ci: verify the actions lockfile in CI

Fails the build when .github/workflows/actions.lock stops matching the workflows, or when a locked pin no longer verifies upstream, so a stale or tampered lockfile cannot go unnoticed between dependency updates.
ci: lock workflow actions through an actions.lock lockfile
2026-11-12 08:53:41 -06:00 · 2026-11-12 07:23:19 -05:00 · 2026-11-12 07:18:10 -05:00 · 2026-11-11 19:51:41 -05:00 · 2026-11-11 19:16:01 -05:00 · 2026-11-11 18:46:56 -05:00
148 changed files with 1842 additions and 6810 deletions
@@ -0,0 +1,32 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ast-grep.yml': []
+    '.github/workflows/ci.yml': []
+    '.github/workflows/freebsd.yml': []
+    '.github/workflows/house-rules.yml': []
+    '.github/workflows/lockfile.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.4'
+    '.github/workflows/nix.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.4'
+    '.github/workflows/packaging-lint.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.4'
+    '.github/workflows/release.yml': []
+    '.github/workflows/sonarcloud.yml': []
+    '.github/workflows/windows-arm64.yml': []
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'step-security/harden-runner@v2.22.4':
+        ref: 'v2.22.4'
+        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
+        owner_id: 88700172
+        repo_id: 422287306
@@ -0,0 +1,34 @@
+name: Lockfile
+
+# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
+# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
+# Docs: https://gh.io/actions-lockfile
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  lockfile:
+    name: Lockfile is in sync
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.4
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install gh-actions-lock
+        run: gh extension install github/gh-actions-lock --pin v0.4.1
+      - name: Verify the lockfile
+        run: gh actions-lock --verify
@@ -28,10 +28,10 @@ jobs:
    timeout-minutes: 5
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        uses: step-security/harden-runner@v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
      - name: Git dependencies come from storytold
        run: |
          set -euo pipefail
@@ -28,10 +28,10 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        uses: step-security/harden-runner@v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false
      - name: Install the pinned packaging toolchain
@@ -1,6 +1,10 @@
 name: Release

 on:
+  # A nightly dry run on main: every release build except macOS, nothing signed or released
+  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
+  schedule:
+    - cron: "36 2 * * *"
  push:
    branches: [release]
  workflow_dispatch:
@@ -30,6 +34,7 @@ jobs:
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
    with:
+      dry-run: ${{ github.event_name == 'schedule' }}
      app-name: soundcraft
      app-title: SoundCraft
      version: ${{ inputs.version }}
@@ -86,7 +86,7 @@ People trust SoundCraft with their recordings; a crash loses takes. **This outra
 ## Architecture (layers enforced by `cargo xtask layers`)
 | Layer | Crate | Role |
 |---|---|---|
-| L0 | `soundcraft-time`, `soundcraft-audio-io`, `soundcraft-midi` | Timebases/tempo/grid; audio file formats + peaks; Standard MIDI Files + MIDI ops |
+| L0 | `soundcraft-time`, `soundcraft-midi` | Timebases/tempo/grid; Standard MIDI Files + MIDI ops |
 | L1 | `soundcraft-dsp` | Plugins (EQ, dynamics, reverb, delay, modulation, harmonic, pitch, utility, instruments), offline processing, meters, FFT |
 | L2 | `soundcraft-model` | The session document (tracks, playlists, clips, mixer, routing, automation, markers, groups) |
 | L3 | `soundcraft-mix` | Mix engine shared by realtime playback and offline bounce |
@@ -95,6 +95,8 @@ People trust SoundCraft with their recordings; a crash loses takes. **This outra
 | L6 | `soundcraft-ui-egui` | The swappable UI (egui) |
 | apps | `soundcraft`, `soundcraft-cli`, `soundcraft-web` | Entry points |

+Audio file formats, codecs and waveform peaks are not a SoundCraft crate: they come from `craft-audio` in `storytold/craft-libs`, which every Craft app shares. Fix or extend a format there, never in a local copy; SoundCraft keeps only the mapping onto its session model (`soundcraft_model::FileFormat`).
+
 Nothing below L6 depends on egui/eframe/winit/rfd. The UI is thin: panels read engine state and act through `engine.execute(id, params)`.

 ## Everything is a command
@@ -55,4 +55,3 @@ here. The subset uses default_fonts; the parent face uses monochrome_emoji_fonts
 | `assets/app-icon/soundcraft.ico` | SoundCraft contributors | original, rendered from `icon.svg` | MIT OR Apache-2.0 |
 | `assets/app-icon/hicolor/` | SoundCraft contributors | original, rendered from `icon.svg` (16–512 px PNGs and the scalable SVG) | MIT OR Apache-2.0 |
 | `docs/images/` | SoundCraft contributors | screenshots of SoundCraft rendered from the synthesised demo session | MIT OR Apache-2.0 |
-| `crates/audio-io/tests/fixtures/` | SoundCraft contributors | original test tones and silence generated with ffmpeg (sine) or by hand; commands in `crates/audio-io/tests/fixtures/README.md` | MIT OR Apache-2.0 |
@@ -1061,6 +1061,18 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "craft-audio"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=7db4645d1f1673df3b064de32faa3335bcdd7aed#7db4645d1f1673df3b064de32faa3335bcdd7aed"
+dependencies = [
+ "craft-media",
+ "log",
+ "serde",
+ "symphonia",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
@@ -1097,8 +1109,18 @@ dependencies = [
 [[package]]
 name = "craft-media"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=6e03f65bf45181db77ba6229716e6624db9eb25b#6e03f65bf45181db77ba6229716e6624db9eb25b"
+source = "git+https://github.com/storytold/craft-libs?rev=7db4645d1f1673df3b064de32faa3335bcdd7aed#7db4645d1f1673df3b064de32faa3335bcdd7aed"
 dependencies = [
+ "serde",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "craft-midi"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=7db4645d1f1673df3b064de32faa3335bcdd7aed#7db4645d1f1673df3b064de32faa3335bcdd7aed"
+dependencies = [
+ "serde",
 "thiserror 2.0.21",
 ]

@@ -4331,10 +4353,11 @@ dependencies = [

 [[package]]
 name = "soundcraft"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "chrono",
 "clap",
+ "craft-audio",
 "craft-update",
 "eframe",
 "egui",
@@ -4344,7 +4367,6 @@ dependencies = [
 "objc2-app-kit 0.3.2",
 "rfd",
 "serde_json",
- "soundcraft-audio-io",
 "soundcraft-automation",
 "soundcraft-engine",
 "soundcraft-playback",
@@ -4355,7 +4377,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-au-host"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "log",
 "serde",
@@ -4363,26 +4385,14 @@ dependencies = [
 "thiserror 2.0.21",
 ]

-[[package]]
-name = "soundcraft-audio-io"
-version = "0.17.0"
-dependencies = [
- "log",
- "proptest",
- "serde",
- "serde_json",
- "symphonia",
- "thiserror 2.0.21",
-]
-
 [[package]]
 name = "soundcraft-automation"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "clap",
+ "craft-audio",
 "log",
 "serde_json",
- "soundcraft-audio-io",
 "soundcraft-engine",
 "soundcraft-time",
 "thiserror 2.0.21",
@@ -4390,7 +4400,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-clap-host"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "clap-sys",
 "libloading 0.9.0",
@@ -4403,16 +4413,16 @@ dependencies = [

 [[package]]
 name = "soundcraft-cli"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "clap",
 "clap_complete",
 "clap_mangen",
+ "craft-audio",
 "log",
 "same-file",
 "serde",
 "serde_json",
- "soundcraft-audio-io",
 "soundcraft-automation",
 "soundcraft-dsp",
 "soundcraft-engine",
@@ -4421,7 +4431,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-dsp"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "log",
 "proptest",
@@ -4432,15 +4442,15 @@ dependencies = [

 [[package]]
 name = "soundcraft-engine"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
+ "craft-audio",
 "craft-docpath",
 "log",
 "proptest",
 "serde",
 "serde_json",
 "soundcraft-au-host",
- "soundcraft-audio-io",
 "soundcraft-clap-host",
 "soundcraft-dsp",
 "soundcraft-midi",
@@ -4450,27 +4460,26 @@ dependencies = [
 "soundcraft-video",
 "soundcraft-vst3-host",
 "thiserror 2.0.21",
+ "winsafe",
 "zip",
 ]

 [[package]]
 name = "soundcraft-midi"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
+ "craft-midi",
 "proptest",
- "serde",
- "serde_json",
- "thiserror 2.0.21",
 ]

 [[package]]
 name = "soundcraft-mix"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
+ "craft-audio",
 "log",
 "rayon",
 "soundcraft-au-host",
- "soundcraft-audio-io",
 "soundcraft-clap-host",
 "soundcraft-dsp",
 "soundcraft-midi",
@@ -4481,12 +4490,12 @@ dependencies = [

 [[package]]
 name = "soundcraft-model"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
+ "craft-audio",
 "proptest",
 "serde",
 "serde_json",
- "soundcraft-audio-io",
 "soundcraft-midi",
 "soundcraft-time",
 "thiserror 2.0.21",
@@ -4494,13 +4503,13 @@ dependencies = [

 [[package]]
 name = "soundcraft-playback"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "cpal",
+ "craft-audio",
 "log",
 "serde",
 "serde_json",
- "soundcraft-audio-io",
 "soundcraft-dsp",
 "soundcraft-mix",
 "soundcraft-model",
@@ -4509,7 +4518,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-time"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "proptest",
 "serde",
@@ -4519,8 +4528,9 @@ dependencies = [

 [[package]]
 name = "soundcraft-ui-egui"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
+ "craft-audio",
 "craft-ui",
 "craft-update",
 "egui",
@@ -4531,7 +4541,6 @@ dependencies = [
 "serde",
 "serde_json",
 "soundcraft-au-host",
- "soundcraft-audio-io",
 "soundcraft-clap-host",
 "soundcraft-dsp",
 "soundcraft-engine",
@@ -4549,7 +4558,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-video"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "craft-media",
 "image",
@@ -4561,7 +4570,7 @@ dependencies = [

 [[package]]
 name = "soundcraft-vst3-host"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "libloading 0.9.0",
 "log",
@@ -4577,15 +4586,15 @@ dependencies = [

 [[package]]
 name = "soundcraft-web"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
+ "craft-audio",
 "eframe",
 "egui",
 "js-sys",
 "log",
 "rfd",
 "serde_json",
- "soundcraft-audio-io",
 "soundcraft-engine",
 "soundcraft-model",
 "soundcraft-playback",
@@ -6225,7 +6234,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"

 [[package]]
 name = "xtask"
-version = "0.17.0"
+version = "0.20.1"
 dependencies = [
 "serde_json",
 ]
@@ -4,16 +4,15 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/*", "xtask"]

 [workspace.package]
-version = "0.17.0"
+version = "0.20.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
-rust-version = "1.90"
+rust-version = "1.95"
 repository = "https://github.com/storytold/soundcraft"

 [workspace.dependencies]
 # internal
 soundcraft-time = { path = "crates/time" }
-soundcraft-audio-io = { path = "crates/audio-io" }
 soundcraft-midi = { path = "crates/midi" }
 soundcraft-video = { path = "crates/video" }
 soundcraft-dsp = { path = "crates/dsp" }
@@ -43,7 +42,6 @@ same-file = "1"
 proptest = "1"

 # audio
-symphonia = { version = "0.6", default-features = false, features = ["mp1", "mp2", "mp3", "flac", "vorbis", "ogg", "wav", "pcm", "aiff", "isomp4", "aac", "alac", "adpcm", "caf", "mkv"] }
 rustfft = "6"
 # Session bundles (one file holding a session and its audio, for the browser): stored entries only.
 zip = { version = "9", default-features = false }
@@ -53,7 +51,12 @@ cpal = "0.18"
 craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b" }

 # Video containers and bitstreams, shared with the other craft apps.
-craft-media = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b" }
+craft-media = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "7db4645d1f1673df3b064de32faa3335bcdd7aed" }
+# Audio file formats, codecs and waveform overviews, shared with the other craft apps. It shares
+# types with craft-media, so both stay on one rev.
+# Standard MIDI Files and the note/controller model, shared with the other craft apps.
+craft-midi = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "7db4645d1f1673df3b064de32faa3335bcdd7aed", features = ["serde"] }
+craft-audio = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "7db4645d1f1673df3b064de32faa3335bcdd7aed", features = ["decode", "lossless-encode", "peaks", "serde"] }
 # craft-update: app-specific pretend versions apply to startup and manual checks.
 craft-update = { version = "=0.1.0", git = "https://github.com/storytold/craft-libs", rev = "6e03f65bf45181db77ba6229716e6624db9eb25b", features = ["egui"] }

@@ -88,6 +91,11 @@ debug = false
 opt-level = 1
 debug = "line-tables-only"

+# symphonia's FLAC decoder overflows an i32 add on 32-bit LPC FLAC; the wrapped value is correct
+# (craft-audio README, "symphonia").
+[profile.dev.package.symphonia-bundle-flac]
+overflow-checks = false
+
 [profile.release]
 opt-level = 3
 lto = "thin"
@@ -146,8 +146,7 @@ where things are.
 ## Getting started

