> 1;
+        let mut frame_size = frame_size.min(fs / 25 * 3);
+        let data = match data {
+            Some(d) if d.len() > 1 => Some(d),
+            _ => {
+                frame_size = frame_size.min(self.frame_size);
+                None
+            }
+        };
+        let (mut audiosize, mode, bandwidth);
+        match data {
+            Some(_) => {
+                audiosize = self.frame_size;
+                mode = self.mode.unwrap_or(Mode::CeltOnly);
+                bandwidth = Some(self.bandwidth);
+            }
+            None => {
+                audiosize = frame_size;
+                bandwidth = None;
+                mode = match self.prev_mode {
+                    None => {
+                        pcm[..audiosize * ch].fill(0.0);
+                        return Ok(audiosize);
+                    }
+                    Some(m) => m,
+                };
+                if audiosize > f20 {
+                    self.conceal_long(pcm, audiosize, f20)?;
+                    return Ok(frame_size);
+                }
+                audiosize = shorten_concealment(audiosize, mode, fs);
+            }
+        }
+        let data_len = data.map_or(0, <[_]>::len);
+        let mut dec_storage;
+        let mut dec: Option<&mut RangeDecoder> = match data {
+            Some(d) => {
+                dec_storage = RangeDecoder::new(d);
+                Some(&mut dec_storage)
+            }
+            None => None,
+        };
+        let mut transition = false;
+        if data.is_some()
+            && self.prev_mode.is_some()
+            && ((mode == Mode::CeltOnly && self.prev_mode != Some(Mode::CeltOnly) && !self.prev_redundancy)
+                || (mode != Mode::CeltOnly && self.prev_mode == Some(Mode::CeltOnly)))
+        {
+            transition = true;
+        }
+        let mut pcm_transition = Vec::new();
+        if transition && mode == Mode::CeltOnly {
+            pcm_transition.resize(f5 * ch, 0.0);
+            let n = f5.min(audiosize);
+            self.decode_frame(None, &mut pcm_transition, n, false)?;
+        }
+        if audiosize > frame_size {
+            return Err(Error::InvalidArgument("frame larger than output buffer"));
+        }
+        frame_size = audiosize;
+
+        // SILK.
+        let mut pcm_silk: Vec<f32> = Vec::new();
+        if mode != Mode::CeltOnly {
+            pcm_silk = self.decode_silk_layer(
+                dec.as_deref_mut(),
+                SilkLayer { mode, bandwidth, lost: lost_flag(data.is_some(), fec), frame_size, audiosize, f10 },
+            )?;
+        }
+
+        let mut start_band = 0;
+        let mut redundancy = Redundancy::none(data_len);
+        if !fec
+            && mode != Mode::CeltOnly
+            && let Some(d) = dec.as_deref_mut()
+        {
+            redundancy = Redundancy::parse(d, mode, self.mode == Some(Mode::Hybrid), data_len);
+        }
+        let Redundancy { present: redundancy, celt_to_silk, bytes: redundancy_bytes, len } = redundancy;
+        if mode != Mode::CeltOnly {
+            start_band = 17;
+        }
+        if redundancy {
+            transition = false;
+        }
+        if transition && mode != Mode::CeltOnly {
+            pcm_transition.resize(f5 * ch, 0.0);
+            let n = f5.min(audiosize);
+            self.decode_frame(None, &mut pcm_transition, n, false)?;
+        }
+        if let Some(bw) = bandwidth {
+            self.celt.end = bw.celt_end_band();
+        }
+        self.celt.stream_channels = self.stream_channels;
+        let mut redundant_audio = vec![0f32; if redundancy { f5 * ch } else { 0 }];
+        let mut redundant_rng = 0u32;
+        let red_data = data.map(|d| &d[len..len + redundancy_bytes]);
+        if redundancy && celt_to_silk {
+            self.celt.start = 0;
+            self.celt.decode(red_data, f5, &mut redundant_audio, false, None)?;
+            redundant_rng = self.celt.rng;
+        }
+        self.celt.start = start_band;
+
+        if mode != Mode::SilkOnly {
+            let celt_frame = f20.min(frame_size);
+            if self.prev_mode.is_some() && Some(mode) != self.prev_mode && !self.prev_redundancy {
+                self.celt.reset();
+            }
+            let cdata = if fec { None } else { data.map(|d| &d[..len]) };
+            let cdec = if fec { None } else { dec.as_deref_mut() };
+            self.celt.decode(cdata, celt_frame, pcm, false, cdec)?;
+        } else {
+            pcm[..frame_size * ch].fill(0.0);
+            if self.prev_mode == Some(Mode::Hybrid) && !(redundancy && celt_to_silk && self.prev_redundancy) {
+                self.celt.start = 0;
+                let silence = [0xFFu8, 0xFF];
+                self.celt.decode(Some(&silence), f2_5, pcm, true, None)?;
+            }
+        }
+        if mode != Mode::CeltOnly {
+            for (o, s) in pcm[..frame_size * ch].iter_mut().zip(&pcm_silk) {
+                *o += *s;
+            }
+        }
+        let window = &crate::celt::mode().window;
+        if redundancy && !celt_to_silk {
+            self.celt.reset();
+            self.celt.start = 0;
+            self.celt.decode(red_data, f5, &mut redundant_audio, false, None)?;
+            redundant_rng = self.celt.rng;
+            let o = ch * (frame_size - f2_5);
+            let tail: Vec<f32> = pcm[o..o + f2_5 * ch].to_vec();
+            smooth_fade(&tail, &redundant_audio[ch * f2_5..], &mut pcm[o..], f2_5, ch, window, self.rate);
+        }
+        if redundancy && celt_to_silk {
+            self.fade_in_from(pcm, &redundant_audio, f2_5);
+        }
+        if transition {
+            if audiosize >= f5 {
+                self.fade_in_from(pcm, &pcm_transition, f2_5);
+            } else {
+                let cur: Vec<f32> = pcm[..ch * f2_5].to_vec();
+                smooth_fade(&pcm_transition, &cur, pcm, f2_5, ch, window, self.rate);
+            }
+        }
+        if self.gain_q8 != 0 {
+            let g = (6.488_141e-4f32 * self.gain_q8 as f32).exp2();
+            for v in pcm[..frame_size * ch].iter_mut() {
+                *v *= g;
+            }
+        }
+        self.range_final = match dec.as_deref() {
+            Some(d) if data_len > 1 => d.rng() ^ redundant_rng,
+            _ => 0,
+        };
+        self.prev_mode = Some(mode);
+        self.prev_redundancy = redundancy && !celt_to_silk;
+        Ok(audiosize)
+    }
+
+    /// Conceals a lost span longer than 20 ms by decoding it in 20 ms pieces.
+    fn conceal_long(&mut self, pcm: &mut [f32], audiosize: usize, f20: usize) -> Result<()> {
+        let mut done = 0;
+        while done < audiosize {
+            done += self.decode_frame(None, &mut pcm[done * self.channels..], (audiosize - done).min(f20), false)?;
+        }
+        Ok(())
+    }
+
+    /// Replaces the first `f2_5` samples of `pcm` with `src` and cross-fades the following `f2_5` samples from `src` into `pcm`.
+    fn fade_in_from(&self, pcm: &mut [f32], src: &[f32], f2_5: usize) {
+        let ch = self.channels;
+        let window = &crate::celt::mode().window;
+        pcm[..f2_5 * ch].copy_from_slice(&src[..f2_5 * ch]);
+        let cur: Vec<f32> = pcm[ch * f2_5..ch * 2 * f2_5].to_vec();
+        smooth_fade(&src[ch * f2_5..], &cur, &mut pcm[ch * f2_5..], f2_5, ch, window, self.rate);
+    }
+
+    /// Runs the SILK layer over the frame, zero-filling spans it cannot decode when the packet was lost.
+    fn decode_silk_layer(&mut self, mut dec: Option<&mut RangeDecoder>, l: SilkLayer) -> Result<Vec<f32>> {
+        let ch = self.channels;
+        let mut pcm_silk = vec![0.0; l.frame_size.max(l.f10) * ch];
+        if self.prev_mode == Some(Mode::CeltOnly) {
+            self.silk.reset();
+        }
+        let payload_ms = (1000 * l.audiosize / self.rate as usize).max(10);
+        if l.lost != LostFlag::Lost {
+            self.silk.set_stream(self.stream_channels, silk_internal_rate(l.mode, l.bandwidth));
+        }
+        let mut decoded = 0;
+        while decoded < l.frame_size {
+            let first = decoded == 0;
+            let out = &mut pcm_silk[decoded * ch..];
+            let n = match self.silk.decode(dec.as_deref_mut(), l.lost, first, payload_ms, out) {
+                Ok(n) => n,
+                Err(_) if l.lost != LostFlag::Normal => {
+                    let n = l.frame_size - decoded;
+                    pcm_silk[decoded * ch..(decoded + n) * ch].fill(0.0);
+                    n
+                }
+                Err(e) => return Err(e),
+            };
+            if n == 0 {
+                break;
+            }
+            decoded += n;
+        }
+        Ok(pcm_silk)
+    }
+}
+
+/// Inputs for one SILK-layer decode.
+struct SilkLayer {
+    mode: Mode,
+    bandwidth: Option<Bandwidth>,
+    lost: LostFlag,
+    frame_size: usize,
+    audiosize: usize,
+    f10: usize,
+}
+
+fn lost_flag(has_data: bool, fec: bool) -> LostFlag {
+    if !has_data {
+        LostFlag::Lost
+    } else if fec {
+        LostFlag::Lbrr
+    } else {
+        LostFlag::Normal
+    }
+}
+
+fn silk_internal_rate(mode: Mode, bandwidth: Option<Bandwidth>) -> u32 {
+    match (mode, bandwidth) {
+        (Mode::SilkOnly, Some(Bandwidth::Narrowband)) => 8000,
+        (Mode::SilkOnly, Some(Bandwidth::Mediumband)) => 12000,
+        _ => 16000,
+    }
+}
+
+/// Picks the shorter concealment length for spans of at most 20 ms (10 ms, or 5 ms outside SILK-only mode).
+fn shorten_concealment(audiosize: usize, mode: Mode, rate: usize) -> usize {
+    let f20 = rate / 50;
+    let f10 = f20 >> 1;
+    let f5 = f10 >> 1;
+    if audiosize >= f20 {
+        audiosize
+    } else if audiosize > f10 {
+        f10
+    } else if mode != Mode::SilkOnly && audiosize > f5 && audiosize < f10 {
+        f5
+    } else {
+        audiosize
+    }
+}
+
+/// In-band redundancy header of a packet: whether a redundant CELT frame follows, its direction and size.
+struct Redundancy {
+    present: bool,
+    celt_to_silk: bool,
+    bytes: usize,
+    /// Payload length left for the main frame.
+    len: usize,
+}
+
+impl Redundancy {
+    fn none(len: usize) -> Self {
+        Self { present: false, celt_to_silk: false, bytes: 0, len }
+    }
+
+    fn parse(d: &mut RangeDecoder, mode: Mode, prev_hybrid: bool, len: usize) -> Self {
+        let mut r = Self::none(len);
+        if d.tell() + 17 + 20 * prev_hybrid as i32 > 8 * len as i32 {
+            return r;
+        }
+        r.present = if mode == Mode::Hybrid { d.bit_logp(12) } else { true };
+        if !r.present {
+            return r;
+        }
+        r.celt_to_silk = d.bit_logp(1);
+        r.bytes = if mode == Mode::Hybrid { d.uint(256) as usize + 2 } else { len - ((d.tell() as usize + 7) >> 3) };
+        if r.bytes > len || (len - r.bytes) * 8 < d.tell() as usize {
+            r = Self { celt_to_silk: r.celt_to_silk, ..Self::none(0) };
+        } else {
+            r.len -= r.bytes;
+        }
+        d.shrink_storage(r.bytes);
+        r
+    }
+}
+
+fn smooth_fade(in1: &[f32], in2: &[f32], out: &mut [f32], overlap: usize, ch: usize, window: &[f32; OVERLAP], rate: u32) {
+    let inc = (48000 / rate) as usize;
+    for c in 0..ch {
+        for i in 0..overlap {
+            let w = window[i * inc] * window[i * inc];
+            out[i * ch + c] = w * in2[i * ch + c] + (1.0 - w) * in1[i * ch + c];
+        }
+    }
+}
@@ -0,0 +1,196 @@
+//! Opus identification header (`OpusHead`, RFC 7845 §5.1) and the ISO-BMFF `dOps` box payload.
+
+use crate::{Error, Result};
+
+/// Decoder configuration: channel layout, multistream mapping, pre-skip and output gain.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct OpusHead {
+    /// Output channel count (1..=255).
+    pub channels: usize,
+    /// Samples (at 48 kHz) to discard from the start of the decoded stream.
+    pub pre_skip: u16,
+    /// Sample rate of the original input (informational only).
+    pub input_sample_rate: u32,
+    /// Output gain in Q7.8 dB.
+    pub output_gain: i16,
+    /// Channel mapping family (0: mono/stereo, 1: Vorbis order surround, 255: unspecified order).
+    pub mapping_family: u8,
+    /// Number of elementary streams.
+    pub streams: usize,
+    /// Number of coupled (stereo) streams; these come first.
+    pub coupled_streams: usize,
+    /// Output channel → decoded channel index (255 = silence).
+    pub mapping: Vec<u8>,
+}
+
+impl OpusHead {
+    /// A family-0 configuration for plain mono/stereo streams (no header present).
+    pub fn simple(channels: usize) -> Result<OpusHead> {
+        if !(1..=2).contains(&channels) {
+            return Err(Error::InvalidArgument("family 0 supports 1 or 2 channels"));
+        }
+        Ok(OpusHead {
+            channels,
+            pre_skip: 0,
+            input_sample_rate: 48000,
+            output_gain: 0,
+            mapping_family: 0,
+            streams: 1,
+            coupled_streams: channels - 1,
+            mapping: (0..channels as u8).collect(),
+        })
+    }
+
+    /// Parses an `OpusHead` packet (Ogg first packet, Matroska `CodecPrivate`).
+    pub fn parse(data: &[u8]) -> Result<OpusHead> {
+        if data.len() < 19 || &data[..8] != b"OpusHead" {
+            return Err(Error::InvalidHeader("missing OpusHead magic"));
+        }
+        let version = data[8];
+        if version >> 4 != 0 {
+            return Err(Error::Unsupported("OpusHead major version"));
+        }
+        let channels = data[9] as usize;
+        let pre_skip = u16::from_le_bytes([data[10], data[11]]);
+        let input_sample_rate = u32::from_le_bytes([data[12], data[13], data[14], data[15]]);
+        let output_gain = i16::from_le_bytes([data[16], data[17]]);
+        let family = data[18];
+        Self::build(channels, pre_skip, input_sample_rate, output_gain, family, &data[19..])
+    }
+
+    /// Parses the payload of an ISO-BMFF `dOps` box (Opus in MP4, big-endian fields).
+    pub fn from_dops(data: &[u8]) -> Result<OpusHead> {
+        if data.len() < 11 {
+            return Err(Error::InvalidHeader("dOps too short"));
+        }
+        if data[0] != 0 {
+            return Err(Error::Unsupported("dOps version"));
+        }
+        let channels = data[1] as usize;
+        let pre_skip = u16::from_be_bytes([data[2], data[3]]);
+        let input_sample_rate = u32::from_be_bytes([data[4], data[5], data[6], data[7]]);
+        let output_gain = i16::from_be_bytes([data[8], data[9]]);
+        Self::build(channels, pre_skip, input_sample_rate, output_gain, data[10], &data[11..])
+    }
+
+    /// Serialises as an `OpusHead` packet.
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let mut v = b"OpusHead".to_vec();
+        v.push(1);
+        v.push(self.channels as u8);
+        v.extend(self.pre_skip.to_le_bytes());
+        v.extend(self.input_sample_rate.to_le_bytes());
+        v.extend(self.output_gain.to_le_bytes());
+        v.push(self.mapping_family);
+        if self.mapping_family != 0 {
+            v.push(self.streams as u8);
+            v.push(self.coupled_streams as u8);
+            v.extend(&self.mapping);
+        }
+        v
+    }
+
+    fn build(channels: usize, pre_skip: u16, input_sample_rate: u32, output_gain: i16, family: u8, rest: &[u8]) -> Result<OpusHead> {
+        if channels == 0 {
+            return Err(Error::InvalidHeader("zero channels"));
+        }
+        let (streams, coupled, mapping) = if family == 0 {
+            if channels > 2 {
+                return Err(Error::InvalidHeader("family 0 allows at most 2 channels"));
+            }
+            (1, channels - 1, (0..channels as u8).collect::<Vec<_>>())
+        } else {
+            if family == 3 {
+                return Err(Error::Unsupported("channel mapping family 3 (projection)"));
+            }
+            if rest.len() < 2 + channels {
+                return Err(Error::InvalidHeader("truncated channel mapping table"));
+            }
+            let streams = rest[0] as usize;
+            let coupled = rest[1] as usize;
+            if streams == 0 || coupled > streams || streams + coupled > 255 {
+                return Err(Error::InvalidHeader("bad stream counts"));
+            }
+            if family == 1 && !(1..=8).contains(&channels) {
+                return Err(Error::InvalidHeader("family 1 allows 1 to 8 channels"));
+            }
+            let mapping = rest[2..2 + channels].to_vec();
+            if mapping.iter().any(|&m| m != 255 && m as usize >= streams + coupled) {
+                return Err(Error::InvalidHeader("channel mapping out of range"));
+            }
+            (streams, coupled, mapping)
+        };
+        Ok(OpusHead { channels, pre_skip, input_sample_rate, output_gain, mapping_family: family, streams, coupled_streams: coupled, mapping })
+    }
+
+    /// Checks the invariants the decoder indexes by, for headers built by hand rather than parsed.
+    pub fn validate(&self) -> Result<()> {
+        if self.channels == 0 {
+            return Err(Error::InvalidHeader("zero channels"));
+        }
+        if self.streams == 0 || self.coupled_streams > self.streams || self.streams + self.coupled_streams > 255 {
+            return Err(Error::InvalidHeader("bad stream counts"));
+        }
+        if self.mapping.len() != self.channels {
+            return Err(Error::InvalidHeader("channel mapping length differs from channel count"));
+        }
+        if self.mapping.iter().any(|&m| m != 255 && m as usize >= self.streams + self.coupled_streams) {
+            return Err(Error::InvalidHeader("channel mapping out of range"));
+        }
+        Ok(())
+    }
+
+    /// Linear output gain factor.
+    pub fn gain_linear(&self) -> f32 {
+        10f32.powf(self.output_gain as f32 / (20.0 * 256.0))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_family0_and_roundtrip() {
+        let mut h = b"OpusHead".to_vec();
+        h.extend([1, 2, 0x38, 0x01, 0x80, 0xBB, 0, 0, 0x00, 0x01, 0]);
+        let head = OpusHead::parse(&h).unwrap();
+        assert_eq!(head.channels, 2);
+        assert_eq!(head.pre_skip, 312);
+        assert_eq!(head.input_sample_rate, 48000);
+        assert_eq!(head.output_gain, 256);
+        assert_eq!((head.streams, head.coupled_streams), (1, 1));
+        assert_eq!(head.to_bytes(), h);
+        assert!((head.gain_linear() - 1.122).abs() < 1e-3);
+    }
+
+    #[test]
+    fn parse_family1_51() {
+        let mut h = b"OpusHead".to_vec();
+        h.extend([1, 6, 0x38, 0x01, 0x80, 0xBB, 0, 0, 0, 0, 1, 4, 2, 0, 4, 1, 2, 3, 5]);
+        let head = OpusHead::parse(&h).unwrap();
+        assert_eq!((head.channels, head.streams, head.coupled_streams), (6, 4, 2));
+        assert_eq!(head.mapping, vec![0, 4, 1, 2, 3, 5]);
+        assert_eq!(OpusHead::parse(&head.to_bytes()).unwrap(), head);
+    }
+
+    #[test]
+    fn rejects_garbage() {
+        assert!(OpusHead::parse(b"OpusHea").is_err());
+        assert!(OpusHead::parse(b"OpusTags...........").is_err());
+        let mut h = b"OpusHead".to_vec();
+        h.extend([1, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+        assert!(OpusHead::parse(&h).is_err());
+        let mut h = b"OpusHead".to_vec();
+        h.extend([1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 5]);
+        assert!(OpusHead::parse(&h).is_err());
+    }
+
+    #[test]
+    fn dops() {
+        let d = [0u8, 2, 0x01, 0x38, 0, 0, 0xBB, 0x80, 0, 0, 0];
+        let head = OpusHead::from_dops(&d).unwrap();
+        assert_eq!(head.pre_skip, 312);
+        assert_eq!(head.channels, 2);
+    }
+}
@@ -0,0 +1,46 @@
+//! Clean-room pure-Rust Opus decoder (RFC 6716, updated by RFC 8251).
+//!
+//! Layer L0: no dependencies beyond `std`; no `unsafe`; builds for `wasm32-unknown-unknown`.
+
+// Spec-style indexed loops (FilmCraft allows this lint workspace-wide).
+#![allow(clippy::needless_range_loop)]
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+// The fixed-point parts mirror the normative integer arithmetic; keep C-like shift expressions.
+#![allow(clippy::precedence, clippy::int_plus_one)]
+
+pub(crate) mod celt;
+mod decoder;
+mod header;
+mod multistream;
+pub mod packet;
+pub(crate) mod range;
+pub(crate) mod silk;
+
+pub use decoder::{SAMPLE_RATES, StreamDecoder};
+pub use header::OpusHead;
+pub use multistream::Decoder;
+pub use packet::{Bandwidth, Mode, Packet, Toc};
+
+/// Errors from header parsing and decoding.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Error {
+    InvalidArgument(&'static str),
+    InvalidPacket(&'static str),
+    InvalidHeader(&'static str),
+    Unsupported(&'static str),
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Error::InvalidArgument(s) => write!(f, "invalid argument: {s}"),
+            Error::InvalidPacket(s) => write!(f, "invalid packet: {s}"),
+            Error::InvalidHeader(s) => write!(f, "invalid header: {s}"),
+            Error::Unsupported(s) => write!(f, "unsupported: {s}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+pub type Result<T> = std::result::Result<T, Error>;
@@ -0,0 +1,198 @@
+//! Public decoder: OpusHead-configured (multistream) decoding to planar f32.
+
+use crate::decoder::StreamDecoder;
+use crate::header::OpusHead;
+use crate::packet::Packet;
+use crate::{Error, Result};
+
+/// Opus decoder for an `OpusHead` configuration (mono, stereo, or multistream surround).
+///
+/// Produces planar f32 at the chosen output rate. Pre-skip is *not* removed unless
+/// [`Decoder::set_trim_pre_skip`] is enabled (containers usually handle it via edit lists /
+/// granule positions). The header's output gain is applied.
+pub struct Decoder {
+    head: OpusHead,
+    rate: u32,
+    streams: Vec<StreamDecoder>,
+    trim_pre_skip: bool,
+    skip_remaining: usize,
+    scratch: Vec<Vec<f32>>,
+}
+
+impl Decoder {
+    /// Creates a 48 kHz decoder from an `OpusHead` packet (Ogg / Matroska `CodecPrivate`).
+    pub fn new(opus_head: &[u8]) -> Result<Decoder> {
+        Self::from_head(OpusHead::parse(opus_head)?, 48000)
+    }
+
+    /// Creates a decoder for plain mono/stereo packets without a header.
+    pub fn simple(sample_rate: u32, channels: usize) -> Result<Decoder> {
+        Self::from_head(OpusHead::simple(channels)?, sample_rate)
+    }
+
+    /// Creates a decoder for a parsed header at `sample_rate` (8/12/16/24/48 kHz).
+    pub fn from_head(head: OpusHead, sample_rate: u32) -> Result<Decoder> {
+        head.validate()?;
+        let mut streams = Vec::with_capacity(head.streams);
+        for s in 0..head.streams {
+            let ch = if s < head.coupled_streams { 2 } else { 1 };
+            let mut d = StreamDecoder::new(sample_rate, ch)?;
+            d.set_gain_q8(head.output_gain);
+            streams.push(d);
+        }
+        Ok(Decoder { rate: sample_rate, streams, trim_pre_skip: false, skip_remaining: 0, scratch: vec![Vec::new(); head.streams], head })
+    }
+
+    pub fn head(&self) -> &OpusHead {
+        &self.head
+    }
+
+    pub fn sample_rate(&self) -> u32 {
+        self.rate
+    }
+
+    pub fn channels(&self) -> usize {
+        self.head.channels
+    }
+
+    /// Pre-skip in samples at the output rate.
+    pub fn pre_skip(&self) -> usize {
+        self.head.pre_skip as usize * self.rate as usize / 48000
+    }
+
+    /// When enabled, the first [`Self::pre_skip`] output samples are dropped.
+    pub fn set_trim_pre_skip(&mut self, enable: bool) {
+        self.trim_pre_skip = enable;
+        self.skip_remaining = if enable { self.pre_skip() } else { 0 };
+    }
+
+    /// Disables intensity-stereo phase inversion (useful when downmixing; RFC 8251 section 10).
+    pub fn set_phase_inversion_disabled(&mut self, disabled: bool) {
+        for s in &mut self.streams {
+            s.set_phase_inversion_disabled(disabled);
+        }
+    }
+
+    /// Final range coder state of the first stream (conformance testing).
+    pub fn final_range(&self) -> u32 {
+        self.streams.first().map_or(0, |s| s.final_range())
+    }
+
+    pub fn reset(&mut self) {
+        for s in &mut self.streams {
+            s.reset();
+        }
+        self.skip_remaining = if self.trim_pre_skip { self.pre_skip() } else { 0 };
+    }
+
+    /// Decodes one packet (`None` = lost packet, concealed) into planar channels.
+    pub fn decode(&mut self, packet: Option<&[u8]>) -> Result<Vec<Vec<f32>>> {
+        let n = self.streams.len();
+        for b in &mut self.scratch {
+            b.clear();
+        }
+        let mut samples = None;
+        match packet {
+            Some(data) if !data.is_empty() => {
+                let mut off = 0;
+                for s in 0..n {
+                    let rest = &data[off..];
+                    if rest.is_empty() {
+                        return Err(Error::InvalidPacket("truncated multistream packet"));
+                    }
+                    let used = if s + 1 < n { Packet::parse_self_delimited(rest)?.1 } else { rest.len() };
+                    let pkt = &rest[..used];
+                    let r = if s + 1 < n {
+                        // Re-frame the self-delimited packet as a regular one for the stream decoder.
+                        let (p, _) = Packet::parse_self_delimited(pkt)?;
+                        let regular = reframe(&p);
+                        self.streams[s].decode_interleaved(Some(&regular), &mut self.scratch[s])?
+                    } else {
+                        self.streams[s].decode_interleaved(Some(pkt), &mut self.scratch[s])?
+                    };
+                    if *samples.get_or_insert(r) != r {
+                        return Err(Error::InvalidPacket("multistream frame durations differ"));
+                    }
+                    off += used;
+                }
+            }
+            _ => {
+                let dur = match self.streams[0].last_packet_duration() {
+                    0 => self.rate as usize / 50,
+                    d => d,
+                };
+                for s in 0..n {
+                    self.streams[s].conceal(dur, &mut self.scratch[s])?;
+                }
+                samples = Some(dur);
+            }
+        }
+        let samples = samples.unwrap_or(0);
+        let mut out = vec![vec![0f32; samples]; self.head.channels];
+        for (c, o) in out.iter_mut().enumerate() {
+            let m = self.head.mapping[c] as usize;
+            if m == 255 {
+                continue;
+            }
+            let (s, ch, nch) = if m < 2 * self.head.coupled_streams { (m / 2, m % 2, 2) } else { (m - self.head.coupled_streams, 0, 1) };
+            let src = &self.scratch[s];
+            for (i, v) in o.iter_mut().enumerate() {
+                *v = src[i * nch + ch];
+            }
+        }
+        if self.skip_remaining > 0 {
+            let k = self.skip_remaining.min(samples);
+            for o in &mut out {
+                o.drain(..k);
+            }
+            self.skip_remaining -= k;
+        }
+        Ok(out)
+    }
+}
+
+/// Rebuilds a regular (code 3 VBR) packet from a parsed self-delimited one.
+fn reframe(p: &Packet) -> Vec<u8> {
+    let mut v = vec![(p.toc.config << 3) | if p.toc.stereo { 4 } else { 0 } | 3];
+    v.push(0x80 | p.frames.len() as u8);
+    for f in &p.frames[..p.frames.len() - 1] {
+        let s = f.len();
+        if s < 252 {
+            v.push(s as u8);
+        } else {
+            let b0 = 252 + (s & 3);
+            v.push(b0 as u8);
+            v.push(((s - b0) >> 2) as u8);
+        }
+    }
+    for f in &p.frames {
+        v.extend_from_slice(f);
+    }
+    v
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn head(channels: usize, streams: usize, coupled: usize, mapping: Vec<u8>) -> OpusHead {
+        OpusHead { channels, pre_skip: 0, input_sample_rate: 48000, output_gain: 0, mapping_family: 1, streams, coupled_streams: coupled, mapping }
+    }
+
+    #[test]
+    fn from_head_rejects_inconsistent_headers() {
+        assert!(Decoder::from_head(head(1, 0, 0, vec![0]), 48000).is_err(), "zero streams");
+        assert!(Decoder::from_head(head(2, 1, 0, vec![0]), 48000).is_err(), "short mapping");
+        assert!(Decoder::from_head(head(1, 1, 0, vec![1]), 48000).is_err(), "mapping index out of range");
+        assert!(Decoder::from_head(head(1, 1, 2, vec![0]), 48000).is_err(), "more coupled than streams");
+        assert!(Decoder::from_head(head(0, 1, 0, vec![]), 48000).is_err(), "zero channels");
+    }
+
+    #[test]
+    fn from_head_accepts_valid_headers() {
+        assert!(Decoder::from_head(head(1, 1, 0, vec![0]), 48000).is_ok());
+        assert!(Decoder::from_head(head(2, 1, 1, vec![0, 1]), 48000).is_ok());
+        assert!(Decoder::from_head(head(3, 2, 1, vec![0, 1, 2]), 48000).is_ok());
+        assert!(Decoder::from_head(head(2, 1, 0, vec![0, 255]), 48000).is_ok());
+    }
+}
@@ -0,0 +1,340 @@
+//! TOC byte and frame packing (RFC 6716 §3).
+
+use crate::Error;
+
+/// Coding mode of an Opus frame.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Mode {
+    SilkOnly,
+    Hybrid,
+    CeltOnly,
+}
+
+/// Audio bandwidth.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Bandwidth {
+    /// 4 kHz.
+    Narrowband,
+    /// 6 kHz.
+    Mediumband,
+    /// 8 kHz.
+    Wideband,
+    /// 12 kHz.
+    SuperWideband,
+    /// 20 kHz.
+    Fullband,
+}
+
+impl Bandwidth {
+    /// Number of CELT bands coded for this bandwidth.
+    pub fn celt_end_band(self) -> usize {
+        match self {
+            Bandwidth::Narrowband => 13,
+            Bandwidth::Mediumband | Bandwidth::Wideband => 17,
+            Bandwidth::SuperWideband => 19,
+            Bandwidth::Fullband => 21,
+        }
+    }
+}
+
+/// Decoded table-of-contents byte.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Toc {
+    pub config: u8,
+    pub mode: Mode,
+    pub bandwidth: Bandwidth,
+    pub stereo: bool,
+    /// Frame count code (0..=3).
+    pub code: u8,
+}
+
+impl Toc {
+    pub fn parse(b: u8) -> Toc {
+        let config = b >> 3;
+        let (mode, bandwidth) = match config {
+            0..=3 => (Mode::SilkOnly, Bandwidth::Narrowband),
+            4..=7 => (Mode::SilkOnly, Bandwidth::Mediumband),
+            8..=11 => (Mode::SilkOnly, Bandwidth::Wideband),
+            12..=13 => (Mode::Hybrid, Bandwidth::SuperWideband),
+            14..=15 => (Mode::Hybrid, Bandwidth::Fullband),
+            16..=19 => (Mode::CeltOnly, Bandwidth::Narrowband),
+            20..=23 => (Mode::CeltOnly, Bandwidth::Wideband),
+            24..=27 => (Mode::CeltOnly, Bandwidth::SuperWideband),
+            _ => (Mode::CeltOnly, Bandwidth::Fullband),
+        };
+        Toc { config, mode, bandwidth, stereo: b & 4 != 0, code: b & 3 }
+    }
+
+    /// Samples per frame at 48 kHz.
+    pub fn frame_samples_48k(&self) -> usize {
+        self.frame_samples(48000)
+    }
+
+    /// Samples per frame at `rate`.
+    pub fn frame_samples(&self, rate: u32) -> usize {
+        let rate = rate as usize;
+        let c = self.config as usize;
+        match self.mode {
+            Mode::CeltOnly => (rate << (c & 3)) / 400,
+            Mode::Hybrid => {
+                if c & 1 != 0 {
+                    rate / 50
+                } else {
+                    rate / 100
+                }
+            }
+            Mode::SilkOnly => match c & 3 {
+                3 => rate * 60 / 1000,
+                s => (rate << s) / 100,
+            },
+        }
+    }
+
+    pub fn channels(&self) -> usize {
+        if self.stereo { 2 } else { 1 }
+    }
+}
+
+/// A parsed packet: TOC plus the byte ranges of each frame.
+#[derive(Clone, Debug)]
+pub struct Packet<'a> {
+    pub toc: Toc,
+    pub frames: Vec<&'a [u8]>,
+    /// Bytes of padding (code 3 only).
+    pub padding: usize,
+}
+
+fn parse_size(data: &[u8]) -> Option<(usize, usize)> {
+    match data.first() {
+        None => None,
+        Some(&b) if b < 252 => Some((b as usize, 1)),
+        Some(&b) => data.get(1).map(|&b1| (4 * b1 as usize + b as usize, 2)),
+    }
+}
+
+impl<'a> Packet<'a> {
+    /// Parses a packet (RFC 6716 section 3.2), enforcing requirements R1 to R7.
+    pub fn parse(data: &'a [u8]) -> Result<Packet<'a>, Error> {
+        Self::parse_impl(data, false).map(|(p, _)| p)
+    }
+
+    /// Parses a self-delimited packet (RFC 6716 Appendix B, used for all but the last stream of
+    /// a multistream packet); returns the packet and the number of bytes it occupies.
+    pub fn parse_self_delimited(data: &'a [u8]) -> Result<(Packet<'a>, usize), Error> {
+        Self::parse_impl(data, true)
+    }
+
+    fn parse_impl(data: &'a [u8], self_delimited: bool) -> Result<(Packet<'a>, usize), Error> {
+        const BAD: Error = Error::InvalidPacket("malformed packet framing");
+        if data.is_empty() {
+            return Err(Error::InvalidPacket("empty packet"));
+        }
+        let toc = Toc::parse(data[0]);
+        let fs = toc.frame_samples_48k();
+        let mut pos = 1usize;
+        let mut len = data.len() as isize - 1;
+        let mut sizes: Vec<isize> = Vec::new();
+        let mut padding = 0usize;
+        let mut cbr = false;
+        let count;
+        let mut last_size = len;
+        let read_size = |pos: &mut usize, len: &mut isize| -> Result<isize, Error> {
+            let avail = &data[*pos..(*pos + (*len).max(0) as usize).min(data.len())];
+            let (s, n) = parse_size(avail).ok_or(BAD)?;
+            *pos += n;
+            *len -= n as isize;
+            Ok(s as isize)
+        };
+        match toc.code {
+            0 => count = 1,
+            1 => {
+                count = 2;
+                cbr = true;
+                if !self_delimited {
+                    if len & 1 != 0 {
+                        return Err(BAD);
+                    }
+                    last_size = len / 2;
+                    sizes.push(last_size);
+                }
+            }
+            2 => {
+                count = 2;
+                let s0 = read_size(&mut pos, &mut len)?;
+                if s0 > len {
+                    return Err(BAD);
+                }
+                sizes.push(s0);
+                last_size = len - s0;
+            }
+            _ => {
+                if len < 1 {
+                    return Err(BAD);
+                }
+                let ch = data[pos];
+                pos += 1;
+                len -= 1;
+                count = (ch & 0x3F) as usize;
+                if count == 0 || fs * count > 5760 {
+                    return Err(BAD);
+                }
+                if ch & 0x40 != 0 {
+                    loop {
+                        if len <= 0 {
+                            return Err(BAD);
+                        }
+                        let b = data[pos];
+                        pos += 1;
+                        len -= 1;
+                        let tmp = if b == 255 { 254 } else { b as isize };
+                        len -= tmp;
+                        padding += tmp as usize;
+                        if b != 255 {
+                            break;
+                        }
+                    }
+                }
+                if len < 0 {
+                    return Err(BAD);
+                }
+                cbr = ch & 0x80 == 0;
+                if !cbr {
+                    last_size = len;
+                    for _ in 0..count - 1 {
+                        let before = len;
+                        let s = read_size(&mut pos, &mut len)?;
+                        if s > len {
+                            return Err(BAD);
+                        }
+                        sizes.push(s);
+                        last_size -= (before - len) + s;
+                    }
+                    if last_size < 0 {
+                        return Err(BAD);
+                    }
+                } else if !self_delimited {
+                    last_size = len / count as isize;
+                    if last_size * count as isize != len {
+                        return Err(BAD);
+                    }
+                    for _ in 0..count - 1 {
+                        sizes.push(last_size);
+                    }
+                }
+            }
+        }
+        if self_delimited {
+            let before = len;
+            let s = read_size(&mut pos, &mut len)?;
+            if s > len {
+                return Err(BAD);
+            }
+            if cbr {
+                if s * count as isize > len {
+                    return Err(BAD);
+                }
+                sizes = vec![s; count - 1];
+            } else if (before - len) + s > last_size {
+                return Err(BAD);
+            }
+            last_size = s;
+        }
+        if last_size > 1275 || sizes.iter().any(|&s| s > 1275) {
+            return Err(BAD);
+        }
+        sizes.push(last_size);
+        let mut frames = Vec::with_capacity(count);
+        for &s in &sizes {
+            let s = s as usize;
+            if pos + s > data.len() {
+                return Err(BAD);
+            }
+            frames.push(&data[pos..pos + s]);
+            pos += s;
+        }
+        let total = if self_delimited { pos + padding } else { data.len() };
+        if total > data.len() {
+            return Err(BAD);
+        }
+        Ok((Packet { toc, frames, padding }, total))
+    }
+}
+
+/// Number of samples (at 48 kHz) in a packet, or an error for malformed framing.
+pub fn packet_samples_48k(data: &[u8]) -> Result<usize, Error> {
+    let p = Packet::parse(data)?;
+    Ok(p.toc.frame_samples_48k() * p.frames.len())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn toc_configs() {
+        for cfg in 0u8..32 {
+            let t = Toc::parse(cfg << 3);
+            let ms10 = t.frame_samples(48000) * 10 / 48; // tenths of ms
+            let expect = match cfg {
+                0..=11 => [100, 200, 400, 600][cfg as usize & 3],
+                12..=15 => [100, 200][cfg as usize & 1],
+                _ => [25, 50, 100, 200][cfg as usize & 3],
+            };
+            assert_eq!(ms10, expect, "config {cfg}");
+        }
+        assert!(Toc::parse(0x04).stereo);
+    }
+
+    #[test]
+    fn frame_codes() {
+        // code 0
+        let p = Packet::parse(&[0x00, 1, 2, 3]).unwrap();
+        assert_eq!(p.frames, vec![&[1u8, 2, 3][..]]);
+        // code 1 (odd payload is invalid)
+        assert!(Packet::parse(&[0x01, 1, 2, 3]).is_err());
+        let p = Packet::parse(&[0x01, 1, 2, 3, 4]).unwrap();
+        assert_eq!(p.frames.len(), 2);
+        // code 2
+        let p = Packet::parse(&[0x02, 1, 9, 8, 7]).unwrap();
+        assert_eq!(p.frames, vec![&[9u8][..], &[8u8, 7][..]]);
+        assert!(Packet::parse(&[0x02, 5, 1]).is_err());
+        // code 3 CBR with padding: 2 frames of 2 bytes, 3 bytes padding
+        let p = Packet::parse(&[0x03, 0x42, 3, 1, 2, 3, 4, 0, 0, 0]).unwrap();
+        assert_eq!(p.frames, vec![&[1u8, 2][..], &[3u8, 4][..]]);
+        assert_eq!(p.padding, 3);
+        // code 3 VBR
+        let p = Packet::parse(&[0x03, 0x83, 1, 2, 10, 20, 21, 30]).unwrap();
+        assert_eq!(p.frames, vec![&[10u8][..], &[20u8, 21][..], &[30u8][..]]);
+        // too many frames (> 120 ms)
+        assert!(Packet::parse(&[0x03 | (3 << 3), 0x03, 0]).is_err());
+        // zero frames
+        assert!(Packet::parse(&[0x03, 0x00]).is_err());
+        assert!(Packet::parse(&[]).is_err());
+    }
+
+    #[test]
+    fn two_byte_sizes() {
+        let mut pkt = vec![0x02u8, 252, 1];
+        pkt.extend(std::iter::repeat_n(7u8, 256));
+        pkt.extend([1, 2]);
+        let p = Packet::parse(&pkt).unwrap();
+        assert_eq!(p.frames[0].len(), 256);
+        assert_eq!(p.frames[1], &[1, 2]);
+    }
+
+    #[test]
+    fn self_delimited() {
+        // code 0 with explicit size, followed by trailing data of the next stream.
+        let (p, used) = Packet::parse_self_delimited(&[0x00, 2, 5, 6, 0xAA, 0xBB]).unwrap();
+        assert_eq!(p.frames, vec![&[5u8, 6][..]]);
+        assert_eq!(used, 4);
+        // code 1: one size for both frames.
+        let (p, used) = Packet::parse_self_delimited(&[0x01, 1, 5, 6, 9]).unwrap();
+        assert_eq!(p.frames, vec![&[5u8][..], &[6u8][..]]);
+        assert_eq!(used, 4);
+        // code 3 VBR, 2 frames: size of frame 0, then size of last frame.
+        let (p, used) = Packet::parse_self_delimited(&[0x03, 0x82, 1, 2, 7, 8, 9, 0xFF]).unwrap();
+        assert_eq!(p.frames, vec![&[7u8][..], &[8u8, 9][..]]);
+        assert_eq!(used, 7);
+    }
+}
@@ -0,0 +1,497 @@
+//! Range decoder (RFC 6716 §4.1).
+//!
+//! The decoder reads range-coded symbols from the front of the buffer and raw bits from the back.
+//! Reading past either end yields zeros (never panics); callers detect corruption through
+//! [`RangeDecoder::tell`] exceeding the budget or through out-of-range values.
+
+const SYM_BITS: u32 = 8;
+const CODE_BITS: u32 = 32;
+const SYM_MAX: u32 = (1 << SYM_BITS) - 1;
+#[cfg(test)]
+const CODE_SHIFT: u32 = CODE_BITS - SYM_BITS - 1;
+const CODE_TOP: u32 = 1 << (CODE_BITS - 1);
+const CODE_BOT: u32 = CODE_TOP >> SYM_BITS;
+const CODE_EXTRA: u32 = (CODE_BITS - 2) % SYM_BITS + 1;
+/// Bit resolution of [`RangeDecoder::tell_frac`] (1/8 bit).
+pub const BITRES: u32 = 3;
+
+/// Number of bits needed to represent `x` (0 for 0).
+#[inline]
+pub fn ilog(x: u32) -> i32 {
+    (32 - x.leading_zeros()) as i32
+}
+
+#[derive(Clone, Debug)]
+pub struct RangeDecoder<'a> {
+    buf: &'a [u8],
+    /// Bytes available to the decoder (may be reduced, e.g. for redundancy).
+    storage: usize,
+    offs: usize,
+    end_offs: usize,
+    end_window: u32,
+    nend_bits: i32,
+    nbits_total: i32,
+    rng: u32,
+    val: u32,
+    rem: u32,
+    /// Set when an out-of-range value was decoded.
+    pub error: bool,
+}
+
+impl<'a> RangeDecoder<'a> {
+    pub fn new(buf: &'a [u8]) -> Self {
+        let mut d = RangeDecoder {
+            buf,
+            storage: buf.len(),
+            offs: 0,
+            end_offs: 0,
+            end_window: 0,
+            nend_bits: 0,
+            nbits_total: (CODE_BITS + 1 - ((CODE_BITS - CODE_EXTRA) / SYM_BITS) * SYM_BITS) as i32,
+            rng: 1 << CODE_EXTRA,
+            val: 0,
+            rem: 0,
+            error: false,
+        };
+        d.rem = d.read_byte();
+        d.val = d.rng - 1 - (d.rem >> (SYM_BITS - CODE_EXTRA));
+        d.normalize();
+        d
+    }
+
+    /// Size of the buffer in bytes as seen by the decoder.
+    pub fn storage(&self) -> usize {
+        self.storage
+    }
+
+    /// Shrinks the buffer seen by the decoder (raw bits are then read from the new end).
+    pub fn shrink_storage(&mut self, by: usize) {
+        self.storage = self.storage.saturating_sub(by);
+    }
+
+    pub fn rng(&self) -> u32 {
+        self.rng
+    }
+
+    #[inline]
+    fn read_byte(&mut self) -> u32 {
+        if self.offs < self.storage {
+            let b = self.buf[self.offs];
+            self.offs += 1;
+            b as u32
+        } else {
+            0
+        }
+    }
+
+    #[inline]
+    fn read_byte_from_end(&mut self) -> u32 {
+        if self.end_offs < self.storage {
+            self.end_offs += 1;
+            self.buf[self.storage - self.end_offs] as u32
+        } else {
+            0
+        }
+    }
+
+    #[inline]
+    fn normalize(&mut self) {
+        while self.rng <= CODE_BOT {
+            self.nbits_total += SYM_BITS as i32;
+            self.rng <<= SYM_BITS;
+            let sym = self.rem;
+            self.rem = self.read_byte();
+            let sym = ((sym << SYM_BITS) | self.rem) >> (SYM_BITS - CODE_EXTRA);
+            self.val = ((self.val << SYM_BITS).wrapping_add(SYM_MAX & !sym)) & (CODE_TOP - 1);
+        }
+    }
+
+    /// Returns the cumulative frequency of the next symbol for total `ft` (call [`Self::update`] next).
+    #[inline]
+    pub fn decode(&mut self, ft: u32) -> u32 {
+        let ext = self.rng / ft;
+        let s = self.val / ext;
+        // stash ext in rem-free form: recomputed by update()
+        ft - (s + 1).min(ft)
+    }
+
+    /// Like [`Self::decode`] with `ft = 1 << bits`.
+    #[inline]
+    pub fn decode_bin(&mut self, bits: u32) -> u32 {
+        let ext = self.rng >> bits;
+        let s = self.val / ext;
+        (1 << bits) - (s + 1).min(1 << bits)
+    }
+
+    /// Consumes the symbol with cumulative range `[fl, fh)` of total `ft`.
+    #[inline]
+    pub fn update(&mut self, fl: u32, fh: u32, ft: u32) {
+        let ext = self.rng / ft;
+        let s = ext * (ft - fh);
+        self.val = self.val.wrapping_sub(s);
+        self.rng = if fl > 0 { ext * (fh - fl) } else { self.rng - s };
+        self.normalize();
+    }
+
+    /// Like [`Self::update`] for a symbol decoded with [`Self::decode_bin`].
+    #[inline]
+    pub fn update_bin(&mut self, fl: u32, fh: u32, bits: u32) {
+        let ext = self.rng >> bits;
+        let ft = 1u32 << bits;
+        let s = ext * (ft - fh);
+        self.val = self.val.wrapping_sub(s);
+        self.rng = if fl > 0 { ext * (fh - fl) } else { self.rng - s };
+        self.normalize();
+    }
+
+    /// Decodes a binary symbol whose probability of being 1 is `1/2^logp`.
+    #[inline]
+    pub fn bit_logp(&mut self, logp: u32) -> bool {
+        let r = self.rng;
+        let d = self.val;
+        let s = r >> logp;
+        let ret = d < s;
+        if !ret {
+            self.val = d - s;
+        }
+        self.rng = if ret { s } else { r - s };
+        self.normalize();
+        ret
+    }
+
+    /// Decodes a symbol with an "inverse CDF" table (`icdf[i] = ft - cdf[i+1]`, `ft = 1 << ftb`).
+    #[inline]
+    pub fn icdf(&mut self, icdf: &[u8], ftb: u32) -> usize {
+        let mut s = self.rng;
+        let d = self.val;
+        let r = s >> ftb;
+        let mut ret = 0usize;
+        let mut t;
+        loop {
+            t = s;
+            let v = icdf.get(ret).copied().unwrap_or(0) as u32;
+            s = r * v;
+            if d >= s || ret + 1 >= icdf.len() {
+                break;
+            }
+            ret += 1;
+        }
+        // If the table is exhausted without d >= s, force the last symbol (only on corrupt tables).
+        if d < s {
+            s = 0;
+        }
+        self.val = d - s;
+        self.rng = t - s;
+        self.normalize();
+        ret
+    }
+
+    /// Decodes a uniformly distributed integer in `[0, ft)` (`ft >= 2`).
+    pub fn uint(&mut self, ft: u32) -> u32 {
+        debug_assert!(ft > 1);
+        let ft1 = ft - 1;
+        let ftb = ilog(ft1);
+        if ftb > 8 {
