Pass the Linux signing key to the release workflow (#1363)

.github/workflows/release.yml

@@ -41,3 +41,4 @@ jobs:
       AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
       AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
       AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
+      LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}

Cargo.lock

@@ -1422,19 +1422,6 @@ dependencies = [
  "winit",
 ]
 
-[[package]]
-name = "egui_extras"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-dependencies = [
- "ahash",
- "egui",
- "enum-map",
- "itertools 0.15.0",
- "log",
- "profiling",
-]
-
 [[package]]
 name = "egui_glow"
 version = "0.37.0"
@@ -1488,26 +1475,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
-[[package]]
-name = "enum-map"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
-dependencies = [
- "enum-map-derive",
-]
-
-[[package]]
-name = "enum-map-derive"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -4523,7 +4490,6 @@ dependencies = [
  "craft-ui",
  "craft-update",
  "egui",
- "egui_extras",
  "egui_kittest",
  "image",
  "log",
@@ -6544,6 +6510,11 @@ name = "egui_demo_lib"
 version = "0.37.0"
 source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 
+[[patch.unused]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
 [[patch.unused]]
 name = "egui_inspection"
 version = "0.37.0"

Cargo.toml

@@ -60,8 +60,6 @@ craft-update = { version = "=0.1.0", git = "https://github.com/storytold/craft-l
 # ui
 craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["serde"] }
 egui = { version = "0.37" }
-# Resizable table columns (About ▸ Contributors / Models); no image loaders.
-egui_extras = { version = "0.37", default-features = false }
 eframe = { version = "0.37", default-features = false }
 # Monotonic clock on native and the browser (the `web_time::Instant` panics-free equivalent).
 web-time = "1.1"

crates/clap-host/src/scan.rs

@@ -150,7 +150,9 @@ mod tests {
     fn tmp(name: &str) -> PathBuf {
         let d = std::env::temp_dir().join(format!("soundcraft-clap-scan-{name}-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&d);
-        std::fs::create_dir_all(&d).unwrap();
+        // Created exclusively: a folder still there after the cleanup (someone else's) would
+        // let a link inside it redirect the test's writes.
+        std::fs::create_dir(&d).unwrap();
         d
     }
 

crates/engine/src/autosave.rs

@@ -212,6 +212,9 @@ impl Autosave {
         let audio_dir = self.dir.join("Audio Files");
         let mut s = session.clone();
         let mut copies = BTreeMap::new();
+        // Copies made in this write, by the audio they hold: sources sharing one decoded buffer
+        // (a session may name one file under many ids) share one file.
+        let mut written: BTreeMap<*const SourceAudio, String> = BTreeMap::new();
         for src in &mut s.sources {
             let file = if Path::new(&src.path).is_absolute() { Some(PathBuf::from(&src.path)) } else { base.as_ref().map(|b| b.join(&src.path)) };
             let audio = s.pool.get(src.id);
@@ -224,6 +227,7 @@ impl Autosave {
             let Some(audio) = audio else { continue };
             let name = match self.copies.remove(&src.id) {
                 Some((copy, name)) if copy.upgrade().is_some_and(|a| Arc::ptr_eq(&a, audio)) => name,
+                _ if written.contains_key(&Arc::as_ptr(audio)) => written.get(&Arc::as_ptr(audio)).cloned().unwrap_or_default(),
                 _ => {
                     let name = format!("{} {}.wav", sanitize_name(&src.name), self.next);
                     self.next += 1;
@@ -235,13 +239,16 @@ impl Autosave {
             };
             src.path = audio_dir.join(&name).to_string_lossy().into_owned();
             src.unsaved = true;
+            written.insert(Arc::as_ptr(audio), name.clone());
             copies.insert(src.id, (Arc::downgrade(audio), name));
         }
         let text = s.to_json().map_err(|err| EngineError::Io(err.to_string()))?;
         write_atomically(&self.dir.join(ORIGIN), origin.unwrap_or_default().as_bytes())?;
         write_atomically(&self.dir.join(SESSION), text.as_bytes())?;
         for (_, name) in std::mem::replace(&mut self.copies, copies).into_values() {
-            let _ = std::fs::remove_file(audio_dir.join(name));
+            if !self.copies.values().any(|(_, kept)| *kept == name) {
+                let _ = std::fs::remove_file(audio_dir.join(name));
+            }
         }
         if let Some(r) = recording {
             let plan = serde_json::to_string(r).map_err(|err| EngineError::Io(err.to_string()))?;
@@ -507,6 +514,25 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    #[test]
+    fn sources_sharing_one_buffer_share_one_copy() {
+        let dir = folder("autosave-aliases");
+        let mut e = Engine::default();
+        record(&mut e, 0.5);
+        // Nine more source ids over the same decoded audio, as a session file may declare.
+        let s = e.session_mut();
+        let (src, audio) = (s.sources[0].clone(), s.pool.get(s.sources[0].id).cloned().unwrap());
+        for _ in 0..9 {
+            let id = SourceId(s.alloc());
+            s.sources.push(soundcraft_model::Source { id, ..src.clone() });
+            s.pool.insert(id, audio.clone());
+        }
+        let mut a = Autosave::create(&dir.join("Autosave"), "Song").unwrap();
+        a.write(e.session(), None, None).unwrap();
+        assert_eq!(std::fs::read_dir(a.dir.join("Audio Files")).unwrap().count(), 1, "one file for the ten ids");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn a_take_recorded_after_undo_gets_its_own_copy() {
         let dir = folder("autosave-undo");