 Download a build from the [releases page](https://github.com/storytold/soundcraft/releases), or build
-from source with Rust 1.95 or later for the desktop/web UI (the core workspace's declared
-minimum remains Rust 1.90):
+from source with Rust 1.95 or later:

 ```sh
 git clone https://github.com/storytold/soundcraft
@@ -245,7 +244,6 @@ about egui, so the interface could be swapped for another one.
 | Crate | What it does |
 |---|---|
 | `soundcraft-time` | Timebases, tempo and meter maps, timecode, grid |
-| `soundcraft-audio-io` | Audio file formats and waveform overviews |
 | `soundcraft-midi` | Standard MIDI Files and MIDI operations |
 | `soundcraft-dsp` | Plugins, offline processing, meters, loudness, FFT |
 | `soundcraft-model` | The session document |
@@ -20,7 +20,7 @@ workspace = true
 [dependencies]
 soundcraft-engine.workspace = true
 soundcraft-automation.workspace = true
-soundcraft-audio-io.workspace = true
+craft-audio.workspace = true
 soundcraft-dsp.workspace = true
 serde.workspace = true
 serde_json.workspace = true
@@ -11,31 +11,30 @@ use std::sync::OnceLock;
 use clap::builder::NonEmptyStringValueParser;
 use clap::error::ErrorKind;
 use clap::{ArgAction, Args, CommandFactory, FromArgMatches, Parser, Subcommand, ValueEnum};
+use craft_audio::{DECODE_EXTENSIONS, ENCODE_EXTENSIONS};
 use serde_json::{Value, json};
-use soundcraft_audio_io::FileFormat;
 use soundcraft_automation::ControlTarget;
 use soundcraft_automation::args::{AutomationArgs, ControlClientArgs, blank_env_is_unset, control_target, long_version, name_env_vars};

-/// Help text that names the extensions `list` gives, built once from
-/// [`FileFormat::readable_extensions`] or [`FileFormat::writable_extensions`] so it can't drift
-/// from what the code accepts.
-fn with_formats(cell: &'static OnceLock<String>, before: &str, list: fn() -> Vec<&'static str>, after: &str) -> &'static str {
-    cell.get_or_init(|| format!("{before}({}){after}", list().join(", ")))
+/// Help text that names the extensions in `list`, built once from craft-audio's
+/// [`DECODE_EXTENSIONS`] or [`ENCODE_EXTENSIONS`] so it can't drift from what the code accepts.
+fn with_formats(cell: &'static OnceLock<String>, before: &str, list: &[&str], after: &str) -> &'static str {
+    cell.get_or_init(|| format!("{before}({}){after}", list.join(", ")))
 }

 fn info_file_help() -> &'static str {
    static C: OnceLock<String> = OnceLock::new();
-    with_formats(&C, "An audio file ", FileFormat::readable_extensions, " or a .scraft session")
+    with_formats(&C, "An audio file ", DECODE_EXTENSIONS, " or a .scraft session")
 }

 fn read_help() -> &'static str {
    static C: OnceLock<String> = OnceLock::new();
-    with_formats(&C, "The audio file to read ", FileFormat::readable_extensions, "")
+    with_formats(&C, "The audio file to read ", DECODE_EXTENSIONS, "")
 }

 fn write_help() -> &'static str {
    static C: OnceLock<String> = OnceLock::new();
-    with_formats(&C, "The audio file to write; its extension picks the format ", FileFormat::writable_extensions, "")
+    with_formats(&C, "The audio file to write; its extension picks the format ", ENCODE_EXTENSIONS, "")
 }

 /// soundcraft-cli: SoundCraft without a window
@@ -361,7 +360,7 @@ pub(crate) enum BitDepthArg {
    Float32,
 }

-impl From<BitDepthArg> for soundcraft_audio_io::BitDepth {
+impl From<BitDepthArg> for craft_audio::BitDepth {
    fn from(depth: BitDepthArg) -> Self {
        match depth {
            BitDepthArg::Int16 => Self::Int16,
@@ -14,7 +14,16 @@ pub(crate) fn convert(args: &ConvertArgs, out: &mut dyn Write) -> Result<(), Cli
    };
    let bytes = std::fs::read(input).map_err(|source| CliError::File { path: input.clone(), source })?;
    let ext = input.extension().and_then(std::ffi::OsStr::to_str);
-    let (info, mut buf) = soundcraft_audio_io::decode(&bytes, ext).map_err(|source| CliError::Audio { path: input.clone(), source })?;
+    let (info, mut buf) = craft_audio::decode(&bytes, ext).map_err(|source| CliError::Audio { path: input.clone(), source })?;
+    // The decoder replaces packets it cannot decode with silence of their length and counts them.
+    // Such a file is not a copy of what was recorded: never let it replace its source, and say so
+    // when it is written elsewhere.
+    if info.damaged > 0 {
+        if args.in_place {
+            return Err(ConvertError::Damaged { input: input.clone(), packets: info.damaged }.into());
+        }
+        log::warn!("{}: {} damaged packet(s) decoded as silence", input.display(), info.damaged);
+    }
    let source_rate = buf.sample_rate;
    if let Some(rate) = rate {
        buf.channels = soundcraft_dsp::offline::resample(&buf.channels, buf.sample_rate, rate);
@@ -28,17 +37,22 @@ pub(crate) fn convert(args: &ConvertArgs, out: &mut dyn Write) -> Result<(), Cli
    let dither = dither_flag.unwrap_or_else(|| auto_dither(info.sample_format, bit_depth, processed));
    // Lossy only for the message: an extension that is not valid Unicode names no format.
    let out_ext = output.extension().map_or_else(|| "wav".into(), |e| e.to_string_lossy().to_ascii_lowercase());
-    let Some(format) = soundcraft_audio_io::FileFormat::from_write_extension(&out_ext) else {
+    let Some(format) = craft_audio::encode_format_for(&out_ext) else {
        return Err(ConvertError::OutputFormat { output: output.clone(), ext: out_ext }.into());
    };
    // A BWF source keeps its `bext` (written for WAV output only). The time reference counts
    // samples, so it moves to the output rate.
-    let bwf = info.bwf.map(|mut b| {
+    let mut opts = craft_audio::EncodeOptions::new(format).with_bit_depth(bit_depth).with_dither(dither);
+    // The source's speakers, not the usual ones for its channel count (5.1 with side surrounds
+    // stays that). Channels with no speaker assignment get the format's default.
+    if info.layout.is_ordered() {
+        opts = opts.with_layout(info.layout);
+    }
+    opts.bwf = info.bwf.map(|mut b| {
        b.time_reference = at_rate(b.time_reference, source_rate, buf.sample_rate);
        b
    });
-    let opts = soundcraft_audio_io::EncodeOptions { format, bit_depth, dither, bwf };
-    let bytes = soundcraft_audio_io::encode(&buf, &opts).map_err(|source| CliError::Audio { path: output.clone(), source })?;
+    let bytes = craft_audio::encode(&buf, &opts).map_err(|source| CliError::Audio { path: output.clone(), source })?;
    write_replacing(&args.write_path(), &bytes).map_err(|source| CliError::File { path: output.clone(), source })?;
    outln!(out, "wrote {} ({} ch, {} Hz, {:.2} s)", output.display(), buf.num_channels(), buf.sample_rate, buf.duration_secs());
    Ok(())
@@ -75,13 +89,15 @@ fn write_replacing(target: &std::path::Path, bytes: &[u8]) -> std::io::Result<()
 /// source exactly, i.e. the output has fewer bits than the source, the source is float or lossy, or
 /// resampling/normalizing produced new sample values. A 16-bit file written as 16 or 24-bit, or
 /// anything written as 32-bit float, is copied sample for sample (digital silence stays silent).
-fn auto_dither(source: soundcraft_audio_io::SampleFormat, target: soundcraft_audio_io::BitDepth, processed: bool) -> bool {
-    use soundcraft_audio_io::{BitDepth, SampleFormat};
+fn auto_dither(source: craft_audio::SampleFormat, target: craft_audio::BitDepth, processed: bool) -> bool {
+    use craft_audio::{BitDepth, SampleFormat};
    let target_bits = match target {
        BitDepth::Float32 => return false,
        BitDepth::Int16 => 16,
        BitDepth::Int24 => 24,
        BitDepth::Int32 => 32,
+        // A depth added to craft-audio later: dither, as for any step that may lose resolution.
+        _ => return true,
    };
    if processed {
        return true;
@@ -91,8 +107,8 @@ fn auto_dither(source: soundcraft_audio_io::SampleFormat, target: soundcraft_aud
        SampleFormat::Int16 => target_bits < 16,
        SampleFormat::Int24 => target_bits < 24,
        // Decoded through f32, which holds 24 bits: a 32-bit integer source has already lost
-        // resolution, so treat it like float.
-        SampleFormat::Int32 | SampleFormat::Float32 | SampleFormat::Float64 | SampleFormat::Compressed => true,
+        // resolution, so treat it like float (as is any format added to craft-audio later).
+        _ => true,
    }
 }

@@ -102,7 +118,7 @@ mod tests {

    #[test]
    fn convert_dithers_only_when_resolution_is_lost() {
-        use soundcraft_audio_io::{BitDepth, SampleFormat};
+        use craft_audio::{BitDepth, SampleFormat};
        // Same depth or wider: the samples fit exactly.
        assert!(!auto_dither(SampleFormat::Int16, BitDepth::Int16, false));
        assert!(!auto_dither(SampleFormat::Int16, BitDepth::Int24, false));
@@ -1,6 +1,6 @@
 use std::path::{Path, PathBuf};

-use soundcraft_audio_io::AudioError;
+use craft_audio::AudioError;
 use soundcraft_automation::RemoteError;
 use soundcraft_engine::EngineError;
 use soundcraft_engine::file_access::RootError;
@@ -46,6 +46,8 @@ pub(crate) fn unicode(path: &Path) -> Result<&str, CliError> {
 /// A `convert` option or output the tool refuses.
 #[derive(Debug, PartialEq, thiserror::Error)]
 pub(crate) enum ConvertError {
-    #[error("{}: cannot write `.{ext}` files (supported: {})", output.display(), soundcraft_audio_io::FileFormat::writable_extensions().join(", "))]
+    #[error("{}: cannot write `.{ext}` files (supported: {})", output.display(), craft_audio::ENCODE_EXTENSIONS.join(", "))]
    OutputFormat { output: PathBuf, ext: String },
+    #[error("{}: {packets} damaged packet(s) would be written as silence; not replacing the file (convert to another file to keep what decodes)", input.display())]
+    Damaged { input: PathBuf, packets: u64 },
 }
@@ -17,10 +17,10 @@ pub(crate) fn info(args: &InfoArgs, out: &mut dyn Write, err: &mut dyn Write) ->
    }
    let bytes = std::fs::read(path).map_err(|source| CliError::File { path: path.clone(), source })?;
    let ext = path.extension().and_then(std::ffi::OsStr::to_str);
-    let i = soundcraft_audio_io::probe(&bytes, ext).map_err(|source| CliError::Audio { path: path.clone(), source })?;
+    let i = craft_audio::probe(&bytes, ext).map_err(|source| CliError::Audio { path: path.clone(), source })?;
    print_json(
        out,
-        &json!({"format": i.format, "sample_format": i.sample_format, "sample_rate": i.sample_rate, "channels": i.channels, "frames": i.frames, "seconds": i.duration_secs(), "bwf": i.bwf}),
+        &json!({"format": soundcraft_engine::model::FileFormat::of(&i), "sample_format": i.sample_format, "sample_rate": i.sample_rate, "channels": i.channels, "frames": i.frames, "seconds": i.duration_secs(), "bwf": i.bwf}),
        args.compact,
    );
    Ok(())
@@ -5,7 +5,7 @@
 use std::path::{Path, PathBuf};
 use std::process::Command;

-use soundcraft_audio_io::{AudioBuffer, BitDepth, BwfInfo, EncodeOptions, FileFormat};
+use craft_audio::{AudioBuffer, BitDepth, BwfInfo, EncodeOptions};

 fn tmpdir(tag: &str) -> PathBuf {
    let dir = std::env::temp_dir().join(format!("sc-cli-convert-{tag}-{}", std::process::id()));
@@ -20,8 +20,8 @@ fn write_wav16(path: &Path, samples: &[i16]) {
    for (d, s) in buf.channels[0].iter_mut().zip(samples) {
        *d = f32::from(*s) / 32768.0;
    }
-    let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Int16, dither: false, bwf: None };
-    std::fs::write(path, soundcraft_audio_io::encode(&buf, &opts).unwrap()).unwrap();
+    let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(BitDepth::Int16);
+    std::fs::write(path, craft_audio::encode(&buf, &opts).unwrap()).unwrap();
 }

 fn convert(input: &Path, output: &Path, extra: &[&str]) {
@@ -38,7 +38,7 @@ fn convert(input: &Path, output: &Path, extra: &[&str]) {

 /// The decoded samples of `path`, scaled to 16-bit steps.
 fn steps16(path: &Path) -> Vec<f64> {
-    let (_, buf) = soundcraft_audio_io::decode(&std::fs::read(path).unwrap(), None).unwrap();
+    let (_, buf) = craft_audio::decode(&std::fs::read(path).unwrap(), None).unwrap();
    buf.channels[0].iter().map(|s| f64::from(*s) * 32768.0).collect()
 }

@@ -81,8 +81,8 @@ fn convert_dithers_when_reducing_depth_unless_told_not_to() {
    for (i, s) in buf.channels[0].iter_mut().enumerate() {
        *s = 0.3 / 32768.0 * (i as f32 * 0.01).sin();
    }
-    let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Int24, dither: false, bwf: None };
-    std::fs::write(&src, soundcraft_audio_io::encode(&buf, &opts).unwrap()).unwrap();
+    let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(BitDepth::Int24);
+    std::fs::write(&src, craft_audio::encode(&buf, &opts).unwrap()).unwrap();

    let dithered = dir.join("d16.wav");
    convert(&src, &dithered, &["--bit-depth", "16"]);
@@ -99,18 +99,15 @@ fn convert_keeps_the_bwf_time_stamp() {
    let dir = tmpdir("bext");
    let src = dir.join("take.wav");
    // 01:00:00:00 at 48 kHz.
-    let bwf = BwfInfo {
-        description: "take 3".into(),
-        originator: "recorder".into(),
-        origination_date: "2026-11-03".into(),
-        origination_time: "10:00:00".into(),
-        time_reference: 172_800_000,
-        ..Default::default()
-    };
+    let bwf = BwfInfo::default()
+        .with_description("take 3")
+        .with_originator("recorder")
+        .with_origination("2026-11-03", "10:00:00")
+        .with_time_reference(172_800_000);
    let buf = AudioBuffer::new(48_000, 1, 4800);
-    let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Int24, dither: false, bwf: Some(bwf.clone()) };
-    std::fs::write(&src, soundcraft_audio_io::encode(&buf, &opts).unwrap()).unwrap();
-    let bext = |p: &Path| soundcraft_audio_io::probe(&std::fs::read(p).unwrap(), None).unwrap().bwf;
+    let opts = EncodeOptions::default().with_bwf(bwf.clone());
+    std::fs::write(&src, craft_audio::encode(&buf, &opts).unwrap()).unwrap();
+    let bext = |p: &Path| craft_audio::probe(&std::fs::read(p).unwrap(), None).unwrap().bwf;

    let out = dir.join("16.wav");
    convert(&src, &out, &["--bit-depth", "16"]);
@@ -118,6 +115,58 @@ fn convert_keeps_the_bwf_time_stamp() {
    // Resampled, the stamp still points at 01:00:00:00: 158,760,000 samples at 44.1 kHz.
    let out = dir.join("44k.wav");
    convert(&src, &out, &["--rate", "44100"]);
-    assert_eq!(bext(&out), Some(BwfInfo { time_reference: 158_760_000, ..bwf }));
+    assert_eq!(bext(&out), Some(bwf.with_time_reference(158_760_000)));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Twelve MPEG-1 Layer I frames (mono, 32 kHz, 48 bytes each) of silence. The seventh has the
+/// forbidden bit allocation 15 in every subband: the decoder writes silence for it and counts it.
+fn mp1_with_a_damaged_frame() -> Vec<u8> {
+    let header = [0xFF, 0xFF, 0x18, 0xC0];
+    let good = [&header[..], &[0; 44]].concat();
+    let bad = [&header[..], &[0xFF; 16], &[0; 28]].concat();
+    (0..12).flat_map(|i| if i == 6 { bad.clone() } else { good.clone() }).collect()
+}
+
+#[test]
+fn convert_warns_about_damaged_packets_and_never_replaces_the_source_with_them() {
+    let dir = tmpdir("damaged");
+    let src = dir.join("take.mp1");
+    let bytes = mp1_with_a_damaged_frame();
+    std::fs::write(&src, &bytes).unwrap();
+    let run = |args: &[&std::ffi::OsStr]| {
+        Command::new(env!("CARGO_BIN_EXE_soundcraft-cli")).env("SOUNDCRAFT_NO_PREFS", "1").arg("convert").args(args).output().unwrap()
+    };
+    // To another file: written, with a warning that says how much was lost.
+    let out = dir.join("take.wav");
+    let o = run(&[src.as_os_str(), out.as_os_str()]);
+    assert!(o.status.success(), "{}", String::from_utf8_lossy(&o.stderr));
+    let warning = format!("warning: {}: 1 damaged packet(s) decoded as silence\n", src.display());
+    assert_eq!(String::from_utf8_lossy(&o.stderr), warning);
+    assert_eq!(steps16(&out).len(), 12 * 384);
+    // Over the source: refused, and the source is untouched.
+    let o = run(&[src.as_os_str(), src.as_os_str(), "--in-place".as_ref()]);
+    assert_eq!(o.status.code(), Some(1));
+    let stderr = String::from_utf8_lossy(&o.stderr);
+    assert!(stderr.starts_with(&format!("error: {}: 1 damaged packet(s) would be written as silence", src.display())), "{stderr}");
+    assert_eq!(std::fs::read(&src).unwrap(), bytes);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn convert_keeps_the_speaker_layout() {
+    use craft_audio::ChannelLayout;
+    let dir = tmpdir("layout");
+    let (src, out) = (dir.join("side.wav"), dir.join("out.wav"));
+    // 5.1 with side surrounds: not the layout a reader assumes for six channels.
+    let opts = EncodeOptions::default().with_layout(ChannelLayout::SURROUND_5_1_SIDE);
+    std::fs::write(&src, craft_audio::encode(&AudioBuffer::new(48_000, 6, 480), &opts).unwrap()).unwrap();
+    let layout = |p: &Path| craft_audio::probe(&std::fs::read(p).unwrap(), None).unwrap().layout;
+    assert_eq!(layout(&src), ChannelLayout::SURROUND_5_1_SIDE);
+    convert(&src, &out, &[]);
+    assert_eq!(layout(&out), ChannelLayout::SURROUND_5_1_SIDE);
+    let flac = dir.join("out.flac");
+    convert(&src, &flac, &[]);
+    assert_eq!(layout(&flac), ChannelLayout::SURROUND_5_1_SIDE);
    let _ = std::fs::remove_dir_all(&dir);
 }
@@ -4,7 +4,7 @@
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};

-use soundcraft_audio_io::{AudioBuffer, BitDepth, EncodeOptions, FileFormat};
+use craft_audio::{AudioBuffer, BitDepth, EncodeOptions};

 /// What one run of the binary produced.
 struct Invoke {
@@ -37,20 +37,20 @@ fn sandbox(tag: &str) -> PathBuf {
    for (i, d) in buf.channels[0].iter_mut().enumerate() {
        *d = i as f32 / 400.0;
    }
-    let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Int16, dither: false, bwf: None };
-    std::fs::write(dir.join("in.wav"), soundcraft_audio_io::encode(&buf, &opts).unwrap()).unwrap();
+    let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(BitDepth::Int16);
+    std::fs::write(dir.join("in.wav"), craft_audio::encode(&buf, &opts).unwrap()).unwrap();
    std::fs::write(dir.join("s.txt"), "track.new {}\n").unwrap();
    dir
 }

 /// The sample rate of the WAV `name` in `dir`.
 fn rate_of(dir: &Path, name: &str) -> u32 {
-    soundcraft_audio_io::probe(&std::fs::read(dir.join(name)).unwrap(), None).unwrap().sample_rate
+    craft_audio::probe(&std::fs::read(dir.join(name)).unwrap(), None).unwrap().sample_rate
 }

 /// Bit depth of the WAV `name` in `dir`, as the probe reports the sample format.
 fn format_of(dir: &Path, name: &str) -> String {
-    format!("{:?}", soundcraft_audio_io::probe(&std::fs::read(dir.join(name)).unwrap(), None).unwrap().sample_format)
+    format!("{:?}", craft_audio::probe(&std::fs::read(dir.join(name)).unwrap(), None).unwrap().sample_format)
 }

 /// Exit 1, nothing on stdout, and exactly `error: {message}` on stderr.
@@ -186,7 +186,10 @@ fn repeated_flags_are_usage_errors_in_either_spelling() {
 fn convert_input_and_output_errors() {
    let dir = sandbox("convert-io");
    assert_fails(&invoke(&dir, &["convert", "nope.wav", "o.wav"]), &format!("nope.wav: {}", not_found()));
-    assert_fails(&invoke(&dir, &["convert", "in.wav", "o.xyz"]), "o.xyz: cannot write `.xyz` files (supported: wav, wave, bwf, aif, aiff, flac)");
+    assert_fails(
+        &invoke(&dir, &["convert", "in.wav", "o.xyz"]),
+        "o.xyz: cannot write `.xyz` files (supported: wav, wave, bwf, aif, aiff, aifc, flac)",
+    );
 }

 #[test]
@@ -100,9 +100,8 @@ fn help_subcommand_shows_that_subcommands_help() {

 #[test]
 fn help_names_every_format_the_command_reads_and_writes() {
-    use soundcraft_audio_io::FileFormat;
-    let read = format!("({})", FileFormat::readable_extensions().join(", "));
-    let write = format!("its extension picks the format ({})", FileFormat::writable_extensions().join(", "));
+    let read = format!("({})", craft_audio::DECODE_EXTENSIONS.join(", "));
+    let write = format!("its extension picks the format ({})", craft_audio::ENCODE_EXTENSIONS.join(", "));
    let convert = invoke(&["convert", "--help"]);
    let convert = assert_help(&convert);
    assert!(convert.contains(&read) && convert.contains(&write), "{convert}");
@@ -15,7 +15,7 @@ path = "src/main.rs"

 [target.'cfg(target_arch = "wasm32")'.dependencies]
 soundcraft-engine = { workspace = true }
-soundcraft-audio-io.workspace = true
+craft-audio.workspace = true
 soundcraft-ui-egui.workspace = true
 soundcraft-playback = { workspace = true }
 soundcraft-model = { workspace = true }
@@ -1,6 +1,5 @@
 //! The browser shell: the eframe web runner around [`SoundApp`].

-use soundcraft_audio_io::FileFormat;
 use soundcraft_engine::{Engine, io};
 use soundcraft_ui_egui::dialogs::Dialog;
 use soundcraft_ui_egui::sampler_window::SampleRead;
@@ -96,7 +95,7 @@ impl Purpose {
    fn filter(self) -> (&'static str, Vec<&'static str>) {
        match self {
            Self::Session => ("SoundCraft Session", SESSION_EXTS.to_vec()),
-            Self::Audio => ("Audio", FileFormat::readable_extensions()),
+            Self::Audio => ("Audio", craft_audio::DECODE_EXTENSIONS.to_vec()),
            Self::Midi => ("MIDI", MIDI_EXTS.to_vec()),
        }
    }
@@ -235,7 +234,7 @@ fn download(name: &str, bytes: &[u8]) -> Result<(), String> {
        Some("txt") => "text/plain",
        Some("json" | "scraft") => "application/json",
        Some("musicxml") => "application/vnd.recordare.musicxml+xml",
-        ext => ext.and_then(FileFormat::from_extension).map_or("application/octet-stream", FileFormat::mime_type),
+        ext => ext.and_then(craft_audio::encode_format_for).map_or("application/octet-stream", craft_audio::EncodeFormat::mime_type),
    });
    let blob = web_sys::Blob::new_with_u8_array_sequence_and_options(&parts, &opts).map_err(js)?;
    let url = web_sys::Url::create_object_url_with_blob(&blob).map_err(js)?;
@@ -16,7 +16,7 @@ asio = ["soundcraft-playback/asio"]

 [dependencies]
 soundcraft-engine.workspace = true
-soundcraft-audio-io.workspace = true
+craft-audio.workspace = true
 soundcraft-ui-egui.workspace = true
 soundcraft-playback.workspace = true
 soundcraft-automation.workspace = true
@@ -23,7 +23,6 @@ mod native_menu;
 mod switch;

 use env::Env;
-use soundcraft_audio_io::FileFormat;
 use soundcraft_engine::Engine;
 use soundcraft_ui_egui::{Services, SoundApp, UiState, dialogs};
 use std::sync::Arc;
@@ -153,13 +152,13 @@ fn services() -> Services {
            let d = match purpose {
                "session.open" => d.add_filter("SoundCraft Session", &["scraft"]),
                "file.import_midi" => d.add_filter("MIDI", &["mid", "midi", "smf"]),
-                _ => d.add_filter("Audio", &FileFormat::readable_extensions()),
+                _ => d.add_filter("Audio", craft_audio::DECODE_EXTENSIONS),
            };
            d.pick_file()
        })),
        pick_save: Some(Box::new(|purpose: &str, path: &std::path::Path| {
            let mut d = match purpose {
-                "file.bounce_mix" => rfd::FileDialog::new().add_filter("Audio", &FileFormat::writable_extensions()),
+                "file.bounce_mix" => rfd::FileDialog::new().add_filter("Audio", craft_audio::ENCODE_EXTENSIONS),
                _ => rfd::FileDialog::new().add_filter("SoundCraft Session", &["scraft"]),
            };
            if let Some(dir) = path.parent().filter(|dir| dir.is_dir()) {
@@ -1,21 +0,0 @@
-[package]
-name = "soundcraft-audio-io"
-description = "SoundCraft audio file I/O: WAV/BWF/RF64, AIFF/AIFF-C native readers and writers, FLAC encoder, symphonia-backed decode of compressed formats, waveform peaks"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
-repository.workspace = true
-
-[dependencies]
-serde.workspace = true
-thiserror.workspace = true
-log.workspace = true
-symphonia.workspace = true
-
-[dev-dependencies]
-proptest.workspace = true
-serde_json.workspace = true
-
-[lints]
-workspace = true
@@ -1,283 +0,0 @@
-//! Native AIFF / AIFF-C reader and writer (Apple "Audio Interchange File Format" 1.3 and the
-//! AIFF-C draft: big-endian IFF chunks, 80-bit IEEE extended sample rate).
-
-use crate::pcm::{PcmKind, Quantizer, be_u16, be_u32, deinterleave, sample_format, tag, validate_buffer, validate_layout, write_interleaved};
-use crate::{AudioBuffer, AudioError, AudioInfo, BitDepth, FileFormat, Result, SampleFormat};
-use std::io::{Cursor, Seek, SeekFrom, Write};
-
-/// AIFF-C version 1 timestamp for the FVER chunk.
-const AIFC_VERSION_1: u32 = 0xA280_5140;
-const MAX_SAMPLE_RATE: f64 = 10_000_000.0;
-
-pub(crate) struct AiffLayout {
-    pub info: AudioInfo,
-    pub kind: PcmKind,
-    pub data_start: usize,
-    pub data_len: usize,
-}
-
-pub(crate) enum AiffParse {
-    Native(AiffLayout),
-    /// Compressed AIFF-C (ulaw, alaw, ima4, ...): handed to symphonia.
-    Foreign,
-}
-
-/// True when the bytes start like an AIFF or AIFF-C file.
-pub(crate) fn is_aiff(b: &[u8]) -> bool {
-    tag(b, 0).is_some_and(|t| &t == b"FORM") && tag(b, 8).is_some_and(|t| &t == b"AIFF" || &t == b"AIFC")
-}
-
-/// Decode an 80-bit IEEE 754 extended-precision float.
-pub(crate) fn extended_to_f64(b: &[u8]) -> Option<f64> {
-    let se = be_u16(b, 0)?;
-    let hi = u64::from(be_u32(b, 2)?);
-    let lo = u64::from(be_u32(b, 6)?);
-    let mant = (hi << 32) | lo;
-    if mant == 0 {
-        return Some(0.0);
-    }
-    let exp = i32::from(se & 0x7FFF);
-    if exp == 0x7FFF {
-        return None; // inf / NaN
-    }
-    let v = mant as f64 * 2f64.powi(exp - 16383 - 63);
-    Some(if se & 0x8000 != 0 { -v } else { v })
-}
-
-/// Encode a positive integer as an 80-bit IEEE 754 extended float (exact).
-pub(crate) fn u32_to_extended(r: u32) -> [u8; 10] {
-    let mut out = [0u8; 10];
-    if r == 0 {
-        return out;
-    }
-    let e = 31 - r.leading_zeros();
-    let exp = (16383 + e) as u16;
-    let mant = u64::from(r) << (63 - e);
-    out[..2].copy_from_slice(&exp.to_be_bytes());
-    out[2..].copy_from_slice(&mant.to_be_bytes());
-    out
-}
-
-pub(crate) fn parse(b: &[u8]) -> Result<AiffParse> {
-    if !is_aiff(b) {
-        return Err(AudioError::Malformed("not an AIFF/AIFF-C file".into()));
-    }
-    let is_aifc = tag(b, 8).is_some_and(|t| &t == b"AIFC");
-    let mut comm: Option<(i16, u32, i16, f64, [u8; 4])> = None;
-    let mut ssnd: Option<(usize, usize)> = None;
-
-    let mut pos: usize = 12;
-    let mut chunks = 0usize;
-    while let (Some(id), Some(size32)) = (tag(b, pos), be_u32(b, pos + 4)) {
-        chunks += 1;
-        if chunks > 100_000 {
-            break;
-        }
-        let body = pos.checked_add(8).ok_or_else(|| AudioError::Malformed("chunk offset overflow".into()))?;
-        let remaining = b.len().saturating_sub(body);
-        let declared = usize::try_from(size32).unwrap_or(usize::MAX);
-        let len = declared.min(remaining);
-        let c = b.get(body..body + len).unwrap_or_default();
-        match &id {
-            b"COMM" => {
-                let short = || AudioError::Malformed("COMM chunk too short".into());
-                let channels = be_u16(c, 0).ok_or_else(short)? as i16;
-                let frames = be_u32(c, 2).ok_or_else(short)?;
-                let bits = be_u16(c, 6).ok_or_else(short)? as i16;
-                let rate = extended_to_f64(c.get(8..18).ok_or_else(short)?).ok_or_else(|| AudioError::Malformed("invalid sample rate".into()))?;
-                let compression = if is_aifc { tag(c, 18).ok_or_else(short)? } else { *b"NONE" };
-                comm = Some((channels, frames, bits, rate, compression));
-            }
-            b"SSND" if ssnd.is_none() => {
-                let offset = usize::try_from(be_u32(c, 0).unwrap_or(0)).unwrap_or(usize::MAX);
-                let start = body.saturating_add(8).saturating_add(offset).min(b.len());
-                let data_len = len.saturating_sub(8).saturating_sub(offset);
-                ssnd = Some((start, data_len));
-            }
-            _ => {}
-        }
-        if declared > remaining {
-            break;
-        }
-        pos = match body.checked_add(declared).and_then(|p| p.checked_add(declared & 1)) {
-            Some(p) => p,
-            None => break,
-        };
-    }
-
-    let (channels, frames, bits, rate, compression) = comm.ok_or_else(|| AudioError::Malformed("AIFF has no COMM chunk".into()))?;
-    if channels <= 0 {
-        return Err(AudioError::Malformed("AIFF declares zero or negative channels".into()));
-    }
-    if !(1.0..=MAX_SAMPLE_RATE).contains(&rate) {
-        return Err(AudioError::Malformed(format!("AIFF sample rate {rate} out of range")));
-    }
-    let sample_rate = rate.round() as u32;
-    let int_kind = |big_endian: bool| -> Result<(PcmKind, SampleFormat)> {
-        if !(1..=32).contains(&bits) {
-            return Err(AudioError::Unsupported(format!("AIFF sample size {bits}")));
-        }
-        let bytes = (bits as usize).div_ceil(8);
-        let sf = match bits {
-            1..=8 => SampleFormat::Int8,
-            9..=16 => SampleFormat::Int16,
-            17..=24 => SampleFormat::Int24,
-            _ => SampleFormat::Int32,
-        };
-        Ok((PcmKind::Int { bytes, big_endian, unsigned: false }, sf))
-    };
-    let (kind, sample_format) = match &compression {
-        b"NONE" | b"twos" => int_kind(true)?,
-        b"sowt" => int_kind(false)?,
-        b"fl32" | b"FL32" => (PcmKind::Float { bytes: 4, big_endian: true }, SampleFormat::Float32),
-        b"fl64" | b"FL64" => (PcmKind::Float { bytes: 8, big_endian: true }, SampleFormat::Float64),
-        _ => return Ok(AiffParse::Foreign),
-    };
-    let (data_start, data_len) = ssnd.unwrap_or((b.len(), 0));
-    let block = kind.bytes().saturating_mul(channels as usize).max(1);
-    let frames = u64::from(frames).min((data_len / block) as u64);
-    Ok(AiffParse::Native(AiffLayout {
-        info: AudioInfo { format: FileFormat::Aiff, sample_format, sample_rate, channels: channels as u16, frames, bwf: None },