+            let ftb = (ftb - 8) as u32;
+            let top = (ft1 >> ftb) + 1;
+            let s = self.decode(top);
+            self.update(s, s + 1, top);
+            let t = (s << ftb) | self.bits(ftb);
+            if t <= ft1 {
+                return t;
+            }
+            self.error = true;
+            ft1
+        } else {
+            let s = self.decode(ft);
+            self.update(s, s + 1, ft);
+            s
+        }
+    }
+
+    /// Reads `bits` raw bits (0..=25) from the end of the buffer.
+    pub fn bits(&mut self, bits: u32) -> u32 {
+        if bits == 0 {
+            return 0;
+        }
+        let mut window = self.end_window;
+        let mut available = self.nend_bits;
+        if (available as u32) < bits {
+            loop {
+                window |= self.read_byte_from_end() << available;
+                available += SYM_BITS as i32;
+                if available > (CODE_BITS - SYM_BITS) as i32 {
+                    break;
+                }
+            }
+        }
+        let ret = window & ((1u32 << bits) - 1);
+        window >>= bits;
+        available -= bits as i32;
+        self.end_window = window;
+        self.nend_bits = available;
+        self.nbits_total += bits as i32;
+        ret
+    }
+
+    /// Advances the bit counter so that [`Self::tell`] reports `total` (CELT silence frames).
+    pub fn skip_to_end(&mut self, total: i32) {
+        let t = self.tell();
+        self.nbits_total += total - t;
+    }
+
+    /// Number of bits consumed so far (rounded up).
+    #[inline]
+    pub fn tell(&self) -> i32 {
+        self.nbits_total - ilog(self.rng)
+    }
+
+    /// Number of 1/8 bits consumed so far (rounded up).
+    pub fn tell_frac(&self) -> u32 {
+        let nbits = (self.nbits_total as u32) << BITRES;
+        let mut l = ilog(self.rng) as u32;
+        let mut r = self.rng >> (l - 16);
+        for _ in 0..BITRES {
+            r = (r * r) >> 15;
+            let b = r >> 16;
+            l = (l << 1) | b;
+            r >>= b;
+        }
+        nbits.wrapping_sub(l)
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod enc {
+    //! Minimal range encoder (RFC 6716 §5.1), used only to build test streams.
+    use super::*;
+
+    pub struct RangeEncoder {
+        out: Vec<u8>,
+        end: Vec<u8>,
+        end_window: u32,
+        nend_bits: i32,
+        rng: u32,
+        low: u32,
+        rem: i32,
+        ext: u32,
+        size: usize,
+    }
+
+    impl RangeEncoder {
+        pub fn new(size: usize) -> Self {
+            RangeEncoder { out: Vec::new(), end: Vec::new(), end_window: 0, nend_bits: 0, rng: CODE_TOP, low: 0, rem: -1, ext: 0, size }
+        }
+        fn carry_out(&mut self, c: u32) {
+            if c != SYM_MAX {
+                let carry = c >> SYM_BITS;
+                if self.rem >= 0 {
+                    self.out.push((self.rem as u32 + carry) as u8);
+                }
+                if self.ext > 0 {
+                    let sym = (SYM_MAX + carry) & SYM_MAX;
+                    for _ in 0..self.ext {
+                        self.out.push(sym as u8);
+                    }
+                    self.ext = 0;
+                }
+                self.rem = (c & SYM_MAX) as i32;
+            } else {
+                self.ext += 1;
+            }
+        }
+        fn normalize(&mut self) {
+            while self.rng <= CODE_BOT {
+                self.carry_out(self.low >> CODE_SHIFT);
+                self.low = (self.low << SYM_BITS) & (CODE_TOP - 1);
+                self.rng <<= SYM_BITS;
+            }
+        }
+        pub fn encode(&mut self, fl: u32, fh: u32, ft: u32) {
+            let r = self.rng / ft;
+            if fl > 0 {
+                self.low += self.rng - r * (ft - fl);
+                self.rng = r * (fh - fl);
+            } else {
+                self.rng -= r * (ft - fh);
+            }
+            self.normalize();
+        }
+        pub fn bit_logp(&mut self, val: bool, logp: u32) {
+            let r = self.rng;
+            let s = r >> logp;
+            let r2 = r - s;
+            if val {
+                self.low += r2;
+                self.rng = s;
+            } else {
+                self.rng = r2;
+            }
+            self.normalize();
+        }
+        pub fn icdf(&mut self, s: usize, icdf: &[u8], ftb: u32) {
+            let r = self.rng >> ftb;
+            if s > 0 {
+                self.low += self.rng - r * icdf[s - 1] as u32;
+                self.rng = r * (icdf[s - 1] as u32 - icdf[s] as u32);
+            } else {
+                self.rng -= r * icdf[s] as u32;
+            }
+            self.normalize();
+        }
+        pub fn uint(&mut self, fl: u32, ft: u32) {
+            let ft1 = ft - 1;
+            let ftb = ilog(ft1);
+            if ftb > 8 {
+                let ftb = (ftb - 8) as u32;
+                let top = (ft1 >> ftb) + 1;
+                let v = fl >> ftb;
+                self.encode(v, v + 1, top);
+                self.bits(fl & ((1 << ftb) - 1), ftb);
+            } else {
+                self.encode(fl, fl + 1, ft);
+            }
+        }
+        pub fn bits(&mut self, val: u32, bits: u32) {
+            let mut window = self.end_window;
+            let mut used = self.nend_bits;
+            if used as u32 + bits > CODE_BITS {
+                while used >= SYM_BITS as i32 {
+                    self.end.push((window & SYM_MAX) as u8);
+                    window >>= SYM_BITS;
+                    used -= SYM_BITS as i32;
+                }
+            }
+            window |= val << used;
+            used += bits as i32;
+            self.end_window = window;
+            self.nend_bits = used;
+        }
+        /// Finalises and returns a buffer of exactly `size` bytes.
+        pub fn done(mut self) -> Vec<u8> {
+            let mut l = CODE_BITS as i32 - ilog(self.rng);
+            let mut msk = (CODE_TOP - 1) >> l;
+            let mut end = (self.low + msk) & !msk;
+            if (end | msk) >= self.low + self.rng {
+                l += 1;
+                msk >>= 1;
+                end = (self.low + msk) & !msk;
+            }
+            while l > 0 {
+                self.carry_out(end >> CODE_SHIFT);
+                end = (end << SYM_BITS) & (CODE_TOP - 1);
+                l -= SYM_BITS as i32;
+            }
+            if self.rem >= 0 || self.ext > 0 {
+                self.carry_out(0);
+            }
+            let mut window = self.end_window;
+            let mut used = self.nend_bits;
+            while used > 0 {
+                self.end.push((window & SYM_MAX) as u8);
+                window >>= SYM_BITS;
+                used -= SYM_BITS as i32;
+            }
+            assert!(self.out.len() + self.end.len() <= self.size, "range encoder overflow");
+            let mut buf = self.out;
+            buf.resize(self.size - self.end.len(), 0);
+            for &b in self.end.iter().rev() {
+                buf.push(b);
+            }
+            buf
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::enc::RangeEncoder;
+    use super::*;
+
+    struct Lcg(u32);
+    impl Lcg {
+        fn next(&mut self) -> u32 {
+            self.0 = self.0.wrapping_mul(1664525).wrapping_add(1013904223);
+            self.0 >> 8
+        }
+    }
+
+    #[test]
+    fn roundtrip_mixed_symbols() {
+        let mut rng = Lcg(1);
+        for trial in 0..200 {
+            let n = 1 + (rng.next() % 300) as usize;
+            let mut ops = Vec::new();
+            for _ in 0..n {
+                match rng.next() % 5 {
+                    0 => {
+                        let ft = 2 + rng.next() % 1000;
+                        let v = rng.next() % ft;
+                        ops.push((0u8, v, ft));
+                    }
+                    1 => {
+                        let logp = 1 + rng.next() % 15;
+                        ops.push((1, rng.next().is_multiple_of(7) as u32, logp));
+                    }
+                    2 => {
+                        let bits = 1 + rng.next() % 24;
+                        ops.push((2, rng.next() & ((1 << bits) - 1), bits));
+                    }
+                    3 => {
+                        let ft = 2 + rng.next() % 100_000_000;
+                        ops.push((3, rng.next() % ft, ft));
+                    }
+                    _ => ops.push((4, rng.next() % 4, 0)),
+                }
+            }
+            let icdf: [u8; 4] = [200, 120, 30, 0];
+            let mut e = RangeEncoder::new(8 * n + 16);
+            for &(k, v, p) in &ops {
+                match k {
+                    0 => e.encode(v, v + 1, p),
+                    1 => e.bit_logp(v != 0, p),
+                    2 => e.bits(v, p),
+                    3 => e.uint(v, p),
+                    _ => e.icdf(v as usize, &icdf, 8),
+                }
+            }
+            let buf = e.done();
+            let mut d = RangeDecoder::new(&buf);
+            for (i, &(k, v, p)) in ops.iter().enumerate() {
+                let got = match k {
+                    0 => {
+                        let s = d.decode(p);
+                        d.update(s, s + 1, p);
+                        s
+                    }
+                    1 => d.bit_logp(p) as u32,
+                    2 => d.bits(p),
+                    3 => d.uint(p),
+                    _ => d.icdf(&icdf, 8) as u32,
+                };
+                assert_eq!(got, v, "trial {trial} op {i} kind {k}");
+            }
+            assert!(!d.error);
+        }
+    }
+
+    #[test]
+    fn tell_starts_at_one_bit() {
+        let buf = [0u8; 8];
+        let d = RangeDecoder::new(&buf);
+        assert_eq!(d.tell(), 1);
+        assert_eq!(d.tell_frac(), 8);
+    }
+
+    #[test]
+    fn empty_and_garbage_never_panic() {
+        let mut d = RangeDecoder::new(&[]);
+        for i in 0..100 {
+            d.bits(1 + i % 20);
+            d.uint(3 + i * 77);
+            d.icdf(&[250, 100, 0], 8);
+            d.bit_logp(1 + i % 15);
+        }
+        let _ = d.tell_frac();
+    }
+}
@@ -0,0 +1,912 @@
+//! SILK layer decoder (RFC 6716 §4.2).
+//!
+//! Parameter decoding and reconstruction follow the normative fixed-point arithmetic so that the
+//! output matches the reference decoder sample for sample at the internal rate. Resampling to the
+//! output rate uses our own linear-phase interpolator with the delays of RFC 6716 Table 54.
+
+pub(crate) mod lpc;
+mod resampler;
+#[allow(dead_code)]
+pub(crate) mod tables;
+
+use lpc::{MAX_LPC_ORDER, bwexpander, div32_varq, inverse32_varq, nlsf_decode, nlsf2a, rshift_round, sat16, smlawb, smulwb, smulww};
+use resampler::Resampler;
+use tables::{
+    CB_NB_10, CB_NB_20, CB_WB_10, CB_WB_20, DELTA_GAIN, EXC_LSB, EXC_SIGN, GAIN_MSB, LBRR_FLAGS, LTP_FILTER, LTP_PERIODICITY, LTP_SCALE, LTP_TAPS_0,
+    LTP_TAPS_1, LTP_TAPS_2, MID_ONLY, NLSF_EXT, NLSF_INTERP, NLSF_SEL_NBMB, NLSF_SEL_WB, NLSF_STAGE1, NLSF_STAGE2, PITCH_CONTOUR, PITCH_DELTA,
+    PITCH_HIGH, PITCH_LOW, PULSE_COUNT, RATE_LEVEL, SHELL_2, SHELL_4, SHELL_8, SHELL_16, STEREO_PRED_JOINT, STEREO_WEIGHTS_Q13, TYPE_ACTIVE,
+    TYPE_INACTIVE, UNIFORM3, UNIFORM4, UNIFORM5, UNIFORM8,
+};
+
+use crate::range::RangeDecoder;
+use crate::{Error, Result};
+
+const MAX_FRAME: usize = 320;
+const MAX_SUBFR: usize = 80;
+const LTP_ORDER: usize = 5;
+const OUT_BUF: usize = MAX_FRAME + 2 * MAX_SUBFR;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LostFlag {
+    Normal,
+    Lost,
+    Lbrr,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Cond {
+    Independently,
+    IndependentlyNoLtpScaling,
+    Conditionally,
+}
+
+#[derive(Clone, Default)]
+struct Indices {
+    gains: [i32; 4],
+    ltp_index: [usize; 4],
+    nlsf: [i32; 17],
+    lag_index: i32,
+    contour_index: usize,
+    signal_type: usize,
+    quant_offset_type: usize,
+    nlsf_interp_q2: i32,
+    per_index: usize,
+    ltp_scale_index: usize,
+    seed: i32,
+}
+
+#[derive(Clone)]
+struct Channel {
+    fs_khz: usize,
+    nb_subfr: usize,
+    frame_length: usize,
+    subfr_length: usize,
+    ltp_mem_length: usize,
+    lpc_order: usize,
+    prev_gain_q16: i32,
+    s_lpc_q14: [i32; MAX_LPC_ORDER],
+    out_buf: [i16; OUT_BUF],
+    lag_prev: i32,
+    last_gain_index: i32,
+    prev_signal_type: usize,
+    first_frame_after_reset: bool,
+    prev_nlsf_q15: [i32; MAX_LPC_ORDER],
+    ec_prev_signal_type: usize,
+    ec_prev_lag_index: i32,
+    vad_flags: [bool; 3],
+    lbrr_flag: bool,
+    lbrr_flags: [bool; 3],
+    n_frames_decoded: usize,
+    n_frames_per_packet: usize,
+    loss_cnt: u32,
+    indices: Indices,
+    resampler: Resampler,
+    // PLC memory.
+    plc_lpc_q12: [i32; MAX_LPC_ORDER],
+    plc_gain_q16: i32,
+    plc_pitch: i32,
+    plc_rand: u32,
+}
+
+impl Channel {
+    fn new() -> Channel {
+        Channel {
+            fs_khz: 0,
+            nb_subfr: 4,
+            frame_length: 0,
+            subfr_length: 0,
+            ltp_mem_length: 0,
+            lpc_order: 0,
+            prev_gain_q16: 65536,
+            s_lpc_q14: [0; MAX_LPC_ORDER],
+            out_buf: [0; OUT_BUF],
+            lag_prev: 100,
+            last_gain_index: 10,
+            prev_signal_type: 0,
+            first_frame_after_reset: true,
+            prev_nlsf_q15: [0; MAX_LPC_ORDER],
+            ec_prev_signal_type: 0,
+            ec_prev_lag_index: 0,
+            vad_flags: [false; 3],
+            lbrr_flag: false,
+            lbrr_flags: [false; 3],
+            n_frames_decoded: 0,
+            n_frames_per_packet: 1,
+            loss_cnt: 0,
+            indices: Indices::default(),
+            resampler: Resampler::new(16000, 16000),
+            plc_lpc_q12: [0; MAX_LPC_ORDER],
+            plc_gain_q16: 0,
+            plc_pitch: 0,
+            plc_rand: 22222,
+        }
+    }
+
+    fn set_fs(&mut self, fs_khz: usize, api_rate: u32) {
+        self.subfr_length = 5 * fs_khz;
+        let frame_length = self.nb_subfr * self.subfr_length;
+        if self.fs_khz != fs_khz || self.resampler.rates() != (fs_khz as u32 * 1000, api_rate) {
+            self.resampler = Resampler::new(fs_khz as u32 * 1000, api_rate);
+        }
+        if self.fs_khz != fs_khz || frame_length != self.frame_length {
+            if self.fs_khz != fs_khz {
+                self.ltp_mem_length = 20 * fs_khz;
+                self.lpc_order = if fs_khz == 16 { 16 } else { 10 };
+                self.first_frame_after_reset = true;
+                self.lag_prev = 100;
+                self.last_gain_index = 10;
+                self.prev_signal_type = 0;
+                self.out_buf = [0; OUT_BUF];
+                self.s_lpc_q14 = [0; MAX_LPC_ORDER];
+            }
+            self.fs_khz = fs_khz;
+            self.frame_length = frame_length;
+        }
+    }
+
+    fn decode_indices(&mut self, dec: &mut RangeDecoder, frame_index: usize, decode_lbrr: bool, cond: Cond) {
+        let ix = if decode_lbrr || self.vad_flags[frame_index] { dec.icdf(&TYPE_ACTIVE, 8) + 2 } else { dec.icdf(&TYPE_INACTIVE, 8) };
+        let ind = &mut self.indices;
+        ind.signal_type = ix >> 1;
+        ind.quant_offset_type = ix & 1;
+        if cond == Cond::Conditionally {
+            ind.gains[0] = dec.icdf(&DELTA_GAIN, 8) as i32;
+        } else {
+            ind.gains[0] = (dec.icdf(GAIN_MSB[ind.signal_type], 8) as i32) << 3;
+            ind.gains[0] += dec.icdf(&UNIFORM8, 8) as i32;
+        }
+        for i in 1..self.nb_subfr {
+            ind.gains[i] = dec.icdf(&DELTA_GAIN, 8) as i32;
+        }
+        let wb = self.lpc_order == 16;
+        let s1 = (ind.signal_type >> 1) + if wb { 2 } else { 0 };
+        let i1 = dec.icdf(NLSF_STAGE1[s1], 8);
+        ind.nlsf[0] = i1 as i32;
+        for i in 0..self.lpc_order {
+            let cb = if wb { 8 + NLSF_SEL_WB[i1][i] as usize } else { NLSF_SEL_NBMB[i1][i] as usize };
+            let mut v = dec.icdf(NLSF_STAGE2[cb], 8) as i32;
+            if v == 0 {
+                v -= dec.icdf(&NLSF_EXT, 8) as i32;
+            } else if v == 8 {
+                v += dec.icdf(&NLSF_EXT, 8) as i32;
+            }
+            ind.nlsf[i + 1] = v - 4;
+        }
+        ind.nlsf_interp_q2 = if self.nb_subfr == 4 { dec.icdf(&NLSF_INTERP, 8) as i32 } else { 4 };
+        if ind.signal_type == 2 {
+            let mut absolute = true;
+            if cond == Cond::Conditionally && self.ec_prev_signal_type == 2 {
+                let d = dec.icdf(&PITCH_DELTA, 8) as i32;
+                if d > 0 {
+                    ind.lag_index = self.ec_prev_lag_index + d - 9;
+                    absolute = false;
+                }
+            }
+            if absolute {
+                ind.lag_index = dec.icdf(&PITCH_HIGH, 8) as i32 * (self.fs_khz as i32 >> 1);
+                let low = match self.fs_khz {
+                    8 => PITCH_LOW[0],
+                    12 => PITCH_LOW[1],
+                    _ => PITCH_LOW[2],
+                };
+                ind.lag_index += dec.icdf(low, 8) as i32;
+            }
+            self.ec_prev_lag_index = ind.lag_index;
+            let contour = match (self.fs_khz, self.nb_subfr) {
+                (8, 2) => PITCH_CONTOUR[0],
+                (8, _) => PITCH_CONTOUR[1],
+                (_, 2) => PITCH_CONTOUR[2],
+                _ => PITCH_CONTOUR[3],
+            };
+            ind.contour_index = dec.icdf(contour, 8);
+            ind.per_index = dec.icdf(&LTP_PERIODICITY, 8);
+            for k in 0..self.nb_subfr {
+                ind.ltp_index[k] = dec.icdf(LTP_FILTER[ind.per_index], 8);
+            }
+            ind.ltp_scale_index = if cond == Cond::Independently { dec.icdf(&LTP_SCALE, 8) } else { 0 };
+        }
+        self.ec_prev_signal_type = ind.signal_type;
+        ind.seed = dec.icdf(&UNIFORM4, 8) as i32;
+    }
+
+    fn decode_frame(&mut self, dec: Option<&mut RangeDecoder>, out: &mut [i16], lost: LostFlag, cond: Cond) {
+        let l = self.frame_length;
+        let decode = match (lost, &dec) {
+            (LostFlag::Normal, Some(_)) => true,
+            (LostFlag::Lbrr, Some(_)) => self.lbrr_flags[self.n_frames_decoded],
+            _ => false,
+        };
+        if decode && let Some(dec) = dec {
+            self.decode_indices(dec, self.n_frames_decoded, lost == LostFlag::Lbrr, cond);
+            let mut pulses = [0i32; MAX_FRAME + 16];
+            decode_pulses(dec, &mut pulses, self.indices.signal_type, self.indices.quant_offset_type, l);
+            let ctrl = self.decode_parameters(cond);
+            self.decode_core(&ctrl, &pulses, out);
+            self.plc_lpc_q12 = ctrl.pred_coef_q12[1];
+            self.plc_gain_q16 = ctrl.gains_q16[self.nb_subfr - 1];
+            self.plc_pitch = if self.indices.signal_type == 2 { ctrl.pitch_l[self.nb_subfr - 1] } else { 0 };
+            self.loss_cnt = 0;
+            self.prev_signal_type = self.indices.signal_type;
+            self.first_frame_after_reset = false;
+            self.lag_prev = ctrl.pitch_l[self.nb_subfr - 1];
+        } else {
+            self.conceal(out);
+        }
+        // Update the output buffer.
+        let mv = self.ltp_mem_length - l;
+        self.out_buf.copy_within(l..l + mv, 0);
+        self.out_buf[mv..mv + l].copy_from_slice(&out[..l]);
+    }
+
+    fn decode_parameters(&mut self, cond: Cond) -> Ctrl {
+        let mut ctrl = Ctrl::default();
+        let nb = self.nb_subfr;
+        // Gains.
+        let mut prev = self.last_gain_index;
+        for k in 0..nb {
+            let ind = self.indices.gains[k];
+            if k == 0 && cond != Cond::Conditionally {
+                prev = ind.max(prev - 16);
+            } else {
+                let tmp = ind - 4;
+                let thr = 2 * 36 - 64 + prev;
+                if tmp > thr {
+                    prev += (tmp << 1) - thr;
+                } else {
+                    prev += tmp;
+                }
+            }
+            prev = prev.clamp(0, 63);
+            ctrl.gains_q16[k] = log2lin((smulwb(0x1D1C71, prev) + 2090).min(3967));
+        }
+        self.last_gain_index = prev;
+        // LPC.
+        let order = self.lpc_order;
+        let nlsf = nlsf_decode(&self.indices.nlsf, order == 16);
+        ctrl.pred_coef_q12[1] = nlsf2a(&nlsf[..order]);
+        if self.first_frame_after_reset {
+            self.indices.nlsf_interp_q2 = 4;
+        }
+        if self.indices.nlsf_interp_q2 < 4 {
+            let mut n0 = [0i32; MAX_LPC_ORDER];
+            for i in 0..order {
+                n0[i] = self.prev_nlsf_q15[i] + ((self.indices.nlsf_interp_q2 * (nlsf[i] - self.prev_nlsf_q15[i])) >> 2);
+            }
+            ctrl.pred_coef_q12[0] = nlsf2a(&n0[..order]);
+        } else {
+            ctrl.pred_coef_q12[0] = ctrl.pred_coef_q12[1];
+        }
+        self.prev_nlsf_q15 = nlsf;
+        if self.loss_cnt > 0 {
+            bwexpander(&mut ctrl.pred_coef_q12[0][..order], 63570);
+            bwexpander(&mut ctrl.pred_coef_q12[1][..order], 63570);
+        }
+        if self.indices.signal_type == 2 {
+            let fs = self.fs_khz as i32;
+            let min_lag = 2 * fs;
+            let max_lag = 18 * fs;
+            let lag = min_lag + self.indices.lag_index;
+            for k in 0..nb {
+                let off = match (self.fs_khz, nb) {
+                    (8, 2) => CB_NB_10[self.indices.contour_index][k],
+                    (8, _) => CB_NB_20[self.indices.contour_index][k],
+                    (_, 2) => CB_WB_10[self.indices.contour_index][k],
+                    _ => CB_WB_20[self.indices.contour_index][k],
+                };
+                ctrl.pitch_l[k] = (lag + off).clamp(min_lag, max_lag);
+            }
+            for k in 0..nb {
+                let ix = self.indices.ltp_index[k];
+                let taps = match self.indices.per_index {
+                    0 => LTP_TAPS_0[ix.min(7)],
+                    1 => LTP_TAPS_1[ix.min(15)],
+                    _ => LTP_TAPS_2[ix.min(31)],
+                };
+                for i in 0..LTP_ORDER {
+                    ctrl.ltp_coef_q14[k * LTP_ORDER + i] = taps[i] << 7;
+                }
+            }
+            ctrl.ltp_scale_q14 = [15565, 12288, 8192][self.indices.ltp_scale_index];
+        }
+        ctrl
+    }
+
+    fn decode_core(&mut self, ctrl: &Ctrl, pulses: &[i32], xq: &mut [i16]) {
+        let ind = &self.indices;
+        let l = self.frame_length;
+        let sub = self.subfr_length;
+        let order = self.lpc_order;
+        let ltp_mem = self.ltp_mem_length;
+        let mut s_ltp = [0i16; MAX_FRAME];
+        let mut s_ltp_q15 = [0i32; 2 * MAX_FRAME];
+        let mut res_q14 = [0i32; MAX_SUBFR];
+        let mut s_lpc = [0i32; MAX_SUBFR + MAX_LPC_ORDER];
+        let offset_q10 = [[100, 240], [32, 100]][ind.signal_type >> 1][ind.quant_offset_type];
+        let interp = ind.nlsf_interp_q2 < 4;
+        let mut exc = [0i32; MAX_FRAME];
+        let mut seed = ind.seed;
+        for i in 0..l {
+            seed = seed.wrapping_mul(196_314_165).wrapping_add(907_633_515);
+            let mut e = pulses[i] << 14;
+            if e > 0 {
+                e -= 80 << 4;
+            } else if e < 0 {
+                e += 80 << 4;
+            }
+            e += offset_q10 << 4;
+            if seed < 0 {
+                e = -e;
+            }
+            exc[i] = e;
+            seed = seed.wrapping_add(pulses[i]);
+        }
+        s_lpc[..MAX_LPC_ORDER].copy_from_slice(&self.s_lpc_q14);
+        let mut ltp_buf_idx = ltp_mem;
+        for k in 0..self.nb_subfr {
+            let a_q12 = &ctrl.pred_coef_q12[k >> 1];
+            let mut b_q14 = [0i32; LTP_ORDER];
+            b_q14.copy_from_slice(&ctrl.ltp_coef_q14[k * LTP_ORDER..(k + 1) * LTP_ORDER]);
+            let mut signal_type = ind.signal_type;
+            let gain_q10 = ctrl.gains_q16[k] >> 6;
+            let mut inv_gain_q31 = inverse32_varq(ctrl.gains_q16[k], 47);
+            let gain_adj_q16 = if ctrl.gains_q16[k] != self.prev_gain_q16 {
+                let g = div32_varq(self.prev_gain_q16, ctrl.gains_q16[k], 16);
+                for v in s_lpc[..MAX_LPC_ORDER].iter_mut() {
+                    *v = smulww(g, *v);
+                }
+                g
+            } else {
+                1 << 16
+            };
+            self.prev_gain_q16 = ctrl.gains_q16[k];
+            let mut lag = ctrl.pitch_l[k];
+            if self.loss_cnt > 0 && self.prev_signal_type == 2 && signal_type != 2 && k < 2 {
+                b_q14 = [0; LTP_ORDER];
+                b_q14[LTP_ORDER / 2] = 1 << 12;
+                signal_type = 2;
+                lag = self.lag_prev;
+            }
+            if signal_type == 2 {
+                let lag_u = lag as usize;
+                if k == 0 || (k == 2 && interp) {
+                    let start_idx = ltp_mem as isize - lag as isize - order as isize - (LTP_ORDER / 2) as isize;
+                    let start_idx = start_idx.max(0) as usize;
+                    if k == 2 {
+                        self.out_buf[ltp_mem..ltp_mem + 2 * sub].copy_from_slice(&xq[..2 * sub]);
+                    }
+                    let src_off = start_idx + k * sub;
+                    lpc_analysis_filter(&mut s_ltp[start_idx..ltp_mem], &self.out_buf[src_off..src_off + ltp_mem - start_idx], a_q12, order);
+                    if k == 0 {
+                        inv_gain_q31 = smulwb(inv_gain_q31, ctrl.ltp_scale_q14) << 2;
+                    }
+                    for i in 0..(lag_u + LTP_ORDER / 2).min(ltp_mem) {
+                        s_ltp_q15[ltp_buf_idx - i - 1] = smulwb(inv_gain_q31, s_ltp[ltp_mem - i - 1] as i32);
+                    }
+                } else if gain_adj_q16 != 1 << 16 {
+                    for i in 0..(lag_u + LTP_ORDER / 2).min(ltp_buf_idx) {
+                        let p = ltp_buf_idx - i - 1;
+                        s_ltp_q15[p] = smulww(gain_adj_q16, s_ltp_q15[p]);
+                    }
+                }
+                let base = ltp_buf_idx as isize - lag as isize + (LTP_ORDER / 2) as isize;
+                for i in 0..sub {
+                    let p = base + i as isize;
+                    let g = |o: isize| -> i32 { if p - o >= 0 { s_ltp_q15[(p - o) as usize] } else { 0 } };
+                    let mut pred = 2i32;
+                    pred = smlawb(pred, g(0), b_q14[0]);
+                    pred = smlawb(pred, g(1), b_q14[1]);
+                    pred = smlawb(pred, g(2), b_q14[2]);
+                    pred = smlawb(pred, g(3), b_q14[3]);
+                    pred = smlawb(pred, g(4), b_q14[4]);
+                    res_q14[i] = exc[k * sub + i].wrapping_add(pred << 1);
+                    s_ltp_q15[ltp_buf_idx] = res_q14[i] << 1;
+                    ltp_buf_idx += 1;
+                }
+            } else {
+                res_q14[..sub].copy_from_slice(&exc[k * sub..(k + 1) * sub]);
+            }
+            for i in 0..sub {
+                let mut pred = (order >> 1) as i32;
+                for j in 0..order {
+                    pred = smlawb(pred, s_lpc[MAX_LPC_ORDER + i - 1 - j], a_q12[j]);
+                }
+                let v = res_q14[i].saturating_add(pred.saturating_mul(16));
+                s_lpc[MAX_LPC_ORDER + i] = v;
+                xq[k * sub + i] = sat16(rshift_round(smulww(v, gain_q10), 8)) as i16;
+            }
+            s_lpc.copy_within(sub..sub + MAX_LPC_ORDER, 0);
+        }
+        self.s_lpc_q14.copy_from_slice(&s_lpc[..MAX_LPC_ORDER]);
+    }
+
+    /// Basic concealment: pitch-periodic repetition for voiced history, otherwise LPC-shaped
+    /// noise at the residual level of the history; both fade out over successive losses.
+    fn conceal(&mut self, out: &mut [i16]) {
+        let l = self.frame_length;
+        if l == 0 {
+            return;
+        }
+        self.loss_cnt += 1;
+        let order = self.lpc_order;
+        let mem = self.ltp_mem_length;
+        let fade = 0.85f32.powi(self.loss_cnt as i32);
+        let hist: Vec<f32> = self.out_buf[..mem].iter().map(|&v| v as f32).collect();
+        let pitch = self.plc_pitch as usize;
+        let mut y = hist.clone();
+        if pitch > 0 && pitch < mem {
+            for _ in 0..l {
+                let v = y[y.len() - pitch] * fade;
+                y.push(v);
+            }
+        } else {
+            let mut a12 = self.plc_lpc_q12;
+            bwexpander(&mut a12[..order], 64880);
+            self.plc_lpc_q12 = a12;
+            let a: Vec<f32> = a12[..order].iter().map(|&v| v as f32 / 4096.0).collect();
+            let mut e = 0f32;
+            for i in order..mem {
+                let mut r = hist[i];
+                for j in 0..order {
+                    r -= a[j] * hist[i - 1 - j];
+                }
+                e += r * r;
+            }
+            let rms = (e / (mem - order).max(1) as f32).sqrt() * fade;
+            for _ in 0..l {
+                self.plc_rand = self.plc_rand.wrapping_mul(196_314_165).wrapping_add(907_633_515);
+                let mut v = ((self.plc_rand as i32) >> 16) as f32 / 32768.0 * rms * 1.7;
+                for j in 0..order {
+                    v += a[j] * y[y.len() - 1 - j];
+                }
+                y.push(v.clamp(-32768.0, 32767.0));
+            }
+        }
+        for (o, v) in out.iter_mut().zip(&y[mem..mem + l]) {
+            *o = v.clamp(-32768.0, 32767.0) as i16;
+        }
+        // Keep the LPC synthesis state consistent for the next decoded frame.
+        let g = self.prev_gain_q16.max(1) as i64;
+        for j in 0..MAX_LPC_ORDER {
+            let v = out[l - MAX_LPC_ORDER + j] as i64;
+            self.s_lpc_q14[j] = ((v << 30) / g).clamp(i32::MIN as i64, i32::MAX as i64) as i32;
+        }
+        self.lag_prev = self.plc_pitch.max(1);
+        self.first_frame_after_reset = false;
+    }
+}
+
+#[derive(Default)]
+struct Ctrl {
+    gains_q16: [i32; 4],
+    pred_coef_q12: [[i32; MAX_LPC_ORDER]; 2],
+    pitch_l: [i32; 4],
+    ltp_coef_q14: [i32; 4 * LTP_ORDER],
+    ltp_scale_q14: i32,
+}
+
+fn log2lin(in_log_q7: i32) -> i32 {
+    if in_log_q7 < 0 {
+        return 0;
+    }
+    if in_log_q7 >= 3967 {
+        return i32::MAX;
+    }
+    let out = 1i32 << (in_log_q7 >> 7);
+    let frac = in_log_q7 & 0x7F;
+    if in_log_q7 < 2048 {
+        out + ((out * smlawb(frac, frac * (128 - frac), -174)) >> 7)
+    } else {
+        out + (out >> 7) * smlawb(frac, frac * (128 - frac), -174)
+    }
+}
+
+fn lpc_analysis_filter(out: &mut [i16], input: &[i16], b: &[i32], d: usize) {
+    let len = out.len();
+    for ix in d..len {
+        let mut acc: i32 = 0;
+        for j in 0..d {
+            acc = acc.wrapping_add((input[ix - 1 - j] as i32).wrapping_mul(b[j]));
+        }
+        let v = ((input[ix] as i32) << 12).wrapping_sub(acc);
+        out[ix] = sat16(rshift_round(v, 12)) as i16;
+    }
+    for v in out.iter_mut().take(d.min(len)) {
+        *v = 0;
+    }
+}
+
+fn decode_pulses(dec: &mut RangeDecoder, pulses: &mut [i32], signal_type: usize, quant_offset_type: usize, frame_length: usize) {
+    let rate_level = dec.icdf(RATE_LEVEL[signal_type >> 1], 8);
+    let mut iter = frame_length >> 4;
+    if iter * 16 < frame_length {
+        iter += 1;
+    }
+    let mut sum_pulses = [0i32; 20];
+    let mut n_lshifts = [0i32; 20];
+    for i in 0..iter {
+        let mut s = dec.icdf(PULSE_COUNT[rate_level], 8) as i32;
+        while s == 17 {
+            n_lshifts[i] += 1;
+            let tab = if n_lshifts[i] == 10 { PULSE_COUNT[10] } else { PULSE_COUNT[9] };
+            s = dec.icdf(tab, 8) as i32;
+        }
+        sum_pulses[i] = s;
+    }
+    for i in 0..iter {
+        let blk = &mut pulses[i * 16..(i + 1) * 16];
+        if sum_pulses[i] > 0 {
+            shell_decode(dec, blk, sum_pulses[i]);
+        } else {
+            blk.fill(0);
+        }
+    }
+    for i in 0..iter {
+        let nls = n_lshifts[i];
+        if nls > 0 {
+            for p in pulses[i * 16..(i + 1) * 16].iter_mut() {
+                let mut a = *p;
+                for _ in 0..nls {
+                    a = (a << 1) + dec.icdf(&EXC_LSB, 8) as i32;
+                }
+                *p = a;
+            }
+            sum_pulses[i] |= nls << 5;
+        }
+    }
+    // Signs.
+    let base = 7 * (quant_offset_type + (signal_type << 1));
+    let len = (frame_length + 8) >> 4;
+    for i in 0..len {
+        let p = sum_pulses[i];
+        if p > 0 {
+            let tab = EXC_SIGN[base + ((p & 0x1F) as usize).min(6)];
+            for q in pulses[i * 16..(i + 1) * 16].iter_mut() {
+                if *q > 0 && dec.icdf(tab, 8) == 0 {
+                    *q = -*q;
+                }
+            }
+        }
+    }
+}
+
+fn shell_decode(dec: &mut RangeDecoder, out: &mut [i32], total: i32) {
+    fn split(dec: &mut RangeDecoder, out: &mut [i32], n: usize, count: i32) {
+        if n == 1 {
+            out[0] = count;
+            return;
+        }
+        if count == 0 {
+            out[..n].fill(0);
+            return;
+        }
+        let tab = match n {
+            16 => SHELL_16[(count - 1) as usize],
+            8 => SHELL_8[(count - 1) as usize],
+            4 => SHELL_4[(count - 1) as usize],
+            _ => SHELL_2[(count - 1) as usize],
+        };
+        let left = dec.icdf(tab, 8) as i32;
+        let h = n / 2;
+        let (a, b) = out.split_at_mut(h);
+        split(dec, a, h, left);
+        split(dec, b, h, count - left);
+    }
+    split(dec, out, 16, total.min(16));
+}
+
+#[derive(Default, Clone)]
+struct Stereo {
+    pred_prev_q13: [i32; 2],
+    s_mid: [i16; 2],
+    s_side: [i16; 2],
+}
+
+fn stereo_decode_pred(dec: &mut RangeDecoder) -> [i32; 2] {
+    let n = dec.icdf(&STEREO_PRED_JOINT, 8);
+    let mut ix = [[0usize; 3]; 2];
+    ix[0][2] = n / 5;
+    ix[1][2] = n - 5 * ix[0][2];
+    for v in ix.iter_mut() {
+        v[0] = dec.icdf(&UNIFORM3, 8);
+        v[1] = dec.icdf(&UNIFORM5, 8);
+    }
+    let mut pred = [0i32; 2];
+    for (p, v) in pred.iter_mut().zip(ix.iter_mut()) {
+        v[0] += 3 * v[2];
+        let low = STEREO_WEIGHTS_Q13[v[0]];
+        let step = smulwb(STEREO_WEIGHTS_Q13[v[0] + 1] - low, 6554);
+        *p = low + step * (2 * v[1] as i32 + 1);
+    }
+    pred[0] -= pred[1];
+    pred
+}
+
+fn stereo_ms_to_lr(st: &mut Stereo, x1: &mut [i16], x2: &mut [i16], pred_q13: [i32; 2], fs_khz: usize, len: usize) {
+    x1[..2].copy_from_slice(&st.s_mid);
+    x2[..2].copy_from_slice(&st.s_side);
+    st.s_mid.copy_from_slice(&x1[len..len + 2]);
+    st.s_side.copy_from_slice(&x2[len..len + 2]);
+    let mut p0 = st.pred_prev_q13[0];
+    let mut p1 = st.pred_prev_q13[1];
+    let denom_q16 = (1 << 16) / (8 * fs_khz as i32);
+    let d0 = rshift_round((pred_q13[0] - st.pred_prev_q13[0]) as i16 as i32 * denom_q16 as i16 as i32, 16);
+    let d1 = rshift_round((pred_q13[1] - st.pred_prev_q13[1]) as i16 as i32 * denom_q16 as i16 as i32, 16);
+    let interp = 8 * fs_khz;
+    for n in 0..len {
+        if n < interp {
+            p0 += d0;
+            p1 += d1;
+        } else if n == interp {
+            p0 = pred_q13[0];
+            p1 = pred_q13[1];
+        }
+        let sum = ((x1[n] as i32 + x1[n + 2] as i32) + ((x1[n + 1] as i32) << 1)) << 9;
+        let mut s = smlawb((x2[n + 1] as i32) << 8, sum, p0);
+        s = smlawb(s, (x1[n + 1] as i32) << 11, p1);
+        x2[n + 1] = sat16(rshift_round(s, 8)) as i16;
+    }
+    st.pred_prev_q13 = pred_q13;
+    for n in 0..len {
+        let a = x1[n + 1] as i32;
+        let b = x2[n + 1] as i32;
+        x1[n + 1] = sat16(a + b) as i16;
+        x2[n + 1] = sat16(a - b) as i16;
+    }
+}
+
+/// SILK decoder for up to two internal channels (`silk_decoder`).
+pub struct SilkDecoder {
+    api_rate: u32,
+    api_channels: usize,
+    ch: [Channel; 2],
+    stereo: Stereo,
+    channels_internal: usize,
+    channels_internal_prev: usize,
+    internal_rate: u32,
+    prev_decode_only_middle: bool,
+    ms_pred: [i32; 2],
+    decode_only_middle: bool,
+}
+
+impl SilkDecoder {
+    pub fn new(api_rate: u32, api_channels: usize) -> SilkDecoder {
+        SilkDecoder {
+            api_rate,
+            api_channels,
+            ch: [Channel::new(), Channel::new()],
+            stereo: Stereo::default(),
+            channels_internal: api_channels,
+            channels_internal_prev: 0,
+            internal_rate: 16000,
+            prev_decode_only_middle: false,
+            ms_pred: [0; 2],
+            decode_only_middle: false,
+        }
+    }
+
+    pub fn reset(&mut self) {
+        self.ch = [Channel::new(), Channel::new()];
+        self.stereo = Stereo::default();
+        self.prev_decode_only_middle = false;
+        self.channels_internal_prev = 0;
+    }
+
+    pub fn set_stream(&mut self, channels: usize, internal_rate: u32) {
+        self.channels_internal = channels;
+        self.internal_rate = internal_rate;
+    }
+
+    /// Decodes one SILK frame (10 or 20 ms) into interleaved `out` at the API rate.
+    pub fn decode(
+        &mut self,
+        mut dec: Option<&mut RangeDecoder>,
+        lost: LostFlag,
+        new_packet: bool,
+        payload_ms: usize,
+        out: &mut [f32],
+    ) -> Result<usize> {
+        let nci = self.channels_internal;
+        if new_packet {
+            for c in self.ch.iter_mut() {
+                c.n_frames_decoded = 0;
+            }
+        }
+        if nci > self.channels_internal_prev && self.channels_internal_prev != 0 {
+            self.ch[1] = Channel::new();
+        }
+        let stereo_to_mono = nci == 1 && self.channels_internal_prev == 2 && self.internal_rate == 1000 * self.ch[0].fs_khz as u32;
+        if self.ch[0].n_frames_decoded == 0 {
+            self.configure_channels(nci, payload_ms)?;
+        }
+        if self.api_channels == 2 && nci == 2 && self.channels_internal_prev == 1 {
+            self.stereo.pred_prev_q13 = [0; 2];
+            self.stereo.s_side = [0; 2];
+            self.ch[1].resampler = self.ch[0].resampler.clone();
+        }
+        self.channels_internal_prev = nci;
+
+        if lost != LostFlag::Lost && self.ch[0].n_frames_decoded == 0 {
+            let d = dec.as_deref_mut().ok_or(Error::InvalidPacket("missing SILK data"))?;
+            self.read_packet_flags(d, nci);
+            if lost == LostFlag::Normal {
+                self.skip_lbrr_data(d, nci);
+            }
+        }
+        if nci == 2 {
+            self.decode_stereo_prediction(dec.as_deref_mut(), lost);
+        }
+        if nci == 2 && !self.decode_only_middle && self.prev_decode_only_middle {
+            self.reset_side_channel();
+        }
+        let l = self.ch[0].frame_length;
+        let mut buf = [[0i16; MAX_FRAME + 2]; 2];
+        self.decode_channel_frames(dec, lost, nci, &mut buf);
+        if self.api_channels == 2 && nci == 2 {
+            let (a, b) = buf.split_at_mut(1);
+            stereo_ms_to_lr(&mut self.stereo, &mut a[0], &mut b[0], self.ms_pred, self.ch[0].fs_khz, l);
+        } else {
+            buf[0][..2].copy_from_slice(&self.stereo.s_mid);
+            self.stereo.s_mid.copy_from_slice(&buf[0][l..l + 2]);
+        }
+        let n_out = self.resample_to_output(&buf, nci, stereo_to_mono, out);
+        if lost == LostFlag::Lost {
+            for c in self.ch.iter_mut().take(nci) {
+                c.last_gain_index = 10;
+            }
+        } else {
+            self.prev_decode_only_middle = self.decode_only_middle;
+        }
+        Ok(n_out)
+    }
+
+    /// Applies the packet's frame layout and internal sampling rate to the first `nci` channels.
+    fn configure_channels(&mut self, nci: usize, payload_ms: usize) -> Result<()> {
+        let (nfpp, nb) = match payload_ms {
+            10 => (1, 2),
+            20 => (1, 4),
+            40 => (2, 4),
+            60 => (3, 4),
+            _ => return Err(Error::InvalidPacket("bad SILK frame size")),
+        };
+        let fs_khz = ((self.internal_rate >> 10) + 1) as usize;
+        for c in self.ch.iter_mut().take(nci) {
+            c.n_frames_per_packet = nfpp;
+            c.nb_subfr = nb;
+            c.set_fs(fs_khz, self.api_rate);
+        }
+        Ok(())
+    }
+
+    /// Reads the per-frame VAD flags and LBRR flags at the start of a packet.
+    fn read_packet_flags(&mut self, d: &mut RangeDecoder, nci: usize) {
+        for c in self.ch.iter_mut().take(nci) {
+            for i in 0..c.n_frames_per_packet {
+                c.vad_flags[i] = d.bit_logp(1);
+            }
+            c.lbrr_flag = d.bit_logp(1);
+        }
+        for c in self.ch.iter_mut().take(nci) {
+            c.lbrr_flags = [false; 3];
+            if !c.lbrr_flag {
+                continue;
+            }
+            if c.n_frames_per_packet == 1 {
+                c.lbrr_flags[0] = true;
+            } else {
+                let sym = d.icdf(LBRR_FLAGS[c.n_frames_per_packet - 2], 8) + 1;
+                for i in 0..c.n_frames_per_packet {
+                    c.lbrr_flags[i] = (sym >> i) & 1 != 0;
+                }
+            }
+        }
+    }
+
+    /// Consumes (without using) the in-band LBRR frames of a normally decoded packet.
+    fn skip_lbrr_data(&mut self, d: &mut RangeDecoder, nci: usize) {
+        for i in 0..self.ch[0].n_frames_per_packet {
+            for n in 0..nci {
+                if !self.ch[n].lbrr_flags[i] {
+                    continue;
+                }
+                if nci == 2 && n == 0 {
+                    stereo_decode_pred(d);
+                    if !self.ch[1].lbrr_flags[i] {
+                        d.icdf(&MID_ONLY, 8);
+                    }
+                }
+                let cond = if i > 0 && self.ch[n].lbrr_flags[i - 1] { Cond::Conditionally } else { Cond::Independently };
+                let c = &mut self.ch[n];
+                c.decode_indices(d, i, true, cond);
+                let mut pulses = [0i32; MAX_FRAME + 16];
+                decode_pulses(d, &mut pulses, c.indices.signal_type, c.indices.quant_offset_type, c.frame_length);
+            }
+        }
+    }
+
+    /// Reads the mid/side prediction weights, or reuses the previous ones when this frame carries none.
+    fn decode_stereo_prediction(&mut self, dec: Option<&mut RangeDecoder>, lost: LostFlag) {
+        let fi = self.ch[0].n_frames_decoded;
+        let coded = lost == LostFlag::Normal || (lost == LostFlag::Lbrr && self.ch[0].lbrr_flags[fi]);
+        match dec {
+            Some(d) if coded => {
+                self.ms_pred = stereo_decode_pred(d);
+                let side_inactive = (lost == LostFlag::Normal && !self.ch[1].vad_flags[fi]) || (lost == LostFlag::Lbrr && !self.ch[1].lbrr_flags[fi]);
+                self.decode_only_middle = side_inactive && d.icdf(&MID_ONLY, 8) == 1;
+            }
+            _ => self.ms_pred = self.stereo.pred_prev_q13,
+        }
+    }
+
+    /// Resets the side channel's decoder state when it resumes after a mid-only stretch.
+    fn reset_side_channel(&mut self) {
+        let c = &mut self.ch[1];
+        c.out_buf = [0; OUT_BUF];
+        c.s_lpc_q14 = [0; MAX_LPC_ORDER];
+        c.lag_prev = 100;
+        c.last_gain_index = 10;
+        c.prev_signal_type = 0;
+        c.first_frame_after_reset = true;
+    }
+
+    /// Frame-coding condition for channel `n` of the frame currently being decoded.
+    fn frame_condition(&self, n: usize, lost: LostFlag) -> Cond {
+        let frame_index = self.ch[0].n_frames_decoded as isize - n as isize;
+        if frame_index <= 0 {
+            Cond::Independently
+        } else if lost == LostFlag::Lbrr {
+            if self.ch[n].lbrr_flags[frame_index as usize - 1] { Cond::Conditionally } else { Cond::Independently }
+        } else if n > 0 && self.prev_decode_only_middle {
+            Cond::IndependentlyNoLtpScaling
+        } else {
+            Cond::Conditionally
+        }
+    }
+
+    /// Decodes the current frame of every active channel into `buf` (silence for an inactive side channel).
+    fn decode_channel_frames(&mut self, mut dec: Option<&mut RangeDecoder>, lost: LostFlag, nci: usize, buf: &mut [[i16; MAX_FRAME + 2]; 2]) {
+        let has_side = if lost == LostFlag::Normal {
+            !self.decode_only_middle
+        } else {
+            !self.prev_decode_only_middle || (nci == 2 && lost == LostFlag::Lbrr && self.ch[1].lbrr_flags[self.ch[1].n_frames_decoded])
+        };
+        let l = self.ch[0].frame_length;
+        for n in 0..nci {
+            if n == 0 || has_side {
+                let cond = self.frame_condition(n, lost);
+                self.ch[n].decode_frame(dec.as_deref_mut(), &mut buf[n][2..], lost, cond);
+            } else {
+                buf[n][2..2 + l].fill(0);
+            }
+            self.ch[n].n_frames_decoded += 1;
+        }
+    }
+
+    /// Resamples the decoded channels to the API rate into interleaved `out`; returns samples per channel.
+    fn resample_to_output(&mut self, buf: &[[i16; MAX_FRAME + 2]; 2], nci: usize, stereo_to_mono: bool, out: &mut [f32]) -> usize {
+        let l = self.ch[0].frame_length;
+        let n_out = l * self.api_rate as usize / (self.ch[0].fs_khz * 1000);
+        let ach = self.api_channels;
+        let mut tmp = Vec::with_capacity(n_out);
+        for n in 0..ach.min(nci) {
+            tmp.clear();
+            self.ch[n].resampler.process(&buf[n][1..1 + l], &mut tmp);
+            for (i, &v) in tmp.iter().enumerate().take(n_out) {
+                out[i * ach + n] = v / 32768.0;
+            }
+        }
+        if ach == 2 && nci == 1 {
+            if stereo_to_mono {
+                tmp.clear();
+                self.ch[1].resampler.process(&buf[0][1..1 + l], &mut tmp);
+                for (i, &v) in tmp.iter().enumerate().take(n_out) {
+                    out[i * 2 + 1] = v / 32768.0;
+                }
+            } else {
+                for i in 0..n_out {
+                    out[i * 2 + 1] = out[i * 2];
+                }
+            }
+        }
+        n_out
+    }
+}
@@ -0,0 +1,377 @@
+//! Fixed-point NLSF decoding, NLSF→LPC conversion and filter stabilisation
+//! (RFC 6716 §4.2.7.5, with the RFC 8251 §6/§7 overflow fixes).
+
+use super::tables::{
+    COS_Q12, LSF_ORDER_NBMB, LSF_ORDER_WB, NLSF_CB_NBMB, NLSF_CB_WB, NLSF_MIN_SPACING_NBMB, NLSF_MIN_SPACING_WB, NLSF_PRED_NBMB, NLSF_PRED_WB,
+    NLSF_PSEL_NBMB, NLSF_PSEL_WB,
+};
+
+pub const MAX_LPC_ORDER: usize = 16;
+
+#[inline]
+pub fn smulwb(a: i32, b: i32) -> i32 {
+    ((a as i64 * (b as i16) as i64) >> 16) as i32