crates/engine/src/cmd.rs

@@ -347,7 +347,10 @@ pub fn clip_id(p: &Value, cmd: &str) -> Result<ClipId> {
 
 pub fn clip_ids_param(e: &Engine, p: &Value) -> Vec<ClipId> {
     if let Some(arr) = p.get("clips").and_then(Value::as_array) {
-        return arr.iter().filter_map(Value::as_u64).map(ClipId).collect();
+        // Each clip once, in the order given: a repeated id would otherwise be processed (and,
+        // for a render, re-rendered into another source) once per repeat.
+        let mut seen = std::collections::HashSet::new();
+        return arr.iter().filter_map(Value::as_u64).map(ClipId).filter(|id| seen.insert(*id)).collect();
     }
     if let Some(n) = p.get("clip").and_then(Value::as_u64) {
         return vec![ClipId(n)];

crates/engine/src/score.rs

@@ -418,7 +418,9 @@ fn svg_budgeted(parts: &[Part], setup: &ScoreSetup, budget: usize) -> Result<Str
     const STAFF_GAP: f64 = 70.0;
     const SYSTEM_GAP: f64 = 40.0;
     let n_measures = parts.iter().map(|p| p.measures.len()).max().unwrap_or(0);
-    let per = setup.bars_per_system.max(1) as usize;
+    // The layout range the setup offers (1 to 16): a caller's own value can't multiply the
+    // barlines drawn per system beyond it.
+    let per = setup.bars_per_system.clamp(1, 16) as usize;
     let systems = n_measures.div_ceil(per).max(1);
     let label_w = if setup.show_track_names { 70.0 } else { 0.0 };
     let staff_x0 = MARGIN + label_w + 34.0;
@@ -782,6 +784,14 @@ mod tests {
         assert!(m.items.iter().any(|i| i.pitches.is_empty()), "the discarded suffix became rests");
     }
 
+    #[test]
+    fn bars_per_system_is_held_to_the_supported_range() {
+        let setup = ScoreSetup { title: "t".into(), composer: String::new(), bars_per_system: u32::MAX, show_track_names: false };
+        let part = Part { name: "p".into(), bass: false, measures: vec![Measure { numerator: 4, denominator: 4, items: Vec::new() }] };
+        let out = svg_budgeted(std::slice::from_ref(&part), &setup, 1 << 20).unwrap();
+        assert_eq!(out.matches("stroke-width=\"1\"").count(), 16, "sixteen barlines, not billions");
+    }
+
     #[test]
     fn oversized_title_is_refused_by_the_header_check() {
         // An oversized part name/title must be caught by the header check even with no measures:

crates/time/src/tempo.rs

@@ -213,18 +213,52 @@ impl TempoMap {
         }
     }
 
-    /// Remove the meters after `tick`, returning each with the bar it starts.
+    /// Remove the meters after `tick`, returning each with the bar it starts: the bar
+    /// [`Self::bar_beat_at_tick`] gives its tick, counted in one pass over the map rather than one
+    /// walk per meter, so a session with many meter changes edits in linear time.
     fn take_meters_after(&mut self, tick: i64) -> Vec<(i64, MeterEvent)> {
-        let later: Vec<_> = self.meters.iter().filter(|e| e.tick > tick).map(|e| (self.bar_beat_at_tick(e.tick).bar, *e)).collect();
+        let mut later = Vec::new();
+        let (mut bar, mut seg_tick) = (1i64, 0i64);
+        for (i, m) in self.meters.iter().enumerate() {
+            let tpb = m.ticks_per_bar();
+            if m.tick > tick {
+                later.push((bar.saturating_add(m.tick.saturating_sub(seg_tick) / tpb), *m));
+            }
+            if let Some(n) = self.meters.get(i + 1) {
+                bar = bar.saturating_add(ceil_div(n.tick.saturating_sub(seg_tick), tpb));
+                seg_tick = n.tick;
+            }
+        }
         self.meters.retain(|e| e.tick <= tick);
         later
     }
 
+    /// The bar and tick of the last meter's segment, where [`Self::bar_start_tick`]'s walk ends.
+    fn last_segment(&self) -> (i64, i64) {
+        let (mut cur_bar, mut cur_tick) = (1i64, 0i64);
+        for (i, m) in self.meters.iter().enumerate() {
+            if let Some(n) = self.meters.get(i + 1) {
+                cur_bar = cur_bar.saturating_add(ceil_div(n.tick.saturating_sub(cur_tick), m.ticks_per_bar()));
+                cur_tick = n.tick;
+            }
+        }
+        (cur_bar, cur_tick)
+    }
+
     /// Put meters back at the start of their bars under the current earlier meters, in bar order.
+    /// Each lands at or past the last meter, so the walk to its bar resumes from there; a bar
+    /// before it (meters off their bar lines) takes the full walk.
     fn restore_meters_at_bars(&mut self, later: Vec<(i64, MeterEvent)>) {
+        let (mut cur_bar, mut cur_tick) = self.last_segment();
         for (bar, ev) in later {
-            let tick = self.bar_start_tick(bar);
+            let tick = if bar >= cur_bar {
+                let tpb = self.meters.last().map_or(MeterEvent { tick: 0, numerator: 4, denominator: 4 }, |m| *m).ticks_per_bar();
+                cur_tick.saturating_add(bar.saturating_sub(cur_bar).saturating_mul(tpb))
+            } else {
+                self.bar_start_tick(bar)
+            };
             self.put_meter(MeterEvent { tick, ..ev });
+            (cur_bar, cur_tick) = if bar >= cur_bar { (bar, tick) } else { self.last_segment() };
         }
     }
 
@@ -441,6 +475,36 @@ mod tests {
         assert_eq!(m.bar_beat_at_tick(m.tick_at_bar_beat(bb)), bb);
     }
 