-        kind,
-        data_start,
-        data_len,
-    }))
-}
-
-pub(crate) fn decode(b: &[u8], layout: &AiffLayout) -> Result<AudioBuffer> {
-    let end = layout.data_start.saturating_add(layout.data_len).min(b.len());
-    let data = b.get(layout.data_start..end).unwrap_or_default();
-    let channels = deinterleave(data, layout.kind, usize::from(layout.info.channels), layout.info.frames)?;
-    Ok(AudioBuffer { sample_rate: layout.info.sample_rate, channels })
-}
-
-fn push_chunk(out: &mut Vec<u8>, id: &[u8; 4], body: &[u8]) {
-    out.extend_from_slice(id);
-    out.extend_from_slice(&u32::try_from(body.len()).unwrap_or(u32::MAX).to_be_bytes());
-    out.extend_from_slice(body);
-    if body.len() % 2 == 1 {
-        out.push(0);
-    }
-}
-
-/// Encode AIFF (integer depths) or AIFF-C `fl32` (Float32).
-pub(crate) fn encode(buf: &AudioBuffer, depth: BitDepth, dither: bool) -> Result<Vec<u8>> {
-    validate_buffer(buf)?;
-    let frames = buf.frames();
-    let head_len = header(buf.channels.len(), buf.sample_rate, depth, frames as u64)?.len();
-    let data_len = usize::from(sample_format(depth).0 / 8).saturating_mul(buf.channels.len()).saturating_mul(frames);
-    let total = head_len.saturating_add(data_len).saturating_add(1);
-    let mut out = Vec::new();
-    out.try_reserve_exact(total).map_err(|_| AudioError::TooLarge(format!("cannot allocate {total} bytes for AIFF output")))?;
-    let mut w = Writer::new(Cursor::new(out), buf.channels.len(), buf.sample_rate, depth, dither)?;
-    w.write(&buf.channels, frames)?;
-    Ok(w.finish()?.into_inner())
-}
-
-/// An AIFF written block by block: a placeholder header first, then the real one (the same
-/// length) written over it by [`Writer::finish`].
-pub(crate) struct Writer<W> {
-    out: W,
-    start: u64,
-    channels: usize,
-    sample_rate: u32,
-    depth: BitDepth,
-    quantizers: Vec<Quantizer>,
-    frames: u64,
-    bytes: Vec<u8>,
-    /// Set when a block write has failed: the sink may hold a prefix of that block while
-    /// `frames` does not count it, so the writer refuses every later call.
-    failed: bool,
-}
-
-impl<W: Write + Seek> Writer<W> {
-    pub(crate) fn new(mut out: W, channels: usize, sample_rate: u32, depth: BitDepth, dither: bool) -> Result<Self> {
-        validate_layout(channels, sample_rate)?;
-        let start = out.stream_position()?;
-        out.write_all(&header(channels, sample_rate, depth, 0)?)?;
-        let quantizers = Quantizer::per_channel(u32::from(sample_format(depth).0), dither, channels);
-        Ok(Writer { out, start, channels, sample_rate, depth, quantizers, frames: 0, bytes: Vec::new(), failed: false })
-    }
-
-    /// The frame count after `frames` more, or an error when AIFF can't hold that many (4 GiB).
-    pub(crate) fn check_room(&self, frames: u64) -> Result<u64> {
-        let total = self.frames.saturating_add(frames);
-        header(self.channels, self.sample_rate, self.depth, total)?;
-        Ok(total)
-    }
-
-    /// Appends `frames` frames of planar audio (missing samples are silence), unless they don't
-    /// fit (see [`Writer::check_room`]).
-    pub(crate) fn write(&mut self, block: &[Vec<f32>], frames: usize) -> Result<()> {
-        if self.failed {
-            return Err(crate::failed_write_error());
-        }
-        let total = self.check_room(frames as u64)?;
-        if let Err(e) = write_interleaved(&mut self.out, &mut self.bytes, block, frames, &mut self.quantizers, sample_format(self.depth), true) {
-            self.failed = true;
-            return Err(AudioError::from(e));
-        }
-        self.frames = total;
-        Ok(())
-    }
-
-    pub(crate) fn finish(mut self) -> Result<W> {
-        if self.failed {
-            return Err(crate::failed_write_error());
-        }
-        let data_len = u64::from(sample_format(self.depth).0 / 8).saturating_mul(self.channels as u64).saturating_mul(self.frames);
-        if data_len % 2 == 1 {
-            self.out.write_all(&[0])?;
-        }
-        let head = header(self.channels, self.sample_rate, self.depth, self.frames)?;
-        self.out.seek(SeekFrom::Start(self.start))?;
-        self.out.write_all(&head)?;
-        self.out.seek(SeekFrom::End(0))?;
-        self.out.flush()?;
-        Ok(self.out)
-    }
-}
-
-/// Everything before the sample data of an AIFF holding `frames` frames; its length doesn't
-/// depend on `frames`.
-fn header(channels: usize, sample_rate: u32, depth: BitDepth, frames: u64) -> Result<Vec<u8>> {
-    let channels_i16 = i16::try_from(channels).map_err(|_| AudioError::Encode("too many channels for AIFF".into()))?;
-    let frames_u32 = u32::try_from(frames).map_err(|_| AudioError::TooLarge("too many frames for AIFF".into()))?;
-    let (bits, is_float) = sample_format(depth);
-    let data_len = u64::from(bits / 8).saturating_mul(channels as u64).saturating_mul(frames);
-
-    let mut comm = Vec::with_capacity(40);
-    comm.extend_from_slice(&channels_i16.to_be_bytes());
-    comm.extend_from_slice(&frames_u32.to_be_bytes());
-    comm.extend_from_slice(&bits.to_be_bytes());
-    comm.extend_from_slice(&u32_to_extended(sample_rate));
-    if is_float {
-        comm.extend_from_slice(b"fl32");
-        let name = b"32-bit float";
-        comm.push(name.len() as u8);
-        comm.extend_from_slice(name);
-        if (name.len() + 1) % 2 == 1 {
-            comm.push(0);
-        }
-    }
-
-    let mut head = Vec::with_capacity(128);
-    head.extend_from_slice(b"FORM");
-    head.extend_from_slice(&[0, 0, 0, 0]); // patched below
-    head.extend_from_slice(if is_float { b"AIFC" } else { b"AIFF" });
-    if is_float {
-        push_chunk(&mut head, b"FVER", &AIFC_VERSION_1.to_be_bytes());
-    }
-    push_chunk(&mut head, b"COMM", &comm);
-    head.extend_from_slice(b"SSND");
-    let ssnd_len = u32::try_from(data_len.saturating_add(8)).map_err(|_| AudioError::TooLarge("AIFF data exceeds 4 GiB".into()))?;
-    head.extend_from_slice(&ssnd_len.to_be_bytes());
-    head.extend_from_slice(&[0u8; 8]); // offset, blockSize
-
-    let total = (head.len() as u64).saturating_add(data_len).saturating_add(data_len & 1);
-    let form_len = u32::try_from(total - 8).map_err(|_| AudioError::TooLarge("AIFF file exceeds 4 GiB".into()))?;
-    if let Some(slot) = head.get_mut(4..8) {
-        slot.copy_from_slice(&form_len.to_be_bytes());
-    }
-    Ok(head)
-}
@@ -1,71 +0,0 @@
-//! Planar `f32` audio buffer.
-
-/// Planar f32 audio.
-///
-/// Every channel is expected to hold the same number of frames; [`AudioBuffer::frames`] reports the
-/// shortest channel so a ragged buffer never causes out-of-bounds access.
-#[derive(Debug, Clone, Default, PartialEq)]
-pub struct AudioBuffer {
-    /// Sample rate in Hz.
-    pub sample_rate: u32,
-    /// One `Vec` of samples per channel.
-    pub channels: Vec<Vec<f32>>,
-}
-
-impl AudioBuffer {
-    /// A silent buffer with `channels` channels of `frames` frames each.
-    pub fn new(sample_rate: u32, channels: usize, frames: usize) -> Self {
-        Self { sample_rate, channels: vec![vec![0.0; frames]; channels] }
-    }
-
-    /// Number of frames (the length of the shortest channel; 0 when there are no channels).
-    pub fn frames(&self) -> usize {
-        self.channels.iter().map(Vec::len).min().unwrap_or(0)
-    }
-
-    /// Number of channels.
-    pub fn num_channels(&self) -> usize {
-        self.channels.len()
-    }
-
-    /// Duration in seconds (0 when the sample rate is 0).
-    pub fn duration_secs(&self) -> f64 {
-        if self.sample_rate == 0 {
-            return 0.0;
-        }
-        self.frames() as f64 / f64::from(self.sample_rate)
-    }
-
-    /// Interleaved copy of the samples (frame-major: `L0 R0 L1 R1 ...`).
-    pub fn interleaved(&self) -> Vec<f32> {
-        let frames = self.frames();
-        let mut out = Vec::with_capacity(frames.saturating_mul(self.channels.len()));
-        for f in 0..frames {
-            for ch in &self.channels {
-                out.push(ch.get(f).copied().unwrap_or(0.0));
-            }
-        }
-        out
-    }
-
-    /// Build a planar buffer from interleaved samples. A trailing partial frame is dropped;
-    /// `channels == 0` yields an empty buffer.
-    pub fn from_interleaved(sr: u32, channels: usize, data: &[f32]) -> Self {
-        if channels == 0 {
-            return Self { sample_rate: sr, channels: Vec::new() };
-        }
-        let frames = data.len() / channels;
-        let mut out: Vec<Vec<f32>> = (0..channels).map(|_| Vec::with_capacity(frames)).collect();
-        for frame in data.chunks_exact(channels) {
-            for (ch, &s) in out.iter_mut().zip(frame) {
-                ch.push(s);
-            }
-        }
-        Self { sample_rate: sr, channels: out }
-    }
-
-    /// Absolute peak over all channels (NaN samples are ignored).
-    pub fn peak(&self) -> f32 {
-        self.channels.iter().flat_map(|c| c.iter()).fold(0.0f32, |acc, &s| acc.max(s.abs()))
-    }
-}
@@ -1,98 +0,0 @@
-//! Size checks on CAF chunks before symphonia reads them: it allocates whatever a magic cookie,
-//! a packet table or a packet claims, and a failed allocation aborts the process.
-
-use crate::pcm::{be_u16, be_u32, be_u64};
-use crate::{AudioError, Result};
-
-/// Refuse the CAF stream at `at` if its magic cookie, packet table or packets claim more bytes
-/// than the file holds.
-pub(crate) fn check(b: &[u8], at: usize) -> Result<()> {
-    if be_u16(b, at + 4) == Some(1) { chunks(b, at + 8) } else { Ok(()) }
-}
-
-fn malformed(what: &str) -> AudioError {
-    AudioError::Malformed(format!("CAF {what} is larger than the file"))
-}
-
-/// Walk the chunks the way the CAF reader reads them: it advances by the bytes it parses, not by
-/// the declared size, and after a `data` chunk of unknown size it reads on into the audio.
-fn chunks(b: &[u8], mut pos: usize) -> Result<()> {
-    // Whether the packet table lists each packet's size and frame count (variable per packet).
-    let (mut lists_sizes, mut lists_frames, mut described) = (false, false, false);
-    while let (Some(kind), Some(size)) = (b.get(pos..pos + 4), be_u64(b, pos + 4)) {
-        let body = pos + 12;
-        let used = match kind {
-            b"desc" if size == 32 => {
-                lists_sizes = be_u32(b, body + 16) == Some(0);
-                lists_frames = be_u32(b, body + 20) == Some(0);
-                described = true;
-                Some(32)
-            }
-            b"data" if size == u64::MAX => Some(4),
-            b"chan" if size >= 12 => be_u32(b, body + 8).map(|n| 12 + u64::from(n) * 20),
-            b"pakt" if size >= 24 && described => packet_table(b, body, lists_sizes, lists_frames)?,
-            b"kuki" if size > b.len().saturating_sub(body) as u64 => return Err(malformed("magic cookie")),
-            b"desc" | b"pakt" | b"chan" => None,
-            _ => Some(size),
-        };
-        match used.filter(|_| described).and_then(|n| usize::try_from(n).ok()).and_then(|n| body.checked_add(n)) {
-            Some(next) if next < b.len() => pos = next,
-            _ => return Ok(()),
-        }
-    }
-    Ok(())
-}
-
-/// Check a packet table's count and packet sizes; returns the bytes symphonia reads for it, or
-/// None where symphonia stops. It reserves room for every packet before reading any, so a table
-/// it would refuse after that, or that runs past the file, is refused first.
-fn packet_table(b: &[u8], body: usize, lists_sizes: bool, lists_frames: bool) -> Result<Option<u64>> {
-    let valid = |at: usize| be_u64(b, at).filter(|&n| n as i64 >= 0);
-    let (Some(packets), Some(_)) = (valid(body), valid(body + 8)) else { return Ok(None) };
-    let mut at = body + 24;
-    if packets > b.len().saturating_sub(at) as u64 {
-        return Err(malformed("packet table"));
-    }
-    if !lists_sizes && !lists_frames {
-        return if packets == 0 { Ok(Some(24)) } else { Err(AudioError::Malformed("a constant bit rate CAF lists packets".into())) };
-    }
-    for _ in 0..packets {
-        if lists_sizes {
-            let Some((size, len)) = varint(b, at) else { return Err(malformed("packet table")) };
-            if size > b.len() as u64 {
-                return Err(malformed("packet"));
-            }
-            at += len;
-        }
-        if lists_frames {
-            let Some((_, len)) = varint(b, at) else { return Err(malformed("packet table")) };
-            at += len;
-        }
-    }
-    Ok(Some((at - body) as u64))
-}
-
-/// A CAF variable-length integer at `at` and its length in bytes.
-fn varint(b: &[u8], at: usize) -> Option<(u64, usize)> {
-    let mut v = 0u64;
-    for i in 0..9 {
-        let x = *b.get(at + i)?;
-        v |= u64::from(x & 0x7f);
-        if x & 0x80 == 0 {
-            return Some((v, i + 1));
-        }
-        v <<= 7;
-    }
-    None
-}
-
-#[cfg(test)]
-mod tests {
-    #[test]
-    fn rejects_cookie_size_above_signed_range() {
-        let mut bytes = b"caff\0\x01\0\0kuki".to_vec();
-        bytes.extend_from_slice(&(1u64 << 63).to_be_bytes());
-
-        assert!(super::check(&bytes, 0).is_err());
-    }
-}
@@ -1,563 +0,0 @@
-//! A small pure-Rust FLAC encoder (RFC 9639): fixed blocksize, independent channels, and per
-//! subframe the cheapest of CONSTANT, VERBATIM or FIXED (orders 0–4) prediction with
-//! partitioned Rice-coded residuals. Decoding is symphonia's, after [`check_metadata`].
-
-use crate::pcm::{Quantizer, be_u32, le_u32, validate_buffer};
-use crate::{AudioBuffer, AudioError, AudioInfo, BitDepth, FileFormat, Result, SampleFormat};
-use std::io::{Cursor, Seek, SeekFrom, Write};
-
-const BLOCK_SIZE: usize = 4096;
-const MAX_PARTITION_ORDER: u32 = 6;
-
-struct BitWriter {
-    out: Vec<u8>,
-    acc: u64,
-    nbits: u32,
-}
-
-impl BitWriter {
-    fn new() -> Self {
-        Self { out: Vec::new(), acc: 0, nbits: 0 }
-    }
-
-    /// Write the low `n` (≤ 32) bits of `v`, MSB first.
-    fn write(&mut self, v: u64, n: u32) {
-        if n == 0 {
-            return;
-        }
-        let n = n.min(32);
-        let mask = (1u64 << n) - 1;
-        self.acc = (self.acc << n) | (v & mask);
-        self.nbits += n;
-        while self.nbits >= 8 {
-            self.nbits -= 8;
-            self.out.push((self.acc >> self.nbits) as u8);
-        }
-        self.acc &= (1u64 << self.nbits) - 1;
-    }
-
-    fn write_signed(&mut self, v: i64, n: u32) {
-        self.write(v as u64, n);
-    }
-
-    /// `q` zero bits followed by a one bit.
-    fn write_unary(&mut self, mut q: u64) {
-        while q >= 32 {
-            self.write(0, 32);
-            q -= 32;
-        }
-        self.write(1, (q as u32) + 1);
-    }
-
-    fn align(&mut self) {
-        if self.nbits > 0 {
-            let pad = 8 - self.nbits;
-            self.write(0, pad);
-        }
-    }
-
-    fn into_bytes(mut self) -> Vec<u8> {
-        self.align();
-        self.out
-    }
-}
-
-fn crc8(data: &[u8]) -> u8 {
-    let mut crc: u8 = 0;
-    for &b in data {
-        crc ^= b;
-        for _ in 0..8 {
-            crc = if crc & 0x80 != 0 { (crc << 1) ^ 0x07 } else { crc << 1 };
-        }
-    }
-    crc
-}
-
-fn crc16(data: &[u8]) -> u16 {
-    let mut crc: u16 = 0;
-    for &b in data {
-        crc ^= u16::from(b) << 8;
-        for _ in 0..8 {
-            crc = if crc & 0x8000 != 0 { (crc << 1) ^ 0x8005 } else { crc << 1 };
-        }
-    }
-    crc
-}
-
-/// FLAC's UTF-8-like variable-length integer coding (up to 36 bits).
-fn write_utf8_number(w: &mut BitWriter, v: u64) {
-    if v < 0x80 {
-        w.write(v, 8);
-        return;
-    }
-    // Payload bits available for an n-byte coding: 5n + 1 (n = 2..=6), 36 for n = 7.
-    let n: u32 = (2..=7).find(|&n| if n == 7 { true } else { v < (1u64 << (5 * n + 1)) }).unwrap_or(7);
-    let cont_bits = 6 * (n - 1);
-    let lead_payload = if n == 7 { 0 } else { 7 - n };
-    let prefix: u64 = (0xFFu64 << (8 - n)) & 0xFF;
-    let lead = prefix | ((v >> cont_bits) & ((1u64 << lead_payload) - 1));
-    w.write(lead, 8);
-    for i in (0..n - 1).rev() {
-        w.write(0x80 | ((v >> (6 * i)) & 0x3F), 8);
-    }
-}
-
-fn sample_rate_code(r: u32) -> (u64, Option<(u64, u32)>) {
-    match r {
-        88_200 => (1, None),
-        176_400 => (2, None),
-        192_000 => (3, None),
-        8_000 => (4, None),
-        16_000 => (5, None),
-        22_050 => (6, None),
-        24_000 => (7, None),
-        32_000 => (8, None),
-        44_100 => (9, None),
-        48_000 => (10, None),
-        96_000 => (11, None),
-        r if r % 1000 == 0 && r / 1000 <= 255 => (12, Some((u64::from(r / 1000), 8))),
-        r if r <= 65_535 => (13, Some((u64::from(r), 16))),
-        r if r % 10 == 0 && r / 10 <= 65_535 => (14, Some((u64::from(r / 10), 16))),
-        _ => (0, None),
-    }
-}
-
-fn bps_code(bps: u32) -> u64 {
-    match bps {
-        8 => 1,
-        12 => 2,
-        16 => 4,
-        20 => 5,
-        24 => 6,
-        _ => 0, // from STREAMINFO
-    }
-}
-
-fn zigzag(r: i64) -> u64 {
-    ((r << 1) ^ (r >> 63)) as u64
-}
-
-/// Fixed-predictor residuals for `order`, or `None` when any residual leaves the i32 range.
-fn fixed_residual(x: &[i64], order: usize) -> Option<Vec<i64>> {
-    let mut res = Vec::with_capacity(x.len().saturating_sub(order));
-    for n in order..x.len() {
-        let g = |k: usize| x.get(n - k).copied().unwrap_or(0);
-        let r = match order {
-            0 => g(0),
-            1 => g(0) - g(1),
-            2 => g(0) - 2 * g(1) + g(2),
-            3 => g(0) - 3 * g(1) + 3 * g(2) - g(3),
-            _ => g(0) - 4 * g(1) + 6 * g(2) - 4 * g(3) + g(4),
-        };
-        if r < i64::from(i32::MIN) || r > i64::from(i32::MAX) {
-            return None;
-        }
-        res.push(r);
-    }
-    Some(res)
-}
-
-/// Best Rice parameter and its cost in bits for one partition.
-fn best_rice(part: &[u64]) -> (u32, u64) {
-    if part.is_empty() {
-        return (0, 0);
-    }
-    let sum: u64 = part.iter().sum();
-    let mean = sum / part.len() as u64;
-    let guess = if mean == 0 { 0 } else { 63 - mean.leading_zeros() };
-    let mut best = (0u32, u64::MAX);
-    for k in guess.saturating_sub(1)..=(guess + 1).min(30) {
-        let cost = part.len() as u64 * u64::from(k + 1) + part.iter().map(|&u| u >> k).sum::<u64>();
-        if cost < best.1 {
-            best = (k, cost);
-        }
-    }
-    best
-}
-
-/// Residual coding plan: partition order, per-partition parameters, total bits.
-struct RicePlan {
-    order: u32,
-    params: Vec<u32>,
-    bits: u64,
-    wide: bool,
-}
-
-fn plan_residual(u: &[u64], block_len: usize, pred_order: usize) -> RicePlan {
-    let mut best: Option<RicePlan> = None;
-    for p in 0..=MAX_PARTITION_ORDER {
-        let parts = 1usize << p;
-        if !block_len.is_multiple_of(parts) || block_len / parts <= pred_order {
-            break;
-        }
-        let per = block_len / parts;
-        let mut params = Vec::with_capacity(parts);
-        let mut bits = 0u64;
-        let mut start = 0usize;
-        for i in 0..parts {
-            let len = if i == 0 { per - pred_order } else { per };
-            let part = u.get(start..start + len).unwrap_or_default();
-            start += len;
-            let (k, cost) = best_rice(part);
-            params.push(k);
-            bits += cost;
-        }
-        let wide = params.iter().any(|&k| k > 14);
-        bits += 6 + parts as u64 * if wide { 5 } else { 4 };
-        if best.as_ref().is_none_or(|b| bits < b.bits) {
-            best = Some(RicePlan { order: p, params, bits, wide });
-        }
-    }
-    best.unwrap_or(RicePlan { order: 0, params: vec![0], bits: u64::MAX, wide: false })
-}
-
-fn write_residual(w: &mut BitWriter, u: &[u64], block_len: usize, pred_order: usize, plan: &RicePlan) {
-    w.write(u64::from(plan.wide), 2);
-    w.write(u64::from(plan.order), 4);
-    let parts = 1usize << plan.order;
-    let per = block_len / parts;
-    let mut start = 0usize;
-    for (i, &k) in plan.params.iter().enumerate() {
-        let len = if i == 0 { per - pred_order } else { per };
-        w.write(u64::from(k), if plan.wide { 5 } else { 4 });
-        for &v in u.get(start..start + len).unwrap_or_default() {
-            w.write_unary(v >> k);
-            w.write(v, k);
-        }
-        start += len;
-    }
-}
-
-fn write_subframe(w: &mut BitWriter, x: &[i64], bps: u32) {
-    let n = x.len();
-    let first = x.first().copied().unwrap_or(0);
-    if x.iter().all(|&s| s == first) {
-        w.write(0, 1);
-        w.write(0, 6);
-        w.write(0, 1);
-        w.write_signed(first, bps);
-        return;
-    }
-    let verbatim_bits = n as u64 * u64::from(bps);
-    let mut best: Option<(usize, Vec<u64>, RicePlan)> = None;
-    for order in 0..=4usize.min(n.saturating_sub(1)) {
-        let Some(res) = fixed_residual(x, order) else { continue };
-        let u: Vec<u64> = res.into_iter().map(zigzag).collect();
-        let plan = plan_residual(&u, n, order);
-        let bits = plan.bits.saturating_add(order as u64 * u64::from(bps));
-        if bits < verbatim_bits && best.as_ref().is_none_or(|b| bits < b.2.bits.saturating_add(b.0 as u64 * u64::from(bps))) {
-            best = Some((order, u, plan));
-        }
-    }
-    match best {
-        Some((order, u, plan)) => {
-            w.write(0, 1);
-            w.write(8 + order as u64, 6);
-            w.write(0, 1);
-            for &s in x.iter().take(order) {
-                w.write_signed(s, bps);
-            }
-            write_residual(w, &u, n, order, &plan);
-        }
-        None => {
-            w.write(0, 1);
-            w.write(1, 6);
-            w.write(0, 1);
-            for &s in x {
-                w.write_signed(s, bps);
-            }
-        }
-    }
-}
-
-/// Checks that FLAC can hold the layout; returns the bits per sample.
-fn check(channels: usize, sample_rate: u32, depth: BitDepth) -> Result<u32> {
-    crate::pcm::validate_layout(channels, sample_rate)?;
-    if channels > 8 {
-        return Err(AudioError::Unsupported(format!("FLAC supports at most 8 channels, got {channels}")));
-    }
-    if sample_rate > 655_350 {
-        return Err(AudioError::Unsupported(format!("FLAC sample rate {sample_rate} exceeds 655350 Hz")));
-    }
-    match depth {
-        BitDepth::Int16 => Ok(16),
-        BitDepth::Int24 => Ok(24),
-        BitDepth::Int32 => Ok(32),
-        BitDepth::Float32 => Err(AudioError::Unsupported("FLAC cannot store 32-bit float samples".into())),
-    }
-}
-
-fn stream_info(channels: usize, sample_rate: u32, bps: u32, total: u64) -> Vec<u8> {
-    let mut si = BitWriter::new();
-    si.write(1, 1); // last metadata block
-    si.write(0, 7); // STREAMINFO
-    si.write(34, 24);
-    si.write(BLOCK_SIZE as u64, 16);
-    si.write(BLOCK_SIZE as u64, 16);
-    si.write(0, 24);
-    si.write(0, 24);
-    si.write(u64::from(sample_rate), 20);
-    si.write(channels as u64 - 1, 3);
-    si.write(u64::from(bps - 1), 5);
-    si.write(total >> 32, 4);
-    si.write(total & 0xFFFF_FFFF, 32);
-    for _ in 0..4 {
-        si.write(0, 32); // MD5 unknown
-    }
-    si.into_bytes()
-}
-
-/// A FLAC stream written block by block; [`Writer::finish`] fills in the total sample count.
-pub(crate) struct Writer<W> {
-    out: W,
-    start: u64,
-    channels: usize,
-    sample_rate: u32,
-    bps: u32,
-    quantizers: Vec<Quantizer>,
-    pending: Vec<Vec<i64>>,
-    frames: u64,
-    frame_no: u64,
-    /// Set when a frame write has failed: `write_frame` clears the pending samples before
-    /// writing, so a failed frame is lost while `frames` still counts it; the writer refuses
-    /// every later call.
-    failed: bool,
-}
-
-impl<W: Write + Seek> Writer<W> {
-    pub(crate) fn new(mut out: W, channels: usize, sample_rate: u32, depth: BitDepth, dither: bool) -> Result<Self> {
-        let bps = check(channels, sample_rate, depth)?;
-        let start = out.stream_position()?;
-        out.write_all(b"fLaC")?;
-        out.write_all(&stream_info(channels, sample_rate, bps, 0))?;
-        Ok(Writer {
-            out,
-            start,
-            channels,
-            sample_rate,
-            bps,
-            quantizers: Quantizer::per_channel(bps, dither, channels),
-            pending: (0..channels).map(|_| Vec::with_capacity(BLOCK_SIZE)).collect(),
-            frames: 0,
-            frame_no: 0,
-            failed: false,
-        })
-    }
-
-    /// The frame count after `frames` more, or an error past what FLAC can count (2^36 frames).
-    pub(crate) fn check_room(&self, frames: u64) -> Result<u64> {
-        let total = self.frames.saturating_add(frames);
-        if total >= 1u64 << 36 {
-            return Err(AudioError::TooLarge("too many frames for FLAC".into()));
-        }
-        Ok(total)
-    }
-
-    /// Appends `frames` frames of planar audio (missing samples are silence), unless they don't
-    /// fit (see [`Writer::check_room`]).
-    pub(crate) fn write(&mut self, block: &[Vec<f32>], frames: usize) -> Result<()> {
-        if self.failed {
-            return Err(crate::failed_write_error());
-        }
-        let total = self.check_room(frames as u64)?;
-        let mut done = 0;
-        while done < frames {
-            let held = self.pending.first().map_or(0, Vec::len);
-            let n = (BLOCK_SIZE - held).min(frames - done);
-            for (c, (p, q)) in self.pending.iter_mut().zip(self.quantizers.iter_mut()).enumerate() {
-                let src = block.get(c).and_then(|ch| ch.get(done..)).unwrap_or_default();
-                p.extend((0..n).map(|i| i64::from(q.quantize(src.get(i).copied().unwrap_or(0.0)))));
-            }
-            done += n;
-            if held + n == BLOCK_SIZE
-                && let Err(e) = self.write_frame()
-            {
-                self.failed = true;
-                return Err(e);
-            }
-        }
-        self.frames = total;
-        Ok(())
-    }
-
-    fn write_frame(&mut self) -> Result<()> {
-        let len = self.pending.first().map_or(0, Vec::len);
-        if len == 0 {
-            return Ok(());
-        }
-        let (sr_code, sr_extra) = sample_rate_code(self.sample_rate);
-        let mut w = BitWriter::new();
-        w.write(0x3FFE, 14);
-        w.write(0, 1);
-        w.write(0, 1); // fixed blocksize stream
-        w.write(7, 4); // 16-bit (blocksize-1) follows
-        w.write(sr_code, 4);
-        w.write(self.channels as u64 - 1, 4);
-        w.write(bps_code(self.bps), 3);
-        w.write(0, 1);
-        write_utf8_number(&mut w, self.frame_no);
-        w.write(len as u64 - 1, 16);
-        if let Some((v, n)) = sr_extra {
-            w.write(v, n);
-        }
-        let header = w.into_bytes();
-        let mut w = BitWriter::new();
-        for &b in &header {
-            w.write(u64::from(b), 8);
-        }
-        w.write(u64::from(crc8(&header)), 8);
-        for p in &mut self.pending {
-            write_subframe(&mut w, p, self.bps);
-            p.clear();
-        }
-        let mut frame = w.into_bytes();
-        let crc = crc16(&frame);
-        frame.extend_from_slice(&crc.to_be_bytes());
-        self.out.write_all(&frame)?;
-        self.frame_no += 1;
-        Ok(())
-    }
-
-    pub(crate) fn finish(mut self) -> Result<W> {
-        if self.failed {
-            return Err(crate::failed_write_error());
-        }
-        self.write_frame()?;
-        let info = stream_info(self.channels, self.sample_rate, self.bps, self.frames);
-        self.out.seek(SeekFrom::Start(self.start.saturating_add(4)))?;
-        self.out.write_all(&info)?;
-        self.out.seek(SeekFrom::End(0))?;
-        self.out.flush()?;
-        Ok(self.out)
-    }
-}
-
-pub(crate) fn encode(buf: &AudioBuffer, depth: BitDepth, dither: bool) -> Result<Vec<u8>> {
-    validate_buffer(buf)?;
-    let bps = check(buf.channels.len(), buf.sample_rate, depth)?;
-    let frames = buf.frames();
-    let mut out = Vec::new();
-    out.try_reserve(frames.saturating_mul(buf.channels.len()).saturating_mul(bps as usize / 8) / 2)
-        .map_err(|_| AudioError::TooLarge("cannot allocate FLAC output".into()))?;
-    let mut w = Writer::new(Cursor::new(out), buf.channels.len(), buf.sample_rate, depth, dither)?;
-    w.write(&buf.channels, frames)?;
-    Ok(w.finish()?.into_inner())
-}
-
-/// Refuse the FLAC stream at `at` if a comment or picture field claims more bytes than its
-/// metadata block holds: symphonia allocates each field's length before reading it.
-pub(crate) fn check_metadata(b: &[u8], at: usize) -> Result<()> {
-    let mut pos = at + 4;
-    while let Some(head) = be_u32(b, pos) {
-        let (body, len) = (pos + 4, (head & 0x00ff_ffff) as usize);
-        let end = (body + len).min(b.len());
-        let overruns = match (head >> 24) & 0x7f {
-            4 => comments_overrun(b, body, end),
-            // Picture: type, MIME type, description, four size fields, data.
-            6 => overruns(b, body + 4, end, be_u32, [0, 0, 16]),
-            _ => false,
-        };
-        if overruns {
-            return Err(AudioError::Malformed("a FLAC metadata field is larger than its block".into()));
-        }
-        if head >> 31 == 1 {
-            break;
-        }
-        pos = body + len;
-    }
-    Ok(())
-}
-
-/// The info of a FLAC stream with no audio frames at all: STREAMINFO declares 0 samples and
-/// nothing follows the metadata blocks. Symphonia's reader fails on these, as it looks for a first
-/// frame, so the caller answers them itself.
-pub(crate) fn empty_stream_info(b: &[u8], at: usize) -> Option<AudioInfo> {
-    let mut pos = at.checked_add(4)?;
-    let mut first = true;
-    loop {
-        let head = be_u32(b, pos)?;
-        let (body, len) = (pos.checked_add(4)?, (head & 0x00ff_ffff) as usize);