+}
+#[inline]
+pub fn smlawb(a: i32, b: i32, c: i32) -> i32 {
+    a.wrapping_add(smulwb(b, c))
+}
+#[inline]
+pub fn smulww(a: i32, b: i32) -> i32 {
+    ((a as i64 * b as i64) >> 16) as i32
+}
+#[inline]
+pub fn smmul(a: i32, b: i32) -> i32 {
+    ((a as i64 * b as i64) >> 32) as i32
+}
+#[inline]
+pub fn rshift_round(a: i32, s: u32) -> i32 {
+    if s == 1 { (a >> 1) + (a & 1) } else { ((a >> (s - 1)) + 1) >> 1 }
+}
+#[inline]
+pub fn rshift_round64(a: i64, s: u32) -> i64 {
+    if s == 1 { (a >> 1) + (a & 1) } else { ((a >> (s - 1)) + 1) >> 1 }
+}
+#[inline]
+pub fn sat16(a: i32) -> i32 {
+    a.clamp(-32768, 32767)
+}
+
+/// `silk_INVERSE32_varQ`: approximation of `(1 << q_res) / b32`.
+pub fn inverse32_varq(b32: i32, q_res: i32) -> i32 {
+    let b_headrm = b32.unsigned_abs().leading_zeros() as i32 - 1;
+    let b32_nrm = b32.wrapping_shl(b_headrm as u32);
+    let b32_inv = (i32::MAX >> 2) / (b32_nrm >> 16);
+    let mut result = b32_inv << 16;
+    let err_q32 = ((1i32 << 29).wrapping_sub(smulwb(b32_nrm, b32_inv))).wrapping_shl(3);
+    result = result.wrapping_add(((err_q32 as i64 * b32_inv as i64) >> 16) as i32);
+    let lshift = 61 - b_headrm - q_res;
+    if lshift <= 0 {
+        let s = (-lshift) as u32;
+        let lim_hi = i32::MAX >> s;
+        let lim_lo = i32::MIN >> s;
+        result.clamp(lim_lo, lim_hi) << s
+    } else if lshift < 32 {
+        result >> lshift
+    } else {
+        0
+    }
+}
+
+/// `silk_DIV32_varQ`: approximation of `(a32 << q_res) / b32`.
+pub fn div32_varq(a32: i32, b32: i32, q_res: i32) -> i32 {
+    let a_headrm = a32.unsigned_abs().leading_zeros() as i32 - 1;
+    let a32_nrm = a32.wrapping_shl(a_headrm as u32);
+    let b_headrm = b32.unsigned_abs().leading_zeros() as i32 - 1;
+    let b32_nrm = b32.wrapping_shl(b_headrm as u32);
+    let b32_inv = (i32::MAX >> 2) / (b32_nrm >> 16);
+    let mut result = smulwb(a32_nrm, b32_inv);
+    let a32_nrm = a32_nrm.wrapping_sub(((smmul(b32_nrm, result) as i64) << 3) as i32);
+    result = smlawb(result, a32_nrm, b32_inv);
+    let lshift = 29 + a_headrm - b_headrm - q_res;
+    if lshift < 0 {
+        let s = (-lshift) as u32;
+        let lim_hi = i32::MAX >> s;
+        let lim_lo = i32::MIN >> s;
+        result.clamp(lim_lo, lim_hi) << s
+    } else if lshift < 32 {
+        result >> lshift
+    } else {
+        0
+    }
+}
+
+fn sqrt_approx(x: i32) -> i32 {
+    if x <= 0 {
+        return 0;
+    }
+    let lz = x.leading_zeros() as i32;
+    let frac = (x.rotate_right((24 - lz).rem_euclid(32) as u32)) & 0x7f;
+    let mut y = if lz & 1 != 0 { 32768 } else { 46214 };
+    y >>= lz >> 1;
+    smlawb(y, y, 213 * frac)
+}
+
+/// Decodes the stage-1/stage-2 indices into stabilised NLSFs (Q15).
+pub fn nlsf_decode(indices: &[i32], wb: bool) -> [i32; MAX_LPC_ORDER] {
+    let order = if wb { 16 } else { 10 };
+    let i1 = indices[0] as usize;
+    let cb1: &[i32] = if wb { &NLSF_CB_WB[i1] } else { &NLSF_CB_NBMB[i1] };
+    let qstep = if wb { 9830 } else { 11796 };
+    // Residual dequantisation with backwards prediction.
+    let mut res_q10 = [0i32; MAX_LPC_ORDER];
+    let mut out_q10 = 0i32;
+    for i in (0..order).rev() {
+        let pred = if i + 1 < order {
+            let sel = if wb { NLSF_PSEL_WB[i1][i] } else { NLSF_PSEL_NBMB[i1][i] } as usize;
+            let w = if wb { NLSF_PRED_WB[sel][i] } else { NLSF_PRED_NBMB[sel][i] };
+            (out_q10 * w) >> 8
+        } else {
+            0
+        };
+        let mut v = indices[i + 1] << 10;
+        if v > 0 {
+            v -= 102;
+        } else if v < 0 {
+            v += 102;
+        }
+        out_q10 = smlawb(pred, v, qstep);
+        res_q10[i] = out_q10;
+    }
+    // Laroia weights.
+    let mut nlsf = [0i32; MAX_LPC_ORDER];
+    for k in 0..order {
+        let prev = if k == 0 { 0 } else { cb1[k - 1] };
+        let next = if k + 1 == order { 256 } else { cb1[k + 1] };
+        let w = (1024 / (cb1[k] - prev).max(1) + 1024 / (next - cb1[k]).max(1)).min(32767);
+        let w_q9 = sqrt_approx(w << 16);
+        let v = (cb1[k] << 7) + (res_q10[k] << 14) / w_q9.max(1);
+        nlsf[k] = v.clamp(0, 32767);
+    }
+    let dmin: &[i32] = if wb { &NLSF_MIN_SPACING_WB } else { &NLSF_MIN_SPACING_NBMB };
+    nlsf_stabilize(&mut nlsf[..order], dmin);
+    nlsf
+}
+
+pub fn nlsf_stabilize(nlsf: &mut [i32], dmin: &[i32]) {
+    let l = nlsf.len();
+    for _ in 0..20 {
+        let mut min_diff = nlsf[0] - dmin[0];
+        let mut idx = 0;
+        for i in 1..l {
+            let d = nlsf[i] - (nlsf[i - 1] + dmin[i]);
+            if d < min_diff {
+                min_diff = d;
+                idx = i;
+            }
+        }
+        let d = 32768 - (nlsf[l - 1] + dmin[l]);
+        if d < min_diff {
+            min_diff = d;
+            idx = l;
+        }
+        if min_diff >= 0 {
+            return;
+        }
+        if idx == 0 {
+            nlsf[0] = dmin[0];
+        } else if idx == l {
+            nlsf[l - 1] = 32768 - dmin[l];
+        } else {
+            let mut min_center = dmin[..idx].iter().sum::<i32>();
+            min_center += dmin[idx] >> 1;
+            let mut max_center = 32768 - dmin[idx + 1..=l].iter().sum::<i32>();
+            max_center -= dmin[idx] >> 1;
+            let c = rshift_round(nlsf[idx - 1] + nlsf[idx], 1);
+            let c = if min_center > max_center { c.clamp(max_center, min_center) } else { c.clamp(min_center, max_center) };
+            nlsf[idx - 1] = c - (dmin[idx] >> 1);
+            nlsf[idx] = nlsf[idx - 1] + dmin[idx];
+        }
+    }
+    // Fallback.
+    nlsf.sort_unstable();
+    nlsf[0] = nlsf[0].max(dmin[0]);
+    for i in 1..l {
+        nlsf[i] = nlsf[i].max(sat16(nlsf[i - 1] + dmin[i]));
+    }
+    nlsf[l - 1] = nlsf[l - 1].min(32768 - dmin[l]);
+    for i in (0..l - 1).rev() {
+        nlsf[i] = nlsf[i].min(nlsf[i + 1] - dmin[i + 1]);
+    }
+}
+
+fn bwexpander_32(ar: &mut [i32], mut chirp_q16: i32) {
+    let d = ar.len();
+    let chirp_minus_one = chirp_q16 - 65536;
+    for v in ar.iter_mut().take(d - 1) {
+        *v = smulww(chirp_q16, *v);
+        chirp_q16 += rshift_round(chirp_q16.wrapping_mul(chirp_minus_one), 16);
+    }
+    ar[d - 1] = smulww(chirp_q16, ar[d - 1]);
+}
+
+/// `silk_bwexpander` on Q12 coefficients (16-bit).
+pub fn bwexpander(ar: &mut [i32], mut chirp_q16: i32) {
+    let d = ar.len();
+    let chirp_minus_one = chirp_q16 - 65536;
+    for v in ar.iter_mut().take(d - 1) {
+        *v = rshift_round(chirp_q16.wrapping_mul(*v), 16);
+        chirp_q16 += rshift_round(chirp_q16.wrapping_mul(chirp_minus_one), 16);
+    }
+    ar[d - 1] = rshift_round(chirp_q16.wrapping_mul(ar[d - 1]), 16);
+}
+
+fn lpc_inverse_pred_gain(a_q12: &[i32]) -> i32 {
+    const QA: u32 = 24;
+    const A_LIMIT: i32 = 16_773_022;
+    let order = a_q12.len();
+    let mut a = [0i32; MAX_LPC_ORDER];
+    let mut dc = 0;
+    for k in 0..order {
+        dc += a_q12[k];
+        a[k] = a_q12[k] << (QA - 12);
+    }
+    if dc >= 4096 {
+        return 0;
+    }
+    let mut inv_gain: i32 = 1 << 30;
+    let mul32_frac_q31 = |x: i32, y: i32| rshift_round64(x as i64 * y as i64, 31) as i32;
+    for k in (1..order).rev() {
+        if a[k] > A_LIMIT || a[k] < -A_LIMIT {
+            return 0;
+        }
+        let rc_q31 = -(a[k] << (31 - QA));
+        let rc_mult1 = (1i32 << 30) - smmul(rc_q31, rc_q31);
+        inv_gain = smmul(inv_gain, rc_mult1) << 2;
+        if inv_gain < 107_374 {
+            return 0;
+        }
+        let mult2q = 32 - rc_mult1.unsigned_abs().leading_zeros() as i32;
+        let rc_mult2 = inverse32_varq(rc_mult1, mult2q + 30);
+        for n in 0..(k + 1) >> 1 {
+            let t1 = a[n];
+            let t2 = a[k - n - 1];
+            let v1 = rshift_round64(t1.saturating_sub(mul32_frac_q31(t2, rc_q31)) as i64 * rc_mult2 as i64, mult2q as u32);
+            if v1 > i32::MAX as i64 || v1 < i32::MIN as i64 {
+                return 0;
+            }
+            let v2 = rshift_round64(t2.saturating_sub(mul32_frac_q31(t1, rc_q31)) as i64 * rc_mult2 as i64, mult2q as u32);
+            if v2 > i32::MAX as i64 || v2 < i32::MIN as i64 {
+                return 0;
+            }
+            a[n] = v1 as i32;
+            a[k - n - 1] = v2 as i32;
+        }
+    }
+    if a[0] > A_LIMIT || a[0] < -A_LIMIT {
+        return 0;
+    }
+    let rc_q31 = -(a[0] << (31 - QA));
+    let rc_mult1 = (1i32 << 30) - smmul(rc_q31, rc_q31);
+    inv_gain = smmul(inv_gain, rc_mult1) << 2;
+    if inv_gain < 107_374 {
+        return 0;
+    }
+    inv_gain
+}
+
+/// Converts NLSFs (Q15) to stable Q12 LPC coefficients (`silk_NLSF2A`).
+pub fn nlsf2a(nlsf: &[i32]) -> [i32; MAX_LPC_ORDER] {
+    let d = nlsf.len();
+    let ordering: &[usize] = if d == 16 { &LSF_ORDER_WB } else { &LSF_ORDER_NBMB };
+    let mut c_q17 = [0i32; MAX_LPC_ORDER];
+    for k in 0..d {
+        let i = (nlsf[k] >> 8) as usize;
+        let f = nlsf[k] & 255;
+        let c0 = COS_Q12[i];
+        let c1 = COS_Q12[(i + 1).min(128)];
+        c_q17[ordering[k]] = (c0 * 256 + (c1 - c0) * f + 4) >> 3;
+    }
+    let d2 = d / 2;
+    let find_poly = |off: usize| -> [i64; 10] {
+        let mut out = [0i64; 10];
+        out[0] = 1 << 16;
+        out[1] = -(c_q17[off] as i64);
+        for k in 1..d2 {
+            let ftmp = c_q17[2 * k + off] as i64;
+            out[k + 1] = 2 * out[k - 1] - ((ftmp * out[k] + 32768) >> 16);
+            for n in (2..=k).rev() {
+                out[n] += out[n - 2] - ((ftmp * out[n - 1] + 32768) >> 16);
+            }
+            out[1] -= ftmp;
+        }
+        out
+    };
+    let p = find_poly(0);
+    let q = find_poly(1);
+    let mut a32 = [0i32; MAX_LPC_ORDER];
+    for k in 0..d2 {
+        let ptmp = p[k + 1] + p[k];
+        let qtmp = q[k + 1] - q[k];
+        a32[k] = (-qtmp - ptmp) as i32;
+        a32[d - k - 1] = (qtmp - ptmp) as i32;
+    }
+    let a32 = &mut a32[..d];
+    // Limit the dynamic range (silk_LPC_fit with QIN = 17, QOUT = 12).
+    let mut a_q12 = [0i32; MAX_LPC_ORDER];
+    let mut i = 0;
+    while i < 10 {
+        let mut maxabs = 0i32;
+        let mut idx = 0;
+        for (k, &v) in a32.iter().enumerate() {
+            let av = v.saturating_abs();
+            if av > maxabs {
+                maxabs = av;
+                idx = k;
+            }
+        }
+        let maxabs = rshift_round(maxabs, 5);
+        if maxabs > 32767 {
+            let maxabs = maxabs.min(163_838);
+            let chirp = 65470 - ((maxabs - 32767) << 14) / ((maxabs * (idx as i32 + 1)) >> 2);
+            bwexpander_32(a32, chirp);
+        } else {
+            break;
+        }
+        i += 1;
+    }
+    if i == 10 {
+        for k in 0..d {
+            a_q12[k] = sat16(rshift_round(a32[k], 5));
+            a32[k] = a_q12[k] << 5;
+        }
+    } else {
+        for k in 0..d {
+            a_q12[k] = rshift_round(a32[k], 5);
+        }
+    }
+    for i in 0..16 {
+        if lpc_inverse_pred_gain(&a_q12[..d]) == 0 {
+            bwexpander_32(a32, 65536 - (2 << i));
+            for k in 0..d {
+                a_q12[k] = rshift_round(a32[k], 5);
+            }
+        } else {
+            break;
+        }
+    }
+    a_q12
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn flat_nlsf_gives_small_lpc() {
+        // Uniformly spaced NLSFs correspond to an (almost) flat spectrum.
+        let nlsf: Vec<i32> = (1..=16).map(|k| k * 32768 / 17).collect();
+        let a = nlsf2a(&nlsf);
+        assert!(a.iter().all(|v| v.abs() < 600), "{a:?}");
+        let nlsf: Vec<i32> = (1..=10).map(|k| k * 32768 / 11).collect();
+        let a = nlsf2a(&nlsf);
+        assert!(a[..10].iter().all(|v| v.abs() < 600), "{a:?}");
+    }
+
+    #[test]
+    fn stabilize_enforces_spacing() {
+        let mut v = [100, 90, 80, 30000, 30001, 30002, 31000, 32000, 32700, 32760];
+        nlsf_stabilize(&mut v, &NLSF_MIN_SPACING_NBMB);
+        assert!(v[0] >= NLSF_MIN_SPACING_NBMB[0]);
+        for i in 1..10 {
+            assert!(v[i] - v[i - 1] >= NLSF_MIN_SPACING_NBMB[i], "{v:?}");
+        }
+        assert!(32768 - v[9] >= NLSF_MIN_SPACING_NBMB[10]);
+    }
+
+    #[test]
+    fn inverse_approximations() {
+        for &b in &[65536, 100_000, 1 << 20, 81920, 1_686_110_208] {
+            let inv = inverse32_varq(b, 47) as f64;
+            let exact = 2f64.powi(47) / b as f64;
+            assert!((inv - exact).abs() / exact < 1e-3, "{b}");
+        }
+        let q = div32_varq(65536, 131072, 16) as f64;
+        assert!((q - 32768.0).abs() < 2.0);
+    }
+}
@@ -0,0 +1,205 @@
+//! SILK output resampler (RFC 6716 §4.2.9: non-normative filter, normative delay budget).
+//!
+//! A windowed-sinc polyphase interpolator whose group delay matches the delay allocation of
+//! RFC 6716 Table 54 (and the integer delays used when no rate conversion is needed), so that the
+//! SILK output lines up with the CELT layer in Hybrid mode.
+
+#[derive(Clone)]
+pub struct Resampler {
+    fin: u32,
+    fout: u32,
+    /// Pure-delay mode (equal rates): delay line.
+    copy_delay: usize,
+    /// Polyphase taps per output phase.
+    phases: Vec<(i64, Vec<f32>)>,
+    period: u64,
+    /// Total delay in units of 1/fout input samples.
+    delay_q: i64,
+    half: i64,
+    future: i64,
+    hist: Vec<f32>,
+    /// Absolute input index of `hist[0]`.
+    hist_start: i64,
+    n_in: i64,
+    n_out: u64,
+}
+
+fn gcd(a: u32, b: u32) -> u32 {
+    if b == 0 { a } else { gcd(b, a % b) }
+}
+
+/// Least-squares fractional-delay interpolator: taps at offsets `-past+1 ..= future` (in input
+/// samples) approximating a delay of `frac` samples over `[0, wp]`, with zero response weighted
+/// over `[ws, pi]` when `ws < pi` (decimation).
+fn design_fractional(past: i64, future: i64, frac: f64, wp: f64, ws: f64) -> Vec<f64> {
+    let offs: Vec<f64> = ((-past + 1)..=future).map(|m| m as f64).collect();
+    let n = offs.len();
+    // \int_a^b cos(w x) dw
+    let ic = |x: f64, a: f64, b: f64| if x.abs() < 1e-12 { b - a } else { ((b * x).sin() - (a * x).sin()) / x };
+    let stop_w = 30.0;
+    const LOW_W: f64 = 0.05;
+    let mut q = vec![vec![0f64; n + 1]; n];
+    for i in 0..n {
+        for k in 0..n {
+            let d = offs[i] - offs[k];
+            let mut v = ic(d, 0.0, 0.6 * wp) + LOW_W * ic(d, 0.6 * wp, wp);
+            if ws < std::f64::consts::PI {
+                v += stop_w * ic(d, ws, std::f64::consts::PI);
+            }
+            q[i][k] = v + if i == k { 1e-9 } else { 0.0 };
+        }
+        q[i][n] = ic(offs[i] - frac, 0.0, 0.6 * wp) + LOW_W * ic(offs[i] - frac, 0.6 * wp, wp);
+    }
+    // Gaussian elimination with partial pivoting.
+    for c in 0..n {
+        let p = (c..n).max_by(|&a, &b| q[a][c].abs().total_cmp(&q[b][c].abs())).unwrap_or(c);
+        q.swap(c, p);
+        let piv = q[c][c];
+        for r in 0..n {
+            if r != c {
+                let f = q[r][c] / piv;
+                if f != 0.0 {
+                    for k in c..=n {
+                        q[r][k] -= f * q[c][k];
+                    }
+                }
+            }
+        }
+    }
+    (0..n).map(|i| q[i][n] / q[i][i]).collect()
+}
+
+impl Resampler {
+    pub fn new(fin: u32, fout: u32) -> Resampler {
+        let mut r = Resampler {
+            fin,
+            fout,
+            copy_delay: 0,
+            phases: Vec::new(),
+            period: 1,
+            delay_q: 0,
+            half: 0,
+            future: 0,
+            hist: Vec::new(),
+            hist_start: 0,
+            n_in: 0,
+            n_out: 0,
+        };
+        if fin == fout {
+            r.copy_delay = match fin {
+                8000 => 4,
+                12000 => 9,
+                _ => 12,
+            };
+            r.hist = vec![0.0; r.copy_delay];
+            return r;
+        }
+        // Delay in milliseconds per internal bandwidth (RFC 6716 Table 54).
+        let delay_ms = match fin {
+            8000 => 0.538,
+            12000 => 0.692,
+            _ => 0.706,
+        };
+        let d_in = delay_ms * fin as f64 / 1000.0; // input samples
+        // Future taps are limited by the delay budget; past taps are free.
+        let future = (d_in.floor() as i64).max(1);
+        let past = 24i64;
+        r.half = past;
+        r.future = future;
+        r.delay_q = (d_in * fout as f64).round() as i64;
+        let g = gcd(fin, fout);
+        r.period = (fout / g) as u64;
+        let pi = std::f64::consts::PI;
+        // Passband edge and (for decimation) stopband edge in radians per input sample.
+        let (wp, ws) = if fout > fin { (0.94 * pi, pi) } else { (0.88 * pi * fout as f64 / fin as f64, pi * fout as f64 / fin as f64) };
+        for j in 0..r.period as i64 {
+            let num = j * fin as i64 - r.delay_q;
+            let base = num.div_euclid(fout as i64);
+            let frac = num.rem_euclid(fout as i64) as f64 / fout as f64;
+            let taps = design_fractional(past, future, frac, wp, ws);
+            r.phases.push((base, taps.iter().map(|&t| t as f32).collect()));
+        }
+        r.hist = vec![0.0; (past + future + 4) as usize];
+        r.hist_start = -(past + future + 4);
+        r
+    }
+
+    pub fn rates(&self) -> (u32, u32) {
+        (self.fin, self.fout)
+    }
+
+    /// Resamples `input` (16-bit scale) and appends the output samples.
+    pub fn process(&mut self, input: &[i16], out: &mut Vec<f32>) {
+        if self.fin == self.fout {
+            for &v in input {
+                self.hist.push(v as f32);
+            }
+            let n = self.hist.len() - self.copy_delay;
+            out.extend_from_slice(&self.hist[..n]);
+            self.hist.drain(..n);
+            return;
+        }
+        self.hist.extend(input.iter().map(|&v| v as f32));
+        self.n_in += input.len() as i64;
+        let total_out = (self.n_in as u64 * self.fout as u64) / self.fin as u64;
+        while self.n_out < total_out {
+            let j = self.n_out;
+            let cycle = (j / self.period) as i64;
+            let (base0, ref taps) = self.phases[(j % self.period) as usize];
+            let base = base0 + cycle * self.fin as i64 * self.period as i64 / self.fout as i64;
+            let first = base - self.half + 1;
+            let mut acc = 0f32;
+            for (m, &t) in taps.iter().enumerate() {
+                let idx = first + m as i64 - self.hist_start;
+                if idx >= 0 && (idx as usize) < self.hist.len() {
+                    acc += self.hist[idx as usize] * t;
+                }
+            }
+            out.push(acc);
+            self.n_out += 1;
+        }
+        // Trim history, keeping enough for the next taps.
+        let keep_from = self.n_in - (self.half + self.future + 4);
+        if keep_from > self.hist_start {
+            let drop = (keep_from - self.hist_start) as usize;
+            self.hist.drain(..drop.min(self.hist.len()));
+            self.hist_start = keep_from;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn upsample_sine_and_delay() {
+        for &(fin, fout) in &[(16000u32, 48000u32), (8000, 48000), (12000, 48000), (16000, 24000), (16000, 8000), (12000, 16000)] {
+            let mut r = Resampler::new(fin, fout);
+            let f = 440.0;
+            let n = fin as usize / 10;
+            let x: Vec<i16> = (0..n).map(|i| ((2.0 * std::f64::consts::PI * f * i as f64 / fin as f64).sin() * 10000.0) as i16).collect();
+            let mut y = Vec::new();
+            for c in x.chunks(fin as usize / 50) {
+                r.process(c, &mut y);
+            }
+            assert_eq!(y.len(), n * fout as usize / fin as usize);
+            // Compare against the ideal delayed sine.
+            let delay_ms = match fin {
+                8000 => 0.538,
+                12000 => 0.692,
+                _ => 0.706,
+            };
+            let mut err = 0f64;
+            let mut sig = 0f64;
+            for (j, &v) in y.iter().enumerate().skip(fout as usize / 100) {
+                let t = j as f64 / fout as f64 - delay_ms / 1000.0;
+                let ideal = (2.0 * std::f64::consts::PI * f * t).sin() * 10000.0;
+                err += (v as f64 - ideal).powi(2);
+                sig += ideal * ideal;
+            }
+            let snr = 10.0 * (sig / err).log10();
+            assert!(snr > 35.0, "{fin}->{fout}: {snr} dB");
+        }
+    }
+}
@@ -0,0 +1,540 @@
+//! SILK probability tables and codebooks, transcribed from RFC 6716 §4.2 (Tables 4–53).
+//!
+//! PDFs are written as in the RFC (`{...}/256`) and converted at compile time to the inverse-CDF
+//! form consumed by the range decoder.
+
+/// Converts a PDF (summing to 256) into an inverse CDF (`256 - cdf[i+1]`).
+pub const fn icdf<const N: usize>(pdf: &[u8; N]) -> [u8; N] {
+    let mut out = [0u8; N];
+    let mut acc: u32 = 0;
+    let mut i = 0;
+    while i < N {
+        acc += pdf[i] as u32;
+        out[i] = (256 - acc) as u8;
+        i += 1;
+    }
+    out
+}
+
+pub const STEREO_PRED_JOINT: [u8; 25] = icdf(&[7, 2, 1, 1, 1, 10, 24, 8, 1, 1, 3, 23, 92, 23, 3, 1, 1, 8, 24, 10, 1, 1, 1, 2, 7]);
+pub const UNIFORM3: [u8; 3] = icdf(&[85, 86, 85]);
+pub const UNIFORM5: [u8; 5] = icdf(&[51, 51, 52, 51, 51]);
+pub const STEREO_WEIGHTS_Q13: [i32; 16] = [-13732, -10050, -8266, -7526, -6500, -5000, -2950, -820, 820, 2950, 5000, 6500, 7526, 8266, 10050, 13732];
+pub const MID_ONLY: [u8; 2] = icdf(&[192, 64]);
+pub const TYPE_INACTIVE: [u8; 2] = icdf(&[26, 230]);
+pub const TYPE_ACTIVE: [u8; 4] = icdf(&[24, 74, 148, 10]);
+pub const GAIN_MSB: [&[u8]; 3] =
+    [&icdf::<8>(&[32, 112, 68, 29, 12, 1, 1, 1]), &icdf::<8>(&[2, 17, 45, 60, 62, 47, 19, 4]), &icdf::<8>(&[1, 3, 26, 71, 94, 50, 9, 2])];
+pub const UNIFORM8: [u8; 8] = icdf(&[32, 32, 32, 32, 32, 32, 32, 32]);
+pub const DELTA_GAIN: [u8; 41] =
+    icdf(&[6, 5, 11, 31, 132, 21, 8, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]);
+pub const NLSF_STAGE1: [&[u8]; 4] = [
+    &icdf::<32>(&[44, 34, 30, 19, 21, 12, 11, 3, 3, 2, 16, 2, 2, 1, 5, 2, 1, 3, 3, 1, 1, 2, 2, 2, 3, 1, 9, 9, 2, 7, 2, 1]),
+    &icdf::<32>(&[1, 10, 1, 8, 3, 8, 8, 14, 13, 14, 1, 14, 12, 13, 11, 11, 12, 11, 10, 10, 11, 8, 9, 8, 7, 8, 1, 1, 6, 1, 6, 5]),
+    &icdf::<32>(&[31, 21, 3, 17, 1, 8, 17, 4, 1, 18, 16, 4, 2, 3, 1, 10, 1, 3, 16, 11, 16, 2, 2, 3, 2, 11, 1, 4, 9, 8, 7, 3]),
+    &icdf::<32>(&[1, 4, 16, 5, 18, 11, 5, 14, 15, 1, 3, 12, 13, 14, 14, 6, 14, 12, 2, 6, 1, 12, 12, 11, 10, 3, 10, 5, 1, 1, 1, 3]),
+];
+pub const NLSF_STAGE2: [&[u8]; 16] = [
+    &icdf::<9>(&[1, 1, 1, 15, 224, 11, 1, 1, 1]),
+    &icdf::<9>(&[1, 1, 2, 34, 183, 32, 1, 1, 1]),
+    &icdf::<9>(&[1, 1, 4, 42, 149, 55, 2, 1, 1]),
+    &icdf::<9>(&[1, 1, 8, 52, 123, 61, 8, 1, 1]),
+    &icdf::<9>(&[1, 3, 16, 53, 101, 74, 6, 1, 1]),
+    &icdf::<9>(&[1, 3, 17, 55, 90, 73, 15, 1, 1]),
+    &icdf::<9>(&[1, 7, 24, 53, 74, 67, 26, 3, 1]),
+    &icdf::<9>(&[1, 1, 18, 63, 78, 58, 30, 6, 1]),
+    &icdf::<9>(&[1, 1, 1, 9, 232, 9, 1, 1, 1]),
+    &icdf::<9>(&[1, 1, 2, 28, 186, 35, 1, 1, 1]),
+    &icdf::<9>(&[1, 1, 3, 42, 152, 53, 2, 1, 1]),
+    &icdf::<9>(&[1, 1, 10, 49, 126, 65, 2, 1, 1]),
+    &icdf::<9>(&[1, 4, 19, 48, 100, 77, 5, 1, 1]),
+    &icdf::<9>(&[1, 1, 14, 54, 100, 72, 12, 1, 1]),
+    &icdf::<9>(&[1, 1, 15, 61, 87, 61, 25, 4, 1]),
+    &icdf::<9>(&[1, 7, 21, 50, 77, 81, 17, 1, 1]),
+];
+pub const NLSF_SEL_NBMB: [[u8; 10]; 32] = [
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [1, 3, 1, 2, 2, 1, 2, 1, 1, 1],
+    [2, 1, 1, 1, 1, 1, 1, 1, 1, 1],
+    [1, 2, 2, 2, 2, 1, 2, 1, 1, 1],
+    [2, 3, 3, 3, 3, 2, 2, 2, 2, 2],
+    [0, 5, 3, 3, 2, 2, 2, 2, 1, 1],
+    [0, 2, 2, 2, 2, 2, 2, 2, 2, 1],
+    [2, 3, 6, 4, 4, 4, 5, 4, 5, 5],
+    [2, 4, 5, 5, 4, 5, 4, 6, 4, 4],
+    [2, 4, 4, 7, 4, 5, 4, 5, 5, 4],
+    [4, 3, 3, 3, 2, 3, 2, 2, 2, 2],
+    [1, 5, 5, 6, 4, 5, 4, 5, 5, 5],
+    [2, 7, 4, 6, 5, 5, 5, 5, 5, 5],
+    [2, 7, 5, 5, 5, 5, 5, 6, 5, 4],
+    [3, 3, 5, 4, 4, 5, 4, 5, 4, 4],
+    [2, 3, 3, 5, 5, 4, 4, 4, 4, 4],
+    [2, 4, 4, 6, 4, 5, 4, 5, 5, 5],
+    [2, 5, 4, 6, 5, 5, 5, 4, 5, 4],
+    [2, 7, 4, 5, 4, 5, 4, 5, 5, 5],
+    [2, 5, 4, 6, 7, 6, 5, 6, 5, 4],
+    [3, 6, 7, 4, 6, 5, 5, 6, 4, 5],
+    [2, 7, 6, 4, 4, 4, 5, 4, 5, 5],
+    [4, 5, 5, 4, 6, 6, 5, 6, 5, 4],
+    [2, 5, 5, 6, 5, 6, 4, 6, 4, 4],
+    [4, 5, 5, 5, 3, 7, 4, 5, 5, 4],
+    [2, 3, 4, 5, 5, 6, 4, 5, 5, 4],
+    [2, 3, 2, 3, 3, 4, 2, 3, 3, 3],
+    [1, 1, 2, 2, 2, 2, 2, 3, 2, 2],
+    [4, 5, 5, 6, 6, 6, 5, 6, 4, 5],
+    [3, 5, 5, 4, 4, 4, 4, 3, 3, 2],
+    [2, 5, 3, 7, 5, 5, 4, 4, 5, 4],
+    [4, 4, 5, 4, 5, 6, 5, 6, 5, 4],
+];
+pub const NLSF_SEL_WB: [[u8; 16]; 32] = [
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [2, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 1, 1, 1, 0, 3],
+    [2, 5, 5, 3, 7, 4, 4, 5, 2, 5, 4, 5, 5, 4, 3, 3],
+    [0, 2, 1, 2, 2, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1],
+    [0, 6, 5, 4, 6, 4, 7, 5, 4, 4, 4, 5, 5, 4, 4, 3],
+    [0, 3, 5, 5, 4, 3, 3, 5, 3, 3, 3, 3, 3, 3, 2, 4],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 2, 6, 3, 7, 2, 5, 3, 4, 5, 5, 4, 3, 3, 2, 3],
+    [0, 6, 2, 6, 6, 4, 5, 4, 6, 5, 4, 4, 5, 3, 3, 3],
+    [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [2, 2, 3, 4, 5, 3, 3, 3, 3, 3, 3, 3, 2, 2, 1, 3],
+    [2, 2, 3, 3, 4, 3, 3, 3, 3, 3, 3, 3, 3, 2, 1, 3],
+    [3, 4, 4, 4, 6, 4, 4, 5, 3, 5, 4, 4, 5, 4, 3, 4],
+    [0, 6, 4, 5, 4, 7, 5, 2, 6, 5, 7, 4, 4, 3, 5, 3],
+    [0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0],
+    [1, 6, 5, 7, 5, 4, 5, 3, 4, 5, 4, 4, 4, 3, 3, 4],
+    [1, 3, 3, 4, 4, 3, 3, 5, 2, 3, 3, 5, 5, 5, 3, 4],
+    [2, 3, 3, 2, 2, 2, 3, 2, 1, 2, 1, 2, 1, 1, 1, 4],
+    [0, 2, 3, 5, 3, 3, 2, 2, 2, 1, 1, 0, 0, 0, 0, 0],
+    [3, 4, 3, 5, 3, 3, 2, 2, 1, 1, 1, 1, 1, 2, 2, 4],
+    [2, 6, 3, 7, 7, 4, 5, 4, 5, 3, 5, 3, 3, 2, 3, 3],
+    [2, 3, 5, 6, 6, 3, 5, 3, 4, 4, 3, 3, 3, 3, 2, 4],
+    [1, 3, 3, 4, 4, 4, 4, 3, 5, 5, 5, 3, 1, 1, 1, 1],
+    [2, 5, 3, 6, 6, 4, 7, 4, 4, 5, 3, 4, 4, 3, 3, 3],
+    [0, 6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 6, 6, 3, 5, 2, 5, 5, 3, 4, 4, 7, 7, 4, 4, 4],
+    [3, 3, 7, 3, 5, 4, 3, 3, 3, 2, 2, 3, 3, 3, 2, 3],
+    [0, 0, 1, 0, 0, 0, 2, 1, 2, 1, 1, 2, 2, 2, 1, 1],
+    [0, 3, 2, 5, 3, 3, 2, 3, 2, 1, 0, 0, 1, 0, 0, 1],
+    [3, 5, 5, 4, 7, 5, 3, 3, 2, 3, 2, 2, 1, 0, 1, 0],
+    [2, 3, 5, 3, 4, 3, 3, 3, 2, 1, 2, 6, 4, 0, 0, 0],
+];
+pub const NLSF_EXT: [u8; 7] = icdf(&[156, 60, 24, 9, 4, 2, 1]);
+pub const NLSF_PRED_NBMB: [[i32; 9]; 2] = [[179, 138, 140, 148, 151, 149, 153, 151, 163], [116, 67, 82, 59, 92, 72, 100, 89, 92]];
+pub const NLSF_PRED_WB: [[i32; 15]; 2] = [
+    [175, 148, 160, 176, 178, 173, 174, 164, 177, 174, 196, 182, 198, 192, 182],
+    [68, 62, 66, 60, 72, 117, 85, 90, 118, 136, 151, 142, 160, 142, 155],
+];
+pub const NLSF_PSEL_NBMB: [[u8; 9]; 32] = [
+    [0, 1, 0, 0, 0, 0, 0, 0, 0],
+    [1, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [1, 1, 1, 0, 0, 0, 0, 1, 0],
+    [0, 1, 0, 0, 0, 0, 0, 0, 0],
+    [0, 1, 0, 0, 0, 0, 0, 0, 0],
+    [1, 0, 1, 1, 0, 0, 0, 1, 0],
+    [0, 1, 1, 0, 0, 1, 1, 0, 0],
+    [0, 0, 1, 1, 0, 1, 0, 1, 1],
+    [0, 0, 1, 1, 0, 0, 1, 1, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 1, 0, 1, 1, 1, 1, 1, 0],
+    [0, 1, 0, 1, 1, 1, 1, 1, 0],
+    [0, 1, 1, 1, 1, 1, 1, 1, 0],
+    [1, 0, 1, 1, 0, 1, 1, 1, 1],
+    [0, 1, 1, 1, 1, 1, 0, 1, 0],
+    [0, 0, 1, 1, 0, 1, 0, 1, 0],
+    [0, 0, 1, 1, 1, 0, 1, 1, 1],
+    [0, 1, 1, 0, 0, 1, 1, 1, 0],
+    [0, 0, 0, 1, 1, 1, 0, 1, 0],
+    [0, 1, 1, 0, 0, 1, 0, 1, 0],
+    [0, 1, 1, 0, 0, 0, 1, 1, 0],
+    [0, 0, 0, 0, 0, 1, 1, 1, 1],
+    [0, 0, 1, 1, 0, 0, 0, 1, 1],
+    [0, 0, 0, 1, 0, 1, 1, 1, 1],
+    [0, 1, 1, 1, 1, 1, 1, 1, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 1, 0, 1, 1, 0, 1, 0],
+    [1, 0, 0, 1, 0, 0, 0, 0, 0],
+    [0, 0, 0, 1, 1, 0, 1, 0, 1],
+    [1, 0, 1, 1, 0, 1, 1, 1, 1],
+];
+pub const NLSF_PSEL_WB: [[u8; 15]; 32] = [
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0],
+    [0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0],
+    [0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0],
+    [0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1],
+    [0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0],
+    [0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0],
+    [0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0],
+    [0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1],
+    [0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0],
+    [0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0],
+    [0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    [0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0],
+    [0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0],
+    [0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0],
+    [0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1],
+    [0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
+    [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0],
+    [0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0],
+];
+pub const NLSF_CB_NBMB: [[i32; 10]; 32] = [
+    [12, 35, 60, 83, 108, 132, 157, 180, 206, 228],
+    [15, 32, 55, 77, 101, 125, 151, 175, 201, 225],
+    [19, 42, 66, 89, 114, 137, 162, 184, 209, 230],
+    [12, 25, 50, 72, 97, 120, 147, 172, 200, 223],
+    [26, 44, 69, 90, 114, 135, 159, 180, 205, 225],
+    [13, 22, 53, 80, 106, 130, 156, 180, 205, 228],
+    [15, 25, 44, 64, 90, 115, 142, 168, 196, 222],
+    [19, 24, 62, 82, 100, 120, 145, 168, 190, 214],
+    [22, 31, 50, 79, 103, 120, 151, 170, 203, 227],
+    [21, 29, 45, 65, 106, 124, 150, 171, 196, 224],
+    [30, 49, 75, 97, 121, 142, 165, 186, 209, 229],
+    [19, 25, 52, 70, 93, 116, 143, 166, 192, 219],
+    [26, 34, 62, 75, 97, 118, 145, 167, 194, 217],
+    [25, 33, 56, 70, 91, 113, 143, 165, 196, 223],
+    [21, 34, 51, 72, 97, 117, 145, 171, 196, 222],
+    [20, 29, 50, 67, 90, 117, 144, 168, 197, 221],
+    [22, 31, 48, 66, 95, 117, 146, 168, 196, 222],
+    [24, 33, 51, 77, 116, 134, 158, 180, 200, 224],
+    [21, 28, 70, 87, 106, 124, 149, 170, 194, 217],
+    [26, 33, 53, 64, 83, 117, 152, 173, 204, 225],
+    [27, 34, 65, 95, 108, 129, 155, 174, 210, 225],
+    [20, 26, 72, 99, 113, 131, 154, 176, 200, 219],
+    [34, 43, 61, 78, 93, 114, 155, 177, 205, 229],
+    [23, 29, 54, 97, 124, 138, 163, 179, 209, 229],
+    [30, 38, 56, 89, 118, 129, 158, 178, 200, 231],
+    [21, 29, 49, 63, 85, 111, 142, 163, 193, 222],
+    [27, 48, 77, 103, 133, 158, 179, 196, 215, 232],
+    [29, 47, 74, 99, 124, 151, 176, 198, 220, 237],
+    [33, 42, 61, 76, 93, 121, 155, 174, 207, 225],
+    [29, 53, 87, 112, 136, 154, 170, 188, 208, 227],
+    [24, 30, 52, 84, 131, 150, 166, 186, 203, 229],
+    [37, 48, 64, 84, 104, 118, 156, 177, 201, 230],
+];
+pub const NLSF_CB_WB: [[i32; 16]; 32] = [
+    [7, 23, 38, 54, 69, 85, 100, 116, 131, 147, 162, 178, 193, 208, 223, 239],
+    [13, 25, 41, 55, 69, 83, 98, 112, 127, 142, 157, 171, 187, 203, 220, 236],
+    [15, 21, 34, 51, 61, 78, 92, 106, 126, 136, 152, 167, 185, 205, 225, 240],
+    [10, 21, 36, 50, 63, 79, 95, 110, 126, 141, 157, 173, 189, 205, 221, 237],
+    [17, 20, 37, 51, 59, 78, 89, 107, 123, 134, 150, 164, 184, 205, 224, 240],
+    [10, 15, 32, 51, 67, 81, 96, 112, 129, 142, 158, 173, 189, 204, 220, 236],
+    [8, 21, 37, 51, 65, 79, 98, 113, 126, 138, 155, 168, 179, 192, 209, 218],
+    [12, 15, 34, 55, 63, 78, 87, 108, 118, 131, 148, 167, 185, 203, 219, 236],
+    [16, 19, 32, 36, 56, 79, 91, 108, 118, 136, 154, 171, 186, 204, 220, 237],
+    [11, 28, 43, 58, 74, 89, 105, 120, 135, 150, 165, 180, 196, 211, 226, 241],
+    [6, 16, 33, 46, 60, 75, 92, 107, 123, 137, 156, 169, 185, 199, 214, 225],
+    [11, 19, 30, 44, 57, 74, 89, 105, 121, 135, 152, 169, 186, 202, 218, 234],
+    [12, 19, 29, 46, 57, 71, 88, 100, 120, 132, 148, 165, 182, 199, 216, 233],
+    [17, 23, 35, 46, 56, 77, 92, 106, 123, 134, 152, 167, 185, 204, 222, 237],
+    [14, 17, 45, 53, 63, 75, 89, 107, 115, 132, 151, 171, 188, 206, 221, 240],
+    [9, 16, 29, 40, 56, 71, 88, 103, 119, 137, 154, 171, 189, 205, 222, 237],
+    [16, 19, 36, 48, 57, 76, 87, 105, 118, 132, 150, 167, 185, 202, 218, 236],
+    [12, 17, 29, 54, 71, 81, 94, 104, 126, 136, 149, 164, 182, 201, 221, 237],
+    [15, 28, 47, 62, 79, 97, 115, 129, 142, 155, 168, 180, 194, 208, 223, 238],
+    [8, 14, 30, 45, 62, 78, 94, 111, 127, 143, 159, 175, 192, 207, 223, 239],
+    [17, 30, 49, 62, 79, 92, 107, 119, 132, 145, 160, 174, 190, 204, 220, 235],
+    [14, 19, 36, 45, 61, 76, 91, 108, 121, 138, 154, 172, 189, 205, 222, 238],
+    [12, 18, 31, 45, 60, 76, 91, 107, 123, 138, 154, 171, 187, 204, 221, 236],
+    [13, 17, 31, 43, 53, 70, 83, 103, 114, 131, 149, 167, 185, 203, 220, 237],
+    [17, 22, 35, 42, 58, 78, 93, 110, 125, 139, 155, 170, 188, 206, 224, 240],
+    [8, 15, 34, 50, 67, 83, 99, 115, 131, 146, 162, 178, 193, 209, 224, 239],
+    [13, 16, 41, 66, 73, 86, 95, 111, 128, 137, 150, 163, 183, 206, 225, 241],
+    [17, 25, 37, 52, 63, 75, 92, 102, 119, 132, 144, 160, 175, 191, 212, 231],
+    [19, 31, 49, 65, 83, 100, 117, 133, 147, 161, 174, 187, 200, 213, 227, 242],
+    [18, 31, 52, 68, 88, 103, 117, 126, 138, 149, 163, 177, 192, 207, 223, 239],
+    [16, 29, 47, 61, 76, 90, 106, 119, 133, 147, 161, 176, 193, 209, 224, 240],
+    [15, 21, 35, 50, 61, 73, 86, 97, 110, 119, 129, 141, 175, 198, 218, 237],
+];
+pub const NLSF_MIN_SPACING_NBMB: [i32; 11] = [250, 3, 6, 3, 3, 3, 4, 3, 3, 3, 461];
+pub const NLSF_MIN_SPACING_WB: [i32; 17] = [100, 3, 40, 3, 3, 3, 5, 14, 14, 10, 11, 3, 8, 9, 7, 3, 347];
+pub const NLSF_INTERP: [u8; 5] = icdf(&[13, 22, 29, 11, 181]);
+pub const LSF_ORDER_NBMB: [usize; 10] = [0, 9, 6, 3, 4, 5, 8, 1, 2, 7];
+pub const LSF_ORDER_WB: [usize; 16] = [0, 15, 8, 7, 4, 11, 12, 3, 2, 13, 10, 5, 6, 9, 14, 1];
+pub const COS_Q12: [i32; 129] = [
+    4096, 4095, 4091, 4085, 4076, 4065, 4052, 4036, 4017, 3997, 3973, 3948, 3920, 3889, 3857, 3822, 3784, 3745, 3703, 3659, 3613, 3564, 3513, 3461,
+    3406, 3349, 3290, 3229, 3166, 3102, 3035, 2967, 2896, 2824, 2751, 2676, 2599, 2520, 2440, 2359, 2276, 2191, 2106, 2019, 1931, 1842, 1751, 1660,
+    1568, 1474, 1380, 1285, 1189, 1093, 995, 897, 799, 700, 601, 501, 401, 301, 201, 101, 0, -101, -201, -301, -401, -501, -601, -700, -799, -897,
+    -995, -1093, -1189, -1285, -1380, -1474, -1568, -1660, -1751, -1842, -1931, -2019, -2106, -2191, -2276, -2359, -2440, -2520, -2599, -2676, -2751,
+    -2824, -2896, -2967, -3035, -3102, -3166, -3229, -3290, -3349, -3406, -3461, -3513, -3564, -3613, -3659, -3703, -3745, -3784, -3822, -3857,
+    -3889, -3920, -3948, -3973, -3997, -4017, -4036, -4052, -4065, -4076, -4085, -4091, -4095, -4096,
+];
+pub const PITCH_HIGH: [u8; 32] = icdf(&[3, 3, 6, 11, 21, 30, 32, 19, 11, 10, 12, 13, 13, 12, 11, 9, 8, 7, 6, 4, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1]);
+pub const PITCH_LOW: [&[u8]; 3] =
+    [&icdf::<4>(&[64, 64, 64, 64]), &icdf::<6>(&[43, 42, 43, 43, 42, 43]), &icdf::<8>(&[32, 32, 32, 32, 32, 32, 32, 32])];
+pub const PITCH_DELTA: [u8; 21] = icdf(&[46, 2, 2, 3, 4, 6, 10, 15, 26, 38, 30, 22, 15, 10, 7, 6, 4, 4, 2, 2, 2]);
+pub const PITCH_CONTOUR: [&[u8]; 4] = [
+    &icdf::<3>(&[143, 50, 63]),
+    &icdf::<11>(&[68, 12, 21, 17, 19, 22, 30, 24, 17, 16, 10]),
+    &icdf::<12>(&[91, 46, 39, 19, 14, 12, 8, 7, 6, 5, 5, 4]),
+    &icdf::<34>(&[33, 22, 18, 16, 15, 14, 14, 13, 13, 10, 9, 9, 8, 6, 6, 6, 5, 4, 4, 4, 3, 3, 3, 2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1]),
+];
+pub const CB_NB_10: [[i32; 2]; 3] = [[0, 0], [1, 0], [0, 1]];
+pub const CB_NB_20: [[i32; 4]; 11] = [
+    [0, 0, 0, 0],
+    [2, 1, 0, -1],
+    [-1, 0, 1, 2],
+    [-1, 0, 0, 1],
+    [-1, 0, 0, 0],
+    [0, 0, 0, 1],
+    [0, 0, 1, 1],
+    [1, 1, 0, 0],
+    [1, 0, 0, 0],
+    [0, 0, 0, -1],
+    [1, 0, 0, -1],
+];
+pub const CB_WB_10: [[i32; 2]; 12] = [[0, 0], [0, 1], [1, 0], [-1, 1], [1, -1], [-1, 2], [2, -1], [-2, 2], [2, -2], [-2, 3], [3, -2], [-3, 3]];
+pub const CB_WB_20: [[i32; 4]; 34] = [
+    [0, 0, 0, 0],
+    [0, 0, 1, 1],
+    [1, 1, 0, 0],
+    [-1, 0, 0, 0],
+    [0, 0, 0, 1],
+    [1, 0, 0, 0],
+    [-1, 0, 0, 1],
+    [0, 0, 0, -1],
+    [-1, 0, 1, 2],
+    [1, 0, 0, -1],
+    [-2, -1, 1, 2],
+    [2, 1, 0, -1],
+    [-2, 0, 0, 2],
+    [-2, 0, 1, 3],
+    [2, 1, -1, -2],
+    [-3, -1, 1, 3],
+    [2, 0, 0, -2],
+    [3, 1, 0, -2],
+    [-3, -1, 2, 4],
+    [-4, -1, 1, 4],
+    [3, 1, -1, -3],
+    [-4, -1, 2, 5],
+    [4, 2, -1, -3],
+    [4, 1, -1, -4],
+    [-5, -1, 2, 6],
+    [5, 2, -1, -4],
+    [-6, -2, 2, 6],
+    [-5, -2, 2, 5],
+    [6, 2, -1, -5],
+    [-7, -2, 3, 8],
+    [6, 2, -2, -6],
+    [5, 2, -2, -5],
+    [8, 3, -2, -7],
+    [-9, -3, 3, 9],
+];
+pub const LTP_PERIODICITY: [u8; 3] = icdf(&[77, 80, 99]);
+pub const LTP_FILTER: [&[u8]; 3] = [
+    &icdf::<8>(&[185, 15, 13, 13, 9, 9, 6, 6]),
+    &icdf::<16>(&[57, 34, 21, 20, 15, 13, 12, 13, 10, 10, 9, 10, 9, 8, 7, 8]),
+    &icdf::<32>(&[15, 16, 14, 12, 12, 12, 11, 11, 11, 10, 9, 9, 9, 9, 8, 8, 8, 8, 7, 7, 6, 6, 5, 4, 5, 4, 4, 4, 3, 4, 3, 2]),
+];
+pub const LTP_TAPS_0: [[i32; 5]; 8] = [
+    [4, 6, 24, 7, 5],
+    [0, 0, 2, 0, 0],
+    [12, 28, 41, 13, -4],
+    [-9, 15, 42, 25, 14],
+    [1, -2, 62, 41, -9],
+    [-10, 37, 65, -4, 3],
+    [-6, 4, 66, 7, -8],
+    [16, 14, 38, -3, 33],
+];
+pub const LTP_TAPS_1: [[i32; 5]; 16] = [
+    [13, 22, 39, 23, 12],
+    [-1, 36, 64, 27, -6],
+    [-7, 10, 55, 43, 17],
+    [1, 1, 8, 1, 1],
+    [6, -11, 74, 53, -9],
+    [-12, 55, 76, -12, 8],
+    [-3, 3, 93, 27, -4],
+    [26, 39, 59, 3, -8],
+    [2, 0, 77, 11, 9],
+    [-8, 22, 44, -6, 7],
+    [40, 9, 26, 3, 9],
+    [-7, 20, 101, -7, 4],
+    [3, -8, 42, 26, 0],
+    [-15, 33, 68, 2, 23],
+    [-2, 55, 46, -2, 15],
+    [3, -1, 21, 16, 41],
+];
+pub const LTP_TAPS_2: [[i32; 5]; 32] = [
+    [-6, 27, 61, 39, 5],
+    [-11, 42, 88, 4, 1],
+    [-2, 60, 65, 6, -4],
+    [-1, -5, 73, 56, 1],
+    [-9, 19, 94, 29, -9],
+    [0, 12, 99, 6, 4],
+    [8, -19, 102, 46, -13],
+    [3, 2, 13, 3, 2],
+    [9, -21, 84, 72, -18],
+    [-11, 46, 104, -22, 8],
+    [18, 38, 48, 23, 0],
+    [-16, 70, 83, -21, 11],
+    [5, -11, 117, 22, -8],
+    [-6, 23, 117, -12, 3],
+    [3, -8, 95, 28, 4],
+    [-10, 15, 77, 60, -15],
+    [-1, 4, 124, 2, -4],
+    [3, 38, 84, 24, -25],
+    [2, 13, 42, 13, 31],
+    [21, -4, 56, 46, -1],
+    [-1, 35, 79, -13, 19],
+    [-7, 65, 88, -9, -14],
+    [20, 4, 81, 49, -29],
+    [20, 0, 75, 3, -17],
+    [5, -9, 44, 92, -8],
+    [1, -3, 22, 69, 31],
+    [-6, 95, 41, -12, 5],
+    [39, 67, 16, -4, 1],
+    [0, -6, 120, 55, -36],
+    [-13, 44, 122, 4, -24],
+    [81, 5, 11, 3, 7],
+    [2, 0, 9, 10, 88],
+];
+pub const LTP_SCALE: [u8; 3] = icdf(&[128, 64, 64]);
+pub const UNIFORM4: [u8; 4] = icdf(&[64, 64, 64, 64]);
+pub const RATE_LEVEL: [&[u8]; 2] = [&icdf::<9>(&[15, 51, 12, 46, 45, 13, 33, 27, 14]), &icdf::<9>(&[33, 30, 36, 17, 34, 49, 18, 21, 18])];
+pub const PULSE_COUNT: [&[u8]; 11] = [
+    &icdf::<18>(&[131, 74, 25, 8, 3, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[58, 93, 60, 23, 7, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[43, 51, 46, 33, 24, 16, 11, 8, 6, 3, 3, 3, 2, 1, 1, 2, 1, 2]),
+    &icdf::<18>(&[17, 52, 71, 57, 31, 12, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[6, 21, 41, 53, 49, 35, 21, 11, 6, 3, 2, 2, 1, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[7, 14, 22, 28, 29, 28, 25, 20, 17, 13, 11, 9, 7, 5, 4, 4, 3, 10]),
+    &icdf::<18>(&[2, 5, 14, 29, 42, 46, 41, 31, 19, 11, 6, 3, 2, 1, 1, 1, 1, 1]),
+    &icdf::<18>(&[1, 2, 4, 10, 19, 29, 35, 37, 34, 28, 20, 14, 8, 5, 4, 2, 2, 2]),
+    &icdf::<18>(&[1, 2, 2, 5, 9, 14, 20, 24, 27, 28, 26, 23, 20, 15, 11, 8, 6, 15]),
+    &icdf::<18>(&[1, 1, 1, 6, 27, 58, 56, 39, 25, 14, 10, 6, 3, 3, 2, 1, 1, 2]),
+    &icdf::<18>(&[2, 1, 6, 27, 58, 56, 39, 25, 14, 10, 6, 3, 3, 2, 1, 1, 2, 0]),
+];
+pub const SHELL_16: [&[u8]; 16] = [
+    &icdf::<2>(&[126, 130]),
+    &icdf::<3>(&[56, 142, 58]),
+    &icdf::<4>(&[25, 101, 104, 26]),
+    &icdf::<5>(&[12, 60, 108, 64, 12]),
+    &icdf::<6>(&[7, 35, 84, 87, 37, 6]),
+    &icdf::<7>(&[4, 20, 59, 86, 63, 21, 3]),
+    &icdf::<8>(&[3, 12, 38, 72, 75, 42, 12, 2]),
+    &icdf::<9>(&[2, 8, 25, 54, 73, 59, 27, 7, 1]),
+    &icdf::<10>(&[2, 5, 17, 39, 63, 65, 42, 18, 4, 1]),
+    &icdf::<11>(&[1, 4, 12, 28, 49, 63, 54, 30, 11, 3, 1]),
+    &icdf::<12>(&[1, 4, 8, 20, 37, 55, 57, 41, 22, 8, 2, 1]),
+    &icdf::<13>(&[1, 3, 7, 15, 28, 44, 53, 48, 33, 16, 6, 1, 1]),
+    &icdf::<14>(&[1, 2, 6, 12, 21, 35, 47, 48, 40, 25, 12, 5, 1, 1]),
+    &icdf::<15>(&[1, 1, 4, 10, 17, 27, 37, 47, 43, 33, 21, 9, 4, 1, 1]),
+    &icdf::<16>(&[1, 1, 1, 8, 14, 22, 33, 40, 43, 38, 28, 16, 8, 1, 1, 1]),
+    &icdf::<17>(&[1, 1, 1, 1, 13, 18, 27, 36, 41, 41, 34, 24, 14, 1, 1, 1, 1]),
+];
+pub const SHELL_8: [&[u8]; 16] = [
+    &icdf::<2>(&[127, 129]),
+    &icdf::<3>(&[53, 149, 54]),
+    &icdf::<4>(&[22, 105, 106, 23]),
+    &icdf::<5>(&[11, 61, 111, 63, 10]),
+    &icdf::<6>(&[6, 35, 86, 88, 36, 5]),
+    &icdf::<7>(&[4, 20, 59, 87, 62, 21, 3]),
+    &icdf::<8>(&[3, 13, 40, 71, 73, 41, 13, 2]),
+    &icdf::<9>(&[3, 9, 27, 53, 70, 56, 28, 9, 1]),
+    &icdf::<10>(&[3, 8, 19, 37, 57, 61, 44, 20, 6, 1]),
+    &icdf::<11>(&[3, 7, 15, 28, 44, 54, 49, 33, 17, 5, 1]),
+    &icdf::<12>(&[1, 7, 13, 22, 34, 46, 48, 38, 28, 14, 4, 1]),
+    &icdf::<13>(&[1, 1, 11, 22, 27, 35, 42, 47, 33, 25, 10, 1, 1]),
+    &icdf::<14>(&[1, 1, 6, 14, 26, 37, 43, 43, 37, 26, 14, 6, 1, 1]),
+    &icdf::<15>(&[1, 1, 4, 10, 20, 31, 40, 42, 40, 31, 20, 10, 4, 1, 1]),
+    &icdf::<16>(&[1, 1, 3, 8, 16, 26, 35, 38, 38, 35, 26, 16, 8, 3, 1, 1]),
+    &icdf::<17>(&[1, 1, 2, 6, 12, 21, 30, 36, 38, 36, 30, 21, 12, 6, 2, 1, 1]),
+];
+pub const SHELL_4: [&[u8]; 16] = [
+    &icdf::<2>(&[127, 129]),
+    &icdf::<3>(&[49, 157, 50]),
+    &icdf::<4>(&[20, 107, 109, 20]),
+    &icdf::<5>(&[11, 60, 113, 62, 10]),
+    &icdf::<6>(&[7, 36, 84, 87, 36, 6]),
+    &icdf::<7>(&[6, 24, 57, 82, 60, 23, 4]),
+    &icdf::<8>(&[5, 18, 39, 64, 68, 42, 16, 4]),
+    &icdf::<9>(&[6, 14, 29, 47, 61, 52, 30, 14, 3]),
+    &icdf::<10>(&[1, 15, 23, 35, 51, 50, 40, 30, 10, 1]),
+    &icdf::<11>(&[1, 1, 21, 32, 42, 52, 46, 41, 18, 1, 1]),
+    &icdf::<12>(&[1, 6, 16, 27, 36, 42, 42, 36, 27, 16, 6, 1]),
+    &icdf::<13>(&[1, 5, 12, 21, 31, 38, 40, 38, 31, 21, 12, 5, 1]),
+    &icdf::<14>(&[1, 3, 9, 17, 26, 34, 38, 38, 34, 26, 17, 9, 3, 1]),
+    &icdf::<15>(&[1, 3, 7, 14, 22, 29, 34, 36, 34, 29, 22, 14, 7, 3, 1]),
+    &icdf::<16>(&[1, 2, 5, 11, 18, 25, 31, 35, 35, 31, 25, 18, 11, 5, 2, 1]),
+    &icdf::<17>(&[1, 1, 4, 9, 15, 21, 28, 32, 34, 32, 28, 21, 15, 9, 4, 1, 1]),
+];
+pub const SHELL_2: [&[u8]; 16] = [
+    &icdf::<2>(&[128, 128]),
+    &icdf::<3>(&[42, 172, 42]),
+    &icdf::<4>(&[21, 107, 107, 21]),
+    &icdf::<5>(&[12, 60, 112, 61, 11]),
+    &icdf::<6>(&[8, 34, 86, 86, 35, 7]),
+    &icdf::<7>(&[8, 23, 55, 90, 55, 20, 5]),
+    &icdf::<8>(&[5, 15, 38, 72, 72, 36, 15, 3]),
+    &icdf::<9>(&[6, 12, 27, 52, 77, 47, 20, 10, 5]),
+    &icdf::<10>(&[6, 19, 28, 35, 40, 40, 35, 28, 19, 6]),
+    &icdf::<11>(&[4, 14, 22, 31, 37, 40, 37, 31, 22, 14, 4]),
+    &icdf::<12>(&[3, 10, 18, 26, 33, 38, 38, 33, 26, 18, 10, 3]),
+    &icdf::<13>(&[2, 8, 13, 21, 29, 36, 38, 36, 29, 21, 13, 8, 2]),
+    &icdf::<14>(&[1, 5, 10, 17, 25, 32, 38, 38, 32, 25, 17, 10, 5, 1]),
+    &icdf::<15>(&[1, 4, 7, 13, 21, 29, 35, 36, 35, 29, 21, 13, 7, 4, 1]),
+    &icdf::<16>(&[1, 2, 5, 10, 17, 25, 32, 36, 36, 32, 25, 17, 10, 5, 2, 1]),
+    &icdf::<17>(&[1, 2, 4, 7, 13, 21, 28, 34, 36, 34, 28, 21, 13, 7, 4, 2, 1]),
+];
+pub const EXC_LSB: [u8; 2] = icdf(&[136, 120]);
+pub const EXC_SIGN: [&[u8]; 42] = [
+    &icdf::<2>(&[2, 254]),
+    &icdf::<2>(&[207, 49]),
+    &icdf::<2>(&[189, 67]),
+    &icdf::<2>(&[179, 77]),
+    &icdf::<2>(&[174, 82]),
+    &icdf::<2>(&[163, 93]),
+    &icdf::<2>(&[157, 99]),
+    &icdf::<2>(&[58, 198]),
+    &icdf::<2>(&[245, 11]),
+    &icdf::<2>(&[238, 18]),
+    &icdf::<2>(&[232, 24]),
+    &icdf::<2>(&[225, 31]),
+    &icdf::<2>(&[220, 36]),
+    &icdf::<2>(&[211, 45]),
+    &icdf::<2>(&[1, 255]),
+    &icdf::<2>(&[210, 46]),
+    &icdf::<2>(&[190, 66]),
+    &icdf::<2>(&[178, 78]),
+    &icdf::<2>(&[169, 87]),
+    &icdf::<2>(&[162, 94]),
+    &icdf::<2>(&[152, 104]),
+    &icdf::<2>(&[48, 208]),
+    &icdf::<2>(&[242, 14]),
+    &icdf::<2>(&[235, 21]),
+    &icdf::<2>(&[224, 32]),
+    &icdf::<2>(&[214, 42]),
+    &icdf::<2>(&[205, 51]),
+    &icdf::<2>(&[190, 66]),
+    &icdf::<2>(&[1, 255]),
+    &icdf::<2>(&[162, 94]),
+    &icdf::<2>(&[152, 104]),
+    &icdf::<2>(&[147, 109]),
+    &icdf::<2>(&[144, 112]),
+    &icdf::<2>(&[141, 115]),
+    &icdf::<2>(&[138, 118]),
+    &icdf::<2>(&[8, 248]),
+    &icdf::<2>(&[203, 53]),
+    &icdf::<2>(&[187, 69]),
+    &icdf::<2>(&[176, 80]),
+    &icdf::<2>(&[168, 88]),
+    &icdf::<2>(&[161, 95]),
+    &icdf::<2>(&[154, 102]),
+];
+pub const LBRR_FLAGS: [&[u8]; 2] = [&icdf::<3>(&[53, 53, 150]), &icdf::<7>(&[41, 20, 29, 41, 15, 28, 82])];
@@ -301,14 +301,18 @@ pub fn master_text_pieces(pres: &Presentation, m: &deckcraft_model::Master, pape
    let (kx, ky) = (paper.0 / pres.notes_size.width.max(1.0), paper.1 / pres.notes_size.height.max(1.0));
    let mut out = vec![];
    for pt in deckcraft_render::place_master_texts(pres, m, n) {
-        let mut para_chars: HashMap<usize, Vec<char>> = HashMap::new();
        for run in &pt.layout.runs {
            let Some(g) = run.glyphs.first() else { continue };
-            let chars = para_chars.entry(run.para).or_insert_with(|| {
-                pt.body.paragraphs.get(run.para).map(|p| p.runs.iter().flat_map(|r| r.content().chars()).collect()).unwrap_or_default()
-            });
-            let (a, b) = (run.chars.0.min(chars.len()), run.chars.1.min(chars.len()));
-            let text: String = chars.get(a..b.max(a)).unwrap_or_default().iter().collect();
+            let text: String = pt
+                .body
+                .paragraphs
+                .get(run.para)
+                .map(|p| p.runs.iter().map(|r| r.content()).collect::<String>())
+                .unwrap_or_default()
+                .chars()
+                .skip(run.chars.0)
+                .take(run.chars.1.saturating_sub(run.chars.0))
+                .collect();
            if text.trim().is_empty() {
                continue;
            }
@@ -494,9 +498,6 @@ impl Backdrops {
 /// Most pixels one slide raster may have; it is RGBA, and the backdrop and the content are two rasters.
 const MAX_RASTER_PIXELS: f64 = 64_000_000.0;