+    #[test]
+    fn editing_an_early_meter_keeps_later_bars_and_scales_linearly() {
+        // 200 000 meter changes, one per bar, built directly: a walk per meter would take
+        // minutes to edit here, and even to build through `set_meter`.
+        let mut m = TempoMap::new(120.0, 4, 4).unwrap();
+        let mut tick = 0;
+        for bar in 1..200_000i64 {
+            let numerator = 3 + (bar % 2) as u32;
+            tick += m.meters.last().map_or(0, MeterEvent::ticks_per_bar);
+            m.meters.push(MeterEvent { tick, numerator, denominator: 4 });
+        }
+        let sample = [1usize, 1_000, 199_998];
+        let bars = |m: &TempoMap| sample.map(|i| m.bar_beat_at_tick(m.meters[i].tick).bar);
+        assert_eq!(bars(&m), [2, 1_001, 199_999]);
+        m.set_meter(0, 7, 8).unwrap();
+        assert_eq!(bars(&m), [2, 1_001, 199_999], "later meters keep their bar numbers");
+        assert_eq!(m.meters.len(), 200_000);
+        assert!(m.meters.windows(2).all(|w| w[0].tick < w[1].tick));
+        assert!(m.remove_meter(m.meters[1].tick));
+        assert_eq!([1usize, 999, 199_997].map(|i| m.bar_beat_at_tick(m.meters[i].tick).bar), [3, 1_001, 199_999]);
+        // Meters off their bar lines (counted as bars 2 and 4) land where they always did: on
+        // bar 2 of the new meter, then two bars of their own later.
+        let mut off = TempoMap::new(120.0, 4, 4).unwrap();
+        off.meters.push(MeterEvent { tick: 100, numerator: 3, denominator: 4 });
+        off.meters.push(MeterEvent { tick: 5_000, numerator: 5, denominator: 4 });
+        off.set_meter(0, 2, 4).unwrap();
+        let placed: Vec<(i64, u32)> = off.meters.iter().map(|e| (e.tick, e.numerator)).collect();
+        assert_eq!(placed, vec![(0, 2), (2 * TICKS_PER_QUARTER, 3), (8 * TICKS_PER_QUARTER, 5)]);
+    }
+
     #[test]
     fn eighth_note_meters() {
         let m = TempoMap::new(120.0, 6, 8).unwrap();

crates/ui-egui/Cargo.toml

@@ -24,7 +24,6 @@ soundcraft-video.workspace = true
 # 0.37 makes the bundled faces opt-in; the app's own font loader starts from
 # `FontDefinitions::default()`, and kittest never supplies fonts to this root.
 egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
-egui_extras = { workspace = true }
 web-time.workspace = true
 serde.workspace = true
 serde_json.workspace = true

crates/ui-egui/src/credits.rs

@@ -262,213 +262,71 @@ pub fn contributors_ui(ui: &mut egui::Ui) {
     let list = sorted(CONTRIBUTORS, v.names, v.key, v.ascending);
     ui.label(RichText::new(format!("{} contributors · {} commits", list.len(), group(TOTAL_COMMITS))).small().weak());
     ui.separator();
-    if list.is_empty() {
-        ui.label("No contributor data was built into this copy.");
-    } else if v.table {
-        // The table scrolls vertically itself, under a fixed header; it only scrolls sideways
-        // once its columns are dragged wider than the dialog.
-        egui::ScrollArea::horizontal().auto_shrink([false, false]).show(ui, |ui| table(ui, &list, &mut v));
-    } else {
-        egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+    egui::ScrollArea::both().auto_shrink([false, false]).show(ui, |ui| {
+        if list.is_empty() {
+            ui.label("No contributor data was built into this copy.");
+        } else if v.table {
+            table(ui, &list, &mut v);
+        } else {
             contributors_grab_bag(ui, &list, v.names);
-        });
-    }
+        }
+    });
     ui.data_mut(|d| d.insert_temp(id, v));
 }
 