-        let end = body.checked_add(len)?;
-        if end > b.len() {
-            return None;
-        }
-        if first && ((head >> 24) & 0x7f != 0 || len != 34) {
-            return None;
-        }
-        first = false;
-        if head >> 31 == 1 {
-            if end != b.len() {
-                return None;
-            }
-            break;
-        }
-        pos = end;
-    }
-    // STREAMINFO, from the sample rate on: 20 bits rate, 3 channels - 1, 5 bits per sample - 1, 36 bits total.
-    let si = at.checked_add(4 + 4 + 10)?;
-    let packed = u64::from_be_bytes(b.get(si..si.checked_add(8)?)?.try_into().ok()?);
-    let sample_rate = (packed >> 44) as u32;
-    let channels = ((packed >> 41) & 0x7) as u16 + 1;
-    let bps = ((packed >> 36) & 0x1f) as u32 + 1;
-    if packed & 0xf_ffff_ffff != 0 || sample_rate == 0 {
-        return None;
-    }
-    let sample_format = match bps {
-        1..=8 => SampleFormat::Int8,
-        9..=16 => SampleFormat::Int16,
-        17..=24 => SampleFormat::Int24,
-        _ => SampleFormat::Int32,
-    };
-    Some(AudioInfo { format: FileFormat::Flac, sample_format, sample_rate, channels, frames: 0, bwf: None })
-}
-
-/// Whether a vendor string or comment in a (little-endian) Vorbis comment block claims more than
-/// the block holds.
-fn comments_overrun(b: &[u8], body: usize, end: usize) -> bool {
-    let Some(vendor) = le_u32(b, body).filter(|_| body.saturating_add(4) <= end) else { return false };
-    if vendor as usize > end - (body + 4) {
-        return true;
-    }
-    let at = (body + 4).saturating_add(vendor as usize);
-    let Some(count) = le_u32(b, at).filter(|_| at.saturating_add(4) <= end) else { return false };
-    overruns(b, at + 4, end, le_u32, std::iter::repeat_n(0, count as usize))
-}
-
-/// Whether one of the length-prefixed fields from `at` claims more than `end` leaves; `gaps` are
-/// the bytes skipped before each length, which `read` reads.
-fn overruns(b: &[u8], mut at: usize, end: usize, read: fn(&[u8], usize) -> Option<u32>, gaps: impl IntoIterator<Item = usize>) -> bool {
-    for gap in gaps {
-        at = at.saturating_add(gap);
-        let Some(n) = read(b, at).filter(|_| at.saturating_add(4) <= end) else { return false };
-        at += 4;
-        if n as usize > end - at {
-            return true;
-        }
-        at += n as usize;
-    }
-    false
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn crc_known_values() {
-        // CRC-8/SMBUS and CRC-16/UMTS (FLAC's polynomials) of "123456789".
-        assert_eq!(crc8(b"123456789"), 0xF4);
-        assert_eq!(crc16(b"123456789"), 0xFEE8);
-    }
-
-    #[test]
-    fn utf8_numbers() {
-        let enc = |v| {
-            let mut w = BitWriter::new();
-            write_utf8_number(&mut w, v);
-            w.into_bytes()
-        };
-        assert_eq!(enc(0x7F), vec![0x7F]);
-        assert_eq!(enc(0x80), vec![0xC2, 0x80]);
-        assert_eq!(enc(0x800), vec![0xE0, 0xA0, 0x80]);
-    }
-}
@@ -1,459 +0,0 @@
-//! SoundCraft audio file I/O.
-//!
-//! Bytes in, bytes out (no filesystem access, so the crate also builds for `wasm32`):
-//!
-//! * [`detect_format`] / [`probe`] / [`decode`] read WAV (PCM 8/16/24/32, float 32/64,
-//!   `WAVE_FORMAT_EXTENSIBLE`, RF64/BW64, BWF `bext`) and AIFF/AIFF-C (big-endian, `sowt`,
-//!   `fl32`/`fl64`) with native readers, and everything else (FLAC, MP3, Ogg Vorbis, AAC/ALAC in
-//!   MP4, CAF, Matroska, ADPCM/A-law/µ-law WAV, ...) through `symphonia`.
-//! * [`encode`] writes WAV/BWF (RF64 above 4 GiB), AIFF / AIFF-C `fl32`, and FLAC (built-in
-//!   encoder), with optional TPDF dither.
-//! * [`wav_float_header`] heads a float WAV written while it grows (recording).
-//! * [`peaks`] builds multi-resolution min/max overviews for waveform drawing.
-//! * [`FileEncoder`] writes the same formats block by block into any `Write + Seek`, so a file
-//!   of any length never has to fit in memory.
-#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
-
-mod aiff;
-mod buffer;
-mod caf;
-mod flac;
-mod mp4;
-mod pcm;
-pub mod peaks;
-mod symph;
-mod wav;
-
-pub use buffer::AudioBuffer;
-use std::io::{Seek, Write};
-
-/// Errors from probing, decoding and encoding.
-#[derive(Debug, thiserror::Error)]
-pub enum AudioError {
-    /// The format, codec or option is valid but not supported.
-    #[error("unsupported audio: {0}")]
-    Unsupported(String),
-    /// The input is corrupt or not what it claims to be.
-    #[error("malformed audio: {0}")]
-    Malformed(String),
-    /// The input (or requested output) exceeds a size limit.
-    #[error("audio too large: {0}")]
-    TooLarge(String),
-    /// Encoding failed (e.g. an empty buffer).
-    #[error("audio encode failed: {0}")]
-    Encode(String),
-    /// Writing the output failed.
-    #[error("audio write failed: {0}")]
-    Io(#[from] std::io::Error),
-}
-
-/// Result alias for this crate.
-pub type Result<T> = std::result::Result<T, AudioError>;
-
-/// Container / codec family of an audio file.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-pub enum FileFormat {
-    Wav,
-    Aiff,
-    Flac,
-    Mp3,
-    Ogg,
-    Aac,
-    Alac,
-    Caf,
-    /// Any other container `symphonia` reads: Matroska and WebM by name.
-    Other,
-}
-
-impl FileFormat {
-    /// The formats [`decode`] reads, found by extension. Contents decide when they disagree.
-    pub const READ: &'static [FileFormat] =
-        &[FileFormat::Wav, FileFormat::Aiff, FileFormat::Flac, FileFormat::Mp3, FileFormat::Ogg, FileFormat::Aac, FileFormat::Caf, FileFormat::Other];
-    /// The formats [`encode`] writes.
-    pub const WRITE: &'static [FileFormat] = &[FileFormat::Wav, FileFormat::Aiff, FileFormat::Flac];
-
-    /// The extensions that name this format, lower case and without the dot; the first is the one
-    /// a new file gets. ALAC shares AAC's MP4 container, so a `.m4a` name reads as AAC until the
-    /// contents say otherwise.
-    pub fn extensions(self) -> &'static [&'static str] {
-        match self {
-            FileFormat::Wav => &["wav", "wave", "bwf", "rf64"],
-            FileFormat::Aiff => &["aif", "aiff", "aifc"],
-            FileFormat::Flac => &["flac"],
-            FileFormat::Mp3 => &["mp3", "mp2", "mp1"],
-            FileFormat::Ogg => &["ogg", "oga"],
-            FileFormat::Aac => &["m4a", "m4b", "aac", "mp4", "adts"],
-            FileFormat::Alac => &["m4a"],
-            FileFormat::Caf => &["caf"],
-            FileFormat::Other => &["mkv", "webm"],
-        }
-    }
-
-    /// The name people know the format by, as menus show it.
-    pub fn name(self) -> &'static str {
-        match self {
-            FileFormat::Wav => "WAV",
-            FileFormat::Aiff => "AIFF",
-            FileFormat::Flac => "FLAC",
-            FileFormat::Mp3 => "MP3",
-            FileFormat::Ogg => "Ogg Vorbis",
-            FileFormat::Aac => "AAC",
-            FileFormat::Alac => "ALAC",
-            FileFormat::Caf => "CAF",
-            FileFormat::Other => "Other",
-        }
-    }
-
-    /// The media type a file of this format is served or downloaded as.
-    pub fn mime_type(self) -> &'static str {
-        match self {
-            FileFormat::Wav => "audio/wav",
-            FileFormat::Aiff => "audio/aiff",
-            FileFormat::Flac => "audio/flac",
-            FileFormat::Mp3 => "audio/mpeg",
-            FileFormat::Ogg => "audio/ogg",
-            FileFormat::Aac | FileFormat::Alac => "audio/mp4",
-            FileFormat::Caf => "audio/x-caf",
-            FileFormat::Other => "application/octet-stream",
-        }
-    }
-
-    /// The extension a new file of this format gets.
-    pub fn default_extension(self) -> &'static str {
-        self.extensions().first().copied().unwrap_or("bin")
-    }
-
-    /// The readable format an extension or format name names (`wav`, `.AIFF`; ASCII
-    /// case-insensitive), or `None` when nothing reads it.
-    pub fn from_extension(ext: &str) -> Option<FileFormat> {
-        let ext = ext.trim_start_matches('.');
-        Self::READ.iter().copied().find(|f| f.extensions().iter().any(|x| x.eq_ignore_ascii_case(ext)))
-    }
-
-    /// The readable format `path`'s extension names, or `None` without a known extension.
-    pub fn from_path(path: impl AsRef<std::path::Path>) -> Option<FileFormat> {
-        path.as_ref().extension().and_then(std::ffi::OsStr::to_str).and_then(Self::from_extension)
-    }
-
-    /// The extensions [`encode`] writes this format under: the names whose readers expect what it
-    /// writes. RF64 and AIFF-C names are left out because `encode` writes plain RIFF and AIFF
-    /// headers for them.
-    pub fn write_extensions(self) -> &'static [&'static str] {
-        match self {
-            FileFormat::Wav => &["wav", "wave", "bwf"],
-            FileFormat::Aiff => &["aif", "aiff"],
-            FileFormat::Flac => &["flac"],
-            _ => &[],
-        }
-    }
-
-    /// The format [`encode`] writes for an extension or format name (ASCII case-insensitive), or
-    /// `None` when it writes none.
-    pub fn from_write_extension(ext: &str) -> Option<FileFormat> {
-        let ext = ext.trim_start_matches('.');
-        Self::WRITE.iter().copied().find(|f| f.write_extensions().iter().any(|x| x.eq_ignore_ascii_case(ext)))
-    }
-
-    /// Every extension of [`FileFormat::READ`], in order: what file pickers and browsers filter by.
-    pub fn readable_extensions() -> Vec<&'static str> {
-        Self::READ.iter().flat_map(|f| f.extensions().iter().copied()).collect()
-    }
-
-    /// Every extension of [`FileFormat::WRITE`], in order: what save dialogs, help and errors list.
-    pub fn writable_extensions() -> Vec<&'static str> {
-        Self::WRITE.iter().flat_map(|f| f.write_extensions().iter().copied()).collect()
-    }
-}
-
-/// Stored sample representation.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-pub enum SampleFormat {
-    Int8,
-    Int16,
-    Int24,
-    Int32,
-    Float32,
-    Float64,
-    /// A lossy codec (MP3, AAC, Vorbis, ...): no fixed bit depth.
-    Compressed,
-}
-
-/// Broadcast Wave (`bext`) metadata.
-#[derive(Debug, Clone, Default, PartialEq, serde::Serialize, serde::Deserialize)]
-pub struct BwfInfo {
-    pub description: String,
-    pub originator: String,
-    pub originator_reference: String,
-    /// `yyyy-mm-dd`.
-    pub origination_date: String,
-    /// `hh:mm:ss`.
-    pub origination_time: String,
-    /// Sample count since midnight of the first sample (the timestamp Pro Tools spots to).
-    pub time_reference: u64,
-}
-
-/// What [`probe`] learns about a file without decoding all of it.
-#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
-pub struct AudioInfo {
-    pub format: FileFormat,
-    pub sample_format: SampleFormat,
-    pub sample_rate: u32,
-    pub channels: u16,
-    pub frames: u64,
-    pub bwf: Option<BwfInfo>,
-}
-
-impl AudioInfo {
-    /// Duration in seconds.
-    pub fn duration_secs(&self) -> f64 {
-        if self.sample_rate == 0 { 0.0 } else { self.frames as f64 / f64::from(self.sample_rate) }
-    }
-}
-
-/// Bit depth for [`encode`].
-#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-pub enum BitDepth {
-    Int16,
-    Int24,
-    Int32,
-    /// Preserve finite samples, including values above full scale; map NaN to 0 and infinities to ±1.
-    Float32,
-}
-
-/// Options for [`encode`].
-#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
-pub struct EncodeOptions {
-    /// `Wav`, `Aiff` or `Flac`; anything else is [`AudioError::Unsupported`].
-    pub format: FileFormat,
-    pub bit_depth: BitDepth,
-    /// Add TPDF dither when quantizing to an integer depth.
-    pub dither: bool,
-    /// Write a BWF `bext` chunk (WAV only; ignored for other formats).
-    pub bwf: Option<BwfInfo>,
-}
-
-impl Default for EncodeOptions {
-    fn default() -> Self {
-        Self { format: FileFormat::Wav, bit_depth: BitDepth::Int24, dither: false, bwf: None }
-    }
-}
-
-/// Size of an ID3v2 tag at the start of `b`, if there is one. The 10-byte footer flag (`0x10`)
-/// exists only in ID3v2.4; in v2.2/v2.3 that bit is reserved and must not extend the skip.
-fn id3v2_len(b: &[u8]) -> Option<usize> {
-    if b.get(..3)? != b"ID3" {
-        return None;
-    }
-    let version = *b.get(3)?;
-    let flags = *b.get(5)?;
-    let size = b.get(6..10)?.iter().fold(0usize, |acc, &x| (acc << 7) | usize::from(x & 0x7F));
-    let footer = version == 4 && flags & 0x10 != 0;
-    Some(10 + size + if footer { 10 } else { 0 })
-}
-
-fn detect_by_magic(b: &[u8], depth: u32) -> Option<FileFormat> {
-    let head = |n: usize| b.get(..n);
-    if wav::is_wav(b) {
-        return Some(FileFormat::Wav);
-    }
-    if aiff::is_aiff(b) {
-        return Some(FileFormat::Aiff);
-    }
-    match head(4)? {
-        b"fLaC" => return Some(FileFormat::Flac),
-        b"OggS" => return Some(FileFormat::Ogg),
-        b"caff" => return Some(FileFormat::Caf),
-        [0x1A, 0x45, 0xDF, 0xA3] => return Some(FileFormat::Other),
-        _ => {}
-    }
-    if b.get(4..8) == Some(b"ftyp") {
-        // MP4 / M4A: the sample entry inside `stsd` names the codec.
-        let found = b.windows(4).position(|w| w == b"stsd");
-        let codec = found.and_then(|p| b.get(p.checked_add(16)?..p.checked_add(20)?));
-        return Some(if codec == Some(b"alac") { FileFormat::Alac } else { FileFormat::Aac });
-    }
-    if let Some(len) = id3v2_len(b) {
-        if depth == 0
-            && let Some(f) = b.get(len..).and_then(|rest| detect_by_magic(rest, 1))
-        {
-            return Some(f);
-        }
-        return Some(FileFormat::Mp3);
-    }
-    let (b0, b1) = (*b.first()?, *b.get(1)?);
-    if b0 == 0xFF && b1 & 0xE0 == 0xE0 {
-        let layer = (b1 >> 1) & 0x3;
-        if b1 & 0xF0 == 0xF0 && layer == 0 {
-            return Some(FileFormat::Aac); // ADTS
-        }
-        if layer != 0 {
-            return Some(FileFormat::Mp3);
-        }
-    }
-    None
-}
-
-/// Identify a file by its magic bytes, falling back to the extension hint (`"wav"`, `".flac"`).
-pub fn detect_format(bytes: &[u8], ext_hint: Option<&str>) -> FileFormat {
-    detect_by_magic(bytes, 0).unwrap_or_else(|| ext_hint.and_then(FileFormat::from_extension).unwrap_or(FileFormat::Other))
-}
-
-/// Read a file's format, sample rate, channel count, length and BWF metadata.
-pub fn probe(bytes: &[u8], ext_hint: Option<&str>) -> Result<AudioInfo> {
-    let format = detect_format(bytes, ext_hint);
-    match format {
-        FileFormat::Wav if wav::is_wav(bytes) => match wav::parse(bytes)? {
-            wav::WavParse::Native(l) => Ok(l.info),
-            wav::WavParse::Foreign { bwf } => {
-                let mut info = symph::probe(bytes, format)?;
-                info.bwf = bwf;
-                Ok(info)
-            }
-        },
-        FileFormat::Aiff if aiff::is_aiff(bytes) => match aiff::parse(bytes)? {
-            aiff::AiffParse::Native(l) => Ok(l.info),
-            aiff::AiffParse::Foreign => symph::probe(bytes, format),
-        },
-        _ => symph::probe(bytes, format),
-    }
-}
-
-/// Decode a whole file to planar `f32`.
-pub fn decode(bytes: &[u8], ext_hint: Option<&str>) -> Result<(AudioInfo, AudioBuffer)> {
-    let format = detect_format(bytes, ext_hint);
-    match format {
-        FileFormat::Wav if wav::is_wav(bytes) => match wav::parse(bytes)? {
-            wav::WavParse::Native(l) => {
-                let buf = wav::decode(bytes, &l)?;
-                let mut info = l.info;
-                info.frames = buf.frames() as u64;
-                Ok((info, buf))
-            }
-            wav::WavParse::Foreign { bwf } => {
-                let (mut info, buf) = symph::decode(bytes, format)?;
-                info.bwf = bwf;
-                Ok((info, buf))
-            }
-        },
-        FileFormat::Aiff if aiff::is_aiff(bytes) => match aiff::parse(bytes)? {
-            aiff::AiffParse::Native(l) => {
-                let buf = aiff::decode(bytes, &l)?;
-                let mut info = l.info;
-                info.frames = buf.frames() as u64;
-                Ok((info, buf))
-            }
-            aiff::AiffParse::Foreign => symph::decode(bytes, format),
-        },
-        _ => symph::decode(bytes, format),
-    }
-}
-
-/// Encode `buf` as WAV/BWF, AIFF/AIFF-C or FLAC. Samples are clamped to [-1, 1].
-pub fn encode(buf: &AudioBuffer, opts: &EncodeOptions) -> Result<Vec<u8>> {
-    match opts.format {
-        FileFormat::Wav => wav::encode(buf, opts.bit_depth, opts.dither, opts.bwf.as_ref(), false, None),
-        FileFormat::Aiff => aiff::encode(buf, opts.bit_depth, opts.dither),
-        FileFormat::Flac => flac::encode(buf, opts.bit_depth, opts.dither),
-        other => Err(AudioError::Unsupported(format!("encoding {other:?} is not supported"))),
-    }
-}
-
-/// Encode a WAV file in the RF64 layout regardless of size (normally used only above 4 GiB).
-pub fn encode_wav_rf64(buf: &AudioBuffer, opts: &EncodeOptions) -> Result<Vec<u8>> {
-    wav::encode(buf, opts.bit_depth, opts.dither, opts.bwf.as_ref(), true, None)
-}
-
-/// Like [`encode`], with an explicit WAV speaker mask (`dwChannelMask`, e.g. 0x60F) for layouts
-/// a channel count alone cannot identify (7.0 vs 6.1, 5.1.4 vs 7.1.2, Ambisonics = 0). AIFF and
-/// FLAC have fixed channel orders and ignore it.
-pub fn encode_with_channel_mask(buf: &AudioBuffer, opts: &EncodeOptions, mask: u32) -> Result<Vec<u8>> {
-    match opts.format {
-        FileFormat::Wav => wav::encode(buf, opts.bit_depth, opts.dither, opts.bwf.as_ref(), false, Some(mask)),
-        _ => encode(buf, opts),
-    }
-}
-
-/// The error a stream encoder returns for every call after one of its writes has failed: the
-/// sink may already hold a prefix of the failed block, so the encoder's counters can no longer
-/// describe the bytes on the sink, and later writes or `finish` must not claim success.
-pub(crate) fn failed_write_error() -> AudioError {
-    AudioError::Encode("the stream encoder already failed on an earlier write; its output is incomplete".into())
-}
-
-/// Writes WAV/BWF (RF64 above 4 GiB), AIFF / AIFF-C `fl32` or FLAC block by block, producing
-/// the same bytes [`encode_with_channel_mask`] would for the whole buffer.
-pub struct FileEncoder<W: Write + Seek>(Writer<W>);
-
-enum Writer<W> {
-    Wav(wav::Writer<W>),
-    Aiff(aiff::Writer<W>),
-    Flac(flac::Writer<W>),
-}
-
-impl<W: Write + Seek> FileEncoder<W> {
-    /// Starts a file at the current position of `out`. `mask` overrides the WAV speaker mask
-    /// derived from the channel count.
-    pub fn new(out: W, opts: &EncodeOptions, channels: usize, sample_rate: u32, mask: Option<u32>) -> Result<Self> {
-        let (depth, dither) = (opts.bit_depth, opts.dither);
-        Ok(FileEncoder(match opts.format {
-            FileFormat::Wav => Writer::Wav(wav::Writer::new(
-                out,
-                channels,
-                sample_rate,
-                depth,
-                dither,
-                wav::HeaderExtras { bwf: opts.bwf.as_ref(), mask, force_rf64: false },
-            )?),
-            FileFormat::Aiff => Writer::Aiff(aiff::Writer::new(out, channels, sample_rate, depth, dither)?),
-            FileFormat::Flac => Writer::Flac(flac::Writer::new(out, channels, sample_rate, depth, dither)?),
-            other => return Err(AudioError::Unsupported(format!("encoding {other:?} is not supported"))),
-        }))
-    }
-
-    /// Fails, without writing anything, when `frames` more frames would not fit the format (an
-    /// AIFF holds 4 GiB, a FLAC 2^36 frames).
-    pub fn check_room(&self, frames: u64) -> Result<()> {
-        match &self.0 {
-            Writer::Wav(w) => w.check_room(frames),
-            Writer::Aiff(w) => w.check_room(frames),
-            Writer::Flac(w) => w.check_room(frames),
-        }
-        .map(drop)
-    }
-
-    /// Appends the first `frames` frames of `block`, one `Vec` per channel (missing samples are
-    /// silence), unless they don't fit (see [`FileEncoder::check_room`]). Once a write has
-    /// failed, the encoder is unusable: the sink may hold a prefix of the failed block, so
-    /// every later `write` and `finish` fails instead of completing an inconsistent file.
-    pub fn write(&mut self, block: &[Vec<f32>], frames: usize) -> Result<()> {
-        match &mut self.0 {
-            Writer::Wav(w) => w.write(block, frames),
-            Writer::Aiff(w) => w.write(block, frames),
-            Writer::Flac(w) => w.write(block, frames),
-        }
-    }
-
-    /// Completes the headers and hands back `out`, positioned at the end of the file.
-    pub fn finish(self) -> Result<W> {
-        match self.0 {
-            Writer::Wav(w) => w.finish(),
-            Writer::Aiff(w) => w.finish(),
-            Writer::Flac(w) => w.finish(),
-        }
-    }
-}
-
-/// The WAVE_FORMAT_EXTENSIBLE speaker mask of a WAV file, if it has one.
-pub fn wav_channel_mask(bytes: &[u8]) -> Option<u32> {
-    wav::read_channel_mask(bytes)
-}
-
-/// The header of a 32-bit float WAV holding `frames` frames (little-endian samples follow it). Its
-/// length doesn't depend on `frames`, so a recorder can rewrite it in place as the file grows; it
-/// switches to RF64 above 4 GiB.
-pub fn wav_float_header(channels: usize, sample_rate: u32, frames: u64) -> Result<Vec<u8>> {
-    if channels == 0 || sample_rate == 0 {
-        return Err(AudioError::Encode("a WAV needs channels and a sample rate".into()));
-    }
-    wav::header(channels, sample_rate, (32, true), None, None, frames, false)
-}
@@ -1,106 +0,0 @@
-//! Size checks on MP4 atoms before symphonia reads them: it allocates whatever an atom, a sample
-//! table or a sample claims, and a failed allocation aborts the process.
-
-use crate::pcm::{be_u32, be_u64};
-use crate::{AudioError, Result};
-
-#[derive(Clone, Copy)]
-enum Level {
-    Top,
-    Moov,
-    Trak,
-    Mdia,
-    Minf,
-    Stbl,
-    Udta,
-    Meta,
-    Ilst,
-    Tag,
-}
-
-/// Refuse the MP4 file whose top-level atoms start at `at` if an atom symphonia reads whole, a
-/// sample table or a sample claims more bytes than the file holds.
-pub(crate) fn check(b: &[u8], at: usize) -> Result<()> {
-    atoms(b, at, b.len(), Level::Top).map(|_| ())
-}
-
-fn malformed(what: &str) -> AudioError {
-    AudioError::Malformed(format!("MP4 {what} is larger than the file"))
-}
-
-/// Walk the atoms in `pos..end` that symphonia descends into, as it reads them. False where
-/// symphonia stops reading: at a header it refuses, or after an atom that runs past `end`.
-fn atoms(b: &[u8], mut pos: usize, end: usize, level: Level) -> Result<bool> {
-    // A header that starts inside the container is read whole, even past its end.
-    while pos < end {
-        let (Some(size), Some(kind)) = (be_u32(b, pos), b.get(pos + 4..pos + 8)) else { return Ok(false) };
-        let head = if size == 1 { 16 } else { 8 };
-        // Size 0: no data, and the next atom starts at the container's end.
-        let len = match size {
-            0 => head,
-            1 => be_u64(b, pos + 8).unwrap_or(0),
-            n => u64::from(n),
-        };
-        if len < head {
-            return Ok(false);
-        }
-        let body = pos + head as usize;
-        let data_end = usize::try_from(len).ok().and_then(|n| pos.checked_add(n));
-        let next = if size == 0 { Some(end) } else { data_end };
-        let inner = data_end.map_or(b.len(), |n| n.min(b.len()));
-        let more = match (level, kind) {
-            (Level::Top, b"moov") => atoms(b, body, inner, Level::Moov)?,
-            (Level::Top | Level::Udta, b"meta") => atoms(b, body + 4, inner, Level::Meta)?,
-            (Level::Moov, b"trak") => atoms(b, body, inner, Level::Trak)?,
-            (Level::Moov, b"udta") => atoms(b, body, inner, Level::Udta)?,
-            (Level::Trak, b"mdia") => atoms(b, body, inner, Level::Mdia)?,
-            (Level::Mdia, b"minf") => atoms(b, body, inner, Level::Minf)?,
-            (Level::Minf, b"stbl") => atoms(b, body, inner, Level::Stbl)?,
-            (Level::Meta, b"ilst") => atoms(b, body, inner, Level::Ilst)?,
-            (Level::Ilst, _) => atoms(b, body, inner, Level::Tag)?,
-            (Level::Stbl, b"stts" | b"co64") => table(b, body + 4, 8, inner)?,
-            (Level::Stbl, b"stsc") => table(b, body + 4, 12, inner)?,
-            (Level::Stbl, b"stco") => table(b, body + 4, 4, inner)?,
-            (Level::Stbl, b"stsz") => sample_sizes(b, body, inner)?,
-            (Level::Mdia, b"hdlr") | (Level::Tag, b"data" | b"name" | b"mean") if len > (b.len() - pos) as u64 => {
-                return Err(malformed(&format!("`{}` atom", String::from_utf8_lossy(kind))));
-            }
-            _ => true,
-        };
-        match next {
-            Some(n) if more && n <= end => pos = n,
-            _ => return Ok(false),
-        }
-    }
-    Ok(true)
-}
-
-/// A sample table's entries, counted at `count`, must fit in the file: symphonia reserves room for
-/// all of them first. False if they run past the table's atom (`end`), where symphonia stops.
-fn table(b: &[u8], count: usize, entry: u64, end: usize) -> Result<bool> {
-    let Some(n) = be_u32(b, count) else { return Ok(false) };
-    let (first, bytes) = (count + 4, u64::from(n) * entry);
-    if bytes > b.len().saturating_sub(first) as u64 {
-        return Err(malformed("sample table"));
-    }
-    Ok(first as u64 + bytes <= end as u64)
-}
-
-/// Every sample's size must fit in the file: symphonia reads each one into a buffer of that size.
-/// Sizes past the atom are never used, as symphonia stops before reading a packet.
-fn sample_sizes(b: &[u8], body: usize, end: usize) -> Result<bool> {
-    let (Some(size), Some(count)) = (be_u32(b, body + 4), be_u32(b, body + 8)) else { return Ok(false) };
-    let file = b.len() as u64;
-    if u64::from(size) > file {
-        return Err(malformed("sample"));
-    }
-    if size != 0 {
-        return Ok(true);
-    }
-    let fits = table(b, body + 8, 4, end)?;
-    let (sizes, _) = b.get(body + 12..end).unwrap_or_default().as_chunks::<4>();
-    if sizes.iter().take(count as usize).any(|s| u64::from(u32::from_be_bytes(*s)) > file) {
-        return Err(malformed("sample"));
-    }
-    Ok(fits)
-}
@@ -1,279 +0,0 @@
-//! Byte-level PCM helpers shared by the WAV, AIFF and FLAC code: bounded readers, sample
-//! decoding to `f32`, and quantization (with optional TPDF dither) for encoding.
-
-use crate::{AudioError, BitDepth, Result};
-use std::io::Write;
-
-/// Maximum number of decoded `f32` samples (all channels) we will produce: 4 GiB of output.
-pub(crate) const MAX_DECODE_SAMPLES: u64 = (4u64 << 30) / 4;
-
-/// Little-endian `u16` at `pos`.
-pub(crate) fn le_u16(b: &[u8], pos: usize) -> Option<u16> {
-    let s = b.get(pos..pos.checked_add(2)?)?;
-    Some(u16::from_le_bytes([*s.first()?, *s.get(1)?]))
-}
-
-/// Little-endian `u32` at `pos`.
-pub(crate) fn le_u32(b: &[u8], pos: usize) -> Option<u32> {
-    let s: [u8; 4] = b.get(pos..pos.checked_add(4)?)?.try_into().ok()?;
-    Some(u32::from_le_bytes(s))
-}
-
-/// Little-endian `u64` at `pos`.
-pub(crate) fn le_u64(b: &[u8], pos: usize) -> Option<u64> {
-    let s: [u8; 8] = b.get(pos..pos.checked_add(8)?)?.try_into().ok()?;
-    Some(u64::from_le_bytes(s))
-}
-
-/// Big-endian `u16` at `pos`.
-pub(crate) fn be_u16(b: &[u8], pos: usize) -> Option<u16> {
-    let s: [u8; 2] = b.get(pos..pos.checked_add(2)?)?.try_into().ok()?;
-    Some(u16::from_be_bytes(s))
-}
-
-/// Big-endian `u32` at `pos`.
-pub(crate) fn be_u32(b: &[u8], pos: usize) -> Option<u32> {
-    let s: [u8; 4] = b.get(pos..pos.checked_add(4)?)?.try_into().ok()?;
-    Some(u32::from_be_bytes(s))
-}
-
-/// Big-endian `u64` at `pos`.
-pub(crate) fn be_u64(b: &[u8], pos: usize) -> Option<u64> {
-    let s: [u8; 8] = b.get(pos..pos.checked_add(8)?)?.try_into().ok()?;
-    Some(u64::from_be_bytes(s))
-}
-
-/// Four-byte tag at `pos`.
-pub(crate) fn tag(b: &[u8], pos: usize) -> Option<[u8; 4]> {
-    b.get(pos..pos.checked_add(4)?)?.try_into().ok()
-}
-
-/// How the samples in a PCM byte stream are encoded.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum PcmKind {
-    /// Signed (or, for 1-byte WAV, unsigned) integers occupying `bytes` bytes each, left-justified.
-    Int { bytes: usize, big_endian: bool, unsigned: bool },
-    /// IEEE float, 4 or 8 bytes.
-    Float { bytes: usize, big_endian: bool },
-}
-
-impl PcmKind {
-    pub(crate) fn bytes(self) -> usize {
-        match self {
-            PcmKind::Int { bytes, .. } | PcmKind::Float { bytes, .. } => bytes,
-        }
-    }
-}
-
-/// Decode one sample from exactly `kind.bytes()` bytes. Returns 0 for a short slice.
-fn decode_sample(s: &[u8], kind: PcmKind) -> f32 {
-    match kind {
-        PcmKind::Int { bytes, big_endian, unsigned } => {
-            if bytes == 0 || bytes > 4 || s.len() < bytes {
-                return 0.0;
-            }
-            let mut acc: u32 = 0;
-            for i in 0..bytes {
-                let idx = if big_endian { i } else { bytes - 1 - i };
-                let mut byte = s.get(idx).copied().unwrap_or(0);
-                if unsigned && i == 0 {
-                    byte ^= 0x80;
-                }
-                acc = (acc << 8) | u32::from(byte);
-            }
-            let shifted = acc << (32 - 8 * bytes as u32);
-            (f64::from(shifted as i32) / 2_147_483_648.0) as f32
-        }
-        PcmKind::Float { bytes, big_endian } => {
-            let v = match bytes {
-                4 => {
-                    let Some(a) = s.get(..4).and_then(|x| <[u8; 4]>::try_from(x).ok()) else { return 0.0 };
-                    if big_endian { f32::from_be_bytes(a) } else { f32::from_le_bytes(a) }
-                }
-                8 => {
-                    let Some(a) = s.get(..8).and_then(|x| <[u8; 8]>::try_from(x).ok()) else { return 0.0 };