-/// Most ruled note lines one handout area gets (a letter page holds about 30).
-const MAX_NOTE_LINES: usize = 500;
-
 /// Render scale for a slide of `slide` units drawn `box_width` points wide at `dpi`, with the total pixel count capped.
 fn raster_scale(box_width: f64, slide: (f64, f64), dpi: f64) -> f64 {
    let scale = (box_width / 72.0 * dpi.clamp(36.0, 600.0)) / slide.0;
@@ -573,17 +574,20 @@ impl Exporter<'_> {

    /// Invisible glyphs exactly over the rasterised text.
    fn text_layer(&mut self, s: &mut Surface, pt: &PlacedText, view: Affine, visible: bool) -> Result<()> {
-        // Each paragraph's characters, gathered once: a long paragraph wraps into many runs.
-        let mut para_chars: HashMap<usize, Vec<char>> = HashMap::new();
        for run in &pt.layout.runs {
            if run.glyphs.is_empty() || run.size <= 0.0 {
                continue;
            }
-            let chars = para_chars.entry(run.para).or_insert_with(|| {
-                pt.body.paragraphs.get(run.para).map(|p| p.runs.iter().flat_map(|r| r.content().chars()).collect()).unwrap_or_default()
-            });
-            let (a, b) = (run.chars.0.min(chars.len()), run.chars.1.min(chars.len()));
-            let text: String = chars.get(a..b.max(a)).unwrap_or_default().iter().collect();
+            let text: String = pt
+                .body
+                .paragraphs
+                .get(run.para)
+                .map(|p| p.runs.iter().map(|r| r.content()).collect::<String>())
+                .unwrap_or_default()
+                .chars()
+                .skip(run.chars.0)
+                .take(run.chars.1.saturating_sub(run.chars.0))
+                .collect();
            if text.trim().is_empty() {
                continue;
            }
@@ -663,28 +667,19 @@ impl Exporter<'_> {
        let lh = size * 1.3;
        let mut y = area.y0 + size;
        s.set_fill(Some(grey(0x20, 1.0)));
-        let space = width(" ");
        'outer: for para in text.split('\n') {
-            // The line's width is kept as words are added, not measured again for each word.
            let mut line = String::new();
-            let mut line_w = 0.0;
            for word in para.split(' ') {
-                let word_w = width(word);
-                let cand_w = if line.is_empty() { word_w } else { line_w + space + word_w };
-                if cand_w > area.width() && !line.is_empty() {
+                let cand = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
+                if width(&cand) > area.width() && !line.is_empty() {
                    if y > area.y1 {
                        break 'outer;
                    }
                    s.draw_text(Point::from_xy(area.x0 as f32, y as f32), font.clone(), size as f32, &line, false, TextDirection::Auto);
                    y += lh;
                    line = word.to_string();
-                    line_w = word_w;
                } else {
-                    if !line.is_empty() {
-                        line.push(' ');
-                    }
-                    line.push_str(word);
-                    line_w = cand_w;
+                    line = cand;
                }
            }
            if y > area.y1 {
@@ -701,26 +696,20 @@ impl Exporter<'_> {