-/// How the contributor table's spare width is shared out: all of it to Name.
-const CONTRIBUTOR_GROW: [f32; 10] = [1.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0];
-
-/// How the model table's spare width is shared out: to Company and Model, the text columns.
-const MODEL_GROW: [f32; 6] = [1.0, 2.0, 0.0, 0.0, 0.0, 0.0];
-
-/// The narrowest a column can be dragged.
-const MIN_COLUMN: f32 = 28.0;
-
-/// The width a column needs for its header and its widest cell.
-fn natural(ui: &egui::Ui, header: RichText, cells: impl Iterator<Item = String>) -> f32 {
-    let measure = |text: egui::WidgetText| text.into_galley(ui, Some(egui::TextWrapMode::Extend), f32::INFINITY, egui::TextStyle::Body).size().x;
-    let widest = cells.map(|c| measure(c.into())).fold(measure(header.into()), f32::max);
-    widest + 2.0 * ui.spacing().button_padding.x
-}
-
-/// Opening column widths: each column's natural width, with the spare room shared out by `grow`,
-/// so the columns fill `room` exactly. When there is too little room, only the growing columns
-/// give way, each in proportion to its width above [`MIN_COLUMN`], and none goes below that.
-fn fit_widths(natural: &[f32], grow: &[f32], room: f32) -> Vec<f32> {
-    let spare = room - natural.iter().sum::<f32>();
-    let weight = grow.iter().sum::<f32>();
-    let slack = |w: f32| (w - MIN_COLUMN).max(0.0);
-    let flexible: f32 = natural.iter().zip(grow).filter(|(_, g)| **g > 0.0).map(|(w, _)| slack(*w)).sum();
-    natural
-        .iter()
-        .zip(grow)
-        .map(|(w, g)| {
-            if *g > 0.0 && spare >= 0.0 {
-                w + spare * g / weight
-            } else if *g > 0.0 && flexible > 0.0 {
-                w - (-spare).min(flexible) * slack(*w) / flexible
-            } else {
-                *w
-            }
-        })
-        .collect()
-}
-
-/// A striped table whose columns open at [`fit_widths`], so it fills the width and nothing scrolls
-/// sideways. Every column, the last included, can be dragged wider or narrower at its right edge:
-/// only a table dragged wider than the window scrolls sideways. Text too long for its column is
-/// clipped. When a column's natural width or the window changes, the columns go back to a new fit,
-/// dropping any dragged widths.
-fn fitted_table<'a>(ui: &'a mut egui::Ui, id: &str, natural: &[f32], grow: &[f32]) -> egui_extras::TableBuilder<'a> {
-    // Every cell is followed by the item gap, and the vertical scrollbar keeps its margins.
-    let s = ui.spacing();
-    let gaps = s.item_spacing.x * natural.len() as f32;
-    let bar = s.scroll.bar_width + s.scroll.bar_inner_margin + s.scroll.bar_outer_margin;
-    let widths = fit_widths(natural, grow, (ui.available_width() - gaps - bar).max(0.0));
-    // The table keeps its own column widths, so a change in what they were fitted to has to clear
-    // them. A longer name can leave the fit itself unchanged, and scrolling can nudge the available
-    // width, so this compares the natural widths and the clip rect, which scrolling never moves.
-    let fit = egui::Id::unique(("credits_fit", id));
-    let measured = (natural.to_vec(), ui.clip_rect().width());
-    let refit = ui.data_mut(|d| d.get_temp::<(Vec<f32>, f32)>(fit)).as_ref() != Some(&measured);
-    ui.data_mut(|d| d.insert_temp(fit, measured));
-    let mut t =
-        egui_extras::TableBuilder::new(ui).id_salt(id).striped(true).resizable(true).auto_shrink([false, false]).max_scroll_height(f32::INFINITY);
-    if refit {
-        t.reset();
-    }
-    for w in widths {
-        t = t.column(egui_extras::Column::initial(w).at_least(MIN_COLUMN).clip(true));
-    }
-    t
-}
-
-/// Add a cell's widget right-aligned (counts, dates) or left-aligned (names), vertically centred.
-fn aligned<R>(ui: &mut egui::Ui, right: bool, add: impl FnOnce(&mut egui::Ui) -> R) -> R {
-    let layout = if right { egui::Layout::right_to_left(egui::Align::Center) } else { egui::Layout::left_to_right(egui::Align::Center) };
-    ui.with_layout(layout, add).inner
-}
-
-fn row_height(ui: &egui::Ui) -> f32 {
-    ui.text_style_height(&egui::TextStyle::Body) + 6.0
-}
-
-/// One contributor's table cells after the name, in `SortKey::ALL` order.
-fn cells(c: &Contributor) -> [String; 9] {
-    [
-        group(c.prs),
-        group(c.commits),
-        group(c.lines_added),
-        group(c.lines_deleted),
-        signed(c.lines_delta()),
-        group(c.binary_added),
-        group(c.binary_deleted),
-        day(c.first_commit).to_string(),
-        day(c.last_commit).to_string(),
-    ]
-}
-
-/// A contributor-table header. The sorted column is highlighted; its direction shows on the
-/// toolbar's sort-order button, so no arrow widens the column.
-fn header_text(k: SortKey) -> RichText {
-    RichText::new(k.label().1).strong()
-}
-
 fn table(ui: &mut egui::Ui, list: &[&Contributor], v: &mut View) {
-    let h = row_height(ui);
-    let rows: Vec<[String; 9]> = list.iter().map(|c| cells(c)).collect();
-    let widths: Vec<f32> = SortKey::ALL
-        .iter()
-        .enumerate()
-        .map(|(i, &k)| match i.checked_sub(1) {
-            None => natural(ui, header_text(k), list.iter().map(|c| c.name(v.names))),
-            Some(col) => natural(ui, header_text(k), rows.iter().filter_map(|r| r.get(col).cloned())),
-        })
-        .collect();
-    fitted_table(ui, "credits_table", &widths, &CONTRIBUTOR_GROW)
-        .header(h + 4.0, |mut header| {
-            for k in SortKey::ALL {
-                header.col(|ui| {
-                    let r = aligned(ui, k != SortKey::Name, |ui| ui.selectable_label(v.key == k, header_text(k))).on_hover_text(k.label().0);
-
-                    if r.clicked() {
-                        if v.key == k {
-                            v.ascending = !v.ascending;
-                        } else {
-                            v.key = k;
-                            v.ascending = k.default_ascending();
-                        }
-                    }
-                });
+    egui::Grid::new("credits_table").striped(true).num_columns(SortKey::ALL.len()).show(ui, |ui| {
+        for k in SortKey::ALL {
+            let arrow = if v.key == k { if v.ascending { " ⏶" } else { " ⏷" } } else { "" };
+            if ui.button(RichText::new(format!("{}{arrow}", k.label().1)).strong()).on_hover_text(k.label().0).clicked() {
+                if v.key == k {
+                    v.ascending = !v.ascending;
+                } else {
+                    v.key = k;
+                    v.ascending = k.default_ascending();
+                }
             }
-        })
-        .body(|mut body| {
-            for (c, cells) in list.iter().zip(rows) {
-                body.row(h, |mut row| {
-                    row.col(|ui| {
-                        aligned(ui, false, |ui| ui.hyperlink_to(c.name(v.names), format!("https://github.com/{}", c.login)))
-                            .on_hover_text(c.summary());
-                    });
-                    for text in cells {
-                        row.col(|ui| {
-                            aligned(ui, true, |ui| ui.label(text));
-                        });
-                    }
-                });
-            }
-        });
+        }
+        ui.end_row();
+        for c in list {
+            ui.hyperlink_to(c.name(v.names), format!("https://github.com/{}", c.login)).on_hover_text(c.summary());
+            ui.label(group(c.prs));
+            ui.label(group(c.commits));
+            ui.label(group(c.lines_added));
+            ui.label(group(c.lines_deleted));
+            ui.label(signed(c.lines_delta()));
+            ui.label(group(c.binary_added));
+            ui.label(group(c.binary_deleted));
+            ui.label(day(c.first_commit));
+            ui.label(day(c.last_commit));
+            ui.end_row();
+        }
+    });
 }
 