-                    (if big_endian { f64::from_be_bytes(a) } else { f64::from_le_bytes(a) }) as f32
-                }
-                _ => 0.0,
-            };
-            if v.is_finite() { v } else { 0.0 }
-        }
-    }
-}
-
-/// Deinterleave `frames` frames of `channels`-channel PCM from `data` into planar `f32`.
-pub(crate) fn deinterleave(data: &[u8], kind: PcmKind, channels: usize, frames: u64) -> Result<Vec<Vec<f32>>> {
-    let bytes = kind.bytes();
-    let block = bytes.checked_mul(channels).filter(|&b| b > 0).ok_or_else(|| AudioError::Malformed("zero-sized sample frame".into()))?;
-    let available = (data.len() / block) as u64;
-    let frames = frames.min(available);
-    let total = frames.checked_mul(channels as u64).ok_or_else(|| AudioError::TooLarge("sample count overflows".into()))?;
-    if total > MAX_DECODE_SAMPLES {
-        return Err(AudioError::TooLarge(format!("{total} samples exceeds the {MAX_DECODE_SAMPLES}-sample decode limit")));
-    }
-    let frames = usize::try_from(frames).map_err(|_| AudioError::TooLarge("frame count exceeds address space".into()))?;
-    let mut out: Vec<Vec<f32>> = (0..channels).map(|_| Vec::with_capacity(frames)).collect();
-    for frame in data.chunks_exact(block).take(frames) {
-        for (ch, s) in out.iter_mut().zip(frame.chunks_exact(bytes)) {
-            ch.push(decode_sample(s, kind));
-        }
-    }
-    Ok(out)
-}
-
-/// Converts `f32` samples to integers of a given bit depth, clamping to [-1, 1] and optionally
-/// adding triangular (TPDF) dither of ±1 LSB.
-pub(crate) struct Quantizer {
-    bits: u32,
-    dither: bool,
-    rng: u64,
-}
-
-impl Quantizer {
-    /// A quantizer for one channel; each channel gets an independent dither sequence.
-    pub(crate) fn new(bits: u32, dither: bool, channel: usize) -> Self {
-        let rng = 0x9E37_79B9_7F4A_7C15u64 ^ (channel as u64).wrapping_add(1).wrapping_mul(0xD1B5_4A32_D192_ED03);
-        Self { bits: bits.clamp(2, 32), dither, rng: if rng == 0 { 1 } else { rng } }
-    }
-
-    /// One quantizer per channel.
-    pub(crate) fn per_channel(bits: u32, dither: bool, channels: usize) -> Vec<Self> {
-        (0..channels).map(|c| Self::new(bits, dither, c)).collect()
-    }
-
-    /// Uniform in [0, 1) from a xorshift64* generator (deterministic, no OS entropy needed).
-    fn uniform(&mut self) -> f64 {
-        let mut x = self.rng;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.rng = x;
-        (x.wrapping_mul(0x2545_F491_4F6C_DD1D) >> 11) as f64 / (1u64 << 53) as f64
-    }
-
-    pub(crate) fn quantize(&mut self, x: f32) -> i32 {
-        let x = if x.is_nan() { 0.0 } else { x.clamp(-1.0, 1.0) };
-        let scale = (1u64 << (self.bits - 1)) as f64;
-        let mut v = f64::from(x) * scale;
-        if self.dither {
-            v += self.uniform() - self.uniform();
-        }
-        let max = scale - 1.0;
-        round_half_away(v.clamp(-scale, max)) as i32
-    }
-}
-
-#[inline]
-fn round_half_away(v: f64) -> f64 {
-    let t = v as i64;
-    let f = v - t as f64;
-    (t + i64::from(f >= 0.5) - i64::from(f <= -0.5)) as f64
-}
-
-/// Bits per sample at `depth`, and whether they are float.
-pub(crate) fn sample_format(depth: BitDepth) -> (u16, bool) {
-    match depth {
-        BitDepth::Int16 => (16, false),
-        BitDepth::Int24 => (24, false),
-        BitDepth::Int32 => (32, false),
-        BitDepth::Float32 => (32, true),
-    }
-}
-
-/// Interleaves `frames` frames of planar audio (missing samples are silence) as `bits`-bit
-/// samples and writes them to `out`, a few thousand frames at a time through `scratch`.
-pub(crate) fn write_interleaved(
-    out: &mut impl Write,
-    scratch: &mut Vec<u8>,
-    block: &[Vec<f32>],
-    frames: usize,
-    quantizers: &mut [Quantizer],
-    (bits, is_float): (u16, bool),
-    big_endian: bool,
-) -> std::io::Result<()> {
-    let size = usize::from(bits / 8);
-    let mut start = 0;
-    while start < frames {
-        let end = frames.min(start + 4096);
-        scratch.clear();
-        for f in start..end {
-            for (c, q) in quantizers.iter_mut().enumerate() {
-                let s = block.get(c).and_then(|ch| ch.get(f)).copied().unwrap_or(0.0);
-                match (is_float, big_endian) {
-                    (true, false) => scratch.extend_from_slice(&sanitize_float(s).to_le_bytes()),
-                    (true, true) => scratch.extend_from_slice(&sanitize_float(s).to_be_bytes()),
-                    (false, false) => scratch.extend_from_slice(q.quantize(s).to_le_bytes().get(..size).unwrap_or_default()),
-                    (false, true) => scratch.extend_from_slice(q.quantize(s).to_be_bytes().get(4 - size..).unwrap_or_default()),
-                }
-            }
-        }
-        out.write_all(scratch)?;
-        start = end;
-    }
-    Ok(())
-}
-
-/// Preserve finite float samples, mapping NaN to 0 and infinities to their sign (±1).
-fn sanitize_float(x: f32) -> f32 {
-    if x.is_finite() {
-        x
-    } else if x.is_nan() {
-        0.0
-    } else {
-        x.signum()
-    }
-}
-
-/// Check that a buffer is encodable: at least one channel and a non-zero sample rate.
-pub(crate) fn validate_buffer(buf: &crate::AudioBuffer) -> Result<()> {
-    validate_layout(buf.channels.len(), buf.sample_rate)
-}
-
-/// Check that a stream is encodable: at least one channel and a non-zero sample rate.
-pub(crate) fn validate_layout(channels: usize, sample_rate: u32) -> Result<()> {
-    if channels == 0 {
-        return Err(AudioError::Encode("buffer has no channels".into()));
-    }
-    if channels > usize::from(u16::MAX) {
-        return Err(AudioError::Encode("too many channels".into()));
-    }
-    if sample_rate == 0 {
-        return Err(AudioError::Encode("sample rate is 0".into()));
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn round_half_away_matches_f64_round_on_the_quantizer_range() {
-        let edges = [
-            0.0,
-            -0.0,
-            0.5,
-            -0.5,
-            1.5,
-            -1.5,
-            2.5,
-            0.499_999_999_999_999_94,
-            -0.499_999_999_999_999_94,
-            8_388_607.5,
-            -8_388_608.0,
-            2_147_483_647.0,
-            -2_147_483_648.0,
-        ];
-        let mut x = 0x2545_f491_4f6c_dd1du64;
-        let spread = (0..10_000).map(|_| {
-            x ^= x << 13;
-            x ^= x >> 7;
-            x ^= x << 17;
-            (x >> 11) as f64 / (1u64 << 53) as f64 * 4_294_967_295.0 - 2_147_483_648.0
-        });
-        for v in edges.into_iter().chain(spread) {
-            assert!(round_half_away(v) == v.round(), "{v}");
-            assert_eq!(round_half_away(v) as i32, v.round() as i32, "{v}");
-        }
-    }
-}
@@ -1,280 +0,0 @@
-//! Multi-resolution overview for waveform drawing.
-//!
-//! Level 0 sums up each block of [`BLOCK`] samples (min, max and sum of squares); each following
-//! level merges [`FANOUT`] blocks of the level below, until a level has a single block. Range
-//! queries combine the coarsest whole blocks that fit inside the range and read the partial blocks
-//! at its edges from the samples, so a query is exact and costs O(log n) regardless of zoom.
-
-/// Samples per level-0 block.
-pub const BLOCK: usize = 32;
-/// Blocks of level `n` merged into one block of level `n + 1`.
-pub const FANOUT: usize = 4;
-/// Upper bound on the number of spans [`Peaks::spans`] will produce.
-pub const MAX_COLUMNS: usize = 1 << 20;
-
-/// Multi-resolution overview of one channel for waveform drawing.
-#[derive(Debug, Clone, Default, PartialEq, serde::Serialize, serde::Deserialize)]
-pub struct Peaks {
-    len: usize,
-    levels: Vec<Vec<Block>>,
-}
-
-/// What a run of samples sums up to; NaN samples count for nothing.
-#[derive(Debug, Clone, Copy, PartialEq, serde::Serialize, serde::Deserialize)]
-struct Block {
-    min: f32,
-    max: f32,
-    squares: f64,
-}
-
-impl Block {
-    const EMPTY: Block = Block { min: f32::INFINITY, max: f32::NEG_INFINITY, squares: 0.0 };
-
-    fn point(s: f32) -> Block {
-        Block { min: s, max: s, squares: if s.is_finite() { f64::from(s) * f64::from(s) } else { 0.0 } }
-    }
-
-    fn of(samples: &[f32]) -> Block {
-        samples.iter().fold(Block::EMPTY, |b, &s| b.merge(Block::point(s)))
-    }
-
-    fn merge(self, o: Block) -> Block {
-        Block { min: self.min.min(o.min), max: self.max.max(o.max), squares: self.squares + o.squares }
-    }
-
-    /// (min, max), or (0, 0) when nothing was summed up.
-    fn range(self) -> (f32, f32) {
-        if self.min > self.max { (0.0, 0.0) } else { (self.min, self.max) }
-    }
-}
-
-impl Peaks {
-    /// Build the overview of `samples` (one channel). NaN samples are ignored.
-    pub fn build(samples: &[f32]) -> Peaks {
-        if samples.is_empty() {
-            return Peaks::default();
-        }
-        let mut levels: Vec<Vec<Block>> = vec![samples.chunks(BLOCK).map(Block::of).collect()];
-        while let Some(last) = levels.last().filter(|l| l.len() > 1) {
-            let next = last.chunks(FANOUT).map(|c| c.iter().fold(Block::EMPTY, |a, &b| a.merge(b))).collect();
-            levels.push(next);
-        }
-        Peaks { len: samples.len(), levels }
-    }
-
-    /// Number of samples the overview was built from.
-    pub fn len_samples(&self) -> usize {
-        self.len
-    }
-
-    /// Number of resolution levels (0 for an empty overview).
-    pub fn num_levels(&self) -> usize {
-        self.levels.len()
-    }
-
-    /// (min, max) over the sample range `[start, end)`, clamped to the data. `samples` must be the
-    /// data the overview was built from. Returns `(0.0, 0.0)` for an empty range.
-    pub fn minmax(&self, samples: &[f32], start: usize, end: usize) -> (f32, f32) {
-        self.sum(samples, start, end).range()
-    }
-
-    fn sum(&self, samples: &[f32], start: usize, end: usize) -> Block {
-        let end = end.min(self.len).min(samples.len());
-        let (first, last) = (start.div_ceil(BLOCK), end / BLOCK);
-        let raw = |a: usize, b: usize| Block::of(samples.get(a..b).unwrap_or_default());
-        if first >= last {
-            return raw(start, end);
-        }
-        raw(start, first * BLOCK).merge(raw(last * BLOCK, end)).merge(self.blocks(first, last))
-    }
-
-    /// The level-0 blocks `[lo, hi)`, summed from the coarsest blocks that fit.
-    fn blocks(&self, mut lo: usize, mut hi: usize) -> Block {
-        let mut acc = Block::EMPTY;
-        for (lvl, level) in self.levels.iter().enumerate() {
-            let mut add = |i: usize| acc = acc.merge(level.get(i).copied().unwrap_or(Block::EMPTY));
-            if lvl + 1 == self.levels.len() || hi.saturating_sub(lo) < 2 * FANOUT {
-                (lo..hi).for_each(add);
-                break;
-            }
-            while !lo.is_multiple_of(FANOUT) {
-                add(lo);
-                lo += 1;
-            }
-            while !hi.is_multiple_of(FANOUT) {
-                hi -= 1;
-                add(hi);
-            }
-            lo /= FANOUT;
-            hi /= FANOUT;
-        }
-        acc
-    }
-
-    /// The spans of sample positions `[start + c * step, start + (c + 1) * step + overlap]` that
-    /// reach the data, clamped to it.
-    fn windows(&self, samples: &[f32], start: f64, step: f64, overlap: f64, cols: usize) -> impl Iterator<Item = Option<(f64, f64)>> {
-        let n = self.len.min(samples.len());
-        let valid = n > 0 && start.is_finite() && step.is_finite() && step > 0.0 && overlap.is_finite() && overlap >= 0.0;
-        let last = n.saturating_sub(1) as f64;
-        (0..cols.min(MAX_COLUMNS)).map(move |c| {
-            let (a, b) = (start + step * c as f64, start + step * (c + 1) as f64 + overlap);
-            (valid && b >= 0.0 && a <= last).then(|| (a.max(0.0), b.min(last)))
-        })
-    }
-
-    /// (min, max) of the line through `samples` over each of `cols` spans of sample positions
-    /// `[start + c * step, start + (c + 1) * step + overlap]`; fractional positions interpolate
-    /// between samples. Neighbouring spans share at least their boundary, so a waveform drawn from
-    /// them stays connected at any zoom. `None` for spans outside the data.
-    pub fn spans(&self, samples: &[f32], start: f64, step: f64, overlap: f64, cols: usize) -> Vec<Option<(f32, f32)>> {
-        let at = |t: f64| {
-            let i = t.floor();
-            let a = samples.get(i as usize).copied().unwrap_or(0.0);
-            let b = samples.get(i as usize + 1).copied().unwrap_or(a);
-            Block::point(a + (b - a) * (t - i) as f32)
-        };
-        self.windows(samples, start, step, overlap, cols)
-            .map(|w| w.map(|(a, b)| self.sum(samples, a.ceil() as usize, b.floor() as usize + 1).merge(at(a)).merge(at(b)).range()))
-            .collect()
-    }
-
-    /// The RMS of `samples` over each span [`Peaks::spans`] gives, including the samples just
-    /// outside a span's ends.
-    pub fn rms_spans(&self, samples: &[f32], start: f64, step: f64, overlap: f64, cols: usize) -> Vec<Option<f32>> {
-        self.windows(samples, start, step, overlap, cols)
-            .map(|w| {
-                w.map(|(a, b)| {
-                    let (s, e) = (a.floor() as usize, (b.ceil() as usize).saturating_add(1).min(self.len).min(samples.len()));
-                    (self.sum(samples, s, e).squares / e.saturating_sub(s).max(1) as f64).sqrt() as f32
-                })
-            })
-            .collect()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn brute(samples: &[f32], start: usize, end: usize) -> (f32, f32) {
-        let s = &samples[start..end];
-        (s.iter().copied().fold(f32::INFINITY, f32::min), s.iter().copied().fold(f32::NEG_INFINITY, f32::max))
-    }
-
-    fn signal(n: usize) -> Vec<f32> {
-        (0..n).map(|i| ((i as f32 * 0.037).sin() * (i as f32 * 0.0011).cos()) + if i % 997 == 0 { 0.5 } else { 0.0 }).collect()
-    }
-
-    #[test]
-    fn every_range_is_exact() {
-        let x = signal(100_003);
-        let p = Peaks::build(&x);
-        for &(a, b) in &[(0, 32), (0, 100_003), (32, 64_000), (3200, 3232), (96, 99_968), (64, 100_003), (5, 6), (31, 33), (1000, 1031)] {
-            assert_eq!(p.minmax(&x, a, b), brute(&x, a, b), "range {a}..{b}");
-        }
-        let mut seed = 12345u64;
-        for _ in 0..2000 {
-            seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
-            let a = (seed >> 33) as usize % 100_003;
-            seed = seed.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
-            let b = a + 1 + (seed >> 33) as usize % (100_003 - a);
-            assert_eq!(p.minmax(&x, a, b), brute(&x, a, b), "range {a}..{b}");
-        }
-    }
-
-    #[test]
-    fn degenerate_inputs() {
-        let p = Peaks::build(&[]);
-        assert_eq!(p.len_samples(), 0);
-        assert_eq!(p.minmax(&[], 0, 10), (0.0, 0.0));
-        assert_eq!(p.spans(&[], 0.0, 1.0, 0.0, 4), vec![None; 4]);
-        let x = [0.5, -0.25];
-        let p = Peaks::build(&x);
-        assert_eq!(p.minmax(&x, 0, 2), (-0.25, 0.5));
-        assert_eq!(p.minmax(&x, 5, 3), (0.0, 0.0));
-        assert_eq!(p.minmax(&x, 0, usize::MAX), (-0.25, 0.5));
-        assert_eq!(p.minmax(&x[..1], 0, 2), (0.5, 0.5));
-        for (start, step, overlap) in [
-            (f64::NAN, 1.0, 0.0),
-            (0.0, 0.0, 0.0),
-            (0.0, -1.0, 0.0),
-            (0.0, f64::INFINITY, 0.0),
-            (f64::NEG_INFINITY, 1.0, 0.0),
-            (0.0, 1.0, -0.5),
-            (0.0, 1.0, f64::NAN),
-        ] {
-            assert_eq!(p.spans(&x, start, step, overlap, 3), vec![None; 3]);
-        }
-        assert_eq!(p.spans(&x, 0.0, 1.0, 0.0, 0).len(), 0);
-        assert_eq!(p.spans(&x, 0.0, 1.0, 0.0, usize::MAX).len(), MAX_COLUMNS);
-        let x = [f32::NAN, 1.0];
-        let p = Peaks::build(&x);
-        assert_eq!(p.minmax(&x, 0, 2), (1.0, 1.0));
-        assert_eq!(p.spans(&x, 0.0, 1.0, 0.0, 1), vec![Some((1.0, 1.0))]);
-        assert!(p.rms_spans(&x, 0.0, 1.0, 0.0, 1)[0].is_some_and(f32::is_finite));
-    }
-
-    #[test]
-    fn finite_large_samples_keep_finite_rms() {
-        let samples = vec![1e20_f32; BLOCK];
-        let peaks = Peaks::build(&samples);
-        assert_eq!(peaks.rms_spans(&samples, 0.0, BLOCK as f64, 0.0, 1), vec![Some(1e20)]);
-    }
-
-    #[test]
-    fn rms_spans_match_the_samples() {
-        let x = signal(20_000);
-        let p = Peaks::build(&x);
-        let rms = |s: usize, e: usize| (x[s..e].iter().map(|&v| f64::from(v) * f64::from(v)).sum::<f64>() / (e - s) as f64).sqrt() as f32;
-        for (step, overlap) in [(1.5, 0.0), (37.0, 37.0), (1000.0, 0.0), (4096.0, 512.0)] {
-            let cols = ((19_999.0 - overlap) / step) as usize;
-            for (c, got) in p.rms_spans(&x, 0.0, step, overlap, cols).into_iter().enumerate() {
-                let (a, b) = (c as f64 * step, ((c + 1) as f64 * step + overlap).min(19_999.0));
-                let (got, want) = (got.unwrap(), rms(a.floor() as usize, (b.ceil() as usize + 1).min(20_000)));
-                assert!((got - want).abs() <= want * 1e-4 + 1e-6, "span {c} at step {step}: {got} vs {want}");
-            }
-        }
-        let sine: Vec<f32> = (0..48_000).map(|i| (i as f32 * 0.01).sin()).collect();
-        let p = Peaks::build(&sine);
-        let r = p.rms_spans(&sine, 0.0, 47_000.0, 0.0, 1)[0].unwrap();
-        assert!((r - std::f32::consts::FRAC_1_SQRT_2).abs() < 1e-3, "{r}");
-        assert_eq!(p.rms_spans(&sine, f64::NAN, 1.0, 0.0, 2), vec![None, None]);
-        assert_eq!(p.rms_spans(&sine, 50_000.0, 1.0, 0.0, 1), vec![None]);
-    }
-
-    #[test]
-    fn spans_cover_their_samples_and_touch_their_neighbours() {
-        let x = signal(10_000);
-        let p = Peaks::build(&x);
-        for step in [0.3, 1.0, 7.5, 100.0, 333.3] {
-            let cols = (9_999.0 / step) as usize;
-            let spans = p.spans(&x, 0.0, step, 0.0, cols);
-            for (c, s) in spans.iter().enumerate() {
-                let (lo, hi) = s.unwrap_or_else(|| panic!("span {c} at step {step}"));
-                let (a, b) = ((c as f64 * step).ceil() as usize, ((c + 1) as f64 * step).floor() as usize);
-                if a <= b {
-                    let truth = brute(&x, a, b + 1);
-                    assert!(lo <= truth.0 && hi >= truth.1, "span {c} at step {step}");
-                }
-                if let Some(Some((nlo, nhi))) = spans.get(c + 1) {
-                    assert!(*nlo <= hi && *nhi >= lo, "spans {c} and {} at step {step} don't touch", c + 1);
-                }
-            }
-            let all = spans.iter().flatten().fold((f32::INFINITY, f32::NEG_INFINITY), |a, s| (a.0.min(s.0), a.1.max(s.1)));
-            assert_eq!(all, brute(&x, 0, ((cols as f64 * step).floor() as usize + 1).min(10_000)), "step {step}");
-        }
-    }
-
-    #[test]
-    fn spans_follow_the_line_between_samples() {
-        let x = [0.0, 1.0, -1.0, 0.5];
-        let p = Peaks::build(&x);
-        assert_eq!(p.spans(&x, 0.0, 0.25, 0.0, 4), vec![Some((0.0, 0.25)), Some((0.25, 0.5)), Some((0.5, 0.75)), Some((0.75, 1.0))]);
-        assert_eq!(p.spans(&x, 0.5, 1.0, 0.0, 1), vec![Some((0.0, 1.0))]);
-        let spans = vec![None, Some((0.0, 0.0)), Some((0.0, 1.0)), Some((-1.0, 1.0)), Some((-1.0, 0.5)), Some((0.5, 0.5)), None];
-        assert_eq!(p.spans(&x, -2.0, 1.0, 0.0, 7), spans);
-        assert_eq!(p.spans(&x, 0.0, 1.0, 1.0, 3), vec![Some((-1.0, 1.0)), Some((-1.0, 1.0)), Some((-1.0, 0.5))]);
-        assert_eq!(p.spans(&x, 0.0, 1.0, 0.5, 3), vec![Some((0.0, 1.0)), Some((-1.0, 1.0)), Some((-1.0, 0.5))]);
-    }
-}
@@ -1,751 +0,0 @@
-//! Decode path for everything that isn't native PCM WAV/AIFF, backed by `symphonia`.
-
-use std::io::{Cursor, Seek, SeekFrom};
-use std::panic::{AssertUnwindSafe, catch_unwind};
-
-use symphonia::core::codecs::audio::well_known::{
-    CODEC_ID_AAC, CODEC_ID_ADPCM_G722, CODEC_ID_ADPCM_G726, CODEC_ID_ADPCM_G726LE, CODEC_ID_ADPCM_IMA_QT, CODEC_ID_ADPCM_IMA_WAV, CODEC_ID_ADPCM_MS,
-    CODEC_ID_ALAC, CODEC_ID_FLAC, CODEC_ID_MP1, CODEC_ID_MP2, CODEC_ID_MP3, CODEC_ID_OPUS, CODEC_ID_PCM_ALAW, CODEC_ID_PCM_F32BE, CODEC_ID_PCM_F32LE,
-    CODEC_ID_PCM_F64BE, CODEC_ID_PCM_F64LE, CODEC_ID_PCM_MULAW, CODEC_ID_VORBIS,
-};
-use symphonia::core::codecs::audio::{AudioCodecId, AudioCodecParameters, AudioDecoderOptions, CODEC_ID_NULL_AUDIO};
-use symphonia::core::errors::Error as SymError;
-use symphonia::core::formats::probe::{Hint, ProbeOptions, ProbeableFormat, Score, Scoreable};
-use symphonia::core::formats::{FormatOptions, FormatReader, Track};
-use symphonia::core::io::{MediaSourceStream, MediaSourceStreamOptions, ScopedStream};
-use symphonia::core::meta::MetadataOptions;
-
-use crate::pcm::{MAX_DECODE_SAMPLES, be_u32};
-use crate::{AudioBuffer, AudioError, AudioInfo, FileFormat, Result, SampleFormat};
-
-/// The most frames a packet may declare: decoders allocate a packet's frames up front, and ALAC
-/// takes its frame length from the file (encoders use 4096).
-const MAX_PACKET_FRAMES: u64 = 1 << 20;
-
-/// How far [`first_marker`] looks for the first format marker: the same 1 MiB a default symphonia
-/// probe scans.
-const MAX_PREFIX_SCAN: usize = 1 << 20;
-
-/// How many MPEG/ADTS candidates [`first_marker`] may hand to the readers' expensive `Scoreable`
-/// implementations. A crafted 1 MiB prefix of repeated sync markers otherwise asks for hundreds
-/// of thousands of scores, each allowed up to symphonia's 16 KiB score depth. Once the budget is
-/// spent, the scan stops at the next audio candidate: a container-like byte string later in an
-/// unscored audio payload must not become authoritative. A container marker reached first is still
-/// checked; an unchecked one the probe selects is refused after probing.
-const MAX_AUDIO_SCORE_ATTEMPTS: usize = 256;
-
-/// A per-scan budget for `Scoreable::score` calls. Taking a slot consumes it even when the score
-/// rejects the candidate, so a stream of false syncs cannot multiply the work.
-struct ScoreBudget {
-    used: usize,
-}
-
-impl ScoreBudget {
-    /// Start a scan with no expensive score attempts spent.
-    fn new() -> Self {
-        Self { used: 0 }
-    }
-
-    /// Spend one score attempt, returning false once the per-scan budget is exhausted.
-    fn take(&mut self) -> bool {
-        if self.exhausted() {
-            return false;
-        }
-        self.used = self.used.saturating_add(1);
-        true
-    }
-
-    /// Whether no attempt is left for this scan.
-    fn exhausted(&self) -> bool {
-        self.used >= MAX_AUDIO_SCORE_ATTEMPTS
-    }
-}
-
-/// Turn a symphonia error into the audio layer's error, keeping "unsupported" and "too large"
-/// distinct from a malformed file.
-fn map_err(e: SymError) -> AudioError {
-    match e {
-        SymError::Unsupported(m) => AudioError::Unsupported(m.to_string()),
-        SymError::LimitError(m) => AudioError::TooLarge(m.to_string()),
-        other => AudioError::Malformed(other.to_string()),
-    }
-}
-
-/// Run `f`, turning a panic inside the third-party decoder into an error.
-fn guarded<T>(f: impl FnOnce() -> Result<T>) -> Result<T> {
-    catch_unwind(AssertUnwindSafe(f)).unwrap_or_else(|_| Err(AudioError::Malformed("decoder failed on malformed input".into())))
-}
-
-/// What [`open`] found: a reader, or a stream that holds no audio frames and has no reader.
-enum Opened {
-    Reader(Box<dyn FormatReader>),
-    Empty(AudioInfo),
-}
-
-/// Decoder options for every compressed format. Gapless playback used to be a
-/// `FormatOptions` flag in symphonia 0.5; in 0.6 the decoder option (on by default) trims the
-/// encoder delay and padding that the demuxer reports on each packet.
-fn decoder_options() -> AudioDecoderOptions {
-    AudioDecoderOptions::default().gapless(true)
-}
-
-/// The first byte after any ID3v2 tags at the start of `b`. Symphonia's tag reader allocates
-/// whatever a frame claims, so the tags are skipped, not read: they are not used here.
-fn skip_id3v2(b: &[u8]) -> usize {
-    let mut at = 0usize;
-    loop {
-        match b.get(at..).and_then(crate::id3v2_len) {
-            Some(n) if n > 0 => at = at.saturating_add(n),
-            _ => return at,
-        }
-    }
-}
-
-/// The first format marker the probe can reach from `start`, within its 1 MiB scan limit.
-#[derive(Clone, Copy)]
-enum FirstMarker {
-    Flac(usize),
-    Caf(usize),
-    Mp4(usize),
-    Wav(usize),
-    /// MPEG audio, Ogg, Matroska or AIFF: formats with no separate container size check.
-    Audio,
-}
-
-/// What the preflight container checks covered before the probe built a reader.
-enum Precheck {
-    /// A zero-frame FLAC: returned without a reader, because Symphonia 0.6's reader needs a first
-    /// audio frame to resynchronize to.
-    Empty(AudioInfo),
-    /// The size checks ran for the container the probe reports under this short name.
-    Checked(&'static str),
-    /// No container size check was needed.
-    Unchecked,
-}
-
-/// Probe short names whose demuxer allocates from sizes in the file, so the matching container
-/// check has to run before the stream is decoded.
-const SIZE_CHECKED_PROBE_FORMATS: &[&str] = &["caf", "flac", "isomp4", "wave"];
-
-/// The container markers to check for the family `detected` names. `None` is a raw audio stream
-/// (MP3, Ogg, AIFF), whose payload may contain container-like bytes: the unrestricted scan below
-/// finds a container only when one starts the stream, before any audio marker.
-fn container_markers(detected: FileFormat) -> Option<&'static [&'static [u8; 4]]> {
-    match detected {
-        // RF64 and BW64 are the >4 GiB RIFF forms.
-        FileFormat::Wav => Some(&[b"RIFF", b"RF64", b"BW64"]),
-        FileFormat::Flac => Some(&[b"fLaC"]),
-        FileFormat::Caf => Some(&[b"caff"]),
-        // MP4/M4A put `ftyp` after the first atom's size field.
-        FileFormat::Aac | FileFormat::Alac => Some(&[b"ftyp"]),
-        // Unknown files may carry junk before the container; symphonia's probe scans for markers.
-        FileFormat::Other => Some(&[b"caff", b"ftyp", b"fLaC", b"RIFF"]),
-        FileFormat::Aiff | FileFormat::Mp3 | FileFormat::Ogg => None,
-    }
-}
-
-/// The probe short name a container marker stands for.
-fn expected_probe_format(marker: &[u8; 4]) -> &'static str {
-    match marker {
-        b"caff" => "caf",
-        // The isomp4 reader reads the `ftyp` atom.
-        b"ftyp" => "isomp4",
-        b"fLaC" => "flac",
-        // RIFF, RF64 and BW64.
-        _ => "wave",
-    }
-}
-
-/// Find the first marker of `markers` at or after `at`, within symphonia's probe depth. A RIFF
-/// form other than WAVE is skipped, as the probe skips it and reads a WAVE behind it.
-fn find_container_marker<'a>(bytes: &[u8], at: usize, markers: &'a [&'static [u8; 4]]) -> Option<(usize, &'a [u8; 4])> {
-    let end = bytes.len().min(at.saturating_add(MAX_PREFIX_SCAN));
-    for pos in at..end.saturating_sub(3) {
-        let window = bytes.get(pos..pos + 4)?;
-        if let Some(marker) = markers.iter().find(|marker| window == marker.as_slice()) {
-            if matches!(*marker, b"RIFF" | b"RF64" | b"BW64") && bytes.get(pos + 8..pos + 12) != Some(&b"WAVE"[..]) {
-                continue;
-            }
-            return Some((pos, *marker));
-        }
-    }
-    None
-}
-
-/// The scan variant for a marker found by [`find_container_marker`], with the probe short name its
-/// size check stands for. `ftyp` sits four bytes into its atom, so the MP4 check starts there.
-fn marker_kind(at: usize, marker: &[u8; 4]) -> (FirstMarker, &'static str) {
-    match marker {
-        b"fLaC" => (FirstMarker::Flac(at), expected_probe_format(marker)),
-        b"caff" => (FirstMarker::Caf(at), expected_probe_format(marker)),
-        b"ftyp" => (FirstMarker::Mp4(at.saturating_sub(4)), expected_probe_format(marker)),
-        _ => (FirstMarker::Wav(at), expected_probe_format(marker)),
-    }
-}
-
-/// The probe short name a container scan variant stands for.
-fn marker_name(marker: FirstMarker) -> &'static str {
-    match marker {
-        FirstMarker::Flac(_) => "flac",
-        FirstMarker::Caf(_) => "caf",
-        FirstMarker::Mp4(_) => "isomp4",
-        FirstMarker::Wav(_) => "wave",
-        FirstMarker::Audio => "",
-    }
-}
-
-/// Whether `rest` starts with one of `R`'s exact registered probe markers.
-fn has_probe_marker<R: ProbeableFormat<'static>>(rest: &[u8]) -> bool {
-    R::probe_data().iter().any(|data| data.spec.markers.iter().any(|marker| rest.starts_with(marker)))
-}
-
-/// Score `R` at `at` exactly as symphonia's private probe does: `Supported` wins, EOF and every
-/// other scoring error mean "not this format", while a real I/O error aborts the probe.
-fn scores_supported<R: Scoreable>(stream: &mut MediaSourceStream<'_>, at: usize, depth: u16) -> Result<bool> {
-    stream.seek(SeekFrom::Start(u64::try_from(at).unwrap_or(u64::MAX)))?;
-    match R::score(ScopedStream::new(stream, u64::from(depth))) {
-        Ok(Score::Supported(_)) => Ok(true),
-        Err(SymError::IoError(e)) if e.kind() != std::io::ErrorKind::UnexpectedEof => Err(AudioError::Malformed(e.to_string())),
-        _ => Ok(false),
-    }
-}
-
-/// Whether `b[at..]` is an MPEG/ADTS candidate the probe would actually select: an exact
-/// `probe_data()` marker and a `Supported` score from the same reader. A loose `0xFFEx` pair is
-/// not enough: `0xFFE0` is neither a registered marker nor a valid frame, so it must not stop the
-/// scan before a later FLAC/CAF/MP4 candidate.
-fn audio_sync_at<'a>(b: &'a [u8], at: usize, stream: &mut Option<MediaSourceStream<'a>>, budget: &mut ScoreBudget) -> Result<bool> {
-    let rest = b.get(at..).unwrap_or_default();
-    let adts = has_probe_marker::<symphonia::default::formats::AdtsReader<'static>>(rest);