    /// Ruled lines for handwritten notes (3-per-page handouts).
    fn note_lines(&self, s: &mut Surface, r: Rect) {
-        // Counted, not stepped: at huge coordinates adding 22 leaves y unchanged, and a huge page
-        // would want millions of rules.
-        let first = r.y0 + 18.0;
-        let count = ((r.y1 - first) / 22.0).floor() + 1.0;
-        if count.is_nan() || count < 1.0 {
-            return;
-        }
+        let mut y = r.y0 + 18.0;
        s.set_stroke(Some(krilla::paint::Stroke {
            paint: krilla::color::rgb::Color::new(0xB0, 0xB0, 0xB0).into(),
            width: 0.5,
            ..Default::default()
        }));
-        for i in 0..(count.min(MAX_NOTE_LINES as f64) as usize) {
-            let y = first + 22.0 * i as f64;
+        while y <= r.y1 {
            let mut p = kurbo::BezPath::new();
            p.move_to((r.x0, y));
            p.line_to((r.x1, y));
            if let Some(path) = to_path(&p) {
                s.draw_path(&path);
            }
+            y += 22.0;
        }
        s.set_stroke(None);
    }
@@ -728,17 +728,3 @@ fn raster_scale_caps_total_pixels_not_each_side() {
    let s = raster_scale(720.0, (960.0, 540.0), 200.0);
    assert!((s - 720.0 / 72.0 * 200.0 / 960.0).abs() < 1e-12);
 }
-
-#[cfg_attr(target_arch = "wasm32", wasm_bindgen_test::wasm_bindgen_test)]
-#[cfg_attr(not(target_arch = "wasm32"), test)]
-fn huge_paper_and_long_notes_export_in_bounded_work() {
-    // At 1e19 pt adding a rule's 22 pt leaves y unchanged: the rules are counted, not stepped. A narrow page keeps the raster small.
-    let p = deck(1);
-    let bytes = export(&p, &PdfOptions { paper: (612.0, 1.0e19), ..opts(PageLayout::Handouts { per_page: 3 }) }).expect("export");
-    assert!(bytes.starts_with(b"%PDF-"));
-    // 20,000 short words of notes, wrapped with the line width kept as words are added.
-    let mut p = deck(1);
-    Arc::make_mut(&mut p.slides[0]).notes = TextBody::from_text(&"ab ".repeat(20_000));
-    let bytes = export(&p, &opts(PageLayout::Notes)).expect("export");
-    assert!(bytes.starts_with(b"%PDF-"));
-}
@@ -403,7 +403,7 @@ pub fn data_xml(d: &Diagram, seed: u32, drawing_rel: &str, pics: &[(usize, Strin
    w.finish()
 }