-/// About ▸ Models: AI models credited in Co-Authored-By trailers.
+/// About › Models: AI models credited in Co-Authored-By trailers.
 pub fn models_ui(ui: &mut egui::Ui) {
     if MODELS.is_empty() {
         ui.label("No model credits were built into this copy.");
         return;
     }
     let assisted: u64 = MODELS.iter().map(|m| m.commits).max().unwrap_or(0).max(1);
-    let h = row_height(ui);
-    let titles = ["Company", "Model", "Version", "Commits", "% of all commits", "Lines +/−"];
-    // Company, Model and Version read as text; the counts line up on the right.
-    let right = [false, false, false, true, true, true];
-    let rows: Vec<[String; 6]> = MODELS
-        .iter()
-        .map(|m| {
-            [
-                m.company.to_string(),
-                m.model.to_string(),
-                m.version.to_string(),
-                group(m.commits),
-                format!("{:.0}%", 100.0 * m.commits as f64 / TOTAL_COMMITS.max(assisted) as f64),
-                format!("+{} / −{}", group(m.lines_added), group(m.lines_deleted)),
-            ]
-        })
-        .collect();
-    let widths: Vec<f32> = titles
-        .iter()
-        .enumerate()
-        .map(|(i, title)| natural(ui, RichText::new(*title).strong(), rows.iter().filter_map(|r| r.get(i).cloned())))
-        .collect();
-    egui::ScrollArea::horizontal().id_salt("credits_models").auto_shrink([false, false]).show(ui, |ui| {
-        fitted_table(ui, "credits_models", &widths, &MODEL_GROW)
-            .header(h + 4.0, |mut header| {
-                for (title, r) in titles.into_iter().zip(right) {
-                    header.col(|ui| {
-                        aligned(ui, r, |ui| ui.label(RichText::new(title).strong()));
-                    });
-                }
-            })
-            .body(|mut body| {
-                for cells in rows {
-                    body.row(h, |mut row| {
-                        for (text, r) in cells.into_iter().zip(right) {
-                            row.col(|ui| {
-                                aligned(ui, r, |ui| ui.label(text));
-                            });
-                        }
-                    });
-                }
-            });
+    egui::ScrollArea::both().auto_shrink([false, false]).show(ui, |ui| {
+        egui::Grid::new("credits_models").striped(true).num_columns(6).show(ui, |ui| {
+            for h in ["Company", "Model", "Version", "Commits", "% of all commits", "Lines +/−"] {
+                ui.label(RichText::new(h).strong());
+            }
+            ui.end_row();
+            for m in MODELS {
+                ui.label(m.company);
+                ui.label(m.model);
+                ui.label(m.version);
+                ui.label(group(m.commits));
+                ui.label(format!("{:.0}%", 100.0 * m.commits as f64 / TOTAL_COMMITS.max(assisted) as f64));
+                ui.label(format!("+{} / −{}", group(m.lines_added), group(m.lines_deleted)));
+                ui.end_row();
+            }
+        });
     });
 }
 