-    let mpa = has_probe_marker::<symphonia::default::formats::MpaReader<'static>>(rest);
-    if !adts && !mpa {
-        return Ok(false);
-    }
-    if stream.is_none() {
-        *stream = Some(MediaSourceStream::new(Box::new(Cursor::new(b)), MediaSourceStreamOptions::default()));
-    }
-    let Some(mss) = stream.as_mut() else { return Ok(false) };
-    let depth = ProbeOptions::default().max_score_depth;
-    if adts && budget.take() && scores_supported::<symphonia::default::formats::AdtsReader<'static>>(mss, at, depth)? {
-        return Ok(true);
-    }
-    if mpa && budget.take() && scores_supported::<symphonia::default::formats::MpaReader<'static>>(mss, at, depth)? {
-        return Ok(true);
-    }
-    Ok(false)
-}
-
-/// Find the first marker that can start a container or audio stream. Symphonia's `Probe::probe`
-/// constructs the reader itself and exposes no pre-construction hook, while checking every magic
-/// in the scan window would validate bytes the probe never reaches (for example a valid MP3's
-/// audio payload). Stopping at the first marker avoids that: it is the candidate the probe selects
-/// for FLAC, CAF, MP4, Ogg and Matroska, and for WAV/AIFF once their full form is verified below.
-/// MPEG/ADTS candidates are checked with the readers' own `probe_data()`/`Scoreable` APIs, so a
-/// false sync byte pair cannot stop the scan. If that scoring budget runs out, the scan stops at
-/// the next audio candidate instead of trusting a container-like byte string later in the unscored
-/// audio payload. A container marker reached before any such candidate is still preflighted; if
-/// the probe selects a size-checked container the scan did not check, `open` refuses it.
-///
-/// WAV candidates include RF64/BW64 so `check_info` can run, although symphonia 0.6 registers only
-/// the RIFF marker. Native PCM RF64/BW64 is parsed by `wav::parse` before this path; a foreign
-/// RF64/BW64 stream therefore remains unsupported by the probe rather than misdetected.
-fn first_marker(b: &[u8], start: usize) -> Result<Option<FirstMarker>> {
-    first_marker_with_budget(b, start, &mut ScoreBudget::new())
-}
-
-/// [`first_marker`] with an explicit score budget, so a test can prove a prefix crowded with
-/// false sync markers performs only the bounded number of reader scores.
-fn first_marker_with_budget(b: &[u8], start: usize, budget: &mut ScoreBudget) -> Result<Option<FirstMarker>> {
-    let end = b.len().min(start.saturating_add(MAX_PREFIX_SCAN));
-    let mut at = start;
-    let mut audio_probe = None;
-    while at.saturating_add(4) <= end {
-        let rest = b.get(at..).unwrap_or_default();
-        if rest.get(..4) == Some(b"fLaC".as_slice()) {
-            return Ok(Some(FirstMarker::Flac(at)));
-        }
-        if rest.get(..4) == Some(b"caff".as_slice()) {
-            return Ok(Some(FirstMarker::Caf(at)));
-        }
-        if rest.get(..4) == Some(b"OggS".as_slice()) || rest.get(..4) == Some(b"\x1A\x45\xDF\xA3".as_slice()) || crate::aiff::is_aiff(rest) {
-            return Ok(Some(FirstMarker::Audio));
-        }
-        if crate::wav::is_wav(rest) {
-            return Ok(Some(FirstMarker::Wav(at)));
-        }
-        if let (Some(&b0), Some(&b1)) = (b.get(at), b.get(at + 1))
-            && b0 == 0xFF
-            && b1 & 0xE0 == 0xE0
-        {
-            // A candidate after the cap cannot be scored. Stop rather than let a container-like
-            // byte string later in an unscored audio payload become preflight-authoritative; the
-            // probe will select the reader, and `open` refuses an unchecked size-checked one.
-            if budget.exhausted() {
-                return Ok(None);
-            }
-            if audio_sync_at(b, at, &mut audio_probe, budget)? {
-                return Ok(Some(FirstMarker::Audio));
-            }
-        }
-        if rest.get(4..8) == Some(b"ftyp".as_slice()) {
-            return Ok(Some(FirstMarker::Mp4(at)));
-        }
-        at += 1;
-    }
-    Ok(None)
-}
-
-/// Run the early size checks on the container the probe can select. `start` is the first byte
-/// after leading ID3v2 tags. A zero-frame FLAC is returned as an empty stream because Symphonia
-/// 0.6's reader requires a first audio frame to resynchronize to.
-fn precheck(b: &[u8], start: usize, detected: FileFormat) -> Result<Precheck> {
-    let any_marker = |b: &[u8], start: usize| -> Result<Option<(FirstMarker, &'static str)>> {
-        Ok(match first_marker(b, start)? {
-            // Stop at the first marker of any kind, so container magic incidental to an audio
-            // payload is not mistaken for the stream's container.
-            Some(FirstMarker::Audio) | None => None,
-            Some(marker) => Some((marker, marker_name(marker))),
-        })
-    };
-    let found = match container_markers(detected) {
-        // Follow the detection: check the first marker of the family it names, so a misleading
-        // marker cannot let a differently sized container reach the probe unchecked. A detection
-        // is only a hint, though: when the stream holds none of its markers (a FLAC behind a
-        // `.mp3` name), the probe can still select another container, which is checked here.
-        Some(markers) => match find_container_marker(b, start, markers) {
-            Some((at, marker)) => Some(marker_kind(at, marker)),
-            None => any_marker(b, start)?,
-        },
-        None => any_marker(b, start)?,
-    };
-    let Some((marker, expected)) = found else { return Ok(Precheck::Unchecked) };
-    match marker {
-        FirstMarker::Flac(at) => {
-            crate::flac::check_metadata(b, at)?;
-            if let Some(info) = crate::flac::empty_stream_info(b, at) {
-                return Ok(Precheck::Empty(info));
-            }
-            Ok(Precheck::Checked(expected))
-        }
-        FirstMarker::Caf(at) => {
-            crate::caf::check(b, at)?;
-            Ok(Precheck::Checked(expected))
-        }
-        FirstMarker::Mp4(at) => {
-            crate::mp4::check(b, at)?;
-            Ok(Precheck::Checked(expected))
-        }
-        FirstMarker::Wav(at) => {
-            crate::wav::check_info(b, at)?;
-            Ok(Precheck::Checked(expected))
-        }
-        FirstMarker::Audio => Ok(Precheck::Unchecked),
-    }
-}
-
-/// Skip leading ID3v2 tags, run the container size preflight, then probe with symphonia; a zero-frame FLAC found by
-/// the preflight comes back as [`Opened::Empty`] without probing. A size-checked container is refused when probing
-/// selects a different reader or one that was never checked, so incidental payload magic cannot bypass those limits.
-fn open(bytes: &[u8], detected: FileFormat) -> Result<Opened> {
-    let start = skip_id3v2(bytes);
-    if start > 0 && start >= bytes.len() {
-        return Err(AudioError::Malformed("ID3v2 tag extends past the end of the file".into()));
-    }
-    let checked = precheck(bytes, start, detected)?;
-    if let Precheck::Empty(info) = checked {
-        return Ok(Opened::Empty(info));
-    }
-    let mut mss = MediaSourceStream::new(Box::new(Cursor::new(bytes.to_vec())), MediaSourceStreamOptions::default());
-    // Seek (rather than pre-positioning the cursor) so the stream's absolute position is `start`
-    // too: container offsets such as MP4's `stco` are absolute file offsets.
-    mss.seek(SeekFrom::Start(u64::try_from(start).unwrap_or(u64::MAX)))?;
-    let reader: Box<dyn FormatReader> =
-        symphonia::default::get_probe().probe(&Hint::new(), mss, FormatOptions::default(), MetadataOptions::default()).map_err(map_err)?;
-    let probed = reader.format_info().short_name;
-    match checked {
-        // Only containers whose readers allocate from sizes in the file need the check. A stream
-        // the probe reads with another reader (MP3, Ogg, AIFF, ...) has no such size fields, so a
-        // marker found in its audio data must not reject it.
-        Precheck::Checked(expected) if SIZE_CHECKED_PROBE_FORMATS.contains(&probed) && probed != expected => {
-            return Err(AudioError::Malformed(format!("the probed container ({probed}) is not the one whose size checks ran")));
-        }
-        Precheck::Unchecked if SIZE_CHECKED_PROBE_FORMATS.contains(&probed) => {
-            return Err(AudioError::Malformed(format!("the probed container ({probed}) was not size-checked")));
-        }
-        _ => {}
-    }
-    Ok(Opened::Reader(reader))
-}
-
-fn format_from_codec(codec: AudioCodecId, detected: FileFormat) -> FileFormat {
-    if detected != FileFormat::Other {
-        return detected;
-    }
-    match codec {
-        c if c == CODEC_ID_FLAC => FileFormat::Flac,
-        c if c == CODEC_ID_MP3 || c == CODEC_ID_MP2 || c == CODEC_ID_MP1 => FileFormat::Mp3,
-        c if c == CODEC_ID_AAC => FileFormat::Aac,
-        c if c == CODEC_ID_ALAC => FileFormat::Alac,
-        c if c == CODEC_ID_VORBIS => FileFormat::Ogg,
-        _ => FileFormat::Other,
-    }
-}
-
-/// The stored sample format, using the codec and its declared bit depth. Lossy and unusual
-/// codecs decode to `Compressed`.
-fn sample_format_of(p: &AudioCodecParameters) -> SampleFormat {
-    let c = p.codec;
-    if c == CODEC_ID_PCM_F32LE || c == CODEC_ID_PCM_F32BE {
-        return SampleFormat::Float32;
-    }
-    if c == CODEC_ID_PCM_F64LE || c == CODEC_ID_PCM_F64BE {
-        return SampleFormat::Float64;
-    }
-    let lossy = [
-        CODEC_ID_MP1,
-        CODEC_ID_MP2,
-        CODEC_ID_MP3,
-        CODEC_ID_AAC,
-        CODEC_ID_VORBIS,
-        CODEC_ID_OPUS,
-        CODEC_ID_ADPCM_MS,
-        CODEC_ID_ADPCM_IMA_WAV,
-        CODEC_ID_ADPCM_IMA_QT,
-        CODEC_ID_ADPCM_G722,
-        CODEC_ID_ADPCM_G726,
-        CODEC_ID_ADPCM_G726LE,
-        CODEC_ID_PCM_ALAW,
-        CODEC_ID_PCM_MULAW,
-    ];
-    let lossless = !lossy.contains(&c);
-    match (lossless, p.bits_per_sample) {
-        (true, Some(1..=8)) => SampleFormat::Int8,
-        (true, Some(9..=16)) => SampleFormat::Int16,
-        (true, Some(17..=24)) => SampleFormat::Int24,
-        (true, Some(25..=32)) => SampleFormat::Int32,
-        _ => SampleFormat::Compressed,
-    }
-}
-
-/// The audio parameters of `track`, if it carries any.
-fn audio_params(track: &Track) -> Option<&AudioCodecParameters> {
-    track.codec_params.as_ref()?.audio()
-}
-
-/// The first track with a decodable audio codec, with the stream information the UI shows.
-fn info_of(reader: &dyn FormatReader, detected: FileFormat) -> Result<(u32, AudioInfo)> {
-    let track = reader
-        .tracks()
-        .iter()
-        .find(|t| audio_params(t).is_some_and(|p| p.codec != CODEC_ID_NULL_AUDIO))
-        .ok_or_else(|| AudioError::Unsupported("no decodable audio track".into()))?;
-    let p = audio_params(track).ok_or_else(|| AudioError::Unsupported("no decodable audio track".into()))?;
-    let sample_rate = p.sample_rate.filter(|&r| r > 0).ok_or_else(|| AudioError::Malformed("unknown sample rate".into()))?;
-    let channels = p.channels.as_ref().map(|c| c.count()).unwrap_or(0);
-    let channels = u16::try_from(channels).map_err(|_| AudioError::Unsupported("too many channels".into()))?;
-    Ok((
-        track.id,
-        AudioInfo {
-            format: format_from_codec(p.codec, detected),
-            sample_format: sample_format_of(p),
-            sample_rate,
-            channels,
-            frames: track.num_frames.unwrap_or(0),
-            bwf: None,
-        },
-    ))
-}
-
-/// A demux error ends the decode; it is only an error when nothing was decoded yet.
-fn demux_failure(frames: u64, e: SymError) -> Result<()> {
-    if frames == 0 {
-        return Err(map_err(e));
-    }
-    log::warn!("stopping decode after demux error: {e}");
-    Ok(())
-}
-
-/// Note a corrupt packet (the `errors`-th); a stream that never decodes is malformed.
-fn corrupt_packet(errors: usize, frames: u64, msg: &str) -> Result<()> {
-    log::debug!("skipping corrupt packet: {msg}");
-    if errors > 1000 && frames == 0 {
-        return Err(AudioError::Malformed(format!("no decodable packets: {msg}")));
-    }
-    Ok(())
-}
-
-/// The decoded stream is authoritative for the channel count: record it and allocate the planes.
-fn init_planar(info: &mut AudioInfo, ch: usize) -> Result<Vec<Vec<f32>>> {
-    info.channels = u16::try_from(ch).map_err(|_| AudioError::Unsupported("too many channels".into()))?;
-    Ok((0..ch).map(|_| Vec::new()).collect())
-}
-
-/// Append one interleaved block to the planes, replacing non-finite samples with silence.
-fn append_interleaved(planar: &mut [Vec<f32>], interleaved: &[f32], ch: usize) {
-    for frame in interleaved.chunks_exact(ch) {
-        for (dst, &s) in planar.iter_mut().zip(frame) {
-            dst.push(if s.is_finite() { s } else { 0.0 });
-        }
-    }
-}
-
-/// Decode the whole first audio track. When `count_only`, samples are counted but not stored.
-fn run(bytes: &[u8], detected: FileFormat, count_only: bool) -> Result<(AudioInfo, AudioBuffer)> {
-    let mut reader = match open(bytes, detected)? {
-        Opened::Reader(reader) => reader,
-        Opened::Empty(info) => {
-            let buf = AudioBuffer::new(info.sample_rate, usize::from(info.channels), 0);
-            return Ok((info, buf));
-        }
-    };
-    let (track_id, mut info) = info_of(reader.as_ref(), detected)?;
-    let track = reader.tracks().iter().find(|t| t.id == track_id).ok_or_else(|| AudioError::Malformed("track vanished".into()))?;
-    if let Some(n) = track.num_frames {
-        let total = n.saturating_mul(u64::from(info.channels.max(1)));
-        if !count_only && total > MAX_DECODE_SAMPLES {
-            return Err(AudioError::TooLarge(format!("{total} samples exceeds the decode limit")));
-        }
-    }
-    let params = audio_params(track).cloned().ok_or_else(|| AudioError::Malformed("track vanished".into()))?;
-    let alac = params.extra_data.as_deref().filter(|_| params.codec == CODEC_ID_ALAC).and_then(|d| be_u32(d, 0));
-    if params.max_frames_per_packet.into_iter().chain(alac.map(u64::from)).any(|n| n > MAX_PACKET_FRAMES) {
-        return Err(AudioError::Malformed("the file declares packets far longer than any codec uses".into()));
-    }
-    let mut decoder = symphonia::default::get_codecs().make_audio_decoder(&params, &decoder_options()).map_err(map_err)?;
-
-    let mut planar: Vec<Vec<f32>> = Vec::new();
-    let mut interleaved: Vec<f32> = Vec::new();
-    let mut frames: u64 = 0;
-    let mut errors = 0usize;
-    loop {
-        let packet = match reader.next_packet() {
-            Ok(Some(packet)) => packet,
-            Ok(None) => break,
-            Err(SymError::IoError(e)) if e.kind() == std::io::ErrorKind::UnexpectedEof => break,
-            Err(SymError::ResetRequired) => break,
-            Err(e) => {
-                demux_failure(frames, e)?;
-                break;
-            }
-        };
-        if packet.track_id != track_id {
-            continue;
-        }
-        let decoded = match decoder.decode(&packet) {
-            Ok(d) => d,
-            Err(SymError::DecodeError(m)) => {
-                errors += 1;
-                corrupt_packet(errors, frames, m)?;
-                continue;
-            }
-            Err(SymError::IoError(_)) => break,
-            Err(e) => return Err(map_err(e)),
-        };
-        // The interleaved copy below is laid out by planes: use their count so a decoder whose
-        // channel spec disagrees with its planes cannot trip the copy's length assertion.
-        let ch = decoded.num_planes();
-        if ch == 0 {
-            continue;
-        }
-        if planar.is_empty() {
-            planar = init_planar(&mut info, ch)?;
-        }
-        let n = decoded.frames() as u64;
-        frames = frames.saturating_add(n);
-        if frames.saturating_mul(ch as u64) > MAX_DECODE_SAMPLES {
-            return Err(AudioError::TooLarge("decoded audio exceeds the 4 GiB limit".into()));
-        }
-        if count_only {
-            continue;
-        }
-        let needed = usize::try_from(n)
-            .ok()
-            .and_then(|n| n.checked_mul(ch))
-            .ok_or_else(|| AudioError::TooLarge("decoded audio exceeds the 4 GiB limit".into()))?;
-        if interleaved.len() < needed {
-            interleaved.try_reserve(needed - interleaved.len()).map_err(|_| AudioError::TooLarge("cannot allocate decoded audio".into()))?;
-            interleaved.resize(needed, 0.0);
-        }
-        decoded.copy_to_slice_interleaved(&mut interleaved[..needed]);
-        append_interleaved(&mut planar, &interleaved[..needed], ch);
-    }
-    if info.channels == 0 {
-        return Err(AudioError::Malformed("stream contains no audio".into()));
-    }
-    if planar.is_empty() {
-        planar = (0..usize::from(info.channels)).map(|_| Vec::new()).collect();
-    }
-    info.frames = if count_only { frames } else { planar.iter().map(Vec::len).min().unwrap_or(0) as u64 };
-    let sample_rate = info.sample_rate;
-    Ok((info, AudioBuffer { sample_rate, channels: planar }))
-}
-
-/// Frames symphonia's AAC decoder yields for every packet; it supports no other frame length.
-const AAC_FRAMES_PER_PACKET: u64 = 1024;
-
-/// Whether `track` of `reader` is AAC in MP4. The MP4 reader reports the stts total as the length,
-/// but the decoder yields a whole frame per packet (sample durations are not applied), so a last
-/// sample whose duration differs from a frame makes the two disagree.
-fn is_mp4_aac(reader: &dyn FormatReader, track_id: u32) -> bool {
-    reader.format_info().short_name == "isomp4"
-        && reader.tracks().iter().find(|t| t.id == track_id).and_then(audio_params).is_some_and(|p| p.codec == CODEC_ID_AAC)
-}
-
-/// The decoded length of AAC in MP4: count the track's packets without decoding them.
-fn mp4_aac_frames(reader: &mut dyn FormatReader, track_id: u32) -> Result<u64> {
-    let mut frames: u64 = 0;
-    loop {
-        match reader.next_packet() {
-            Ok(Some(packet)) if packet.track_id == track_id => frames = frames.saturating_add(AAC_FRAMES_PER_PACKET),
-            Ok(Some(_)) => {}
-            Ok(None) => break,
-            Err(SymError::IoError(e)) if e.kind() == std::io::ErrorKind::UnexpectedEof => break,
-            Err(SymError::ResetRequired) => break,
-            Err(e) => {
-                demux_failure(frames, e)?;
-                break;
-            }
-        }
-    }
-    Ok(frames)
-}
-
-pub(crate) fn probe(bytes: &[u8], detected: FileFormat) -> Result<AudioInfo> {
-    guarded(|| {
-        let mut reader = match open(bytes, detected)? {
-            Opened::Reader(reader) => reader,
-            Opened::Empty(info) => return Ok(info),
-        };
-        let (track_id, mut info) = info_of(reader.as_ref(), detected)?;
-        if info.frames > 0 && info.channels > 0 && is_mp4_aac(reader.as_ref(), track_id) {
-            info.frames = mp4_aac_frames(reader.as_mut(), track_id)?;
-        }
-        if info.frames > 0 && info.channels > 0 {
-            return Ok(info);
-        }
-        // Length not in the header (e.g. MP3 without a Xing frame): count by decoding.
-        run(bytes, detected, true).map(|(i, _)| i)
-    })
-}
-
-pub(crate) fn decode(bytes: &[u8], detected: FileFormat) -> Result<(AudioInfo, AudioBuffer)> {
-    guarded(|| run(bytes, detected, false))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use symphonia::core::codecs::audio::well_known::{
-        CODEC_ID_AAC, CODEC_ID_ADPCM_MS, CODEC_ID_ALAC, CODEC_ID_FLAC, CODEC_ID_MP3, CODEC_ID_PCM_F32LE, CODEC_ID_PCM_F64LE, CODEC_ID_PCM_S16LE,
-        CODEC_ID_VORBIS,
-    };
-
-    /// Build codec parameters for a test, optionally declaring a bit depth.
-    fn params(codec: AudioCodecId, bits_per_sample: Option<u32>) -> AudioCodecParameters {
-        let mut params = AudioCodecParameters::new();
-        params.for_codec(codec);
-        if let Some(bits) = bits_per_sample {
-            params.with_bits_per_sample(bits);
-        }
-        params
-    }
-
-    /// Codec ids map to their reported formats, while a format detected from the container wins over the codec.
-    #[test]
-    fn codecs_map_to_the_reported_formats() {
-        assert_eq!(format_from_codec(CODEC_ID_FLAC, FileFormat::Other), FileFormat::Flac);
-        assert_eq!(format_from_codec(CODEC_ID_MP3, FileFormat::Other), FileFormat::Mp3);
-        assert_eq!(format_from_codec(CODEC_ID_AAC, FileFormat::Other), FileFormat::Aac);
-        assert_eq!(format_from_codec(CODEC_ID_ALAC, FileFormat::Other), FileFormat::Alac);
-        assert_eq!(format_from_codec(CODEC_ID_VORBIS, FileFormat::Other), FileFormat::Ogg);
-        // The container detected from the bytes wins over the codec.
-        assert_eq!(format_from_codec(CODEC_ID_ALAC, FileFormat::Aac), FileFormat::Aac);
-    }
-
-    /// PCM and FLAC keep their declared bit depth; lossy codecs report `Compressed` regardless of their decoded
-    /// width.
-    #[test]
-    fn sample_formats_keep_their_depth_and_lossy_marker() {
-        assert_eq!(sample_format_of(&params(CODEC_ID_PCM_S16LE, Some(16))), SampleFormat::Int16);
-        assert_eq!(sample_format_of(&params(CODEC_ID_FLAC, Some(24))), SampleFormat::Int24);
-        assert_eq!(sample_format_of(&params(CODEC_ID_FLAC, Some(8))), SampleFormat::Int8);
-        assert_eq!(sample_format_of(&params(CODEC_ID_FLAC, Some(32))), SampleFormat::Int32);
-        assert_eq!(sample_format_of(&params(CODEC_ID_PCM_F32LE, Some(32))), SampleFormat::Float32);
-        assert_eq!(sample_format_of(&params(CODEC_ID_PCM_F64LE, Some(64))), SampleFormat::Float64);
-        // Lossy codecs report no fixed bit depth, whatever their decoded sample format is.
-        assert_eq!(sample_format_of(&params(CODEC_ID_AAC, Some(16))), SampleFormat::Compressed);
-        assert_eq!(sample_format_of(&params(CODEC_ID_ADPCM_MS, Some(4))), SampleFormat::Compressed);
-        assert_eq!(sample_format_of(&params(CODEC_ID_ALAC, None)), SampleFormat::Compressed);
-    }
-
-    /// Decoder options keep gapless trimming enabled so the encoder delay and padding reported by the demuxer are
-    /// removed.
-    #[test]
-    fn gapless_decoding_stays_enabled() {
-        assert!(decoder_options().gapless);
-    }
-
-    /// A complete MPEG frame header is a candidate; loose or unregistered sync pairs are rejected before scoring,
-    /// while a registered but truncated header is rejected by the reader's score after consuming a budget slot.
-    #[test]
-    fn only_the_readers_own_audio_markers_are_candidates() {
-        /// Whether the preflight would score `b` as an audio candidate at offset 0.
-        fn candidate(b: &[u8]) -> bool {
-            let mut stream = None;
-            let mut budget = ScoreBudget::new();
-            matches!(audio_sync_at(b, 0, &mut stream, &mut budget), Ok(true))
-        }
-        let mut mp3_frame = vec![0u8; 417];
-        mp3_frame[..4].copy_from_slice(&[0xFF, 0xFB, 0x90, 0x00]); // MPEG-1 Layer III, 128 kbps, 44.1 kHz
-        assert!(candidate(&[&mp3_frame[..], &mp3_frame].concat()));
-        for false_sync in [vec![0xFF, 0xE0, 0x00], vec![0xFF, 0xF0, 0x00], vec![0xFF, 0xFB, 0xF0, 0x00]] {
-            assert!(!candidate(&false_sync), "{false_sync:?} is not a probe candidate");
-        }
-    }
-
-    /// A prefix made of false MPEG sync markers must not ask the readers to score every byte
-    /// position: the per-scan budget caps the expensive work. A cheap container marker reached
-    /// before the next audio candidate is still found, but once the cap is spent an audio
-    /// candidate stops the scan so later payload magic cannot be preflight-authoritative.
-    #[test]
-    fn a_prefix_crowded_with_sync_markers_scores_only_the_budget() {
-        let mut crowded = vec![0u8; 1 << 16];
-        for pair in crowded.as_chunks_mut::<2>().0 {
-            pair.copy_from_slice(&[0xFF, 0xE2]);
-        }
-        let mut budget = ScoreBudget::new();
-        assert!(matches!(first_marker_with_budget(&crowded, 0, &mut budget), Ok(None)));
-        assert_eq!(budget.used, MAX_AUDIO_SCORE_ATTEMPTS, "no candidate after the cap is scored");
-
-        // At the cap boundary, with no later audio candidate, the cheap marker is still found.
-        let mut at_cap: Vec<u8> = (0..MAX_AUDIO_SCORE_ATTEMPTS).flat_map(|_| [0xFFu8, 0xE2]).collect();
-        at_cap.extend_from_slice(b"fLaC");
-        let mut budget = ScoreBudget::new();
-        assert!(
-            matches!(first_marker_with_budget(&at_cap, 0, &mut budget), Ok(Some(FirstMarker::Flac(_)))),
-            "a container marker reached before the next audio candidate is still found"
-        );
-        assert_eq!(budget.used, MAX_AUDIO_SCORE_ATTEMPTS);
-
-        // One more false candidate between the cap and the magic makes the scan stop unchecked:
-        // the same magic could instead sit in a valid audio payload.
-        let mut after_candidate = at_cap[..2 * MAX_AUDIO_SCORE_ATTEMPTS].to_vec();
-        after_candidate.extend_from_slice(&[0xFF, 0xE2]);
-        after_candidate.extend_from_slice(b"fLaC");
-        let mut budget = ScoreBudget::new();
-        assert!(matches!(first_marker_with_budget(&after_candidate, 0, &mut budget), Ok(None)), "an audio candidate after the cap stops the scan");
-        assert_eq!(budget.used, MAX_AUDIO_SCORE_ATTEMPTS);
-    }
-
-    /// ID3v2 sizes are read in their 7-bit syncsafe form; consecutive tags are skipped by their declared sizes, and
-    /// the v2.3 reserved footer bit does not extend a tag.
-    #[test]
-    fn leading_id3_tags_are_skipped_by_their_declared_size() {
-        let tag = [&b"ID3\x04\0\0\0\0\0\x05"[..], b"hello"].concat();
-        assert_eq!(skip_id3v2(&[&tag[..], &tag[..]].concat()), 30);
-        assert_eq!(skip_id3v2(b"fLaC"), 0);
-        // The 10-byte footer flag exists only in v2.4; the same bit in v2.3 is reserved.
-        assert_eq!(crate::id3v2_len(b"ID3\x03\0\x10\0\0\0\0"), Some(10));
-        assert_eq!(crate::id3v2_len(b"ID3\x04\0\x10\0\0\0\0"), Some(20));
-    }
-}
@@ -1,574 +0,0 @@
-//! Native WAV / BWF / RF64 reader and writer (RIFF chunk layout per the Microsoft multimedia
-//! specification, `bext` per EBU Tech 3285, `ds64` per EBU Tech 3306).
-
-use crate::pcm::{PcmKind, Quantizer, deinterleave, le_u16, le_u32, le_u64, sample_format, tag, validate_buffer, validate_layout, write_interleaved};
-use crate::{AudioBuffer, AudioError, AudioInfo, BitDepth, BwfInfo, FileFormat, Result, SampleFormat};
-use std::io::{Cursor, Seek, SeekFrom, Write};
-
-const WAVE_FORMAT_PCM: u16 = 1;
-const WAVE_FORMAT_IEEE_FLOAT: u16 = 3;
-const WAVE_FORMAT_EXTENSIBLE: u16 = 0xFFFE;
-/// Tail of the KSDATAFORMAT_SUBTYPE_* GUIDs (bytes 2..16); bytes 0..2 hold the format tag.
-const GUID_TAIL: [u8; 14] = [0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x80, 0x00, 0x00, 0xAA, 0x00, 0x38, 0x9B, 0x71];
-/// Tail of the Ambisonic subtype GUIDs {0000000x-0721-11D3-8644-C8C1CA000000}: PCM (x = 1) and float (x = 3) as well.
-const AMBISONIC_TAIL: [u8; 14] = [0x00, 0x00, 0x21, 0x07, 0xD3, 0x11, 0x86, 0x44, 0xC8, 0xC1, 0xCA, 0x00, 0x00, 0x00];
-const BEXT_MIN_LEN: usize = 602;
-
-/// Parsed WAV layout (no sample data decoded yet).
-pub(crate) struct WavLayout {
-    pub info: AudioInfo,
-    pub kind: PcmKind,
-    pub data_start: usize,
-    pub data_len: usize,
-}
-
-/// Outcome of parsing a WAV header.
-pub(crate) enum WavParse {
-    /// A PCM / float layout we decode natively.
-    Native(WavLayout),
-    /// A valid WAV whose codec we hand to symphonia (ADPCM, A-law, ...).
-    Foreign { bwf: Option<BwfInfo> },
-}
-
-struct Fmt {
-    tag: u16,
-    channels: u16,
-    sample_rate: u32,
-    block_align: u16,
-    bits: u16,
-    valid_bits: u16,
-}
-
-fn parse_fmt(c: &[u8]) -> Result<Fmt> {
-    let short = || AudioError::Malformed("fmt chunk too short".into());
-    let mut fmt = Fmt {
-        tag: le_u16(c, 0).ok_or_else(short)?,
-        channels: le_u16(c, 2).ok_or_else(short)?,
-        sample_rate: le_u32(c, 4).ok_or_else(short)?,
-        block_align: le_u16(c, 12).ok_or_else(short)?,
-        bits: le_u16(c, 14).unwrap_or(0),
-        valid_bits: 0,
-    };
-    fmt.valid_bits = fmt.bits;
-    if fmt.tag == WAVE_FORMAT_EXTENSIBLE {
-        // cbSize(2) validBits(2) channelMask(4) subFormat GUID(16)
-        let (Some(cb_size), Some(valid), Some(sub)) = (le_u16(c, 16), le_u16(c, 18), le_u16(c, 24)) else {
-            return Err(AudioError::Malformed("WAVE_FORMAT_EXTENSIBLE fmt chunk too short".into()));
-        };
-        let Some(tail) = c.get(26..40) else {
-            return Err(AudioError::Malformed("WAVE_FORMAT_EXTENSIBLE fmt chunk too short".into()));
-        };
-        if cb_size < 22 {
-            return Err(AudioError::Malformed("WAVE_FORMAT_EXTENSIBLE cbSize is below 22".into()));
-        }
-        if valid > fmt.bits {
-            return Err(AudioError::Malformed("WAVE_FORMAT_EXTENSIBLE valid bits exceed the container size".into()));
-        }
-        if valid != 0 {
-            fmt.valid_bits = valid;
-        }
-        // A subtype outside the KSDATAFORMAT_SUBTYPE_* family is not PCM/float, whatever its first two bytes say:
-        // keep the extensible tag so the file goes to the foreign decoder.
-        if tail == GUID_TAIL || tail == AMBISONIC_TAIL {
-            fmt.tag = sub;
-        }
-    }
-    Ok(fmt)
-}
-
-/// Read a NUL-padded ASCII field.
-fn fixed_str(b: &[u8]) -> String {
-    let end = b.iter().position(|&c| c == 0).unwrap_or(b.len());
-    String::from_utf8_lossy(b.get(..end).unwrap_or_default()).trim_end().to_string()
-}
-
-fn parse_bext(c: &[u8]) -> Option<BwfInfo> {
-    if c.len() < 346 {
-        return None;
-    }
-    let lo = u64::from(le_u32(c, 338)?);
-    let hi = u64::from(le_u32(c, 342)?);
-    Some(BwfInfo {