-/// The outline of a data part: the `parOf` tree under the document point, depth first, or the data points in `ptLst` order when no `parOf` connections exist.
+/// The outline of a data part: the `parOf` tree under the document point, depth first.
 pub fn outline(data: &El) -> Vec<DiagramNode> {
    outline_ids(data).into_iter().map(|(_, n)| n).collect()
 }
@@ -429,13 +429,11 @@ pub fn node_pictures(data: &El) -> Vec<(usize, String)> {
    out
 }

-/// Extracts diagram outline `(modelId, DiagramNode)` pairs in tree order from a `dgm:dataModel` element.
 fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
    let Some(pts) = data.child("ptLst") else { return vec![] };
    let mut texts: HashMap<&str, String> = HashMap::new();
    let mut assistants: std::collections::HashSet<&str> = std::collections::HashSet::new();
    let mut titles: HashMap<&str, String> = HashMap::new();
-    let mut pt_order: Vec<&str> = Vec::new();
    let mut doc: Option<&str> = None;
    for pt in pts.children_named("pt").take(MAX_NODES * 4) {
        let Some(id) = pt.attr("modelId") else { continue };
@@ -444,7 +442,6 @@ fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
            ty @ ("node" | "asst") => {
                let t = pt.child("t").map(paragraphs).unwrap_or_default();
                texts.insert(id, t);
-                pt_order.push(id);
                if ty == "asst" {
                    assistants.insert(id);
                }
@@ -462,6 +459,7 @@ fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
            _ => {}
        }
    }
+    let Some(doc) = doc else { return vec![] };
    let mut kids: HashMap<&str, Vec<(i64, &str)>> = HashMap::new();
    if let Some(cx) = data.child("cxnLst") {
        for c in cx.children_named("cxn").take(MAX_NODES * 4) {
@@ -480,7 +478,7 @@ fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
    let mut out = vec![];
    let mut seen = std::collections::HashSet::new();
    // Depth first, iteratively; a node reached twice (a cycle in a hostile file) is skipped.
-    let mut stack: Vec<(&str, u8)> = doc.and_then(|d| kids.get(d)).map(|v| v.iter().rev().map(|(_, id)| (*id, 0u8)).collect()).unwrap_or_default();
+    let mut stack: Vec<(&str, u8)> = kids.get(doc).map(|v| v.iter().rev().map(|(_, id)| (*id, 0u8)).collect()).unwrap_or_default();
    while let Some((id, level)) = stack.pop() {
        if out.len() >= MAX_NODES || !seen.insert(id) {
            continue;
@@ -499,23 +497,6 @@ fn outline_ids(data: &El) -> Vec<(String, DiagramNode)> {
            stack.extend(v.iter().rev().map(|(_, c)| (*c, level.saturating_add(1))));
        }
    }
-    if out.is_empty() && kids.is_empty() {
-        for id in pt_order {
-            if out.len() >= MAX_NODES || !seen.insert(id) {
-                continue;
-            }
-            out.push((
-                id.to_string(),
-                DiagramNode {
-                    text: texts.get(id).cloned().unwrap_or_default(),
-                    level: 0,
-                    picture: None,
-                    assistant: assistants.contains(id),
-                    title: titles.get(id).cloned().unwrap_or_default(),
-                },
-            ));
-        }
-    }
    out
 }

@@ -897,14 +878,5 @@ mod tests {
        assert_eq!(colors_for(&cs_id("accent4")), "accent4");
        assert_eq!(colors_for(&cs_id("")), "");
        assert_eq!(style_for(&qs_id("outline")), "outline");
-
-        let unconnected = br#"<dgm:dataModel xmlns:dgm="d"><dgm:ptLst><dgm:pt modelId="0" type="doc"/><dgm:pt modelId="1" type="node"><dgm:t><a:p xmlns:a="a"><a:r><a:t>Alpha</a:t></a:r></a:p></dgm:t></dgm:pt><dgm:pt modelId="2" type="node"><dgm:t><a:p xmlns:a="a"><a:r><a:t>Beta</a:t></a:r></a:p></dgm:t></dgm:pt></dgm:ptLst><dgm:cxnLst/></dgm:dataModel>"#;
-        let unconnected_doc = crate::xml::parse(unconnected).unwrap();
-        assert_eq!(outline(&unconnected_doc.root), nodes(&[("Alpha", 0), ("Beta", 0)]));
-
-        // When parOf connections exist but no root (type="doc") reaches them, do not flatten the hierarchy to level 0.
-        let unrooted_hierarchy = br#"<dgm:dataModel xmlns:dgm="d"><dgm:ptLst><dgm:pt modelId="1" type="node"><dgm:t><a:p xmlns:a="a"><a:r><a:t>Parent</a:t></a:r></a:p></dgm:t></dgm:pt><dgm:pt modelId="2" type="node"><dgm:t><a:p xmlns:a="a"><a:r><a:t>Child</a:t></a:r></a:p></dgm:t></dgm:pt></dgm:ptLst><dgm:cxnLst><dgm:cxn srcId="1" destId="2"/></dgm:cxnLst></dgm:dataModel>"#;
-        let unrooted_doc = crate::xml::parse(unrooted_hierarchy).unwrap();
-        assert!(outline(&unrooted_doc.root).is_empty());
    }
 }
@@ -70,13 +70,6 @@ pub fn import_checked(bytes: &[u8]) -> Result<(Presentation, Vec<String>), PptxE
    read::import_checked(bytes)
 }

-/// [`import`] with a lower presentation-wide chart point budget, so tests reach the over-budget
-/// path without a multi-million-point chart.
-#[doc(hidden)]
-pub fn import_with_chart_budget(bytes: &[u8], points: usize) -> Result<Presentation, PptxError> {
-    read::import_with_chart_points(bytes, points).map(|(p, _)| p)
-}
-
 /// Read the theme of a `.thmx` file, or of a `.pptx` / `.potx`'s first master, with its media.
 pub fn import_theme(bytes: &[u8]) -> Result<(deckcraft_model::theme::Theme, Vec<deckcraft_model::MediaItem>), PptxError> {
    read::import_theme(bytes)
@@ -10,7 +10,6 @@ mod timing;
 pub(crate) use chart::{chart_from as chart_from_el, read_chart_xml};
 pub(crate) use chartex::{chartex_from, read_chartex_xml};

-use std::cell::Cell;
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;

@@ -39,17 +38,8 @@ pub struct Imp<'a> {
    pub vml_previews: HashMap<String, HashMap<String, String>>,
    /// Aggregate byte count of retained chart sidecars across the presentation.
    pub kept_sidecar_bytes: usize,
-    /// Data slots of the charts decoded so far (see `chart::MAX_PRESENTATION_CHART_POINTS`).
-    pub chart_points: usize,
-    /// Points the presentation may hold across modelled charts.
-    pub chart_points_cap: usize,
    /// Cached kept sidecars by normalized chart part name.
    pub kept_charts: HashMap<String, deckcraft_model::chart::ChartKept>,
-    /// Chart parts whose sidecar capture was refused, with the retained-byte total it started from:
-    /// the same start gives the same refusal, so the copy is not repeated.
-    pub rejected_kept: HashMap<String, usize>,
-    /// Bytes of chart parts decoded so far, rejected ones included (see `chart::MAX_CHART_DECODE_BYTES`).
-    pub chart_decode_bytes: usize,
    /// Add-in tags parts, parsed once each, by normalized part name.
    pub tags_by_part: HashMap<String, Arc<[(String, String)]>>,
    /// Bytes of tags copied into the model so far (see [`MAX_TAG_BYTES`]).
@@ -100,22 +90,21 @@ pub struct Part {
    pub ns: Vec<(String, String)>,
    /// Prefixes bound below the root only (on a wrapper such as `mc:Choice`), each to one namespace.
    pub inner_ns: Vec<(String, String)>,
-    /// Bytes of namespace declarations this part may still copy onto kept fragments.
-    ns_budget: Cell<usize>,
 }

 impl Part {
    pub fn new(pkg: &Package, name: &str, doc: &Doc) -> Self {
        let ns = doc.ns_decls();
-        Part { name: name.to_string(), rels: pkg.rels(name), inner_ns: inner_decls(&doc.root, &ns), ns, ns_budget: Cell::new(MAX_COPIED_NS_BYTES) }
+        Part { name: name.to_string(), rels: pkg.rels(name), inner_ns: inner_decls(&doc.root, &ns), ns }
    }
    /// Serialize an element with the namespace declarations it needs from the part root.
    pub fn keep(&self, el: &El) -> String {
-        keep_with(el, &[&self.ns], Some(&self.ns_budget))
+        keep_xml(el, &self.ns)
    }
    /// Like [`Part::keep`], also declaring prefixes that only an enclosing wrapper binds.
    pub fn keep_inner(&self, el: &El) -> String {
-        keep_with(el, &[&self.ns, &self.inner_ns], Some(&self.ns_budget))
+        let ns: Vec<(String, String)> = self.ns.iter().chain(&self.inner_ns).cloned().collect();
+        keep_xml(el, &ns)
    }
 }

@@ -150,81 +139,36 @@ fn inner_decls(root: &El, ns: &[(String, String)]) -> Vec<(String, String)> {
    out
 }

-/// Longest namespace name copied onto a kept fragment or a resolved `mc` branch. Real ones are
-/// URIs of well under 100 bytes; a longer one is not copied, so one declaration cannot be
-/// multiplied by every fragment that uses its prefix.
-const MAX_NS_VALUE: usize = 2048;
-
-/// Namespace declaration bytes one part may copy onto all its kept fragments together; past it a
-/// fragment keeps its markup but is not given further declarations.
-const MAX_COPIED_NS_BYTES: usize = 8 << 20;
-
-/// Prefixes `el` and its descendants use in element and attribute names, and those listed in
-/// `mc:Ignorable` or `mc:MustUnderstand` (which must stay declared for the markup-compatibility rules to hold),
-/// and those starting a QName-like attribute value.
-fn used_prefixes(el: &El) -> HashSet<&str> {
-    fn rec<'a>(e: &'a El, used: &mut HashSet<&'a str>, depth: usize) {
+/// Serialize `el`, declaring every prefix it uses that the source root declared.
+pub fn keep_xml(el: &El, ns: &[(String, String)]) -> String {
+    let mut used = HashSet::new();
+    fn rec(e: &El, used: &mut HashSet<String>, depth: usize) {
        if depth > crate::xml::MAX_DEPTH {
            return;
        }
        if let Some((p, _)) = e.name.split_once(':') {
-            used.insert(p);
+            used.insert(p.to_string());
        }
-        for (k, v) in &e.attrs {
-            if let Some((p, local)) = k.split_once(':')
+        for (k, _) in &e.attrs {
+            if let Some((p, _)) = k.split_once(':')
                && p != "xmlns"
                && p != "xml"
            {
-                used.insert(p);
-                if local == "Ignorable" || local == "MustUnderstand" {
-                    used.extend(v.split_whitespace());
-                }
-            }
-            // QName-valued attributes (`xsi:type="q:Item"`) need their prefix declared too.
-            if k != "xmlns" && !k.starts_with("xmlns:") {
-                for t in v.split_whitespace() {
-                    if let Some((p, _)) = t.split_once(':')
-                        && !p.is_empty()
-                    {
-                        used.insert(p);
-                    }
-                }
+                used.insert(p.to_string());
            }
        }
        for c in e.elements() {
            rec(c, used, depth + 1);
        }
    }
-    let mut used = HashSet::new();
    rec(el, &mut used, 0);
-    used
-}
-
-/// Serialize `el`, declaring every prefix it uses that the source root declared.
-pub fn keep_xml(el: &El, ns: &[(String, String)]) -> String {
-    keep_with(el, &[ns], None)
-}
-
-fn keep_with(el: &El, decls: &[&[(String, String)]], budget: Option<&Cell<usize>>) -> String {
-    let used = used_prefixes(el);
-    let mut have: HashSet<&str> = el.attrs.iter().map(|(a, _)| a.as_str()).collect();
-    let mut extra = Vec::new();
-    for (k, v) in decls.iter().flat_map(|d| d.iter()) {
+    let mut el = el.clone();
+    for (k, v) in ns {
        let p = k.strip_prefix("xmlns:").unwrap_or("");
-        if !p.is_empty() && used.contains(p) && v.len() <= MAX_NS_VALUE && !have.contains(k.as_str()) {
-            let cost = k.len() + v.len();
-            if let Some(b) = budget {
-                if b.get() < cost {
-                    continue;
-                }
-                b.set(b.get() - cost);
-            }
-            have.insert(k);
-            extra.push((k.clone(), v.clone()));
+        if !p.is_empty() && used.contains(p) && !el.attrs.iter().any(|(a, _)| a == k) {
+            el.attrs.push((k.clone(), v.clone()));
        }
    }
-    let mut el = el.clone();
-    el.attrs.extend(extra);
    el.to_xml()
 }

@@ -373,18 +317,10 @@ fn kept_parts(pkg: &Package, pres_path: &str) -> Vec<deckcraft_model::KeptPart>
            // The part's own relationships (customXml item → itemProps) and their targets.
            let rp = opc::rels_path(&name);
            if let Some(rels_xml) = text(&rp) {
-                let mut capped = false;
                for sub in pkg.rels(&name).items.iter().filter(|s| !s.external && keepable(&s.target)) {
-                    // Checked before the part is read: repeated relationships to one large part
-                    // must not copy it again each time.
-                    if out.iter().any(|k| k.name.eq_ignore_ascii_case(&sub.target)) {
-                        continue;
-                    }
-                    if out.len() >= 400 {
-                        capped = true;
-                        continue;
-                    }
-                    if let Some(x) = text(&sub.target) {
+                    if let Some(x) = text(&sub.target)
+                        && !out.iter().any(|k| k.name.eq_ignore_ascii_case(&sub.target))
+                    {
                        out.push(KeptPart {
                            content_type: pkg.content_type(&sub.target).unwrap_or_default(),
                            name: sub.target.clone(),
@@ -393,9 +329,7 @@ fn kept_parts(pkg: &Package, pres_path: &str) -> Vec<deckcraft_model::KeptPart>
                        });
                    }
                }
-                if !capped && out.len() < 400 {
-                    out.push(KeptPart { name: rp, xml: rels_xml, ..Default::default() });
-                }
+                out.push(KeptPart { name: rp, xml: rels_xml, ..Default::default() });
            }
        }
    }
@@ -432,39 +366,15 @@ fn resolve_mc_rels(el: &mut El, depth: usize, rels: Option<&Rels>) {
                    });
                    let branch = choice.or_else(|| ac.child("Fallback"));
                    if let Some(b) = branch {
-                        // The branch's namespace declarations (the first usable one of each name,
-                        // in order), indexed by prefix once: each child then looks up the prefixes
-                        // it uses instead of scanning every declaration.
-                        let mut decls: Vec<(&String, &String)> = Vec::new();
-                        // An oversized declaration still shadows an outer one of its name: its
-                        // content is left unbound rather than bound to the outer namespace.
-                        let mut by_prefix: HashMap<&str, Option<usize>> = HashMap::new();
-                        for (k, v) in b.attrs.iter().chain(ac.attrs.iter()) {
-                            let prefix = if k == "xmlns" { Some("") } else { k.strip_prefix("xmlns:") };
-                            if let Some(p) = prefix
-                                && !by_prefix.contains_key(p)
-                            {
-                                by_prefix.insert(p, (v.len() <= MAX_NS_VALUE).then_some(decls.len()));
-                                if v.len() <= MAX_NS_VALUE {
-                                    decls.push((k, v));
-                                }
-                            }
-                        }
                        for n in &b.children {
                            if let Node::El(e) = n {
-                                // Carry the namespace declarations from the branch that its content
-                                // uses (all of them per child made children x declarations copies).
-                                let used = used_prefixes(e);
-                                let have: HashSet<&str> = e.attrs.iter().map(|(a, _)| a.as_str()).collect();
-                                let mut wanted: Vec<usize> = std::iter::once("")
-                                    .chain(used.iter().copied())
-                                    .filter_map(|p| by_prefix.get(p).copied().flatten())
-                                    .filter(|&i| !have.contains(decls[i].0.as_str()))
-                                    .collect();
-                                wanted.sort_unstable();
-                                wanted.dedup();
                                let mut e = e.clone();
-                                e.attrs.extend(wanted.into_iter().map(|i| (decls[i].0.clone(), decls[i].1.clone())));
+                                // Carry namespace declarations from the branch onto its content.
+                                for (k, v) in b.attrs.iter().chain(ac.attrs.iter()) {
+                                    if k.starts_with("xmlns") && !e.attrs.iter().any(|(a, _)| a == k) {
+                                        e.attrs.push((k.clone(), v.clone()));
+                                    }
+                                }
                                out.push(Node::El(e));
                            }
                        }
@@ -535,11 +445,7 @@ pub fn import_theme(bytes: &[u8]) -> Result<(deckcraft_model::theme::Theme, Vec<
        table_style_ids: Vec::new(),
        vml_previews: HashMap::new(),
        kept_sidecar_bytes: 0,
-        chart_points: 0,
-        chart_points_cap: chart::MAX_PRESENTATION_CHART_POINTS,
        kept_charts: HashMap::new(),
-        rejected_kept: HashMap::new(),
-        chart_decode_bytes: 0,
        tags_by_part: HashMap::new(),
        tag_bytes: 0,
        tags_capped: false,
@@ -557,11 +463,6 @@ pub fn import(bytes: &[u8]) -> Result<Presentation, PptxError> {
 /// [`import`], plus the parts of the slide list the file names but that couldn't be read (a
 /// missing or truncated slide): those slides are left out, so a caller can say so (#203).
 pub fn import_checked(bytes: &[u8]) -> Result<(Presentation, Vec<String>), PptxError> {
-    import_with_chart_points(bytes, chart::MAX_PRESENTATION_CHART_POINTS)
-}
-
-/// [`import_checked`] with the presentation's chart point budget set (tests lower it).
-pub(crate) fn import_with_chart_points(bytes: &[u8], chart_points_cap: usize) -> Result<(Presentation, Vec<String>), PptxError> {
    let mut lost_slides: Vec<String> = vec![];
    let pkg = Package::open(bytes)?;
    let root_rels = pkg.rels("");
@@ -586,11 +487,7 @@ pub(crate) fn import_with_chart_points(bytes: &[u8], chart_points_cap: usize) ->
        table_style_ids: Vec::new(),
        vml_previews: HashMap::new(),
        kept_sidecar_bytes: 0,
-        chart_points: 0,
-        chart_points_cap,
        kept_charts: HashMap::new(),
-        rejected_kept: HashMap::new(),
-        chart_decode_bytes: 0,
        tags_by_part: HashMap::new(),
        tag_bytes: 0,
        tags_capped: false,
@@ -1526,90 +1423,3 @@ fn header_footer(p: &Presentation) -> HeaderFooter {
    }
    hf
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn mc_branches_carry_only_the_declarations_their_content_uses() {
-        // 2,000 declarations on the branch and 2,000 children: each child gets the one it uses
-        // (and the default), not all 2,000.
-        let decls: String = (0..2000).map(|i| format!(r#" xmlns:n{i}="urn:n{i}""#)).collect();
-        let kids: String = (0..2000).map(|i| format!("<n{i}:x/>")).collect();
-        let x = format!(
-            r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns="urn:d"{decls}>{kids}</mc:Fallback></mc:AlternateContent></r>"#
-        );
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kids: Vec<&El> = d.root.elements().collect();
-        assert_eq!(kids.len(), 2000);
-        assert_eq!(kids[7].attrs, vec![("xmlns".to_string(), "urn:d".to_string()), ("xmlns:n7".to_string(), "urn:n7".to_string())]);
-    }
-
-    /// The branch's own declaration of a prefix wins over the `AlternateContent`'s; an oversized
-    /// one still shadows it (its content stays unbound); a child's own declaration is left alone.
-    #[test]
-    fn mc_branch_declarations_keep_their_precedence() {
-        let long = "u".repeat(MAX_NS_VALUE + 1);
-        let x = format!(
-            r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent xmlns:p="urn:ac" xmlns:q="urn:q-short"><mc:Fallback xmlns:p="urn:b" xmlns:q="{long}"><p:x/><q:y/><p:z xmlns:p="urn:own"/></mc:Fallback></mc:AlternateContent></r>"#
-        );
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kids: Vec<&El> = d.root.elements().collect();
-        let attrs = |i: usize| kids[i].attrs.iter().map(|(k, v)| format!("{k}={v}")).collect::<Vec<_>>();
-        assert_eq!(attrs(0), ["xmlns:p=urn:b"]);
-        assert!(attrs(1).is_empty(), "{:?}", attrs(1));
-        assert_eq!(attrs(2), ["xmlns:p=urn:own"]);
-    }
-
-    #[test]
-    fn mc_branches_keep_prefixes_named_by_must_understand() {
-        let x = r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns:q="urn:q"><a mc:MustUnderstand="q"/></mc:Fallback></mc:AlternateContent></r>"#;
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kid = d.root.elements().next().unwrap();
-        assert!(kid.attrs.iter().any(|(k, v)| k == "xmlns:q" && v == "urn:q"), "{:?}", kid.attrs);
-    }
-
-    #[test]
-    fn mc_branches_keep_prefixes_used_in_qname_values() {
-        let x = r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns:q="urn:q" xmlns:z="urn:z"><n xmlns:xsi="urn:xsi" xsi:type="q:Item"/></mc:Fallback></mc:AlternateContent></r>"#;
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kid = d.root.elements().next().unwrap();
-        assert!(kid.attrs.iter().any(|(k, v)| k == "xmlns:q" && v == "urn:q"), "{:?}", kid.attrs);
-        assert!(!kid.attrs.iter().any(|(k, _)| k == "xmlns:z"), "unused declarations stay out: {:?}", kid.attrs);
-    }
-
-    #[test]
-    fn kept_fragments_skip_oversized_namespace_names() {
-        let big = "u".repeat(MAX_NS_VALUE + 1);
-        let ns = vec![("xmlns:a".to_string(), "urn:a".to_string()), ("xmlns:b".to_string(), big)];
-        let d = crate::xml::parse(br#"<a:x xmlns:a="urn:a" xmlns:b="urn:b"><b:y/></a:x>"#).unwrap();
-        let mut el = d.root.clone();
-        el.attrs.clear();
-        let out = keep_xml(&el, &ns);
-        assert!(out.contains(r#"xmlns:a="urn:a""#), "{out}");
-        assert!(!out.contains("uuuu"), "the oversized declaration is not copied");
-    }
-
-    #[test]
-    fn copied_namespace_bytes_are_budgeted_per_part() {
-        let d = crate::xml::parse(br#"<a:x xmlns:a="urn:a"><a:y/></a:x>"#).unwrap();
-        let mut el = d.root.clone();
-        el.attrs.clear();
-        let part = Part {
-            name: String::new(),
-            rels: Default::default(),
-            ns: vec![("xmlns:a".to_string(), "urn:a".to_string())],
-            inner_ns: vec![],
-            ns_budget: Cell::new(15),
-        };
-        assert!(part.keep(&el).contains(r#"xmlns:a="urn:a""#), "within budget");
-        assert!(part.ns_budget.get() < 15);
-        let again = part.keep(&el);
-        assert!(!again.contains("xmlns:a"), "budget spent, no further declarations: {again}");
-    }
-}
@@ -39,33 +39,6 @@ pub(crate) fn rich_text(t: &El) -> Option<String> {
 /// Most category/value/size slots one chart may decode across all its series and caches, so
 /// sparse `ptCount`/`idx` declarations can't expand far beyond the XML they came from.
 pub(crate) const MAX_CHART_POINTS: usize = 1_000_000;
-/// Data slots (values and categories) the charts of one presentation may hold in all; a chart past
-/// it is read as a placeholder frame. Each frame that references a chart decodes its own copy.
-pub(crate) const MAX_PRESENTATION_CHART_POINTS: usize = 4_000_000;
-
-/// Chart part bytes all chart frames of a presentation may decode, counting every attempt: a
-/// chart that is rejected, or has no data slots, would otherwise be decoded again for each frame
-/// that shows it.
-pub(crate) const MAX_CHART_DECODE_BYTES: usize = 256 * 1024 * 1024;
-
-/// Slots a decoded chart holds, counting the chart itself as at least one.
-pub(crate) fn point_count(c: &Chart) -> usize {
-    let series = |s: &deckcraft_model::chart::Series| {
-        let bars = s.error_bars.as_ref().map_or(0, |e| e.plus.len().saturating_add(e.minus.len()));
-        s.values.len().saturating_add(s.x_values.len()).saturating_add(s.sizes.len()).saturating_add(bars)
-    };
-    let levels: usize = c.category_levels.iter().map(Vec::len).sum();
-    1usize.saturating_add(c.categories.len()).saturating_add(levels).saturating_add(c.series.iter().map(series).fold(0, usize::saturating_add))
-}
-
-/// Bytes of the strings a kept relationship owns.
-fn part_bytes(p: &deckcraft_model::chart::ChartPart) -> usize {
-    p.bytes.len() + p.name.len() + p.content_type.len()
-}
-
-fn rel_bytes(r: &deckcraft_model::chart::ChartRel) -> usize {
-    r.id.len() + r.rel_type.len() + r.target.len() + r.part.len()
-}