@@ -548,131 +406,4 @@ mod tests {
         assert_eq!(day("2026-10-07T18:45:23Z"), "2026-10-07");
         assert_eq!(day(""), "—");
     }
-
-    #[test]
-    fn columns_fill_the_room_and_spare_width_goes_to_growing_columns() {
-        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 300.0), [200.0, 40.0, 60.0]);
-        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 2.0, 0.0], 230.0), [110.0, 60.0, 60.0]);
-        let w = fit_widths(&[123.0, 45.5, 67.25], &[1.0, 0.0, 2.0], 512.0);
-        assert!((w.iter().sum::<f32>() - 512.0).abs() < 0.01, "a fitted table neither scrolls nor leaves a gap: {w:?}");
-    }
-
-    #[test]
-    fn too_little_room_shrinks_only_growing_columns() {
-        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 150.0), [50.0, 40.0, 60.0]);
-        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 0.0), [MIN_COLUMN, 40.0, 60.0]);
-        assert_eq!(fit_widths(&[100.0, 40.0], &[0.0, 0.0], 50.0), [100.0, 40.0]);
-    }
-
-    #[test]
-    fn a_column_at_the_minimum_leaves_the_shortfall_to_the_others() {
-        let w = fit_widths(&[100.0, 300.0, 50.0], &[1.0, 1.0, 0.0], 140.0);
-        assert!((w.iter().sum::<f32>() - 140.0).abs() < 0.01, "the columns still fit the room: {w:?}");
-        assert!(w.iter().all(|c| *c >= MIN_COLUMN), "no column goes below the minimum: {w:?}");
-        assert_eq!(fit_widths(&[100.0, 300.0, 50.0], &[1.0, 1.0, 0.0], 0.0), [MIN_COLUMN, MIN_COLUMN, 50.0]);
-    }
-
-    const WINDOW: f32 = 640.5;
-    const NATURAL: [f32; 3] = [120.0, 80.0, 80.0];
-    const GROW: [f32; 3] = [1.0, 0.0, 0.0];
-
-    /// One frame of a table long enough to scroll; the rects of its header cells.
-    fn table_frame(ctx: &egui::Context, width: f32, natural: &[f32], events: Vec<egui::Event>) -> Vec<egui::Rect> {
-        scrolled_frame(ctx, width, natural, 0.0, events)
-    }
-
-    /// [`table_frame`], scrolled `offset` points sideways.
-    fn scrolled_frame(ctx: &egui::Context, width: f32, natural: &[f32], offset: f32, events: Vec<egui::Event>) -> Vec<egui::Rect> {
-        let screen_rect = Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(width, 300.0)));
-        let raw = egui::RawInput { screen_rect, events, ..Default::default() };
-        let mut cells = Vec::new();
-        let out = ctx.run_ui(raw, |ui| {
-            cells.clear();
-            egui::ScrollArea::horizontal().auto_shrink([false, false]).horizontal_scroll_offset(offset).show(ui, |ui| {
-                fitted_table(ui, "test", natural, &GROW)
-                    .header(20.0, |mut header| {
-                        for _ in natural {
-                            header.col(|ui| cells.push(ui.max_rect()));
-                        }
-                    })
-                    .body(|mut body| {
-                        for _ in 0..40 {
-                            body.row(20.0, |mut row| {
-                                for _ in natural {
-                                    row.col(|ui| {
-                                        ui.label("x");
-                                    });
-                                }
-                            });
-                        }
-                    });
-            });
-        });
-        out.drop_without_applying_deltas();
-        cells
-    }
-
-    /// A new context with the table open and settled, and the rects of its header cells.
-    fn opened_table() -> (egui::Context, Vec<egui::Rect>) {
-        let ctx = egui::Context::default();
-        table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-        let cells = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-        (ctx, cells)
-    }
-
-    /// Drags a column's right edge, which runs midway through the gap after `cell`, then lets go.
-    fn drag_edge(ctx: &egui::Context, cell: egui::Rect, by: f32) {
-        use egui::{Event, Modifiers, PointerButton};
-        let start = egui::pos2(cell.right() + 4.0, cell.center().y);
-        let halfway = start + egui::vec2(by / 2.0, 0.0);
-        let end = start + egui::vec2(by, 0.0);
-        let moved = Event::PointerMoved;
-        let button = |pos, pressed| Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
-        for event in [moved(start), button(start, true), moved(halfway), moved(end), button(end, false)] {
-            table_frame(ctx, WINDOW, &NATURAL, vec![event]);
-        }
-    }
-
-    #[test]
-    fn every_column_can_be_dragged_at_its_right_edge_and_stays_there() {
-        let (_, opened) = opened_table();
-        for (dragged, cell) in opened.iter().enumerate() {
-            let (ctx, _) = opened_table();
-            drag_edge(&ctx, *cell, -30.0);
-            table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-            let after = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-            for (column, (was, now)) in opened.iter().zip(&after).enumerate() {
-                let want = if column == dragged { was.width() - 30.0 } else { was.width() };
-                assert!((now.width() - want).abs() < 1.0, "dragging column {dragged}: column {column} is {now:?}, was {was:?}");
-            }
-        }
-    }
-
-    #[test]
-    fn a_changed_fit_replaces_the_column_widths() {
-        let (ctx, opened) = opened_table();
-        drag_edge(&ctx, opened[0], -30.0);
-        let longer_name = table_frame(&ctx, WINDOW, &[200.0, 80.0, 80.0], Vec::new());
-        assert!((longer_name[0].width() - opened[0].width()).abs() < 1.0, "a longer name drops a dragged width: {longer_name:?}");
-        let wider = table_frame(&ctx, WINDOW, &[120.0, 200.0, 80.0], Vec::new());
-        let widths: Vec<f32> = wider.iter().map(|c| c.width().round()).collect();
-        assert!(widths.ends_with(&[200.0, 80.0]), "a longer cell widens its column: {widths:?}");
-        assert!(wider[2].right() < WINDOW, "the table still fits the window: {wider:?}");
-        let narrower = table_frame(&ctx, 400.0, &NATURAL, Vec::new());
-        assert!(narrower[2].right() < 400.0, "a narrower window refits the table: {narrower:?}");
-    }
-
-    #[test]
-    fn scrolling_sideways_keeps_dragged_widths() {
-        let (ctx, opened) = opened_table();
-        drag_edge(&ctx, opened[0], 100.0);
-        table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-        let dragged = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-        assert!((dragged[0].width() - opened[0].width() - 100.0).abs() < 1.0, "the drag took: {dragged:?}");
-        for offset in [13.3, 27.77, 41.1, 0.6] {
-            scrolled_frame(&ctx, WINDOW, &NATURAL, offset, Vec::new());
-            let scrolled = scrolled_frame(&ctx, WINDOW, &NATURAL, offset, Vec::new());
-            assert!((scrolled[0].width() - dragged[0].width()).abs() < 1.0, "scrolled {offset}: {scrolled:?}");
-        }
-    }
 }

crates/ui-egui/src/panels/about.rs

@@ -7,7 +7,7 @@ pub(super) fn about(app: &mut SoundApp, ctx: &egui::Context) {
         return;
     }
     let tab_id = egui::Id::unique("about_tab");
-    egui::Window::new("About SoundCraft").open(&mut open).default_size(vec2(820.0, 420.0)).collapsible(false).show(ctx, |ui| {
+    egui::Window::new("About SoundCraft").open(&mut open).default_size(vec2(640.0, 420.0)).collapsible(false).show(ctx, |ui| {
         let mut tab = ui.data_mut(|d| d.get_temp::<u8>(tab_id)).unwrap_or(0);
         ui.horizontal(|ui| {
             for (i, l) in (0u8..).zip(["About", "Contributors", "Models"]) {

crates/video/src/h264/dpb.rs

@@ -72,6 +72,22 @@ impl Dpb {
         self.entries.retain(|e| e.needed_for_output || e.mark != RefMark::Unused);
     }
 