-        description: fixed_str(c.get(0..256)?),
-        originator: fixed_str(c.get(256..288)?),
-        originator_reference: fixed_str(c.get(288..320)?),
-        origination_date: fixed_str(c.get(320..330)?),
-        origination_time: fixed_str(c.get(330..338)?),
-        time_reference: (hi << 32) | lo,
-    })
-}
-
-/// Refuse the WAVE file at `at`, which symphonia reads (A-law, ADPCM, ...), if an INFO entry
-/// claims more bytes than the file holds: symphonia allocates each entry's length. Chunks are
-/// walked where symphonia reads them: after the bytes a chunk's parser used, not its length.
-pub(crate) fn check_info(b: &[u8], at: usize) -> Result<()> {
-    if tag(b, at + 8) != Some(*b"WAVE") {
-        return Ok(());
-    }
-    let mut pos = at + 12;
-    while let Some(id) = tag(b, pos) {
-        let Some(len) = le_u32(b, pos + 4).map(|n| n as usize) else { break };
-        let (body, pad) = (pos + 8, len & 1);
-        let used = match &id {
-            b"data" => break,
-            b"fmt " => fmt_used(b, body, len),
-            b"LIST" if len < 4 => break,
-            b"LIST" => {
-                let entries = if tag(b, body) == Some(*b"INFO") { info_entries(b, body + 4, len - 4)? } else { 0 };
-                // The list pads itself, then the chunk is padded again.
-                4 + entries.max(len - 4) + pad
-            }
-            _ => len,
-        };
-        pos = body.saturating_add(used).saturating_add(pad);
-    }
-    Ok(())
-}
-
-/// The bytes symphonia reads of a `fmt ` chunk: some formats' parsers go by their own extra size.
-fn fmt_used(b: &[u8], body: usize, len: usize) -> usize {
-    match le_u16(b, body) {
-        Some(2 | 6 | 7 | 0x11) => le_u16(b, body + 16).map_or(len, |extra| 18 + usize::from(extra)),
-        Some(0xfffe) => 40,
-        _ => len,
-    }
-}
-
-/// Check the INFO entries in the `len` bytes from `start`; returns the bytes symphonia reads of
-/// them, with the pad it reads after an odd entry.
-fn info_entries(b: &[u8], start: usize, len: usize) -> Result<usize> {
-    let mut used = 0;
-    while used + 8 <= len {
-        let Some(n) = le_u32(b, start + used + 4).map(|n| n as usize) else { break };
-        if n > b.len().saturating_sub(start + used + 8) {
-            return Err(AudioError::Malformed("a WAV INFO entry is larger than the file".into()));
-        }
-        used += 8 + n;
-        used += used & 1;
-    }
-    Ok(used)
-}
-
-/// True when the bytes start like a RIFF/RF64/BW64 WAVE file.
-pub(crate) fn is_wav(b: &[u8]) -> bool {
-    matches!(tag(b, 0), Some(t) if &t == b"RIFF" || &t == b"RF64" || &t == b"BW64") && tag(b, 8).is_some_and(|t| &t == b"WAVE")
-}
-
-/// True when everything from `from` to the end of the file is whole RIFF chunks (four printable
-/// ASCII id bytes, a size that fits, the pad byte after an odd size; the last chunk's pad may be
-/// missing): the metadata of a finished file, not samples.
-fn only_chunks_follow(b: &[u8], from: usize) -> bool {
-    let mut pos = from;
-    while pos < b.len() {
-        let (Some(id), Some(size)) = (tag(b, pos), le_u32(b, pos + 4)) else { return false };
-        if !id.iter().all(|c| (0x20..0x7f).contains(c)) {
-            return false;
-        }
-        let size = size as usize;
-        let Some(end) = pos.checked_add(8).and_then(|body| body.checked_add(size)) else { return false };
-        if end > b.len() {
-            return false;
-        }
-        let next = end + (size & 1);
-        if end == b.len() || next == b.len() {
-            return true;
-        }
-        pos = next;
-    }
-    false
-}
-
-/// A `data` chunk header as found in the file, for [`data_chunk_len`].
-struct DataChunk {
-    body: usize,
-    size32: u32,
-    is_rf64: bool,
-    remaining: usize,
-    declared: usize,
-}
-
-/// Bytes of audio a `data` chunk holds: leniently, whatever is present when the size is wrong or
-/// the recording was never finalised.
-fn data_chunk_len(b: &[u8], c: DataChunk) -> usize {
-    let finished = u64::from(le_u32(b, 4).unwrap_or(0)) + 8 == b.len() as u64;
-    let empty = c.size32 == 0 && !c.is_rf64 && finished && only_chunks_follow(b, c.body);
-    if c.size32 == 0 && !c.is_rf64 && !empty { c.remaining } else { c.declared.min(c.remaining) }
-}
-
-/// The sample layout of a `fmt` chunk, `None` for a format we do not read natively.
-fn pcm_layout(fmt: &Fmt) -> Result<Option<(PcmKind, SampleFormat)>> {
-    Ok(Some(match (fmt.tag, fmt.bits) {
-        (WAVE_FORMAT_PCM, bits @ 1..=32) => {
-            let bytes = usize::from(bits.div_ceil(8));
-            let sf = match fmt.valid_bits.min(bits) {
-                0..=8 => SampleFormat::Int8,
-                9..=16 => SampleFormat::Int16,
-                17..=24 => SampleFormat::Int24,
-                _ => SampleFormat::Int32,
-            };
-            (PcmKind::Int { bytes, big_endian: false, unsigned: bytes == 1 }, sf)
-        }
-        (WAVE_FORMAT_IEEE_FLOAT, 32) => (PcmKind::Float { bytes: 4, big_endian: false }, SampleFormat::Float32),
-        (WAVE_FORMAT_IEEE_FLOAT, 64) => (PcmKind::Float { bytes: 8, big_endian: false }, SampleFormat::Float64),
-        (WAVE_FORMAT_PCM | WAVE_FORMAT_IEEE_FLOAT, bits) => {
-            return Err(AudioError::Unsupported(format!("WAV format {} with {bits} bits per sample", fmt.tag)));
-        }
-        _ => return Ok(None),
-    }))
-}
-
-pub(crate) fn parse(b: &[u8]) -> Result<WavParse> {
-    if !is_wav(b) {
-        return Err(AudioError::Malformed("not a RIFF/RF64 WAVE file".into()));
-    }
-    let is_rf64 = tag(b, 0).is_some_and(|t| &t != b"RIFF");
-    let mut ds64_data: Option<u64> = None;
-    let mut fmt: Option<Fmt> = None;
-    let mut bwf: Option<BwfInfo> = None;
-    let mut data: Option<(usize, usize)> = None;
-
-    let mut pos: usize = 12;
-    // Bound the number of chunks we look at so a file of tiny chunks can't spin forever.
-    let mut chunks = 0usize;
-    while let (Some(id), Some(size32)) = (tag(b, pos), le_u32(b, pos + 4)) {
-        chunks += 1;
-        if chunks > 100_000 {
-            break;
-        }
-        let body = pos.checked_add(8).ok_or_else(|| AudioError::Malformed("chunk offset overflow".into()))?;
-        let remaining = b.len().saturating_sub(body);
-        let mut size = u64::from(size32);
-        if &id == b"data" && is_rf64 && size32 == u32::MAX {
-            size = ds64_data.unwrap_or(remaining as u64);
-        }
-        let declared = usize::try_from(size).unwrap_or(usize::MAX);
-        if &id == b"data" {
-            // Lenient: a truncated recording (or a streaming writer's 0 / 0xFFFFFFFF size) still
-            // yields whatever audio is actually present.
-            // A size of 0 in a file whose RIFF size is right and that has only chunks after it is an
-            // empty data chunk followed by metadata (LIST, bext, …); otherwise it is a recording
-            // that was never finalised, and what follows is audio.
-            let len = data_chunk_len(b, DataChunk { body, size32, is_rf64, remaining, declared });
-            if data.is_none() {
-                data = Some((body, len));
-            }
-            if declared > remaining {
-                break;
-            }
-        } else {
-            if declared > remaining {
-                // A truncated non-audio chunk at the end of the file: stop scanning.
-                break;
-            }
-            let c = b.get(body..body + declared).unwrap_or_default();
-            match &id {
-                b"fmt " => fmt = Some(parse_fmt(c)?),
-                b"bext" => bwf = parse_bext(c),
-                b"ds64" => ds64_data = le_u64(c, 8),
-                _ => {}
-            }
-        }
-        let padded = declared.saturating_add(declared & 1);
-        pos = match body.checked_add(padded) {
-            Some(p) => p,
-            None => break,
-        };
-    }
-
-    let fmt = fmt.ok_or_else(|| AudioError::Malformed("WAV has no fmt chunk".into()))?;
-    if fmt.channels == 0 {
-        return Err(AudioError::Malformed("WAV declares zero channels".into()));
-    }
-    if fmt.sample_rate == 0 {
-        return Err(AudioError::Malformed("WAV declares a zero sample rate".into()));
-    }
-    let channels = usize::from(fmt.channels);
-    let Some((kind, sample_format)) = pcm_layout(&fmt)? else { return Ok(WavParse::Foreign { bwf }) };
-    let block = kind.bytes().checked_mul(channels).ok_or_else(|| AudioError::Malformed("block size overflow".into()))?;
-    if usize::from(fmt.block_align) != block {
-        log::debug!("WAV block_align {} disagrees with computed {block}; using computed", fmt.block_align);
-    }
-    let (data_start, data_len) = data.ok_or_else(|| AudioError::Malformed("WAV has no data chunk".into()))?;
-    let frames = (data_len / block) as u64;
-    Ok(WavParse::Native(WavLayout {
-        info: AudioInfo { format: FileFormat::Wav, sample_format, sample_rate: fmt.sample_rate, channels: fmt.channels, frames, bwf },
-        kind,
-        data_start,
-        data_len,
-    }))
-}
-
-pub(crate) fn decode(b: &[u8], layout: &WavLayout) -> Result<AudioBuffer> {
-    let end = layout.data_start.saturating_add(layout.data_len).min(b.len());
-    let data = b.get(layout.data_start..end).unwrap_or_default();
-    let channels = deinterleave(data, layout.kind, usize::from(layout.info.channels), layout.info.frames)?;
-    Ok(AudioBuffer { sample_rate: layout.info.sample_rate, channels })
-}
-
-/// Default speaker mask for a channel count (callers that know the layout pass their own):
-/// mono, stereo, LCR, quad, 5.0, 5.1, 6.1, 7.1 (sides + rears), 7.1.4.
-fn channel_mask(channels: usize) -> u32 {
-    match channels {
-        1 => 0x4,
-        2 => 0x3,
-        3 => 0x7,
-        4 => 0x33,
-        5 => 0x37,
-        6 => 0x3F,
-        7 => 0x13F,
-        8 => 0x63F,
-        // L R C LFE Lrs Rrs Lss Rss Ltf Rtf Ltr Rtr (7.1.4).
-        12 => 0x2_D63F,
-        n if n <= 18 => (1u32 << n) - 1,
-        _ => 0,
-    }
-}
-
-/// The `dwChannelMask` of a WAVE_FORMAT_EXTENSIBLE file (None for plain PCM/float headers).
-pub(crate) fn read_channel_mask(b: &[u8]) -> Option<u32> {
-    if !is_wav(b) {
-        return None;
-    }
-    let mut pos = 12usize;
-    for _ in 0..10_000 {
-        let (id, size) = (tag(b, pos)?, usize::try_from(le_u32(b, pos + 4)?).ok()?);
-        if &id == b"fmt " {
-            return (le_u16(b, pos + 8)? == WAVE_FORMAT_EXTENSIBLE).then(|| le_u32(b, pos + 8 + 20)).flatten();
-        }
-        pos = pos.checked_add(8)?.checked_add(size)?.checked_add(size & 1)?;
-    }
-    None
-}
-
-fn put_fixed_str(out: &mut Vec<u8>, s: &str, len: usize) {
-    let bytes = s.as_bytes();
-    let mut n = bytes.len().min(len);
-    while !s.is_char_boundary(n) {
-        n -= 1;
-    }
-    out.extend_from_slice(bytes.get(..n).unwrap_or_default());
-    out.resize(out.len() + (len - n), 0);
-}
-
-fn bext_chunk(bwf: &BwfInfo) -> Vec<u8> {
-    let mut c = Vec::with_capacity(BEXT_MIN_LEN);
-    put_fixed_str(&mut c, &bwf.description, 256);
-    put_fixed_str(&mut c, &bwf.originator, 32);
-    put_fixed_str(&mut c, &bwf.originator_reference, 32);
-    put_fixed_str(&mut c, &bwf.origination_date, 10);
-    put_fixed_str(&mut c, &bwf.origination_time, 8);
-    c.extend_from_slice(&((bwf.time_reference & 0xFFFF_FFFF) as u32).to_le_bytes());
-    c.extend_from_slice(&((bwf.time_reference >> 32) as u32).to_le_bytes());
-    c.extend_from_slice(&1u16.to_le_bytes()); // version 1
-    c.resize(BEXT_MIN_LEN, 0); // UMID, loudness, reserved; no coding history
-    c
-}
-
-fn push_chunk(out: &mut Vec<u8>, id: &[u8; 4], body: &[u8]) {
-    out.extend_from_slice(id);
-    out.extend_from_slice(&u32::try_from(body.len()).unwrap_or(u32::MAX).to_le_bytes());
-    out.extend_from_slice(body);
-    if body.len() % 2 == 1 {
-        out.push(0);
-    }
-}
-
-/// A WAV written block by block: a placeholder header first, then the real one (the same length,
-/// RF64 above 4 GiB, or always when `force_rf64`) written over it by [`Writer::finish`].
-pub(crate) struct Writer<W> {
-    out: W,
-    start: u64,
-    channels: usize,
-    sample_rate: u32,
-    format: (u16, bool),
-    bwf: Option<BwfInfo>,
-    mask: Option<u32>,
-    force_rf64: bool,
-    quantizers: Vec<Quantizer>,
-    frames: u64,
-    bytes: Vec<u8>,
-    /// Set when a block write has failed: the sink may hold a prefix of that block while
-    /// `frames` does not count it, so the writer refuses every later call.
-    failed: bool,
-}
-
-/// The optional header parts of a WAV file: BWF metadata, speaker mask, and whether to force RF64.
-#[derive(Clone, Copy)]
-pub(crate) struct HeaderExtras<'a> {
-    pub(crate) bwf: Option<&'a BwfInfo>,
-    pub(crate) mask: Option<u32>,
-    pub(crate) force_rf64: bool,
-}
-
-impl<W: Write + Seek> Writer<W> {
-    pub(crate) fn new(mut out: W, channels: usize, sample_rate: u32, depth: BitDepth, dither: bool, extras: HeaderExtras<'_>) -> Result<Self> {
-        let HeaderExtras { bwf, mask, force_rf64 } = extras;
-        validate_layout(channels, sample_rate)?;
-        let format = sample_format(depth);
-        let start = out.stream_position()?;
-        out.write_all(&header(channels, sample_rate, format, bwf, mask, 0, force_rf64)?)?;
-        let quantizers = Quantizer::per_channel(u32::from(format.0), dither, channels);
-        Ok(Writer {
-            out,
-            start,
-            channels,
-            sample_rate,
-            format,
-            bwf: bwf.cloned(),
-            mask,
-            force_rf64,
-            quantizers,
-            frames: 0,
-            bytes: Vec::new(),
-            failed: false,
-        })
-    }
-
-    fn header(&self, frames: u64) -> Result<Vec<u8>> {
-        header(self.channels, self.sample_rate, self.format, self.bwf.as_ref(), self.mask, frames, self.force_rf64)
-    }
-
-    /// The frame count after `frames` more (RF64 has room for any bounce).
-    pub(crate) fn check_room(&self, frames: u64) -> Result<u64> {
-        let total = self.frames.saturating_add(frames);
-        self.header(total)?;
-        Ok(total)
-    }
-
-    /// Appends `frames` frames of planar audio (missing samples are silence).
-    pub(crate) fn write(&mut self, block: &[Vec<f32>], frames: usize) -> Result<()> {
-        if self.failed {
-            return Err(crate::failed_write_error());
-        }
-        let total = self.check_room(frames as u64)?;
-        if let Err(e) = write_interleaved(&mut self.out, &mut self.bytes, block, frames, &mut self.quantizers, self.format, false) {
-            self.failed = true;
-            return Err(AudioError::from(e));
-        }
-        self.frames = total;
-        Ok(())
-    }
-
-    pub(crate) fn finish(mut self) -> Result<W> {
-        if self.failed {
-            return Err(crate::failed_write_error());
-        }
-        let data_len = u64::from(self.format.0 / 8).saturating_mul(self.channels as u64).saturating_mul(self.frames);
-        if data_len % 2 == 1 {
-            self.out.write_all(&[0])?;
-        }
-        let head = self.header(self.frames)?;
-        self.out.seek(SeekFrom::Start(self.start))?;
-        self.out.write_all(&head)?;
-        self.out.seek(SeekFrom::End(0))?;
-        self.out.flush()?;
-        Ok(self.out)
-    }
-}
-
-/// Encode a WAV file. `force_rf64` writes the RF64 layout even for small files (for tests);
-/// it is used automatically when the file would exceed 4 GiB.
-/// `mask` overrides the speaker mask derived from the channel count.
-pub(crate) fn encode(
-    buf: &AudioBuffer,
-    depth: BitDepth,
-    dither: bool,
-    bwf: Option<&BwfInfo>,
-    force_rf64: bool,
-    mask: Option<u32>,
-) -> Result<Vec<u8>> {
-    validate_buffer(buf)?;
-    let channels = buf.channels.len();
-    let frames = buf.frames();
-    let format = sample_format(depth);
-    let head = header(channels, buf.sample_rate, format, bwf, mask, frames as u64, force_rf64)?;
-    let data_len = (usize::from(format.0 / 8) * channels).checked_mul(frames).ok_or_else(|| AudioError::TooLarge("data size overflow".into()))?;
-    let mut out = Vec::new();
-    out.try_reserve_exact(head.len().saturating_add(data_len).saturating_add(1))
-        .map_err(|_| AudioError::TooLarge(format!("cannot allocate {data_len} bytes for WAV output")))?;
-    let mut w = Writer::new(Cursor::new(out), channels, buf.sample_rate, depth, dither, HeaderExtras { bwf, mask, force_rf64 })?;
-    w.write(&buf.channels, frames)?;
-    Ok(w.finish()?.into_inner())
-}
-
-/// Everything before the sample data of a WAV holding `frames` frames.
-pub(crate) fn header(
-    channels: usize,
-    sample_rate: u32,
-    (bits, is_float): (u16, bool),
-    bwf: Option<&BwfInfo>,
-    mask: Option<u32>,
-    frames: u64,
-    force_rf64: bool,
-) -> Result<Vec<u8>> {
-    let block = usize::from(bits / 8).checked_mul(channels).ok_or_else(|| AudioError::TooLarge("block size overflow".into()))?;
-    let block_align = u16::try_from(block).map_err(|_| AudioError::Encode("too many channels for WAV".into()))?;
-    let byte_rate = sample_rate.checked_mul(u32::from(block_align)).ok_or_else(|| AudioError::Encode("WAV byte rate overflow".into()))?;
-    let data_len = u64::from(block_align).checked_mul(frames).ok_or_else(|| AudioError::TooLarge("data size overflow".into()))?;
-    let extensible = channels > 2 || bits > 16 || mask.is_some_and(|m| m != channel_mask(channels));
-    let fmt_tag = if is_float { WAVE_FORMAT_IEEE_FLOAT } else { WAVE_FORMAT_PCM };
-
-    let mut fmt = Vec::with_capacity(40);
-    fmt.extend_from_slice(&(if extensible { WAVE_FORMAT_EXTENSIBLE } else { fmt_tag }).to_le_bytes());
-    fmt.extend_from_slice(&(channels as u16).to_le_bytes());
-    fmt.extend_from_slice(&sample_rate.to_le_bytes());
-    fmt.extend_from_slice(&byte_rate.to_le_bytes());
-    fmt.extend_from_slice(&block_align.to_le_bytes());
-    fmt.extend_from_slice(&bits.to_le_bytes());
-    if extensible {
-        fmt.extend_from_slice(&22u16.to_le_bytes());
-        fmt.extend_from_slice(&bits.to_le_bytes());
-        fmt.extend_from_slice(&mask.unwrap_or_else(|| channel_mask(channels)).to_le_bytes());
-        fmt.extend_from_slice(&fmt_tag.to_le_bytes());
-        fmt.extend_from_slice(&GUID_TAIL);
-    }
-
-    let mut head = Vec::with_capacity(1024);
-    let rf64_body_len = 28usize;
-    // Reserve room for ds64 (as JUNK when not needed, so a later writer could upgrade in place).
-    let mut meta = Vec::new();
-    if let Some(bwf) = bwf {
-        push_chunk(&mut meta, b"bext", &bext_chunk(bwf));
-    }
-    push_chunk(&mut meta, b"fmt ", &fmt);
-    if is_float {
-        push_chunk(&mut meta, b"fact", &u32::try_from(frames).unwrap_or(u32::MAX).to_le_bytes());
-    }
-    let total = ((4 + (8 + rf64_body_len) + meta.len() + 8) as u64)
-        .checked_add(data_len)
-        .and_then(|t| t.checked_add(data_len & 1))
-        .ok_or_else(|| AudioError::TooLarge("WAV size overflow".into()))?;
-    let rf64 = force_rf64 || u32::try_from(total).is_err();
-
-    if rf64 {
-        head.extend_from_slice(b"RF64");
-        head.extend_from_slice(&u32::MAX.to_le_bytes());
-        head.extend_from_slice(b"WAVE");
-        let mut ds64 = Vec::with_capacity(rf64_body_len);
-        ds64.extend_from_slice(&total.to_le_bytes());
-        ds64.extend_from_slice(&data_len.to_le_bytes());
-        ds64.extend_from_slice(&frames.to_le_bytes());
-        ds64.extend_from_slice(&0u32.to_le_bytes());
-        push_chunk(&mut head, b"ds64", &ds64);
-    } else {
-        head.extend_from_slice(b"RIFF");
-        head.extend_from_slice(&(total as u32).to_le_bytes());
-        head.extend_from_slice(b"WAVE");
-        push_chunk(&mut head, b"JUNK", &[0u8; 28]);
-    }
-    head.extend_from_slice(&meta);
-    head.extend_from_slice(b"data");
-    head.extend_from_slice(&(if rf64 { u32::MAX } else { data_len as u32 }).to_le_bytes());
-    Ok(head)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::header;
-
-    #[test]
-    fn rejects_byte_rate_overflow() {
-        let result = header(2, 1_100_000_000, (16, false), None, None, 0, false);
-        assert!(result.is_err(), "overflowing byte rate was accepted");
-    }
-}
@@ -1,17 +0,0 @@
-Tiny fixtures for `tests/it/decode_read_list.rs`: one per container or codec the READ list names
-that the crate cannot write itself. Made with ffmpeg 8.0 from a 0.1 s mono 440 Hz sine
-(`F="-y -f lavfi -i sine=frequency=440:duration=0.1 -ac 1"`):
-
-    ffmpeg $F -ar 8000  -c:a libmp3lame -b:a 16k tone.mp3
-    ffmpeg $F -ar 24000 -c:a mp2 -b:a 32k tone.mp2
-    ffmpeg $F -ar 8000  -c:a libvorbis -q:a -1 tone.ogg
-    ffmpeg $F -ar 8000  -c:a aac -b:a 16k tone.m4a
-    ffmpeg $F -ar 8000  -c:a aac -b:a 16k -f adts tone.aac
-    ffmpeg $F -ar 8000  -c:a pcm_s16le tone.caf
-    ffmpeg $F -ar 8000  -c:a pcm_s16le tone.mkv
-    ffmpeg $F -ar 8000  -c:a libvorbis -q:a -1 tone.webm
-    ffmpeg $F -ar 8000  -c:a pcm_s16le -f aiff tone.aifc    # AIFF-C "sowt"
-
-`silence.mp1` has no ffmpeg encoder. It is four hand-built MPEG-1 Layer I frames (mono, 32 kHz,
-32 kbit/s, 48 bytes each: header `FF FF 18 C0`, all subband allocations zero), which decode to
-silence.
@@ -1,51 +0,0 @@
-//! Every extension the format table reads decodes with the compiled-in `symphonia` features.
-
-use soundcraft_audio_io::{AudioBuffer, BitDepth, EncodeOptions, FileFormat, decode, encode, probe};
-
-fn fixture(name: &str) -> Vec<u8> {
-    let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures").join(name);
-    std::fs::read(&path).unwrap_or_else(|e| panic!("{}: {e}", path.display()))
-}
-
-fn generated(format: FileFormat) -> Vec<u8> {
-    let tone: Vec<f32> = (0..800).map(|i| (i as f32 * 0.1).sin() * 0.5).collect();
-    let buf = AudioBuffer { sample_rate: 8000, channels: vec![tone] };
-    encode(&buf, &EncodeOptions { format, bit_depth: BitDepth::Int16, dither: false, bwf: None }).unwrap()
-}
-
-fn bytes_for(ext: &str) -> Vec<u8> {
-    match ext {
-        "wav" | "wave" | "bwf" => generated(FileFormat::Wav),
-        "rf64" => {
-            let tone = AudioBuffer { sample_rate: 8000, channels: vec![vec![0.25; 800]] };
-            let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Int16, dither: false, bwf: None };
-            soundcraft_audio_io::encode_wav_rf64(&tone, &opts).unwrap()
-        }
-        "aif" | "aiff" => generated(FileFormat::Aiff),
-        "aifc" => fixture("tone.aifc"),
-        "flac" => generated(FileFormat::Flac),
-        "mp3" => fixture("tone.mp3"),
-        "mp2" => fixture("tone.mp2"),
-        "mp1" => fixture("silence.mp1"),
-        "ogg" | "oga" => fixture("tone.ogg"),
-        "m4a" | "m4b" | "mp4" => fixture("tone.m4a"),
-        "aac" | "adts" => fixture("tone.aac"),
-        "caf" => fixture("tone.caf"),
-        "mkv" => fixture("tone.mkv"),
-        "webm" => fixture("tone.webm"),
-        other => panic!("no fixture for the READ extension {other:?}: add one"),
-    }
-}
-
-#[test]
-fn every_read_extension_probes_and_decodes() {
-    for &format in FileFormat::READ {
-        for ext in format.extensions() {
-            let bytes = bytes_for(ext);
-            let info = probe(&bytes, Some(ext)).unwrap_or_else(|e| panic!("probe .{ext}: {e}"));
-            let (_, buf) = decode(&bytes, Some(ext)).unwrap_or_else(|e| panic!("decode .{ext}: {e}"));
-            assert!(info.channels >= 1, ".{ext}");
-            assert!(buf.frames() > 0, ".{ext}: no frames");
-        }
-    }
-}
@@ -1,36 +0,0 @@
-use soundcraft_audio_io::FileFormat;
-
-#[test]
-fn every_read_and_write_format_round_trips_through_its_extensions() {
-    for &format in FileFormat::READ {
-        assert!(!format.extensions().is_empty(), "{format:?}");
-        for ext in format.extensions() {
-            assert_eq!(FileFormat::from_extension(ext), Some(format), "{ext}");
-            assert_eq!(FileFormat::from_extension(&format!(".{}", ext.to_ascii_uppercase())), Some(format), "{ext}");
-            assert_eq!(FileFormat::from_path(format!("dir.x/Take 1.{ext}")), Some(format), "{ext}");
-        }
-    }
-    for &format in FileFormat::WRITE {
-        assert!(!format.write_extensions().is_empty(), "{format:?}");
-        for ext in format.write_extensions() {
-            assert_eq!(FileFormat::from_write_extension(ext), Some(format), "{ext}");
-            assert_eq!(FileFormat::from_write_extension(&ext.to_ascii_uppercase()), Some(format), "{ext}");
-            assert_eq!(FileFormat::from_extension(ext), Some(format), "{ext}: what is written reads back");
-        }
-        assert!(format.write_extensions().contains(&format.default_extension()), "{format:?}");
-    }
-}
-
-#[test]
-fn only_names_whose_readers_expect_the_encoder_output_are_writable() {
-    assert_eq!(FileFormat::writable_extensions(), ["wav", "wave", "bwf", "aif", "aiff", "flac"]);
-    for read_only in ["rf64", "aifc", "mp3", "ogg", "m4a", "mkv"] {
-        assert!(FileFormat::from_extension(read_only).is_some(), "{read_only}");
-        assert_eq!(FileFormat::from_write_extension(read_only), None, "{read_only}");
-    }
-    for unknown in ["xyz", "", "mid"] {
-        assert_eq!(FileFormat::from_extension(unknown), None, "{unknown}");
-    }
-    assert_eq!(FileFormat::from_path("no-extension"), None);
-    assert_eq!(FileFormat::Aiff.default_extension(), "aif");
-}
@@ -1,101 +0,0 @@
-use soundcraft_audio_io::{AudioBuffer, BitDepth, EncodeOptions, FileEncoder, FileFormat, SampleFormat, decode, encode};
-use std::io::Cursor;
-
-fn encoded(audio: &AudioBuffer, options: &EncodeOptions, streaming: bool) -> Vec<u8> {
-    if !streaming {
-        return encode(audio, options).unwrap();
-    }
-    let mut writer = FileEncoder::new(Cursor::new(Vec::new()), options, audio.num_channels(), audio.sample_rate, None).unwrap();
-    // Cross the writer's 4096-frame scratch boundary, then write a short final block.
-    for start in (0..audio.frames()).step_by(4097) {
-        let end = (start + 4097).min(audio.frames());
-        let block: Vec<Vec<f32>> = audio.channels.iter().map(|channel| channel[start..end].to_vec()).collect();
-        writer.write(&block, end - start).unwrap();
-    }
-    writer.finish().unwrap().into_inner()
-}
-
-fn assert_float_headroom(streaming: bool) {
-    let samples = [
-        -f32::MAX,
-        -2.0,
-        -1.25,
-        -1.0,
-        -0.5,
-        -f32::MIN_POSITIVE,
-        -f32::from_bits(1),
-        -0.0,
-        0.0,
-        f32::from_bits(1),
-        f32::MIN_POSITIVE,
-        0.5,
-        1.0,
-        1.25,
-        2.0,
-        f32::MAX,
-    ];
-    for format in [FileFormat::Wav, FileFormat::Aiff] {
-        for dither in [false, true] {
-            for channels in [1, 2] {
-                let audio = AudioBuffer {
-                    sample_rate: 48_000,
-                    channels: (0..channels).map(|c| samples.iter().copied().cycle().skip(c).take(4103).collect()).collect(),
-                };
-                let options = EncodeOptions { format, bit_depth: BitDepth::Float32, dither, bwf: None };
-                let bytes = encoded(&audio, &options, streaming);
-                let pcm: Vec<u8> =
-                    audio.interleaved().iter().flat_map(|v| if format == FileFormat::Wav { v.to_le_bytes() } else { v.to_be_bytes() }).collect();
-                assert!(bytes.ends_with(&pcm), "{format:?}, dither={dither}: stored sample bytes changed");
-                let (info, decoded) = decode(&bytes, None).unwrap();
-                assert_eq!(info.sample_format, SampleFormat::Float32);
-                assert_eq!((decoded.sample_rate, decoded.num_channels(), decoded.frames()), (48_000, channels, 4103));
-                for (channel, (actual, expected)) in decoded.channels.iter().zip(&audio.channels).enumerate() {
-                    for (frame, (actual, expected)) in actual.iter().zip(expected).enumerate() {
-                        assert_eq!(actual.to_bits(), expected.to_bits(), "{format:?}, dither={dither}, channel={channel}, frame={frame}");
-                    }
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn whole_file_float32_preserves_finite_headroom() {
-    assert_float_headroom(false);
-}
-
-#[test]
-fn streaming_float32_preserves_finite_headroom() {
-    assert_float_headroom(true);
-}
-
-#[test]
-fn float32_keeps_non_finite_sample_handling() {
-    let audio = AudioBuffer { sample_rate: 48_000, channels: vec![vec![f32::NAN, f32::NEG_INFINITY, f32::INFINITY]] };
-    let expected = [0.0_f32, -1.0, 1.0];
-    for format in [FileFormat::Wav, FileFormat::Aiff] {
-        for streaming in [false, true] {
-            let options = EncodeOptions { format, bit_depth: BitDepth::Float32, dither: false, bwf: None };
-            let bytes = encoded(&audio, &options, streaming);
-            // Inspect stored samples too: the decoder itself replaces non-finite values.
-            let pcm: Vec<u8> = expected.iter().flat_map(|v| if format == FileFormat::Wav { v.to_le_bytes() } else { v.to_be_bytes() }).collect();
-            assert!(bytes.ends_with(&pcm), "{format:?}, streaming={streaming}");
-            assert_eq!(decode(&bytes, None).unwrap().1.channels[0], expected);
-        }
-    }
-}
-
-#[test]
-fn integer_pcm_still_clips_at_full_scale() {
-    let audio = AudioBuffer { sample_rate: 48_000, channels: vec![vec![-2.0, -1.25, -1.0, -0.5, 0.0, 0.5, 1.0, 1.25, 2.0]] };
-    for (depth, max) in [(BitDepth::Int16, 32767.0 / 32768.0), (BitDepth::Int24, 8_388_607.0 / 8_388_608.0), (BitDepth::Int32, 1.0)] {
-        for format in [FileFormat::Wav, FileFormat::Aiff, FileFormat::Flac] {
-            for streaming in [false, true] {
-                let options = EncodeOptions { format, bit_depth: depth, dither: false, bwf: None };
-                let bytes = encoded(&audio, &options, streaming);
-                let (_, decoded) = decode(&bytes, None).unwrap();