 /// Most slots one cache may hold.
 const MAX_CACHE_POINTS: usize = 100_000;
@@ -130,48 +103,6 @@ pub fn read_chart_xml(bytes: &[u8]) -> Option<Chart> {
    Some(c)
 }

-/// The chart a graphic frame points at. A chart that would cross the presentation's point or
-/// decode limits is not modelled: it is kept as its original part with the relationships it
-/// reaches (`verbatim`), so a save writes it back whole instead of dropping it and its workbook.
-pub(crate) fn frame_chart(imp: &mut super::Imp, part: &super::Part, rid: &str, uri: &str) -> Option<Chart> {
-    let rel = part.rels.get(rid)?;
-    let chartex = uri.ends_with("/chartex");
-    let bytes = imp.pkg.xml_bytes(&rel.target)?;
-    if imp.chart_decode_bytes.saturating_add(bytes.len()) > MAX_CHART_DECODE_BYTES {
-        log::warn!("pptx: chart {} is past the presentation's chart decode limit and is not kept", rel.target);
-        return None;
-    }
-    imp.chart_decode_bytes += bytes.len();
-    let parsed = if imp.chart_points < imp.chart_points_cap {
-        let c = if chartex { super::read_chartex_xml(bytes) } else { super::read_chart_xml(bytes) }?;
-        let n = point_count(&c);
-        if imp.chart_points.saturating_add(n) <= imp.chart_points_cap {
-            imp.chart_points = imp.chart_points.saturating_add(n);
-            let mut c = c;
-            c.kept = capture_kept(imp, &rel.target);
-            return Some(c);
-        }
-        Some(c)
-    } else {
-        None
-    };
-    // Past the limit: keep the part itself (charged to the sidecar budget) and show an empty chart.
-    if chartex || imp.kept_sidecar_bytes.saturating_add(bytes.len()) > MAX_KEPT_TOTAL_BYTES {
-        log::warn!("pptx: chart {} is past the presentation's chart limits and is not kept", rel.target);
-        return None;
-    }
-    imp.kept_sidecar_bytes += bytes.len();
-    log::warn!("pptx: chart {} is past the presentation's chart limits; shown empty and written back unchanged", rel.target);
-    let mut c = parsed.unwrap_or_default();
-    c.series.clear();
-    c.categories.clear();
-    c.category_levels.clear();
-    c.raw = Some(String::from_utf8_lossy(bytes).into_owned());
-    c.verbatim = true;
-    c.kept = capture_kept(imp, &rel.target);
-    Some(c)
-}
-
 pub(crate) fn chart_from(root: &El) -> Option<Chart> {
    chart_within(root, MAX_CHART_POINTS)
 }
@@ -535,20 +466,9 @@ pub(crate) fn capture_kept(imp: &mut super::Imp, chart_part: &str) -> deckcraft_

    let key = crate::opc::norm(chart_part);
    if let Some(cached) = imp.kept_charts.get(&key) {
-        // Every frame that shows this chart gets its own copy, so each copy is charged like the first.
-        let bytes: usize = cached.parts.iter().map(part_bytes).sum::<usize>() + cached.rels.iter().map(rel_bytes).sum::<usize>();
-        if imp.kept_sidecar_bytes.saturating_add(bytes) > MAX_KEPT_TOTAL_BYTES {
-            log::warn!("pptx: chart sidecar retained byte budget exceeded for {chart_part}");
-            return ChartKept::default();
-        }
-        imp.kept_sidecar_bytes += bytes;
        return cached.clone();
    }

-    let charged_before = imp.kept_sidecar_bytes;
-    if imp.rejected_kept.get(&key) == Some(&charged_before) {
-        return ChartKept::default();
-    }
    let mut kept = ChartKept::default();
    // The chart document itself is rewritten; don't store a second copy of it.
    let mut seen = std::collections::HashMap::from([(key.clone(), true)]);
@@ -565,18 +485,6 @@ pub(crate) fn capture_kept(imp: &mut super::Imp, chart_part: &str) -> deckcraft_
            kept.rels.push(ChartRel { id: r.id, rel_type: r.ty, target: r.target_raw, part: r.target, external: false });
        }
    }
-    // The first capture's relationship strings and the parts' names and content types are retained
-    // too (the part bytes were charged as copied).
-    let rel_total: usize =
-        kept.rels.iter().map(rel_bytes).sum::<usize>() + kept.parts.iter().map(|p| p.name.len() + p.content_type.len()).sum::<usize>();
-    if imp.kept_sidecar_bytes.saturating_add(rel_total) > MAX_KEPT_TOTAL_BYTES {
-        log::warn!("pptx: chart sidecar retained byte budget exceeded for {chart_part}");
-        // The dropped parts must not stay charged against later charts.
-        imp.kept_sidecar_bytes = charged_before;
-        imp.rejected_kept.insert(key, charged_before);
-        return ChartKept::default();
-    }
-    imp.kept_sidecar_bytes += rel_total;
    imp.kept_charts.insert(key, kept.clone());
    kept
 }
@@ -682,16 +590,6 @@ fn text_size(e: Option<&El>) -> Option<f64> {
 mod tests {
    use super::*;

-    #[test]
-    fn point_count_charges_every_retained_vector() {
-        let mut c = Chart { categories: vec!["a".into()], category_levels: vec![vec!["x".into(); 2], vec!["y".into(); 3]], ..Default::default() };
-        let mut s =
-            deckcraft_model::chart::Series { values: vec![Some(1.0); 4], x_values: vec![None; 5], sizes: vec![None; 6], ..Default::default() };
-        s.error_bars = Some(deckcraft_model::chart::ErrorBars { plus: vec![None; 7], minus: vec![None; 8], ..Default::default() });
-        c.series = vec![s];
-        assert_eq!(point_count(&c), 1 + 1 + 5 + 4 + 5 + 6 + 15);
-    }
-
    #[test]
    fn sparse_caches_share_one_chart_wide_budget() {
        // Every series declares 100000 points but writes one: without a chart-wide budget each
@@ -741,13 +741,7 @@ mod tests {
        // 200 `m:t` nested in each other around one word: the word, not 200 copies of it.
        let x = format!(r#"<a14:m xmlns:a14="a" xmlns:m="m"><m:oMath>{}word{}</m:oMath></a14:m>"#, "<m:t>".repeat(200), "</m:t>".repeat(200));
        let d = parse(x.as_bytes()).unwrap();
-        let part = Part {
-            name: "ppt/slides/slide1.xml".into(),
-            rels: Default::default(),
-            ns: vec![],
-            inner_ns: vec![],
-            ns_budget: std::cell::Cell::new(1 << 20),
-        };
+        let part = Part { name: "ppt/slides/slide1.xml".into(), rels: Default::default(), ns: vec![], inner_ns: vec![] };
        let mut para = Paragraph::default();
        push_math_run(&mut para, &part, &d.root);
        assert_eq!(para.runs[0].text, "word");
@@ -434,8 +434,11 @@ fn frame(imp: &mut Imp, part: &Part, ctx: &mut IdCtx, e: &El, depth: usize) -> S
            return s;
        }
        if let Some(c) = gd.child("chart")
-            && let Some(chart) = super::chart::frame_chart(imp, part, c.attr("r:id").unwrap_or(""), uri)
+            && let Some(rel) = part.rels.get(c.attr("r:id").unwrap_or(""))
+            && let Some(bytes) = imp.pkg.xml_bytes(&rel.target)
+            && let Some(mut chart) = if uri.ends_with("/chartex") { super::read_chartex_xml(bytes) } else { super::read_chart_xml(bytes) }
        {
+            chart.kept = super::chart::capture_kept(imp, &rel.target);
            s.kind = ShapeKind::Chart(Box::new(chart));
            return s;
        }
@@ -132,20 +132,7 @@ fn title(w: &mut W, text: &str, c: &Chart) {
    w.close("c:title");
 }

-/// Points one cache writes. Excel and PowerPoint hold 32,000 points per series, so this is far
-/// above any chart they make; a longer vector is cut here with a warning, not refused.
-const MAX_CACHE_POINTS: usize = 1_000_000;
-
-/// `vals` cut to [`MAX_CACHE_POINTS`].
-fn capped<T>(vals: &[T]) -> &[T] {
-    if vals.len() > MAX_CACHE_POINTS {
-        log::warn!("pptx: chart data cache cut from {} to {MAX_CACHE_POINTS} points", vals.len());
-    }
-    &vals[..vals.len().min(MAX_CACHE_POINTS)]
-}
-
 fn str_cache(w: &mut W, f: &str, vals: &[String]) {
-    let vals = capped(vals);
    w.open0("c:strRef");
    w.elt("c:f", f);
    w.open0("c:strCache");
@@ -160,7 +147,6 @@ fn str_cache(w: &mut W, f: &str, vals: &[String]) {
 }

 fn num_cache(w: &mut W, f: &str, vals: &[Option<f64>]) {
-    let vals = capped(vals);
    w.open0("c:numRef");
    w.elt("c:f", f);
    w.open0("c:numCache");
@@ -179,7 +165,6 @@ fn num_cache(w: &mut W, f: &str, vals: &[Option<f64>]) {

 /// Numbers written into the chart itself (`c:numLit`), with no worksheet range behind them.
 fn num_lit(w: &mut W, vals: &[Option<f64>]) {
-    let vals = capped(vals);
    w.open0("c:numLit");
    w.val("c:ptCount", vals.len());
    for (i, v) in vals.iter().enumerate() {
@@ -261,9 +246,6 @@ fn point_fills(w: &mut W, s: &Series, g: Group) {
    }
 }

-/// Data points (categories and values counted per series) one chart group writes to its caches.
-const MAX_EXPORT_POINTS: usize = 4_000_000;
-
 fn series(w: &mut W, c: &Chart, s: &Series, i: usize, kind: ChartType, g: Group) {
    w.open0("c:ser");
    w.val("c:idx", i);
@@ -323,7 +305,7 @@ fn series(w: &mut W, c: &Chart, s: &Series, i: usize, kind: ChartType, g: Group)
            trendline(w, t);
        }
    }
-    let n = c.categories.len().max(s.values.len()).min(MAX_CACHE_POINTS);
+    let n = c.categories.len().max(s.values.len());
    let last = n + 1;
    if let Some(e) = &s.error_bars {
        error_bars(w, e, g);
@@ -509,24 +491,6 @@ fn axes(w: &mut W, c: &Chart, g: Group) {
    w.close("c:valAx");
 }

-/// Points `series` writes into its caches for group `g`, synthesized vectors included.
-fn series_points(c: &Chart, s: &Series, g: Group) -> usize {
-    let v = s.values.len();
-    if matches!(g, Group::Scatter | Group::Bubble) {
-        let xs = if s.x_values.is_empty() { v } else { s.x_values.len() };
-        let sizes = if g != Group::Bubble {
-            0
-        } else if s.sizes.is_empty() {
-            v
-        } else {
-            s.sizes.len()
-        };
-        xs.saturating_add(v).saturating_add(sizes)
-    } else {
-        c.categories.len().saturating_add(v)
-    }
-}
-
 fn plot_group(w: &mut W, c: &Chart, kind: ChartType, list: &[(usize, &Series)]) {
    let g = group_of(kind);
    let grouping = if kind.percent() {
@@ -565,17 +529,7 @@ fn plot_group(w: &mut W, c: &Chart, kind: ChartType, list: &[(usize, &Series)])
    if g != Group::Stock {
        w.val("c:varyColors", vary);
    }
-    // Each series repeats the categories in its own cache, so the output grows with series times
-    // categories: stop adding series once a group's caches pass the budget (the first is always written).
-    // The first series is always written; each of its caches is cut at MAX_CACHE_POINTS.
-    let mut left = MAX_EXPORT_POINTS;
-    for (n, (i, s)) in list.iter().enumerate() {
-        let cost = series_points(c, s, g);
-        if n > 0 && cost > left {
-            log::warn!("pptx: chart export stopped after {n} series; the data caches passed {MAX_EXPORT_POINTS} points");
-            break;
-        }
-        left = left.saturating_sub(cost);
+    for (i, s) in list {
        series(w, c, s, *i, kind, g);
    }
    if c.data_labels {
@@ -656,18 +610,6 @@ fn kept_chartex(c: &Chart) -> Option<Vec<u8>> {

 /// The chart part XML, and whether it is the original part (so its relationships still apply).
 pub fn chart_xml(c: &Chart) -> (Vec<u8>, bool) {
-    // A chart too large to model is written back as it was read.
-    if c.verbatim
-        && let Some(raw) = &c.raw
-        && let Ok(doc) = crate::xml::parse(raw.as_bytes())
-        && doc.root.is("chartSpace")
-    {
-        let mut keep = doc.root;
-        drop_unkept_refs(&mut keep, c);
-        let mut w = W::new();
-        w.raw(&keep.to_xml());
-        return (w.finish(), true);
-    }
    // Reuse the kept part when the chart is unchanged since it was read.
    if let Some(raw) = &c.raw
        && !raw.contains(NS_CX)
@@ -1107,21 +1049,7 @@ mod region_map_tests {
 mod tests {
    use deckcraft_color::{ColorTransform, Rgba};
    use deckcraft_model::ColorRef;
-    use deckcraft_model::chart::{Chart, ChartType, Series};
-
-    #[test]
-    fn export_cost_counts_the_caches_each_group_writes() {
-        let s = Series { values: vec![Some(1.0); 600], ..Default::default() };
-        let mut c = Chart::sample(ChartType::Column);
-        c.categories = vec!["a".into(); 1000];
-        // Category and value caches: 1,000 + 600, however the series is stored.
-        assert_eq!(super::series_points(&c, &s, super::Group::Bar), 1600);
-        // A bubble series without x values or sizes still writes three value-length caches.
-        assert_eq!(super::series_points(&c, &s, super::Group::Bubble), 1800);
-        assert_eq!(super::series_points(&c, &s, super::Group::Scatter), 1200);
-        let s = Series { values: vec![Some(1.0); 600], x_values: vec![Some(1.0); 5], sizes: vec![Some(1.0); 7], ..Default::default() };
-        assert_eq!(super::series_points(&c, &s, super::Group::Bubble), 612);
-    }
+    use deckcraft_model::chart::{Chart, ChartType};

    /// The chart's text colour is written where PowerPoint keeps it (`c:txPr` on the axes, legend,
    /// data labels and chart, the title's run defaults) and read back as the same colour.
@@ -1182,19 +1110,3 @@ mod tests {
        assert!(!crate::read::chart::read_chart_xml(&super::chart_xml(&c).0).unwrap().cat_reversed);
    }
 }
-
-#[cfg(test)]
-mod cache_cap_tests {
-    use super::*;
-
-    /// A cache longer than the cap is cut, never refused; anything a real chart holds (32,000
-    /// points per series) is far under it. Zero-sized elements, so the test allocates nothing.
-    #[test]
-    fn caches_are_cut_at_the_cap_not_refused() {
-        const { assert!(MAX_CACHE_POINTS >= 32_000) };
-        let over = vec![(); MAX_CACHE_POINTS + 1];
-        assert_eq!(capped(&over).len(), MAX_CACHE_POINTS);
-        let real = vec![(); 32_000];
-        assert_eq!(capped(&real).len(), 32_000);
-    }
-}
@@ -542,22 +542,10 @@ fn diagram(w: &mut W, x: &mut Exp, o: &mut Out, cx: &mut Ctx, s: &Shape, d: &dec
    let (sx, sy) = (frame.w / child.w.max(1e-6), frame.h / child.h.max(1e-6));
    let mut k = 0;
    let mut flat = vec![];
-    walk(children, &mut |c, _| match &c.kind {
-        ShapeKind::Shape => flat.push(c.clone()),
-        ShapeKind::Connector { .. } => {
-            let mut sc = c.clone();
-            if sc.geom.preset_name() == Some("rect") {
-                sc.geom = Geom::preset("line");
-            }
-            flat.push(sc);
+    walk(children, &mut |c, _| {
+        if matches!(c.kind, ShapeKind::Shape) {
+            flat.push(c.clone());
        }
-        ShapeKind::Picture { fill } => {
-            let mut sc = c.clone();
-            sc.kind = ShapeKind::Shape;
-            sc.fill = Some(deckcraft_model::style::Fill::Picture(fill.clone()));
-            flat.push(sc);
-        }
-        _ => {}
    });
    for mut c in flat.into_iter().take(10_000) {
        if let Some(xf) = &mut c.xfrm {
@@ -328,30 +328,3 @@ fn an_unchanged_chartex_keeps_its_embedded_workbook() {
    assert!(saved.iter().all(|(n, _)| n != "ppt/charts/_rels/chart1.xml.rels"), "the fallback chart has no workbook");
    assert!(!text_of(&saved, "ppt/charts/chart1.xml").contains("externalData"));
 }
-
-/// A chart past the presentation's point budget is not modelled, but a save writes the original
-/// chart part and its workbook back instead of dropping both.
-#[test]
-fn a_chart_past_the_point_budget_is_saved_whole() {
-    let src = with_workbook(&chart_pptx());
-    let p = deckcraft_pptx::import_with_chart_budget(&src, 0).expect("import");
-    let chart = p
-        .slides
-        .iter()
-        .flat_map(|s| s.shapes.iter())
-        .find_map(|s| match &s.kind {
-            ShapeKind::Chart(c) => Some(c.clone()),
-            _ => None,
-        })
-        .expect("the chart stays a chart");
-    assert!(chart.verbatim && chart.series.is_empty());
-    let saved = parts(&deckcraft_pptx::export(&p).expect("export"));
-    let workbook = saved.iter().find(|(n, _)| n == "ppt/embeddings/kept1.xlsx").map(|(_, d)| d.as_slice());
-    assert_eq!(workbook, Some(WORKBOOK));
-    let xml = saved
-        .iter()
-        .find(|(n, _)| n.starts_with("ppt/charts/chart") && n.ends_with(".xml"))
-        .map(|(_, d)| String::from_utf8_lossy(d).into_owned())
-        .expect("chart xml");
-    assert!(xml.contains("externalData") && xml.contains("c:pie"), "{xml}");
-}
@@ -11,7 +11,7 @@ workspace = true
 [dependencies]
 deckcraft-geom = { workspace = true }
 deckcraft-color = { workspace = true }
-craft-metafile = { workspace = true }
+deckcraft-metafile = { workspace = true }
 deckcraft-model = { workspace = true }
 deckcraft-anim = { workspace = true }
 deckcraft-fonts = { workspace = true }
@@ -125,13 +125,10 @@ pub fn draw(ctx: &mut RenderContext, bevel: &Bevel, fill: Option<Rgba>, path: &B
    let longest = bounds.width().max(bounds.height()) * k;
    let s = (MAX_SIDE / longest).min(1.0) * k;
    let (pw, ph) = (((bounds.width() * s).ceil() as u32).clamp(1, 2048), ((bounds.height() * s).ceil() as u32).clamp(1, 2048));
-    // Each pixel tests every edge, so a dense outline is simplified to the raster's edge budget.
-    let pixel = (bounds.width() / f64::from(pw)).min(bounds.height() / f64::from(ph));
-    let polys = crate::pathgrad::simplify(crate::pathgrad::polygons(path), pixel, crate::pathgrad::edge_budget(pw, ph));
+    let polys = crate::pathgrad::polygons(path);
    if polys.is_empty() {
        return;
    }
-    let (pw, ph) = crate::pathgrad::fit_raster(polys.iter().map(|p| p.len().saturating_sub(1)).sum(), pw, ph);
    let areas: Vec<f64> = polys.iter().map(|p| p.windows(2).map(|w| w[0].x * w[1].y - w[1].x * w[0].y).sum::<f64>() / 2.0).collect();
    let face = lit.factor([0.0, 0.0, 1.0]);
    let ratio = if bevel.w > 0.0 { bevel.h / bevel.w } else { 0.0 };
@@ -11,8 +11,6 @@ use vello_cpu::{RenderContext, peniko};

 /// Nesting depth of clips and layers past which a glyph opens no more (hostile fonts).
 const MAX_DEPTH: usize = 64;
-/// Fills and gradient stops one colour glyph may paint; the rest of a hostile glyph is skipped.
-const MAX_WORK: usize = 100_000;

 /// Paint `gid` of `face` as a colour glyph, its origin mapped by `at` (y down, points) at `scale`
 /// points per font unit. `fg` is the text colour (palette index 0xFFFF) and `alpha` fades it all.
@@ -28,7 +26,7 @@ pub fn paint(ctx: &mut RenderContext, face: &FontFace, gid: u32, at: Affine, sca
        .unwrap_or_default();
    // Font units are y up; the slide is y down.
    let base = at * Affine::scale(scale) * Affine::scale_non_uniform(1.0, -1.0);
-    let mut p = Painter { ctx, face, base, stack: vec![Affine::IDENTITY], palette, fg, opened: Vec::new(), work: 0 };
+    let mut p = Painter { ctx, face, base, stack: vec![Affine::IDENTITY], palette, fg, opened: Vec::new() };
    p.ctx.push_layer(None, None, Some(alpha.clamp(0.0, 1.0) as f32), None, None);
    let ok = glyph.paint(face.location(), &mut p).is_ok();
    // A malformed glyph may leave layers open: close them all.
@@ -52,8 +50,6 @@ struct Painter<'a> {
    /// Clips and composite groups pushed by the glyph, innermost last: true when a layer was
    /// opened on the context for it (false past `MAX_DEPTH`, so its pop is skipped too).
    opened: Vec<bool>,
-    /// Fills plus gradient stops painted so far, against [`MAX_WORK`].
-    work: usize,
 }

 fn affine(t: &Transform) -> Affine {
@@ -178,16 +174,6 @@ impl ColorPainter for Painter<'_> {
    }

    fn fill(&mut self, brush: Brush<'_>) {
-        let stops = match &brush {
-            Brush::Solid { .. } => 0,
-            Brush::LinearGradient { color_stops, .. } | Brush::RadialGradient { color_stops, .. } | Brush::SweepGradient { color_stops, .. } => {
-                color_stops.len()
-            }
-        };
-        self.work = self.work.saturating_add(1 + stops);
-        if self.work > MAX_WORK {
-            return;
-        }
        match brush {
            Brush::Solid { palette_index, alpha } => {
                let c = self.color(palette_index, alpha);
@@ -1,5 +1,5 @@
 //! Windows Metafile and Enhanced Metafile pictures (`image/x-wmf`, `image/x-emf`): parsed by
-//! `craft-metafile` and drawn as vectors into a bitmap of the size the slide needs, so they go
+//! `deckcraft-metafile` and drawn as vectors into a bitmap of the size the slide needs, so they go
 //! through the same crop, tile and recolour path as any other picture.
 //!
 //! Text items name the font the file asks for; they are drawn with the face slide text would use
@@ -10,8 +10,8 @@
 use std::collections::HashMap;
 use std::sync::Arc;

-use craft_metafile::{Cap, HAlign, Item, Join, LineStyle, PlacedClip, PlacedItem, Text, Tile, VAlign};
 use deckcraft_fonts::{FontDb, FontFace};
+use deckcraft_metafile::{HAlign, Item, PlacedItem, Text, Tile, VAlign};
 use kurbo::{Affine, BezPath, Rect, Shape as _};
 use skrifa::MetadataProvider as _;
 use vello_cpu::{Pixmap, RenderContext, Resources, peniko};
@@ -28,13 +28,13 @@ const DEFAULT_EM: f64 = 12.0;

 /// Is `bytes` a WMF or EMF file?
 pub fn is_metafile(bytes: &[u8]) -> bool {
-    craft_metafile::is_metafile(bytes)
+    deckcraft_metafile::is_metafile(bytes)
 }

 /// Draw the metafile `bytes` into straight RGBA with its longer side `side` px (transparent where
 /// it draws nothing). `None` when it doesn't parse or has no size.
 pub fn rasterize(bytes: &[u8], side: u32) -> Option<image::RgbaImage> {
-    let mut pic = craft_metafile::parse(bytes).ok()?;
+    let mut pic = deckcraft_metafile::parse(bytes).ok()?;
    if !pic.has_size() {
        return None;
    }
@@ -51,39 +51,31 @@ pub fn rasterize(bytes: &[u8], side: u32) -> Option<image::RgbaImage> {
    ctx.push_clip_layer(&r.to_path(0.1));
    for it in pic.place(r, [0.0; 4]) {
        match it {
-            PlacedItem::Path { path, fill, stroke, line, even_odd, region, clips } => clipped(&mut ctx, region.as_deref(), &clips, |ctx| {
+            PlacedItem::Path { path, fill, stroke, even_odd, region } => clipped(&mut ctx, region.as_deref(), |ctx| {
                if let Some(f) = fill {
                    ctx.set_paint(rgba(f));
                    ctx.set_fill_rule(if even_odd { peniko::Fill::EvenOdd } else { peniko::Fill::NonZero });
                    ctx.fill_path(&path);
                }
-                // The pen's caps, joins and dashes (GDI's default: round, solid); a cosmetic
-                // (zero-width) pen is one pixel.
+                // GDI pens: round caps and joins; a cosmetic (zero-width) pen is one pixel.
                if let Some((s, sw)) = stroke {
                    ctx.set_paint(rgba(s));
-                    ctx.set_stroke(pen(sw.max(1.0), &line));
+                    ctx.set_stroke(kurbo::Stroke::new(sw.max(1.0)).with_caps(kurbo::Cap::Round).with_join(kurbo::Join::Round));
                    ctx.stroke_path(&path);
                }
            }),
-            PlacedItem::Bitmap { index, rect, transform, region, clips } => clipped(&mut ctx, region.as_deref(), &clips, |ctx| {
+            PlacedItem::Bitmap { index, rect, region } => clipped(&mut ctx, region.as_deref(), |ctx| {
                let Some(Some(pm)) = pixmaps.get(index) else { return };
                let (bw, bh) = (pm.width().max(1) as f64, pm.height().max(1) as f64);
                ctx.set_paint(vello_cpu::Image {
                    image: vello_cpu::ImageSource::Pixmap(pm.clone()),
                    sampler: peniko::ImageSampler::default().with_quality(peniko::ImageQuality::Medium),
                });
-                let c = transform.as_coeffs();
-                if c[1] == 0.0 && c[2] == 0.0 {
-                    ctx.set_paint_transform(Affine::translate((rect.x0, rect.y0)) * Affine::scale_non_uniform(rect.width() / bw, rect.height() / bh));
-                    ctx.fill_rect(&rect);
-                } else {
-                    // A turned or skewed bitmap: `transform` maps the unit square onto its place.
-                    ctx.set_paint_transform(transform * Affine::scale_non_uniform(1.0 / bw, 1.0 / bh));
-                    ctx.fill_path(&(transform * Rect::new(0.0, 0.0, 1.0, 1.0).to_path(0.1)));
-                }
+                ctx.set_paint_transform(Affine::translate((rect.x0, rect.y0)) * Affine::scale_non_uniform(rect.width() / bw, rect.height() / bh));
+                ctx.fill_rect(&rect);
                ctx.reset_paint_transform();
            }),
-            PlacedItem::Pattern { index, path, even_odd, tile, region, clips } => clipped(&mut ctx, region.as_deref(), &clips, |ctx| {
+            PlacedItem::Pattern { index, path, even_odd, tile, region } => clipped(&mut ctx, region.as_deref(), |ctx| {
                let Some(Item::Pattern { tile: t, .. }) = pic.items.get(index) else { return };
                let key = Arc::as_ptr(t);
                let (pm, avg) = tiles.entry(key).or_insert_with(|| (premul(t.width, t.height, &t.rgba), average(&t.rgba))).clone();
@@ -110,7 +102,7 @@ pub fn rasterize(bytes: &[u8], side: u32) -> Option<image::RgbaImage> {
                    }
                }
            }),
-            PlacedItem::Text { index, transform, clip, region, clips } => clipped(&mut ctx, region.as_deref(), &clips, |ctx| {
+            PlacedItem::Text { index, transform, clip, region } => clipped(&mut ctx, region.as_deref(), |ctx| {
                let Some(Item::Text(t)) = pic.items.get(index) else { return };
                if let Some(c) = clip {
                    ctx.push_clip_layer(&c.to_path(0.1));
@@ -141,42 +133,17 @@ pub fn rasterize(bytes: &[u8], side: u32) -> Option<image::RgbaImage> {
    image::RgbaImage::from_raw(w as u32, h as u32, px)
 }

-/// Draws `draw` inside the device-context clip and every clip path. No region is the default clip.
-fn clipped(ctx: &mut RenderContext, region: Option<&BezPath>, clips: &[Arc<PlacedClip>], draw: impl FnOnce(&mut RenderContext)) {
+/// Draws `draw` inside the device-context clip. No region is the default clip.
+fn clipped(ctx: &mut RenderContext, region: Option<&BezPath>, draw: impl FnOnce(&mut RenderContext)) {
    if let Some(region) = region {
        ctx.push_clip_layer(region);
-    }
-    for c in clips {
-        ctx.set_fill_rule(if c.even_odd { peniko::Fill::EvenOdd } else { peniko::Fill::NonZero });
-        ctx.push_clip_layer(&c.path);
-    }
-    if !clips.is_empty() {
-        ctx.set_fill_rule(peniko::Fill::NonZero);
-    }
-    draw(ctx);
-    for _ in 0..clips.len() + usize::from(region.is_some()) {
+        draw(ctx);
        ctx.pop_layer();
+    } else {
+        draw(ctx);
    }
 }

-/// A GDI pen as a stroke `width` wide (target units): its caps, joins, miter limit and dashes.
-fn pen(width: f64, line: &LineStyle) -> kurbo::Stroke {
-    let cap = match line.cap {
-        Cap::Round => kurbo::Cap::Round,
-        Cap::Square => kurbo::Cap::Square,
-        Cap::Flat => kurbo::Cap::Butt,
-    };
-    let join = match line.join {
-        Join::Round => kurbo::Join::Round,
-        Join::Bevel => kurbo::Join::Bevel,
-        Join::Miter => kurbo::Join::Miter,
-    };
-    let stroke = kurbo::Stroke::new(width).with_caps(cap).with_join(join).with_miter_limit(f64::from(line.miter_limit));
-    // A dash pattern with no length would never advance: such a pen draws solid.
-    let dash: Vec<f64> = line.dash.iter().map(|d| f64::from(*d)).collect();
-    if dash.iter().all(|d| d.is_finite() && *d >= 0.0) && dash.iter().sum::<f64>() > 0.0 { stroke.with_dashes(0.0, dash) } else { stroke }
-}
-
 /// One glyph placed in text space (x along the baseline from the string's start, font units at
 /// `scale` text units each).
 struct Glyph {
@@ -25,39 +25,6 @@ const MAX_EDGE_WORK: u64 = 64_000_000;
 /// Fewest edges a simplified polygon keeps, so a coarse outline still has a shape.
 const MIN_POLY_EDGES: usize = 8;

-/// Most points `polygons` keeps from one path; a path flattening past this (a huge finite curve) is
-/// not drawn rather than held in memory first.
-const MAX_POINTS: usize = 2_000_000;
-
-/// Quads beyond one per cubic that a path's cubics may subdivide into before [`polygons`] refuses it.
-const MAX_EXTRA_QUADS: f64 = 200_000.0;
-
-/// Flattening tolerance of [`polygons`], in path units.
-const FLATTEN_TOLERANCE: f64 = 0.25;
-
-/// The edge budget for a `pw` x `ph` raster where each pixel tests every edge.
-pub(crate) fn edge_budget(pw: u32, ph: u32) -> usize {
-    let pixels = u64::from(pw).saturating_mul(u64::from(ph)).max(1);
-    usize::try_from(MAX_EDGE_WORK / pixels).unwrap_or(usize::MAX).max(MIN_POLY_EDGES)
-}
-
-/// `pw` x `ph` cut down (aspect kept) until every pixel testing all of `edges` stays within
-/// [`MAX_EDGE_WORK`]; the raster is stretched when painted, so a many-contour outline keeps every
-/// contour at a coarser sampling.
-pub(crate) fn fit_raster(edges: usize, pw: u32, ph: u32) -> (u32, u32) {
-    let work = u64::from(pw).saturating_mul(u64::from(ph)).saturating_mul(edges.max(1) as u64);
-    if work <= MAX_EDGE_WORK {
-        return (pw, ph);
-    }
-    let k = (MAX_EDGE_WORK as f64 / work as f64).sqrt();
-    let w = ((f64::from(pw) * k) as u32).max(1);
-    let h = ((f64::from(ph) * k) as u32).max(1);
-    // A side held at 1 pixel leaves the other to take the rest of the cut.
-    let room = |side: u32| u32::try_from(MAX_EDGE_WORK / u64::from(side).saturating_mul(edges.max(1) as u64).max(1)).unwrap_or(u32::MAX).max(1);
-    let w = w.min(room(h));
-    (w, h.min(room(w)))
-}
-
 /// Colour position (0 at the focus, 1 at the edge) of `p` for path `kind` in `bounds` with the
 /// focus rect `focus` (fractions inset from left, top, right, bottom), `outline` being the
 /// shape's flattened polygon(s) for `shape`.
@@ -145,59 +112,23 @@ fn shape_position(outline: &[Vec<Point>], c: Point, p: Point) -> f64 {