+    /// Make room for a picture: output one (C.4.5.3), or, when none waits for output and
+    /// references alone fill the DPB (marking that keeps more than it holds), drop the reference
+    /// decoded longest ago. False when the DPB is empty.
+    fn make_room(&mut self, out: &mut Vec<Output>) -> bool {
+        if self.bump(out) {
+            return true;
+        }
+        let Some(i) = self.entries.iter().enumerate().filter(|(_, e)| e.mark != RefMark::Unused).min_by_key(|(_, e)| e.frame.id).map(|(i, _)| i)
+        else {
+            return false;
+        };
+        self.entries[i].mark = RefMark::Unused;
+        self.prune();
+        true
+    }
+
     /// Output the picture with the smallest POC (C.4.5.3 "bumping"). Returns false if none waits.
     fn bump(&mut self, out: &mut Vec<Output>) -> bool {
         let Some(i) = self.entries.iter().enumerate().filter(|(_, e)| e.needed_for_output).min_by_key(|(_, e)| e.poc).map(|(i, _)| i) else {
@@ -134,21 +150,29 @@ impl Dpb {
         poc_state: &mut dyn FnMut(u32),
     ) {
         let mut unused = (prev_ref_frame_num + 1) % max_frame_num;
+        // Only the last `max_num_ref_frames` missing frames can still be references when the gap
+        // ends: the sliding window drops the earlier ones first, so building their pictures would
+        // be work (up to 65 535 frame copies from one slice header) thrown straight away. They
+        // advance the POC state only.
+        let gap = (frame_num + max_frame_num - unused) % max_frame_num;
+        let skip = gap.saturating_sub(u32::try_from(max_num_ref_frames.max(1)).unwrap_or(u32::MAX));
         let mut guard = 0;
         while unused != frame_num && guard < max_frame_num {
-            self.sliding_window(unused, max_frame_num, max_num_ref_frames);
-            let (frame, meta) = make_frame(unused);
             poc_state(unused);
-            self.entries.push(DpbEntry {
-                poc: frame.poc,
-                frame,
-                frame_num: unused,
-                long_term_frame_idx: 0,
-                mark: RefMark::Short,
-                needed_for_output: false,
-                non_existing: true,
-                meta,
-            });
+            if guard >= skip {
+                self.sliding_window(unused, max_frame_num, max_num_ref_frames);
+                let (frame, meta) = make_frame(unused);
+                self.entries.push(DpbEntry {
+                    poc: frame.poc,
+                    frame,
+                    frame_num: unused,
+                    long_term_frame_idx: 0,
+                    mark: RefMark::Short,
+                    needed_for_output: false,
+                    non_existing: true,
+                    meta,
+                });
+            }
             unused = (unused + 1) % max_frame_num;
             guard += 1;
         }
@@ -277,6 +301,11 @@ impl Dpb {
                         }
                     }
                 }
+                3 | 6 if self.max_long_term_frame_idx.is_none_or(|max| m.long_term_frame_idx > max) => {
+                    // A long-term index outside what MMCO 4 (or the IDR) allowed (8.2.5.4.3): a
+                    // conforming stream never sends one, and honouring it would let distinct
+                    // indices retain references past the DPB's capacity.
+                }
                 3 => {
                     let pn = i64::from(curr_pic_num) - (i64::from(m.difference_of_pic_nums_minus1) + 1);
                     for e in &mut self.entries {
@@ -384,13 +413,13 @@ impl Dpb {
                     out.push(Output { frame, poc, meta });
                     return;
                 }
-                if !self.bump(out) {
+                if !self.make_room(out) {
                     break;
                 }
             }
         } else {
             while self.entries.len() >= self.capacity {
-                if !self.bump(out) {
+                if !self.make_room(out) {
                     break;
                 }
             }
@@ -429,6 +458,98 @@ mod tests {
         Mmco { op, difference_of_pic_nums_minus1: diff, long_term_pic_num: 0, long_term_frame_idx: 0, max_long_term_frame_idx_plus1: 0 }
     }
 
+    fn frame(id: u32) -> (FrameRef, Arc<OutputMeta>) {
+        let meta = OutputMeta {
+            pts: 0,
+            key: false,
+            crop: (0, 0, 0, 0),
+            full_range: false,
+            colour_primaries: 0,
+            transfer_characteristics: 0,
+            matrix_coefficients: 0,
+            sar: (1, 1),
+            draft: false,
+        };
+        (Arc::new(crate::h264::picture::Frame::new(id, 0, 1, 1)), Arc::new(meta))
+    }
+
+    /// A P slice header of a reference picture, with nothing else set.
+    fn reference_slice() -> SliceHeader {
+        SliceHeader {
+            nal_ref_idc: 1,
+            nal_unit_type: 1,
+            idr: false,
+            first_mb_in_slice: 0,
+            slice_type_raw: 0,
+            slice_type: SliceType::P,
+            pps_id: 0,
+            colour_plane_id: 0,
+            frame_num: 0,
+            field_pic: false,
+            bottom_field: false,
+            idr_pic_id: 0,
+            pic_order_cnt_lsb: 0,
+            delta_pic_order_cnt_bottom: 0,
+            delta_pic_order_cnt: [0; 2],
+            redundant_pic_cnt: 0,
+            direct_spatial_mv_pred: false,
+            num_ref_idx_active: [1, 0],
+            ref_pic_list_mod: [Vec::new(), Vec::new()],
+            pred_weight_table: None,
+            no_output_of_prior_pics: false,
+            long_term_reference: false,
+            adaptive_ref_pic_marking: false,
+            mmcos: Vec::new(),
+            cabac_init_idc: 0,
+            slice_qp_delta: 0,
+            sp_for_switch: false,
+            slice_qs_delta: 0,
+            disable_deblocking_filter_idc: 0,
+            slice_alpha_c0_offset_div2: 0,
+            slice_beta_offset_div2: 0,
+            slice_group_change_cycle: 0,
+            header_bits: 0,
+        }
+    }
+
+    #[test]
+    fn a_frame_num_gap_builds_only_the_frames_that_stay_references() {
+        let mut dpb = Dpb::new();
+        let (mut built, mut poc_updates) = (Vec::new(), 0u32);
+        // frame_num 0 was the last reference; the next slice says 60_000: 59 999 missing frames.
+        dpb.fill_frame_num_gap(0, 60_000, 1 << 16, 4, &mut |n| (built.push(n), frame(n)).1, &mut |_| poc_updates += 1);
+        assert_eq!(poc_updates, 59_999, "every missing frame advances the POC state");
+        assert_eq!(built, vec![59_996, 59_997, 59_998, 59_999], "only the ones the sliding window would keep are built");
+        assert_eq!(dpb.entries.iter().map(|e| e.frame_num).collect::<Vec<_>>(), built);
+        // A gap shorter than the window builds every frame, as before.
+        let mut dpb = Dpb::new();
+        let mut built = Vec::new();
+        dpb.fill_frame_num_gap(7, 10, 16, 4, &mut |n| (built.push(n), frame(n)).1, &mut |_| {});
+        assert_eq!(built, vec![8, 9]);
+    }
+
+    #[test]
+    fn long_term_marking_cannot_grow_the_dpb_past_its_capacity() {
+        let mut dpb = Dpb::new();
+        dpb.capacity = 4;
+        let mut out = Vec::new();
+        let mut sh = SliceHeader { adaptive_ref_pic_marking: true, ..reference_slice() };
+        // Each picture takes a distinct long-term index, after MMCO 4 allowed 1000 of them.
+        for n in 0..40u32 {
+            sh.frame_num = n;
+            sh.mmcos = vec![Mmco { op: 4, max_long_term_frame_idx_plus1: 1000, ..mmco(0, 0) }, Mmco { op: 6, long_term_frame_idx: n, ..mmco(0, 0) }];
+            let (f, meta) = frame(n);
+            dpb.store_picture(&sh, f, n as i32, 1 << 16, 16, meta, &mut out);
+            assert!(dpb.entries.len() <= 4, "{} entries after picture {n}", dpb.entries.len());
+        }
+        // An index past what MMCO 4 allowed is ignored: the picture is a short-term reference.
+        sh.frame_num = 40;
+        sh.mmcos = vec![Mmco { op: 6, long_term_frame_idx: 5000, ..mmco(0, 0) }];
+        let (f, meta) = frame(40);
+        dpb.store_picture(&sh, f, 40, 1 << 16, 16, meta, &mut out);
+        assert_eq!(dpb.entries.iter().find(|e| e.frame_num == 40).map(|e| e.mark), Some(RefMark::Short));
+    }
+
     #[test]
     fn mmco_huge_difference_does_not_panic() {
         for op in [1, 3] {