 /// The outline flattened into closed polygons.
 pub fn polygons(path: &BezPath) -> Vec<Vec<Point>> {
-    // `kurbo::flatten` buffers all of a cubic's quads before calling back, and cannot be stopped
-    // once running, so bound the quads the cubics will make first (kurbo's own count: it splits
-    // cubics into quads at a tenth of the tolerance). An ordinary curve makes a few; only those
-    // past the first of each count.
-    let mut extra_quads = 0.0f64;
-    let mut at = Point::ZERO;
-    let mut start = Point::ZERO;
-    for el in path.iter() {
-        match el {
-            PathEl::MoveTo(p) => {
-                at = p;
-                start = p;
-            }
-            PathEl::LineTo(p) | PathEl::QuadTo(_, p) => at = p,
-            PathEl::CurveTo(a, b, p) => {
-                let err = ((b.to_vec2() * 3.0 - p.to_vec2()) - (a.to_vec2() * 3.0 - at.to_vec2())).hypot2();
-                extra_quads += (err / (432.0 * (FLATTEN_TOLERANCE * 0.1).powi(2))).powf(1.0 / 6.0).ceil().max(1.0) - 1.0;
-                // A non-finite estimate is over the limit too.
-                if extra_quads.is_nan() || extra_quads > MAX_EXTRA_QUADS {
-                    return Vec::new();
-                }
-                at = p;
-            }
-            PathEl::ClosePath => at = start,
-        }
-    }
    let mut out: Vec<Vec<Point>> = Vec::new();
    let mut cur: Vec<Point> = Vec::new();
-    let mut total = 0usize;
-    kurbo::flatten(path.iter(), FLATTEN_TOLERANCE, |el| {
-        total += 1;
-        if total > MAX_POINTS {
-            return;
-        }
-        match el {
-            PathEl::MoveTo(p) => {
-                if cur.len() > 1 {
-                    out.push(std::mem::take(&mut cur));
-                }
-                cur = vec![p];
+    kurbo::flatten(path.iter(), 0.25, |el| match el {
+        PathEl::MoveTo(p) => {
+            if cur.len() > 1 {
+                out.push(std::mem::take(&mut cur));
            }
-            PathEl::LineTo(p) => cur.push(p),
-            PathEl::ClosePath => {
-                if let Some(f) = cur.first().copied() {
-                    cur.push(f);
-                }
-            }
-            _ => {}
+            cur = vec![p];
        }
+        PathEl::LineTo(p) => cur.push(p),
+        PathEl::ClosePath => {
+            if let Some(f) = cur.first().copied() {
+                cur.push(f);
+            }
+        }
+        _ => {}
    });
-    if total > MAX_POINTS {
-        return Vec::new();
-    }
    if cur.len() > 1 {
        out.push(cur);
    }
@@ -214,9 +145,8 @@ pub fn polygons(path: &BezPath) -> Vec<Vec<Point>> {

 /// `outline` cut down to at most about `max_edges` edges in total: first by dropping points
 /// closer than `tol` to the last kept one (detail finer than a raster pixel), then, if still too
-/// many, by keeping every k-th point (a polygon too small to thin stays whole, and none is
-/// dropped). Each polygon stays closed. Returns it unchanged when it fits.
-pub(crate) fn simplify(outline: Vec<Vec<Point>>, tol: f64, max_edges: usize) -> Vec<Vec<Point>> {
+/// many, by keeping every k-th point. Each polygon stays closed. Returns it unchanged when it fits.
+fn simplify(outline: Vec<Vec<Point>>, tol: f64, max_edges: usize) -> Vec<Vec<Point>> {
    let edges = |o: &[Vec<Point>]| o.iter().map(|p| p.len().saturating_sub(1)).sum::<usize>();
    if edges(&outline) <= max_edges {
        return outline;
@@ -259,8 +189,15 @@ pub(crate) fn simplify(outline: Vec<Vec<Point>>, tol: f64, max_edges: usize) ->
            }
            *poly = kept;
        }
-        // Polygons too small to thin stay whole, so the total can still exceed `max_edges`: the
-        // caller shrinks its raster ([`fit_raster`]) rather than lose contours.
+        // Polygons too small to thin stay whole; drop the smallest ones if they alone overflow.
+        if edges(&out) > max_edges {
+            out.sort_by_key(|p| std::cmp::Reverse(p.len()));
+            let mut sum = 0usize;
+            out.retain(|p| {
+                sum = sum.saturating_add(p.len().saturating_sub(1));
+                sum <= max_edges
+            });
+        }
    }
    out
 }
@@ -295,20 +232,14 @@ pub fn fill(ctx: &mut RenderContext, kind: &str, focus: [f64; 4], stops: &[(f64,
    let longest = bounds.width().max(bounds.height()) * k;
    let s = (MAX_SIDE / longest).min(1.0) * k;
    let (pw, ph) = (((bounds.width() * s).ceil() as u32).clamp(1, 4096), ((bounds.height() * s).ceil() as u32).clamp(1, 4096));
-    let (outline, pw, ph) = if kind == "shape" {
-        let max_edges = edge_budget(pw, ph);
+    let outline = if kind == "shape" {
+        let pixels = u64::from(pw).saturating_mul(u64::from(ph)).max(1);
+        let max_edges = usize::try_from(MAX_EDGE_WORK / pixels).unwrap_or(usize::MAX).max(MIN_POLY_EDGES);
        let pixel = (bounds.width() / f64::from(pw)).min(bounds.height() / f64::from(ph));
-        let o = simplify(polygons(path), pixel, max_edges);
-        let (pw, ph) = fit_raster(o.iter().map(|p| p.len().saturating_sub(1)).sum(), pw, ph);
-        (o, pw, ph)
+        simplify(polygons(path), pixel, max_edges)
    } else {
-        (Vec::new(), pw, ph)
+        Vec::new()
    };
-    // An outline `polygons` refused (too many points) has no contours: skip the shape rather than
-    // paint it with the rectangle fallback's different gradient.
-    if kind == "shape" && outline.is_empty() {
-        return;
-    }
    let lut = ramp(stops);
    let a = alpha.clamp(0.0, 1.0);
    let mut data = Vec::with_capacity((pw * ph) as usize);
@@ -441,20 +372,6 @@ mod tests {
        assert!(t.elapsed() < std::time::Duration::from_secs(20), "{:?}", t.elapsed());
    }

-    #[test]
-    fn a_shape_gradient_with_no_usable_outline_paints_nothing() {
-        // One polygon over the per-polygon cap is dropped by `polygons`.
-        let path = many_segment_square(26_000);
-        assert!(polygons(&path).is_empty());
-        let mut ctx = RenderContext::new(64, 64);
-        let stops = [(0.0, Rgba::rgb(0, 0, 0)), (1.0, Rgba::rgb(255, 255, 255))];
-        fill(&mut ctx, "shape", CENTRE, &stops, Rect::new(0.0, 0.0, 64.0, 64.0), &path, Affine::IDENTITY, 1.0);
-        ctx.flush();
-        let mut px = vec![0u8; 64 * 64 * 4];
-        ctx.render(vello_cpu::PixmapMut::new(64, 64, &mut px).unwrap(), &mut vello_cpu::Resources::new());
-        assert!(px.chunks(4).all(|p| p[3] == 0), "nothing was painted");
-    }
-
    #[test]
    fn the_ramp_runs_through_the_stops() {
        let stops = [(0.0, Rgba::rgb(0, 0, 0)), (0.5, Rgba::rgb(128, 128, 128)), (1.0, Rgba::rgb(255, 255, 255))];
@@ -465,33 +382,4 @@ mod tests {
        assert!((r[64].r as i32 - 64).abs() <= 2);
        assert!(ramp(&[(0.3, Rgba::rgb(9, 9, 9))]).iter().all(|c| *c == Rgba::rgb(9, 9, 9)));
    }
-
-    #[test]
-    fn huge_cubics_are_refused_before_flattening() {
-        let mut p = BezPath::new();
-        p.move_to((0.0, 0.0));
-        // About 250,000 quads each: over the limit.
-        for _ in 0..3 {
-            p.curve_to((1e15, -1e15), (-1e15, 1e15), (1.0, 1.0));
-        }
-        p.close_path();
-        assert!(polygons(&p).is_empty());
-        // A cubic of ordinary size still flattens.
-        let mut q = BezPath::new();
-        q.move_to((0.0, 0.0));
-        q.curve_to((100.0, 0.0), (100.0, 100.0), (0.0, 100.0));
-        q.close_path();
-        assert_eq!(polygons(&q).len(), 1);
-    }
-
-    #[test]
-    fn many_contours_keep_every_contour_at_a_coarser_raster() {
-        let square = |x: f64| vec![Point::new(x, 0.0), Point::new(x + 1.0, 0.0), Point::new(x + 1.0, 1.0), Point::new(x, 1.0), Point::new(x, 0.0)];
-        let polys: Vec<Vec<Point>> = (0..100).map(|i| square(f64::from(i) * 2.0)).collect();
-        let simple = simplify(polys, 0.001, 244);
-        assert_eq!(simple.len(), 100, "no contour is dropped");
-        let (pw, ph) = fit_raster(400, 512, 512);
-        assert!(u64::from(pw) * u64::from(ph) * 400 <= MAX_EDGE_WORK && pw > 100, "{pw}x{ph}");
-        assert_eq!(fit_raster(200, 512, 512), (512, 512));
-    }
 }
@@ -1962,19 +1962,6 @@ fn mf_ink(img: &image::RgbaImage) -> Option<(u32, u32, u32, u32)> {
    b
 }

-#[test]
-fn metafile_dashed_pen_leaves_gaps() {
-    // CREATEPENINDIRECT PS_DASH | PS_ENDCAP_FLAT, 40 units (4 px) wide, black, then a line across
-    // the picture at y = 72 px: 12 px dashes with 4 px gaps.
-    let mut pen = i16s(&[0x0201, 40, 0]);
-    pen.extend(0u32.to_le_bytes());
-    let recs = vec![(0x02FA, pen), (0x012D, i16s(&[0])), (0x0214, i16s(&[720, 100])), (0x0213, i16s(&[720, 2780]))];
-    let img = crate::metafile::rasterize(&wmf_with(2880, 1440, &recs), 288).expect("raster");
-    let ink: Vec<bool> = (20..260).map(|x| img.get_pixel(x, 72)[3] > 128).collect();
-    assert!(ink.iter().filter(|b| **b).count() > 120, "dashes are drawn");
-    assert!(ink.iter().filter(|b| !**b).count() > 30, "with gaps between them");
-}
-
 #[test]
 fn metafile_text_ink_lands_at_its_reference_point() {
    // 2 × 1 inch (144 × 72 pt) drawn 288 px wide: 2 px per point. A 36-point "HH", top-left
@@ -12,9 +12,6 @@ use egui::{Align2, Color32, CornerRadius, Pos2, Rect, Sense, Stroke, TextureHand

 use crate::icons::{self, Icon};

-/// Video shapes that get a decoder at once; more play their sound without a picture.
-const MAX_VIDEO_FEEDS: usize = 16;
-
 /// Who started a voice: the editor's control bar stops when you leave the slide, the slide show
 /// manages its own.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -230,10 +227,14 @@ impl MediaHost {
            audio: clip.volume > 0.0,
        };
        let source_changed = self.owners.get(&id).is_some_and(|o| o.source != media_key);
-        // A shape whose feed could not be had (the cap, a decode error) tries again on each play.
-        let feedless = self.videos.get(&id).is_some_and(|v| v.feed.is_none());
-        if clip.video && (source_changed || feedless || !self.videos.contains_key(&id)) {
-            let feed = self.new_feed(id, &bytes);
+        if clip.video && (source_changed || !self.videos.contains_key(&id)) {
+            let feed = match VideoFeed::new(bytes.clone()) {
+                Ok(f) => Some(f),
+                Err(e) => {
+                    log::info!("video {id}: {e}");
+                    None
+                }
+            };
            self.videos.insert(id, Video { feed, frame: None, tex: None });
        } else if !clip.video {
            self.videos.remove(&id);
@@ -242,35 +243,6 @@ impl MediaHost {
        self.owners.insert(id, Owned { owner, clip: clip.clone(), source: media_key });
    }

-    /// A decoder for the video of shape `id`, within the cap on live decoders; `None` past it or
-    /// when the video cannot be decoded (the shape then plays its sound only).
-    fn new_feed(&mut self, id: ShapeId, bytes: &Arc<Vec<u8>>) -> Option<VideoFeed> {
-        // One decoder and frame queue per video shape: past the cap a shape plays its sound only.
-        let mut live = self.videos.iter().filter(|(vid, v)| **vid != id && v.feed.is_some()).count();
-        if live >= MAX_VIDEO_FEEDS {
-            // Videos that have ended no longer need their decoder: free it and keep the last
-            // picture (a replay makes a new feed).
-            for (vid, v) in self.videos.iter_mut() {
-                if *vid != id && v.feed.is_some() && self.player.status(key(*vid)).is_some_and(|s| s.state == PlayState::Ended) {
-                    v.feed = None;
-                    live -= 1;
-                }
-            }
-        }
-        if live >= MAX_VIDEO_FEEDS {
-            log::info!("video {id}: more than {MAX_VIDEO_FEEDS} videos playing; showing no picture");
-            None
-        } else {
-            match VideoFeed::new(bytes.clone()) {
-                Ok(f) => Some(f),
-                Err(e) => {
-                    log::info!("video {id}: {e}");
-                    None
-                }
-            }
-        }
-    }
-
    pub fn pause(&mut self, id: ShapeId) {
        self.player.pause(key(id));
    }
@@ -308,15 +280,6 @@ impl MediaHost {
            self.play(doc_uid, doc, id, clip, Some(t), owner);
            self.pause(id);
        }
-        // A video whose decoder was reclaimed (or refused at the cap) tries for one again, so its picture follows the seek.
-        if clip.video && self.videos.get(&id).is_some_and(|v| v.feed.is_none()) {
-            let bytes = doc.media(clip.media).map(|m| m.data.clone());
-            if let Some(feed) = bytes.and_then(|b| self.new_feed(id, &b))
-                && let Some(v) = self.videos.get_mut(&id)
-            {
-                v.feed = Some(feed);
-            }
-        }
        self.player.seek(key(id), t);
    }

@@ -841,47 +804,4 @@ mod tests {
        assert_eq!((a.rect.x, a.rect.y, a.rect.w, a.rect.h), (100.0, 50.0, 20.0, 20.0));
        assert_eq!((b.rect.x, b.rect.y, b.rect.w, b.rect.h), (120.0, 50.0, 20.0, 20.0));
    }
-
-    /// Past `MAX_VIDEO_FEEDS` live decoders a video shape plays without a picture, and gets a
-    /// decoder again on its next play once one has been freed.
-    #[test]
-    fn video_decoders_are_capped_and_retried_when_one_frees_up() {
-        let mut doc = Presentation::default();
-        let media = doc.add_media("clip.mp4", "video/mp4", include_bytes!("../../media/tests/fixtures/clip-h264.mp4").to_vec()).expect("media");
-        let clip = MediaClip { media, volume: 0.0, video: true, ..Default::default() };
-        let mut host = MediaHost::new(None);
-        let live = |h: &MediaHost| h.videos.values().filter(|v| v.feed.is_some()).count();
-        for n in 0..=MAX_VIDEO_FEEDS as u32 {
-            host.play(1, &doc, ShapeId(5000 + n), &clip, None, Owner::Editor);
-        }
-        assert_eq!(live(&host), MAX_VIDEO_FEEDS);
-        let extra = ShapeId(5000 + MAX_VIDEO_FEEDS as u32);
-        assert!(host.videos.get(&extra).is_some_and(|v| v.feed.is_none()), "the shape past the cap has no picture");
-        host.stop(ShapeId(5000));
-        host.play(1, &doc, extra, &clip, None, Owner::Editor);
-        assert!(host.videos.get(&extra).is_some_and(|v| v.feed.is_some()), "a freed decoder is taken on the next play");
-        assert_eq!(live(&host), MAX_VIDEO_FEEDS);
-    }
-
-    /// Seeking a video that has no decoder (refused at the cap, or reclaimed) retries one without
-    /// restarting playback, so its picture follows the seek.
-    #[test]
-    fn seeking_a_feedless_video_retries_its_decoder() {
-        let mut doc = Presentation::default();
-        let media = doc.add_media("clip.mp4", "video/mp4", include_bytes!("../../media/tests/fixtures/clip-h264.mp4").to_vec()).expect("media");
-        let clip = MediaClip { media, volume: 0.0, video: true, ..Default::default() };
-        let mut host = MediaHost::new(None);
-        for n in 0..=MAX_VIDEO_FEEDS as u32 {
-            host.play(1, &doc, ShapeId(7000 + n), &clip, None, Owner::Editor);
-        }
-        let extra = ShapeId(7000 + MAX_VIDEO_FEEDS as u32);
-        assert!(host.videos.get(&extra).is_some_and(|v| v.feed.is_none()));
-        // Still at the cap: a seek does not exceed it.
-        host.seek(1, &doc, extra, &clip, 0.0, Owner::Editor);
-        assert!(host.videos.get(&extra).is_some_and(|v| v.feed.is_none()));
-        host.stop(ShapeId(7000));
-        host.seek(1, &doc, extra, &clip, 0.0, Owner::Editor);
-        assert!(host.videos.get(&extra).is_some_and(|v| v.feed.is_some()), "the seek got a decoder");
-        assert_eq!(host.videos.values().filter(|v| v.feed.is_some()).count(), MAX_VIDEO_FEEDS);
-    }
 }
@@ -8,7 +8,7 @@ use std::sync::Arc;

 use deckcraft_model::edit;
 use deckcraft_model::text::{Bullet, Paragraph, RunProps, Strike, TextBody};
-use egui::text::{Galley, LayoutJob, TextFormat};
+use egui::text::{CCursor, Galley, LayoutJob, TextFormat};
 use egui::{Align2, Color32, Stroke, Ui, vec2};

 use crate::theme;
@@ -210,30 +210,16 @@ pub fn editor(
    out
 }

-/// The (min y, max y) of the row holding char index `at`; `walk` (row index, chars through that
-/// row) carries over between calls, so successive non-decreasing `at`s cost one pass in all.
-fn row_span_at(galley: &Galley, walk: &mut (usize, usize), at: usize) -> (f32, f32) {
-    while walk.0 + 1 < galley.rows.len() && (walk.1 < at || (walk.1 == at && galley.rows[walk.0].char_count_including_newline().0 > 0)) {
-        walk.0 += 1;
-        walk.1 += galley.rows[walk.0].char_count_including_newline().0;
-    }
-    galley.rows.get(walk.0).map_or((0.0, 0.0), |r| (r.min_y(), r.max_y()))
-}
-
 /// Bullets and numbers at the start of each paragraph's first line of `galley` (laid out from
 /// `body`), drawn at `origin`.
 fn paint_bullets(painter: &egui::Painter, body: &TextBody, galley: &Galley, origin: egui::Pos2, size: f32, color: Color32) {
    let k = size / 12.0;
    let mut at = 0usize;
-    // Paragraph starts only grow, so one forward walk over the rows finds each start's row
-    // (`pos_from_cursor` would rescan from the top for every bullet).
-    let mut walk = (0usize, galley.rows.first().map_or(0, |r| r.char_count_including_newline().0));
    for (p, bullet) in body.paragraphs.iter().zip(bullets(body)) {
        if let Some(b) = bullet {
-            let (min_y, max_y) = row_span_at(galley, &mut walk, at);
-            let (center_y, height) = ((min_y + max_y) / 2.0, max_y - min_y);
-            let pos = origin + vec2(px(indents(p).0, k), center_y);
-            let font = theme::font(height.clamp(size * 0.75, size * 2.0) * 0.8);
+            let row = galley.pos_from_cursor(CCursor::new(at));
+            let pos = origin + vec2(px(indents(p).0, k), row.center().y);
+            let font = theme::font(row.height().clamp(size * 0.75, size * 2.0) * 0.8);
            painter.text(pos, Align2::LEFT_CENTER, b, font, color);
        }
        at += p.char_len() + 1;
@@ -255,7 +241,6 @@ mod tests {
    #![allow(clippy::unwrap_used, clippy::expect_used)]

    use deckcraft_model::text::{ParaProps, Run};
-    use egui::text::CCursor;

    use super::*;

@@ -332,23 +317,6 @@ mod tests {
        assert!(wrapped.iter().all(|r| (r.pos.x - 22.5).abs() < 1.0), "wrapped lines align with the text");
    }

-    #[test]
-    fn row_walk_matches_cursor_lookup_at_paragraph_starts() {
-        let ctx = egui::Context::default();
-        let body = notes();
-        let mut laid = None;
-        let mut out = ctx.run_ui(Default::default(), |ui| laid = Some(galley(ui, &body, 12.0, Color32::BLACK, 300.0)));
-        out.textures_delta.clear();
-        let g = laid.unwrap();
-        let mut walk = (0usize, g.rows.first().map_or(0, |r| r.char_count_including_newline().0));
-        let mut at = 0usize;
-        for p in &body.paragraphs {
-            let want = g.pos_from_cursor(CCursor::new(at));
-            assert_eq!(row_span_at(&g, &mut walk, at), (want.min.y, want.max.y), "paragraph at char {at}");
-            at += p.char_len() + 1;
-        }
-    }
-
    #[test]
    fn typing_keeps_the_formatting_around_it() {
        let mut d = Draft::new(&notes());
@@ -196,40 +196,18 @@ pub(super) fn part_textures(ctx: &egui::Context, doc: &Presentation, from: Optio
    ]
 }

-/// Width of a slide-show grid thumbnail, in pixels.
-const THUMB_WIDTH: f64 = 320.0;
-/// Tallest grid thumbnail, so an extreme portrait slide cannot ask for a huge raster.
-const THUMB_MAX_HEIGHT: f64 = 2048.0;
-
-/// The scale and pixel size of a grid thumbnail of a `width` x `height` slide.
-fn thumb_size(width: f64, height: f64) -> (f64, f64, f64) {
-    let (sw, sh) = (width.max(1.0), height.max(1.0));
-    let scale = (THUMB_WIDTH / sw).min(THUMB_MAX_HEIGHT / sh);
-    (scale, (sw * scale).round().max(1.0), (sh * scale).round().max(1.0))
-}
-
 pub(super) fn render_thumb(ctx: &egui::Context, show: &mut Show, doc: &Presentation, i: usize) -> Option<TextureHandle> {
    if show.thumbs.len() >= GRID_CAP {
        return None;
    }
-    // 320 wide, unless the slide is so tall that this would pass the height limit: fit that box.
-    let (scale, w, h) = thumb_size(doc.slide_size.width, doc.slide_size.height);
-    let img = deckcraft_render::render_slide(doc, i, &RenderOpts { scale, size: Some((w as u32, h as u32)), ..Default::default() });
+    let w = 320.0_f64;
+    let h = (w * doc.slide_size.height / doc.slide_size.width.max(1.0)).round().max(1.0);
+    let img = deckcraft_render::render_slide(
+        doc,
+        i,
+        &RenderOpts { scale: w / doc.slide_size.width.max(1.0), size: Some((w as u32, h as u32)), ..Default::default() },
+    );
    let tex = crate::textures::upload(ctx, format!("show-grid-{i}"), crate::textures::to_color_image(&img, false));
    show.thumbs.push((i, tex.clone()));
    Some(tex)
 }
-
-#[cfg(test)]
-mod thumb_size_tests {
-    use super::*;
-
-    #[test]
-    fn ordinary_slides_are_320_wide_and_extreme_ones_stay_in_the_height_limit() {
-        let (scale, w, h) = thumb_size(960.0, 540.0);
-        assert_eq!((w, h), (320.0, 180.0));
-        assert!((scale - 320.0 / 960.0).abs() < 1e-12);
-        let (_, w, h) = thumb_size(1.0, 1.0e9);
-        assert!(h <= THUMB_MAX_HEIGHT && w >= 1.0);
-    }
-}
@@ -166,17 +166,11 @@ impl Decoder {
        if frames.len() > 1 {
            self.stats.superframes += 1;
        }
-        let queued = self.pending.len();
        for f in frames {
            if f.is_empty() {
                continue;
            }
-            if let Err(e) = self.decode_frame(f, pts) {
-                // A failed sample outputs nothing: drop what its earlier subframes queued so a
-                // later drain does not expand each repeat into its own picture.
-                self.pending.truncate(queued);
-                return Err(e);
-            }
+            self.decode_frame(f, pts)?;
        }
        Ok(self.drain(false))
    }
@@ -1,6 +1,6 @@
 # DeckCraft architecture

-> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-11-11 · **Change:** trivial (containers and the Opus decoder come from craft-libs; previous: minor, native chart payloads stored in bounded ZIP members; previous: minor, community PR wave 2026-10-14: 320 engine commands, 41 dialogs, the `metafile` crate, 1,641 tests; duplicated L2/L5/L6 rows and headers folded; previous: minor, transition frames) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-18 · **Change:** minor (native chart payloads stored in bounded ZIP members; previous: minor, community PR wave 2026-10-14: 320 engine commands, 41 dialogs, the `metafile` crate, 1,641 tests; duplicated L2/L5/L6 rows and headers folded; previous: minor, transition frames) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)

 How DeckCraft is built today. The binding rules (layering, everything is a command, thin UI, never
 break wasm, never crash) are in [AGENTS.md](../AGENTS.md) §3–§5; this document describes what
@@ -15,9 +15,9 @@ nothing below L6 uses egui, eframe, winit or rfd.

 | Layer | Crates | What they do |
 |---|---|---|
-| L0 | `geom`, `color`; standalone `bitstream` | EMU/pt units, transforms, ~180 preset shape generators re-derived from ECMA-376, adjust handles, hit testing; RGB/HSL and DrawingML colour transforms; bit-level I/O and the video decoders' memory budget (`bitstream`) |
-| L1 | `model`, `fonts`; `h264`, `hevc`, `vp9`, `av1` | Presentation, masters, layouts, slides, shapes, text, themes, tables, charts, transitions, animations, placeholder inheritance (`resolve`); font database (craft-fonts + system) with metric-compatible substitutes for Office fonts (Carlito for Calibri, Caladea for Cambria, Liberation for Arial/Times); video decoders |
-| L2 | `text`, `anim`, `format`, `media` | Shaping (HarfRust), UAX #9 bidi, UAX #14 line breaking, autofit, caret hit testing; per-shape animation state over time, the show state machine, transition frame layouts, Morph matching; `.deckcraft` (zip + JSON + media) and outline text; media probing, decoding, mixer and clock (MP4/MOV, MKV/WebM and Ogg demuxers from craft-media and the Opus decoder from craft-audio, both in craft-libs) |
+| L0 | `geom`, `color`, `metafile`; standalone `bitstream`, `matroska`, `ogg`, `opus` | EMU/pt units, transforms, ~180 preset shape generators re-derived from ECMA-376, adjust handles, hit testing; RGB/HSL and DrawingML colour transforms; MKV/WebM and Ogg demuxers, the Opus decoder; EMF/WMF read into a neutral vector model (`metafile`) |
+| L1 | `model`, `fonts`; `h264`, `hevc`, `vp9`, `av1`, `isobmff` | Presentation, masters, layouts, slides, shapes, text, themes, tables, charts, transitions, animations, placeholder inheritance (`resolve`); font database (craft-fonts + system) with metric-compatible substitutes for Office fonts (Carlito for Calibri, Caladea for Cambria, Liberation for Arial/Times); video decoders and the MP4/MOV demuxer |
+| L2 | `text`, `anim`, `format`, `media` | Shaping (HarfRust), UAX #9 bidi, UAX #14 line breaking, autofit, caret hit testing; per-shape animation state over time, the show state machine, transition frame layouts, Morph matching; `.deckcraft` (zip + JSON + media) and outline text; media probing, decoding, mixer and clock |
 | L3 | `render`, `pptx` | `vello_cpu` raster of slides, masters and layouts (fills, outlines, effects, pictures, tables, charts, Morph frames); PPTX import/export from ECMA-376 |
 | L4 | `pdf` | App-owned export layout and rendering through the shared `craft-pdf` writer |
 | L5 | `engine` | Sessions, documents, selection, undo history on shared slide snapshots, the command registry (320 commands in `cmd/*`), pointer tools, keys, AutoRecover, the panic guard (`guard.rs`) |
@@ -81,8 +81,6 @@ macOS, Windows, Linux, FreeBSD and web artifacts.

 | Date | Change | Summary |
 |---|---|---|
-| 2026-11-12 | trivial | The `metafile` crate is gone: `render` reads EMF/WMF with craft-metafile from craft-libs |
-| 2026-11-11 | trivial | The `opus`, `ogg`, `isobmff` and `matroska` crates are gone: `media` uses craft-audio and craft-media from craft-libs |
 | 2026-10-18 | minor | Native chart payloads use referenced ZIP members and share media byte/item limits; old inline sidecars remain readable. Synthetic tests cover multi-megabyte layout, all shape owners, shared budgets, missing/corrupt members and invalid references. Scores and milestone scope unchanged |
 | 2026-10-14 | minor | Community PR wave folded: one L2/L5/L6 row each; command registry 320 (`cmd!` registrations in `cmd/*`), 41 dialogs (titled in `dialogs.rs`), 202k lines, 24 crates (`metafile` added at L0), 1,641 tests. The per-PR rows below give the counts each PR saw on its own branch |
 | 2026-10-14 | minor | Size and Position dialog (`shape.sizePosition`): position, size, rotation, scale and lock aspect in one undo step. 227 commands, 28 dialogs |
@@ -56,7 +56,7 @@ intermediate build that required inline `bytes` cannot read the new referenced r
 | SVG | yes (with PNG fallback) | **no** | The PNG fallback shows; SVG files can't be inserted |
 | EMF / WMF | yes | partial | Drawn as vectors (paths, pens, pattern and hatch brushes, bitmaps, text in the document's fonts with the file's character advances). Rectangle clip regions (`INTERSECTCLIPRECT`, `EXCLUDECLIPRECT`, `EXTSELECTCLIPRGN`) limit later drawing. EMF+ only pictures play every EMF+ drawing record (brushes incl. gradients and textures, pens, paths, curves, images, strings, transforms, clipping; see `crates/metafile/src/emfplus.rs` for the few exceptions). Legacy OLE objects (VML preview) and ActiveX controls show their pictures |
 | HEIC | yes (macOS) | no | |
-| Audio: MP3, AAC/M4A, ALAC, WAV, AIFF, CAF, FLAC, Ogg Vorbis, Opus | yes (Ogg/Opus partly) | yes | Pure-Rust decoders in `crates/media`; Opus from craft-audio (craft-libs) |
+| Audio: MP3, AAC/M4A, ALAC, WAV, AIFF, CAF, FLAC, Ogg Vorbis, Opus | yes (Ogg/Opus partly) | yes | Pure-Rust decoders in `crates/media`, `crates/opus` |
 | WMA | yes (Windows) | embedded, not playable | |
 | Video: H.264, HEVC in MP4/MOV | yes | yes | Pure-Rust, software decode |
 | Video: VP9, AV1 in WebM/MKV | partly (OS codecs) | yes | Ahead of PowerPoint for Mac |
@@ -34,16 +34,21 @@ impl Class {
 /// prefix.
 pub const TABLE: &[(&str, Class)] = &[
    ("geom", Class::Layer(0)),
-    // Video codecs (ported from FilmCraft): `bitstream` is an L0 standalone leaf, the codecs sit
-    // over it at L1, and `media` (probe, decode, playback mixer) at L2. Containers and the Opus
-    // decoder come from craft-libs (craft-media, craft-audio).
+    // Codecs and containers (ported from FilmCraft): L0 standalone leaves, L1 codecs over
+    // `bitstream`, and `media` (probe, decode, playback mixer) at L2.
    ("bitstream", Class::Standalone),
+    ("matroska", Class::Standalone),
+    ("ogg", Class::Standalone),
+    ("opus", Class::Standalone),
    ("h264", Class::Layer(1)),
    ("hevc", Class::Layer(1)),
    ("vp9", Class::Layer(1)),
    ("av1", Class::Layer(1)),
+    ("isobmff", Class::Layer(1)),
    ("media", Class::Layer(2)),
    ("color", Class::Layer(0)),
+    // WMF/EMF reader (ported from WordCraft).
+    ("metafile", Class::Layer(0)),
    ("model", Class::Layer(1)),
    ("fonts", Class::Layer(1)),
    ("text", Class::Layer(2)),
@@ -7,7 +7,7 @@ use std::process::Command;
 use serde_json::Value;

 const SHARED_REPO: &str = "https://github.com/storytold/craft-libs";
-const SHARED_REV: &str = "6e03f65bf45181db77ba6229716e6624db9eb25b";
+const SHARED_REV: &str = "1b34eba41e62138fc2438d2734523b302840b45d";
 const REGISTRY: &str = "registry+https://github.com/rust-lang/crates.io-index";

 pub fn run(root: &Path) -> Result<(), String> {
Author	SHA1	Message	Date
Dylan M. Taylor	92539fdfbc	test: avoid unchecked option parsing in Flatpak regression	2026-11-11 14:08:49 -05:00
Dylan M. Taylor	a87190d919	Release 0.18.1: fix Flatpak update permissions	2026-11-11 14:04:28 -05:00
FredApps	0ce1a83c14	Merge main into release for DeckCraft v0.18.0	2026-11-11 16:35:50 +01:00
Dylan M. Taylor	fc51f46c83	Release 0.17.0	2026-11-09 06:29:58 -05:00