crates/video/src/h264/params.rs

@@ -397,6 +397,10 @@ impl Sps {
         let pic_height_in_map_units = plus(r.read_ue()?, 1, "picture too large")?;
         ensure!(pic_width_in_mbs <= 1024 && pic_height_in_map_units <= 1024, "picture too large");
         let frame_mbs_only = r.read_flag()?;
+        // Picture state is allocated from these before any macroblock is read: the movie's pixel
+        // budget applies here too, so a 16 384-square SPS can't claim its planes.
+        let coded_mbs = u64::from(pic_width_in_mbs) * u64::from(pic_height_in_map_units) * if frame_mbs_only { 1 } else { 2 };
+        ensure!(coded_mbs * 256 <= crate::movie::MAX_PIXELS, "picture too large");
         let mb_adaptive_frame_field = if !frame_mbs_only { r.read_flag()? } else { false };
         let direct_8x8_inference = r.read_flag()?;
         let frame_crop = if r.read_flag()? { Some((r.read_ue()?, r.read_ue()?, r.read_ue()?, r.read_ue()?)) } else { None };
@@ -699,6 +703,37 @@ mod tests {
         assert_eq!(l, [10; 16]);
     }
 
+    #[test]
+    fn an_sps_past_the_pixel_budget_is_refused_before_allocation() {
+        // As `parse_minimal_baseline_sps`, with `mbs` × `mbs` macroblocks.
+        let sps = |mbs: u32, frame_mbs_only: bool| {
+            let mut w = BitWriter::new();
+            w.write_bits(66, 8);
+            w.write_bits(0xC0, 8);
+            w.write_bits(30, 8);
+            w.write_ue(0);
+            w.write_ue(0);
+            w.write_ue(2);
+            w.write_ue(1);
+            w.write_bit(false);
+            w.write_ue(mbs - 1);
+            w.write_ue(mbs - 1);
+            w.write_bit(frame_mbs_only);
+            if !frame_mbs_only {
+                w.write_bit(false); // mb_adaptive_frame_field
+            }
+            w.write_bit(true);
+            w.write_bit(false);
+            w.write_bit(false);
+            w.rbsp_trailing();
+            Sps::parse(&w.finish())
+        };
+        assert!(sps(512, true).is_ok(), "8192 × 8192 is the budget");
+        assert!(sps(513, true).is_err(), "one macroblock column more is past it");
+        assert!(sps(512, false).is_err(), "field pictures double the map units");
+        assert!(sps(362, false).is_ok());
+    }
+
     #[test]
     fn parse_minimal_baseline_sps() {
         // profile 66, level 30, sps_id 0, log2_max_frame_num_minus4 0, poc type 2, 1 ref, 11x9 MBs.

xtask/src/version.rs

@@ -197,8 +197,11 @@ mod tests {
 
     #[test]
     fn a_failed_update_restores_the_manifest() {
-        let root = std::env::temp_dir().join(format!("xtask-version-restore-{}", std::process::id()));
-        std::fs::create_dir_all(&root).unwrap();
+        // Created exclusively: a folder already there (planted, or left by a failed run) would be
+        // someone else's, and a link inside it could redirect the writes below.
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.subsec_nanos());
+        let root = std::env::temp_dir().join(format!("xtask-version-restore-{}-{nanos}", std::process::id()));
+        std::fs::create_dir(&root).unwrap();
         let path = root.join("Cargo.toml");
         std::fs::write(&path, MANIFEST).unwrap();
         let err = set(&root, &path, MANIFEST, "2.0.0", || Err("cargo update failed".into())).unwrap_err();