-                assert_eq!(decoded.channels[0], [-1.0, -1.0, -1.0, -0.5, 0.0, 0.5, max, max, max], "{format:?} {depth:?}, streaming={streaming}");
-            }
-        }
-    }
-}
@@ -1,10 +0,0 @@
-//! Integration tests, built as one test binary: each file is a module.
-
-mod decode_read_list;
-mod file_format;
-mod float_headroom;
-mod malformed;
-mod mp4_length;
-mod roundtrip;
-mod stream;
-mod wav_empty_data;
@@ -1,821 +0,0 @@
-//! Hostile inputs must produce `Err` (or a best-effort `Ok`), never a panic.
-
-use proptest::prelude::*;
-use soundcraft_audio_io::{AudioBuffer, AudioError, BitDepth, EncodeOptions, FileFormat, SampleFormat, decode, detect_format, encode, probe};
-
-fn small(format: FileFormat, depth: BitDepth, channels: usize) -> Vec<u8> {
-    let mut b = AudioBuffer::new(44_100, channels, 300);
-    for ch in &mut b.channels {
-        for (i, s) in ch.iter_mut().enumerate() {
-            *s = ((i as f32) * 0.1).sin() * 0.5;
-        }
-    }
-    encode(&b, &EncodeOptions { format, bit_depth: depth, dither: false, bwf: None }).unwrap()
-}
-
-/// An ID3v2.4 header whose syncsafe size field declares `size` bytes of tag body.
-fn id3_header(size: usize) -> [u8; 10] {
-    let size = size as u32;
-    [b'I', b'D', b'3', 4, 0, 0, ((size >> 21) & 0x7F) as u8, ((size >> 14) & 0x7F) as u8, ((size >> 7) & 0x7F) as u8, (size & 0x7F) as u8]
-}
-
-/// Wrap `body` in an ID3v2.4 tag.
-fn id3_tag(body: &[u8]) -> Vec<u8> {
-    [&id3_header(body.len())[..], body].concat()
-}
-
-/// Little helper for building RIFF files by hand.
-fn riff(chunks: &[(&[u8; 4], Vec<u8>)]) -> Vec<u8> {
-    let mut body = b"WAVE".to_vec();
-    for (id, data) in chunks {
-        body.extend_from_slice(*id);
-        body.extend_from_slice(&(data.len() as u32).to_le_bytes());
-        body.extend_from_slice(data);
-        if data.len() % 2 == 1 {
-            body.push(0);
-        }
-    }
-    let mut out = b"RIFF".to_vec();
-    out.extend_from_slice(&(body.len() as u32).to_le_bytes());
-    out.extend_from_slice(&body);
-    out
-}
-
-fn fmt(tag: u16, channels: u16, sr: u32, bits: u16) -> Vec<u8> {
-    let align = channels * bits.div_ceil(8);
-    let mut f = Vec::new();
-    f.extend_from_slice(&tag.to_le_bytes());
-    f.extend_from_slice(&channels.to_le_bytes());
-    f.extend_from_slice(&sr.to_le_bytes());
-    f.extend_from_slice(&(sr * u32::from(align)).to_le_bytes());
-    f.extend_from_slice(&align.to_le_bytes());
-    f.extend_from_slice(&bits.to_le_bytes());
-    f
-}
-
-#[test]
-fn every_truncation_is_handled() {
-    let files = [
-        small(FileFormat::Wav, BitDepth::Int16, 2),
-        small(FileFormat::Wav, BitDepth::Float32, 6),
-        small(FileFormat::Aiff, BitDepth::Int24, 1),
-        small(FileFormat::Aiff, BitDepth::Float32, 2),
-        small(FileFormat::Flac, BitDepth::Int16, 2),
-        small(FileFormat::Flac, BitDepth::Int24, 1),
-    ];
-    for file in &files {
-        for n in 0..file.len() {
-            let cut = &file[..n];
-            let _ = probe(cut, None);
-            if let Ok((info, buf)) = decode(cut, None) {
-                assert_eq!(buf.num_channels(), info.channels as usize);
-                assert_eq!(buf.frames() as u64, info.frames);
-            }
-        }
-    }
-}
-
-#[test]
-fn truncated_data_chunk_yields_partial_audio() {
-    let file = small(FileFormat::Wav, BitDepth::Int16, 2);
-    let (info, buf) = decode(&file[..file.len() - 400], None).unwrap();
-    assert_eq!(info.frames, 200);
-    assert_eq!(buf.frames(), 200);
-}
-
-#[test]
-fn every_single_byte_corruption_is_handled() {
-    for file in [small(FileFormat::Wav, BitDepth::Int24, 2), small(FileFormat::Aiff, BitDepth::Int16, 2), small(FileFormat::Flac, BitDepth::Int16, 1)]
-    {
-        for i in 0..file.len().min(200) {
-            for v in [0x00, 0xFF, 0x7F, 0x80] {
-                let mut f = file.clone();
-                f[i] = v;
-                let _ = probe(&f, None);
-                let _ = decode(&f, None);
-            }
-        }
-    }
-}
-
-#[test]
-fn zero_channels_is_malformed() {
-    let wav = riff(&[(b"fmt ", fmt(1, 0, 44_100, 16)), (b"data", vec![0; 16])]);
-    assert!(matches!(decode(&wav, None), Err(AudioError::Malformed(_))));
-    assert!(probe(&wav, None).is_err());
-    let mut aiff = small(FileFormat::Aiff, BitDepth::Int16, 1);
-    let comm = aiff.windows(4).position(|w| w == b"COMM").unwrap();
-    aiff[comm + 8] = 0;
-    aiff[comm + 9] = 0;
-    assert!(matches!(decode(&aiff, None), Err(AudioError::Malformed(_))));
-}
-
-#[test]
-fn aiff_negative_channel_count_is_malformed() {
-    let mut aiff = small(FileFormat::Aiff, BitDepth::Int16, 1);
-    let comm = aiff.windows(4).position(|w| w == b"COMM").unwrap();
-    aiff[comm + 8] = 0x80;
-    aiff[comm + 9] = 0;
-    assert!(probe(&aiff, None).is_err());
-}
-
-#[test]
-fn zero_sample_rate_is_malformed() {
-    let wav = riff(&[(b"fmt ", fmt(1, 2, 0, 16)), (b"data", vec![0; 16])]);
-    assert!(decode(&wav, None).is_err());
-    let mut aiff = small(FileFormat::Aiff, BitDepth::Int16, 1);
-    let comm = aiff.windows(4).position(|w| w == b"COMM").unwrap();
-    for b in &mut aiff[comm + 16..comm + 26] {
-        *b = 0;
-    }
-    assert!(decode(&aiff, None).is_err());
-    // Infinite exponent.
-    aiff[comm + 16] = 0x7F;
-    aiff[comm + 17] = 0xFF;
-    assert!(decode(&aiff, None).is_err());
-}
-
-#[test]
-fn absurd_chunk_sizes() {
-    // fmt chunk claims 4 GiB.
-    let mut wav = riff(&[(b"fmt ", fmt(1, 2, 44_100, 16)), (b"data", vec![0; 16])]);
-    wav[16..20].copy_from_slice(&u32::MAX.to_le_bytes());
-    assert!(decode(&wav, None).is_err());
-    // data chunk claims 4 GiB: lenient read of what's there.
-    let mut wav = riff(&[(b"fmt ", fmt(1, 2, 44_100, 16)), (b"data", vec![0; 16])]);
-    let d = wav.windows(4).position(|w| w == b"data").unwrap();
-    wav[d + 4..d + 8].copy_from_slice(&u32::MAX.to_le_bytes());
-    let (info, buf) = decode(&wav, None).unwrap();
-    assert_eq!((info.frames, buf.frames()), (4, 4));
-    // An unknown chunk with an absurd size before fmt.
-    let mut wav = riff(&[(b"junk", vec![0; 4]), (b"fmt ", fmt(1, 2, 44_100, 16)), (b"data", vec![0; 16])]);
-    wav[16..20].copy_from_slice(&0xFFFF_FFF0u32.to_le_bytes());
-    assert!(decode(&wav, None).is_err());
-    // RF64 with a ds64 claiming an exabyte of data.
-    let mut ds64 = Vec::new();
-    ds64.extend_from_slice(&u64::MAX.to_le_bytes());
-    ds64.extend_from_slice(&u64::MAX.to_le_bytes());
-    ds64.extend_from_slice(&u64::MAX.to_le_bytes());
-    ds64.extend_from_slice(&0u32.to_le_bytes());
-    let mut rf = riff(&[(b"ds64", ds64), (b"fmt ", fmt(1, 1, 8_000, 8)), (b"data", vec![0x80; 10])]);
-    rf[..4].copy_from_slice(b"RF64");
-    let d = rf.windows(4).rposition(|w| w == b"data").unwrap();
-    rf[d + 4..d + 8].copy_from_slice(&u32::MAX.to_le_bytes());
-    let (info, buf) = decode(&rf, None).unwrap();
-    assert_eq!((info.frames, buf.frames()), (10, 10));
-    // AIFF COMM claims more frames than present; SSND offset beyond the end.
-    let mut aiff = small(FileFormat::Aiff, BitDepth::Int16, 1);
-    let comm = aiff.windows(4).position(|w| w == b"COMM").unwrap();
-    aiff[comm + 10..comm + 14].copy_from_slice(&u32::MAX.to_be_bytes());
-    assert_eq!(decode(&aiff, None).unwrap().1.frames(), 300);
-    let ssnd = aiff.windows(4).position(|w| w == b"SSND").unwrap();
-    aiff[ssnd + 8..ssnd + 12].copy_from_slice(&u32::MAX.to_be_bytes());
-    assert_eq!(decode(&aiff, None).unwrap().1.frames(), 0);
-}
-
-fn caf(chunks: &[(&[u8; 4], i64, Vec<u8>)]) -> Vec<u8> {
-    let mut out = b"caff\0\x01\0\0".to_vec();
-    for (kind, size, body) in chunks {
-        out.extend_from_slice(*kind);
-        out.extend_from_slice(&size.to_be_bytes());
-        out.extend_from_slice(body);
-    }
-    out
-}
-
-fn caf_desc(format: &[u8; 4], bytes_per_packet: u32, frames_per_packet: u32, channels: u32, bits: u32) -> (&'static [u8; 4], i64, Vec<u8>) {
-    let mut d = 48_000f64.to_be_bytes().to_vec();
-    d.extend_from_slice(format);
-    for v in [0, bytes_per_packet, frames_per_packet, channels, bits] {
-        d.extend_from_slice(&v.to_be_bytes());
-    }
-    (b"desc", 32, d)
-}
-
-fn packet_table(packets: i64, frames: i64, entries: &[u8]) -> Vec<u8> {
-    [&packets.to_be_bytes()[..], &frames.to_be_bytes(), &[0; 8], entries].concat()
-}
-
-#[test]
-fn caf_sizes_beyond_the_file_are_errors_not_aborts() {
-    let aac = || caf_desc(b"aac ", 0, 1024, 2, 0);
-    let huge = 1i64 << 50;
-    let cookie = caf(&[aac(), (b"kuki", huge, vec![0; 8])]);
-    let files = [
-        cookie.clone(),
-        [vec![0; 100], cookie].concat(),
-        caf(&[aac(), (b"data", -1, [&[0; 4][..], b"kuki", &huge.to_be_bytes()].concat())]),
-        caf(&[aac(), (b"pakt", 24, packet_table(huge, 1024, &[])), (b"data", -1, vec![0; 16])]),
-        caf(&[aac(), (b"pakt", 32, packet_table(1, 1024, &[0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0])), (b"data", -1, vec![0; 64])]),
-        caf(&[aac(), (b"pakt", 25, packet_table(1, 1024, &[0x80]))]),
-    ];
-    for f in files {
-        assert!(matches!(probe(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-        assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-    }
-    let constant = caf(&[caf_desc(b"lpcm", 2, 1, 1, 16), (b"pakt", 25, packet_table(1, 1, &[1])), (b"data", -1, vec![0; 16])]);
-    assert!(matches!(decode(&constant, None), Err(AudioError::Malformed(m)) if m.contains("lists packets")));
-}
-
-/// An EBML element: `id`, then `size` as an 8-byte vint (so any size up to 2^56 − 2 fits, and
-/// `u64::MAX` writes the reserved "unknown size"), then `body`.
-fn ebml(id: &[u8], size: u64, body: &[u8]) -> Vec<u8> {
-    let size = if size == u64::MAX { 0x01FF_FFFF_FFFF_FFFF } else { 0x0100_0000_0000_0000 | size };
-    [id, &size.to_be_bytes(), body].concat()
-}
-
-/// The EBML header of a Matroska file.
-fn ebml_header() -> Vec<u8> {
-    let doc_type = ebml(&[0x42, 0x82], 8, b"matroska");
-    ebml(&[0x1A, 0x45, 0xDF, 0xA3], doc_type.len() as u64, &doc_type)
-}
-
-/// #878: symphonia's Matroska reader takes element sizes from the file. With symphonia 0.5 a size
-/// far beyond the file was allocated up front and aborted the process (no `catch_unwind` can catch
-/// an allocation failure); since 0.6 such reads grow with the data actually read. Keep it that way
-/// for the header, for codec data and for block frames.
-#[test]
-fn matroska_sizes_beyond_the_file_are_errors_not_aborts() {
-    let huge = 1u64 << 47;
-    // The 30-byte file from the report: EBML header and DocType sizes of 2^48 − 1 and 2^47.
-    let reported = [
-        0x1A, 0x45, 0xDF, 0xA3, 0x01, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x42, 0x82, 0x01, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6D,
-        0x61, 0x74, 0x72, 0x6F, 0x73, 0x6B, 0x61,
-    ];
-    let segment = |body: Vec<u8>| [ebml_header(), ebml(&[0x18, 0x53, 0x80, 0x67], u64::MAX, &body)].concat();
-    let info = [ebml(&[0x2A, 0xD7, 0xB1], 3, &[0x0F, 0x42, 0x40]), ebml(&[0x4D, 0x80], 4, b"test"), ebml(&[0x57, 0x41], 4, b"test")].concat();
-    let info = ebml(&[0x15, 0x49, 0xA9, 0x66], info.len() as u64, &info);
-    // A valid 16-bit PCM track entry's children, followed by `extra`.
-    let pcm = |extra: &[u8]| {
-        let audio = [ebml(&[0xB5], 8, &48_000f64.to_be_bytes()), ebml(&[0x9F], 1, &[1]), ebml(&[0x62, 0x64], 1, &[16])].concat();
-        [
-            ebml(&[0xD7], 1, &[1]),
-            ebml(&[0x73, 0xC5], 1, &[1]),
-            ebml(&[0x83], 1, &[2]),
-            ebml(&[0x86], 13, b"A_PCM/INT/LIT"),
-            ebml(&[0xE1], audio.len() as u64, &audio),
-            extra.to_vec(),
-        ]
-        .concat()
-    };
-    // That track with a CodecPrivate claiming 2^46 bytes, inside parents that claim even more: the
-    // segment is valid up to that read, which runs out of file.
-    let track = ebml(&[0xAE], huge, &pcm(&ebml(&[0x63, 0xA2], huge >> 1, &[0; 16])));
-    let codec_data = segment([info.clone(), ebml(&[0x16, 0x54, 0xAE, 0x6B], huge, &track)].concat());
-    // The plain track, then a cluster whose SimpleBlock claims 2^47 bytes of frame data.
-    let track = pcm(&[]);
-    let track = ebml(&[0xAE], track.len() as u64, &track);
-    let block = ebml(&[0x1F, 0x43, 0xB6, 0x75], u64::MAX, &[ebml(&[0xE7], 1, &[0]), ebml(&[0xA3], huge, &[0x81, 0, 0, 0x80])].concat());
-    let cluster = segment([info, ebml(&[0x16, 0x54, 0xAE, 0x6B], track.len() as u64, &track), block].concat());
-    let out_of_file = |r: Result<_, AudioError>| matches!(r, Err(AudioError::Malformed(m)) if m.contains("end of file"));
-    for hint in [None, Some("mkv"), Some("wav")] {
-        assert!(probe(&reported, hint).is_err(), "{hint:?}");
-        assert!(decode(&reported, hint).is_err(), "{hint:?}");
-        // Refused at the oversized read itself, not by anything before it.
-        assert!(out_of_file(probe(&codec_data, hint).map(|_| ())), "{hint:?}: {:?}", probe(&codec_data, hint).err());
-        assert!(out_of_file(decode(&codec_data, hint).map(|_| ())), "{hint:?}");
-        // The file and its track open, so decoding reaches the block; the block reader stops at the
-        // end of the file, a best-effort read of what is there.
-        assert!(probe(&cluster, hint).is_ok(), "{hint:?}: {:?}", probe(&cluster, hint).err());
-        assert!(decode(&cluster, hint).map_or(0, |(_, b)| b.frames()) < 1_000, "{hint:?}");
-    }
-}
-
-#[test]
-fn well_formed_caf_still_reads() {
-    let pcm: Vec<u8> = (0..480i16).flat_map(|i| (i * 50).to_be_bytes()).collect();
-    let chan = [((100u32 << 16) | 1).to_be_bytes(), [0; 4], [0; 4]].concat();
-    let data = [vec![0; 4], pcm].concat();
-    let lpcm = caf(&[caf_desc(b"lpcm", 2, 1, 1, 16), (b"chan", 12, chan), (b"free", 8, vec![0; 8]), (b"data", data.len() as i64, data)]);
-    let (info, buf) = decode(&lpcm, None).unwrap();
-    assert_eq!((info.format, buf.frames()), (FileFormat::Caf, 480));
-    let table = packet_table(3, 3072, &[10, 0x81, 0x48, 5]);
-    let aac = caf(&[caf_desc(b"aac ", 0, 1024, 2, 0), (b"pakt", table.len() as i64, table), (b"data", 219, vec![0; 219])]);
-    assert_eq!(probe(&aac, None).unwrap().frames, 3072);
-}
-
-fn atom(kind: &[u8; 4], body: &[u8]) -> Vec<u8> {
-    [&(8 + body.len() as u32).to_be_bytes()[..], kind, body].concat()
-}
-
-/// A mono 16-bit, 48 kHz audio sample entry of `version`, its version fields and codec atoms.
-fn sample_entry(kind: &[u8; 4], version: u8, fields: &[u8], codec: &[u8]) -> Vec<u8> {
-    let base = [0, 0, 0, 0, 0, 0, 0, 1, 0, version, 0, 0, 0, 0, 0, 0, 0, 1, 0, 16, 0, 0, 0, 0];
-    atom(kind, &[&base[..], &(48_000u32 << 16).to_be_bytes(), fields, codec].concat())
-}
-
-/// An MP4 of `frames` 2-byte samples described by `entry`; `swap` may replace any version-0 atom.
-fn mp4(frames: u32, entry: &[u8], swap: impl Fn(&[u8; 4], Vec<u8>) -> Vec<u8>) -> Vec<u8> {
-    let full = |kind: &[u8; 4], fields: &[u32]| {
-        let body: Vec<u8> = [0].iter().chain(fields).flat_map(|v: &u32| v.to_be_bytes()).collect();
-        swap(kind, atom(kind, &body))
-    };
-    let moov = |offset: u32| {
-        let stsd = atom(b"stsd", &[&[0, 0, 0, 0, 0, 0, 0, 1][..], entry].concat());
-        let stbl =
-            [stsd, full(b"stts", &[1, frames, 1]), full(b"stsc", &[1, 1, frames, 1]), full(b"stsz", &[2, frames]), full(b"stco", &[1, offset])];
-        let minf = [full(b"smhd", &[0]), atom(b"stbl", &stbl.concat())].concat();
-        let mdia = [full(b"mdhd", &[0, 0, 48_000, frames, 0]), full(b"hdlr", &[0, u32::from_be_bytes(*b"soun"), 0, 0, 0, 0]), atom(b"minf", &minf)];
-        let trak = [full(b"tkhd", &[0; 20]), atom(b"mdia", &mdia.concat())].concat();
-        atom(b"moov", &[full(b"mvhd", &[[0, 0, 48_000, frames, 1 << 16].as_slice(), &[0; 18], &[2]].concat()), atom(b"trak", &trak)].concat())
-    };
-    let ftyp = atom(b"ftyp", b"M4A \0\0\0\0M4A isom");
-    let offset = (ftyp.len() + moov(0).len() + 8) as u32;
-    let pcm: Vec<u8> = (0..frames as i16).flat_map(|i| (i * 40).to_le_bytes()).collect();
-    [ftyp, moov(offset), atom(b"mdat", &pcm)].concat()
-}
-
-#[test]
-fn mp4_sizes_beyond_the_file_are_errors_not_aborts() {
-    let pcm = sample_entry(b"sowt", 0, &[], &[]);
-    let (_, buf) = decode(&mp4(480, &pcm, |_, a| a), None).unwrap();
-    assert_eq!(buf.frames(), 480);
-    let huge = |kind: &[u8; 4], a: Vec<u8>| [&1u32.to_be_bytes()[..], kind, &(1u64 << 60).to_be_bytes(), &a[8..]].concat();
-    // The first field after version and flags: stts's entry count, stsz's sample size.
-    let first_field_max = |mut a: Vec<u8>| {
-        a[12..16].copy_from_slice(&u32::MAX.to_be_bytes());
-        a
-    };
-    let sizes: Vec<u8> = (0..480u32).flat_map(|i| if i == 479 { u32::MAX } else { 2 }.to_be_bytes()).collect();
-    let per_sample = atom(b"stsz", &[&[0; 8][..], &480u32.to_be_bytes(), &sizes].concat());
-    // A header that starts inside its container is read whole, past the container's end.
-    let mdia = atom(b"mdia", &1u32.to_be_bytes());
-    let straddling = [&b"hdlr"[..], &(1u64 << 60).to_be_bytes(), &[0; 24]].concat();
-    let files = [
-        mp4(480, &pcm, |k, a| if k == b"hdlr" { huge(k, a) } else { a }),
-        mp4(480, &pcm, |k, a| if k == b"stts" { first_field_max(a) } else { a }),
-        mp4(480, &pcm, |k, a| if k == b"stsz" { first_field_max(a) } else { a }),
-        mp4(480, &pcm, |k, a| if k == b"stsz" { per_sample.clone() } else { a }),
-        [atom(b"ftyp", b"M4A \0\0\0\0M4A isom"), atom(b"moov", &atom(b"trak", &mdia)), straddling].concat(),
-    ];
-    for f in files {
-        assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-    }
-}
-
-#[test]
-fn atoms_running_past_their_parent_are_walked_once() {
-    // Each moov holds a trak that runs to the end of the file; symphonia stops after the first.
-    let unit = atom(b"moov", &[&u32::MAX.to_be_bytes()[..], b"trak"].concat());
-    let f = [atom(b"ftyp", b"M4A \0\0\0\0M4A isom"), unit.repeat(1 << 18)].concat();
-    assert!(decode(&f, None).is_err());
-}
-
-#[test]
-fn packets_longer_than_any_codec_uses_are_refused() {
-    let be = |v: &[u32]| v.iter().flat_map(|x| x.to_be_bytes()).collect::<Vec<u8>>();
-    let v2 = |frames: u32| [&be(&[72])[..], &48_000f64.to_be_bytes(), &be(&[1, 0x7f00_0000, 16, 4, 2, frames])].concat();
-    let lpcm = |frames: u32| sample_entry(b"lpcm", 2, &v2(frames), &[]);
-    let config = |frames: u32| [&be(&[0, frames])[..], &[0, 16, 40, 10, 14, 1, 0, 255], &be(&[0, 0, 48_000])].concat();
-    let alac = |frames: u32| sample_entry(b"alac", 0, &[], &atom(b"alac", &config(frames)));
-    let (_, buf) = decode(&mp4(480, &lpcm(1), |_, a| a), None).unwrap();
-    assert_eq!(buf.frames(), 480);
-    for entry in [lpcm(1 << 21), alac(1 << 21)] {
-        assert!(matches!(decode(&mp4(480, &entry, |_, a| a), None), Err(AudioError::Malformed(m)) if m.contains("declares packets")));
-    }
-}
-
-/// FLAC metadata blocks with field lengths exceeding their block boundary are refused as malformed.
-#[test]
-fn flac_metadata_fields_beyond_their_block_are_refused() {
-    let with_block = |kind: u8, body: &[u8]| {
-        let f = small(FileFormat::Flac, BitDepth::Int16, 1);
-        let head = ((0x80 | u32::from(kind)) << 24 | body.len() as u32).to_be_bytes();
-        [&f[..4], &[f[4] & 0x7f], &f[5..42], &head, body, &f[42..]].concat()
-    };
-    let picture = |data: u32| [&[0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0][..], &[0; 16], &data.to_be_bytes(), &[1, 2, 3]].concat();
-    assert_eq!(decode(&with_block(6, &picture(3)), None).unwrap().1.frames(), 300);
-    let comment = [&0u32.to_le_bytes()[..], &1u32.to_le_bytes(), &u32::MAX.to_le_bytes()].concat();
-    let vendor_overflow = [&0x7fff_fff0u32.to_le_bytes()[..], &0u32.to_le_bytes()].concat();
-    for f in [with_block(6, &picture(0x7fff_fff0)), with_block(4, &comment), with_block(4, &vendor_overflow)] {
-        assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than its block")));
-    }
-}
-
-#[test]
-fn an_id3_tag_before_the_audio_is_skipped_unread() {
-    let frame = [&b"TIT2"[..], &0x7fff_ffffu32.to_be_bytes(), &[0, 0, 3, b'h', b'i', 0]].concat();
-    let tag = [&b"ID3\x03\0\0\0\0\0"[..], &[frame.len() as u8], &frame].concat();
-    let flac = small(FileFormat::Flac, BitDepth::Int16, 1);
-    assert_eq!(decode(&[tag, flac].concat(), None).unwrap().1.frames(), 300);
-}
-
-/// Container magic inside an MP3 frame payload must not change detection or make probing reject the stream.
-#[test]
-fn a_valid_mp3_with_incidental_container_magic_still_probes() {
-    let mut frame = vec![0u8; 417];
-    frame[..4].copy_from_slice(&[0xFF, 0xFB, 0x90, 0x00]); // MPEG-1 Layer III, 128 kbps, 44.1 kHz, stereo
-    let mut f: Vec<u8> = (0..8).flat_map(|_| frame.clone()).collect();
-    let at = 417 * 2 + 10; // Inside frame 2's payload, leaving every frame header intact.
-    f[at..at + 8].copy_from_slice(b"caff\0\x01\0\0");
-    f[at + 8..at + 12].copy_from_slice(b"kuki");
-    f[at + 12..at + 20].copy_from_slice(&(1u64 << 50).to_be_bytes());
-    assert_eq!(detect_format(&f, None), FileFormat::Mp3);
-    let info = probe(&f, None).expect("valid MP3 with incidental container magic");
-    assert_eq!((info.format, info.sample_rate, info.channels), (FileFormat::Mp3, 44_100, 2));
-}
-
-/// Symphonia 0.6's CAF/FLAC/MP4 `Scoreable` implementations are unconditional
-/// (`Supported(255)`), so a container magic before the first audio frame *is* the reader the probe
-/// selects; there is no API to ask the probe to skip it. The preflight must therefore keep
-/// refusing an oversized CAF cookie instead of ignoring the marker and playing the MPEG frames
-/// behind it (which would also let a real malformed container bypass the size guard).
-#[test]
-fn a_container_marker_before_the_first_audio_frame_is_the_probed_candidate() {
-    let mut frame = vec![0u8; 417];
-    frame[..4].copy_from_slice(&[0xFF, 0xFB, 0x90, 0x00]); // MPEG-1 Layer III, 128 kbps, 44.1 kHz, stereo
-    let mp3: Vec<u8> = (0..8).flat_map(|_| frame.clone()).collect();
-    let malformed = caf(&[caf_desc(b"aac ", 0, 1024, 2, 0), (b"kuki", 1i64 << 50, vec![0; 8])]);
-    for f in [[vec![0u8], malformed.clone(), mp3.clone()].concat(), [vec![0u8; 32], malformed.clone(), mp3.clone()].concat()] {
-        // The hint still names the raw stream, but the probe sees the CAF marker first.
-        assert_eq!(detect_format(&f, Some("mp3")), FileFormat::Mp3);
-        assert!(matches!(probe(&f, Some("mp3")), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-        assert!(matches!(decode(&f, Some("mp3")), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-    }
-    // Plain leading junk without format magic is tolerated, as before.
-    let f = [vec![0u8; 32], mp3].concat();
-    assert_eq!(detect_format(&f, Some("mp3")), FileFormat::Mp3);
-    let info = probe(&f, Some("mp3")).expect("junk before a valid MP3");
-    assert_eq!((info.format, info.sample_rate, info.channels), (FileFormat::Mp3, 44_100, 2));
-}
-
-/// More false `0xFFEx` pairs than the preflight's scoring budget must not make a later container
-/// magic inside the valid audio payload authoritative. Past the cap the scan is unchecked and the
-/// probe selects the MPEG reader at the first real frame.
-#[test]
-fn an_exhausted_audio_score_budget_does_not_reject_the_mp3_behind_it() {
-    let mut frame = vec![0u8; 417];
-    frame[..4].copy_from_slice(&[0xFF, 0xFB, 0x90, 0x00]);
-    let mut audio: Vec<u8> = (0..8).flat_map(|_| frame.clone()).collect();
-    let at = 417 * 2 + 10; // Inside frame 2's payload, leaving every frame header intact.
-    audio[at..at + 8].copy_from_slice(b"caff\0\x01\0\0");
-    audio[at + 8..at + 12].copy_from_slice(b"kuki");
-    audio[at + 12..at + 20].copy_from_slice(&(1u64 << 50).to_be_bytes());
-    let false_syncs: Vec<u8> = (0..256).flat_map(|_| [0xFFu8, 0xE2]).collect();
-    let f = [false_syncs, audio].concat();
-    assert_eq!(detect_format(&f, Some("mp3")), FileFormat::Mp3);
-    let info = probe(&f, Some("mp3")).expect("valid MP3 after an exhausted audio score budget");
-    assert_eq!((info.format, info.sample_rate, info.channels), (FileFormat::Mp3, 44_100, 2));
-    let (decoded, buf) = decode(&f, Some("mp3")).expect("decode the same MP3");
-    assert_eq!((decoded.format, decoded.sample_rate, decoded.channels), (FileFormat::Mp3, 44_100, 2));
-    assert_eq!(decoded.frames, buf.frames() as u64);
-}
-
-/// Past the score budget the preflight does not run, so if the probe then selects a container
-/// whose reader allocates from sizes in the file, the post-probe refusal still applies.
-#[test]
-fn a_container_selected_without_its_size_check_is_refused() {
-    let flac = small(FileFormat::Flac, BitDepth::Int16, 1);
-    // Exactly the cap of false candidates, then one more that the reader rejects (invalid
-    // bit-rate), so the preflight stops unchecked before reaching the FLAC marker behind it.
-    let mut false_syncs: Vec<u8> = (0..256).flat_map(|_| [0xFFu8, 0xE2]).collect();
-    false_syncs.extend_from_slice(&[0xFF, 0xFB, 0xF0, 0x00]);
-    let f = [false_syncs, flac].concat();
-    assert_eq!(detect_format(&f, None), FileFormat::Mp3);
-    assert!(matches!(probe(&f, None), Err(AudioError::Malformed(m)) if m.contains("was not size-checked")));
-    assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("was not size-checked")));
-}
-
-/// A zero-frame FLAC after arbitrary bytes or ID3 tags is still detected and reported as an empty stream, not a
-/// decode failure.
-#[test]
-fn zero_frame_flac_after_a_prefix_is_still_empty() {
-    let flac =
-        encode(&AudioBuffer::new(48_000, 1, 0), &EncodeOptions { format: FileFormat::Flac, bit_depth: BitDepth::Int16, dither: false, bwf: None })
-            .unwrap();
-    let tag = id3_tag(b"tag");
-    for (f, detected) in [
-        ([vec![0x7A; 64], flac.clone()].concat(), FileFormat::Other),
-        ([tag.clone(), vec![0x7A; 16], flac.clone()].concat(), FileFormat::Mp3),
-        ([tag.clone(), tag, flac.clone()].concat(), FileFormat::Mp3),
-    ] {
-        assert_eq!(detect_format(&f, None), detected);
-        let info = probe(&f, None).expect("empty FLAC after a prefix");
-        assert_eq!((info.format, info.sample_rate, info.channels, info.frames), (FileFormat::Flac, 48_000, 1, 0));
-        assert_eq!(decode(&f, None).unwrap().1.frames(), 0);
-    }
-}
-
-/// Build one MPEG-4 AAC-LC ADTS frame at 48 kHz stereo around `payload`, with the 13-bit length covering the 7-byte
-/// header.
-fn adts_frame(payload: &[u8]) -> Vec<u8> {
-    // MPEG-4 AAC-LC, 48 kHz, stereo; the 13-bit frame length includes this 7-byte header.
-    let len = 7 + payload.len();
-    let mut h = [0xFF, 0xF1, 0x4C, 0x00, 0x00, 0x1F, 0xFC];
-    h[3] = 0x80 | ((len >> 11) & 0x03) as u8; // stereo channel config low bits
-    h[4] = ((len >> 3) & 0xFF) as u8;
-    h[5] = (((len & 0x07) as u8) << 5) | 0x1F;
-    [&h[..], payload].concat()
-}
-
-/// False MPEG sync prefixes must not stop a following zero-frame FLAC from probing as empty.
-#[test]
-fn zero_frame_flac_after_a_false_mpeg_sync_is_still_empty() {
-    let flac =
-        encode(&AudioBuffer::new(48_000, 1, 0), &EncodeOptions { format: FileFormat::Flac, bit_depth: BitDepth::Int16, dither: false, bwf: None })
-            .unwrap();
-    for junk in [vec![0xFF, 0xE0, 0x00], vec![0xFF, 0xF0, 0x00], vec![0xFF, 0xFB, 0xF0, 0x00]] {
-        let f = [junk, flac.clone()].concat();
-        let info = probe(&f, None).expect("empty FLAC after a false sync");
-        assert_eq!((info.format, info.sample_rate, info.channels, info.frames), (FileFormat::Flac, 48_000, 1, 0));
-        assert_eq!(decode(&f, None).unwrap().1.frames(), 0);
-    }
-}
-
-/// A false MPEG sync prefix must not let malformed CAF or MP4 size fields bypass the container preflight.
-#[test]
-fn a_false_sync_does_not_bypass_container_checks() {
-    let bad_caf = caf(&[
-        caf_desc(b"aac ", 0, 1024, 2, 0),
-        (b"pakt", 32, packet_table(1, 1024, &[0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0])),
-        (b"data", -1, vec![0; 64]),
-    ]);
-    assert!(matches!(probe(&bad_caf, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-    let f = [vec![0xFF, 0xE0, 0x00], bad_caf].concat();
-    assert!(matches!(probe(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-    assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-
-    let pcm = sample_entry(b"sowt", 0, &[], &[]);
-    let bad_mp4 = mp4(480, &pcm, |kind, mut a| {
-        if kind == b"stsz" {
-            a[12..16].copy_from_slice(&u32::MAX.to_be_bytes());
-        }
-        a
-    });
-    assert!(probe(&bad_mp4, None).is_err());
-    let f = [vec![0xFF, 0xE0, 0x00], bad_mp4].concat();
-    assert!(matches!(probe(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-    assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-}
-
-/// Container magic inside a valid ADTS payload must not override AAC detection or make probing fail.
-#[test]
-fn a_valid_adts_stream_with_incidental_container_magic_still_probes() {
-    let payload = [0u8; 400];
-    let mut frames: Vec<Vec<u8>> = (0..8).map(|_| adts_frame(&payload)).collect();
-    let at = 100; // Inside frame 2's payload, leaving every frame header intact.
-    frames[2][7 + at..7 + at + 12].copy_from_slice(b"caff\0\x01\0\0kuki");
-    let f: Vec<u8> = frames.concat();
-    assert_eq!(detect_format(&f, None), FileFormat::Aac);
-    let info = probe(&f, None).expect("valid ADTS with incidental container magic");
-    assert_eq!((info.format, info.sample_rate, info.channels), (FileFormat::Aac, 48_000, 2));
-}
-
-/// A later valid CAF must not excuse an earlier malformed container that the preflight or probe rejects.
-#[test]
-fn an_earlier_malformed_container_is_not_excused_by_a_later_valid_one() {
-    let malformed = caf(&[caf_desc(b"aac ", 0, 1024, 2, 0), (b"kuki", 1i64 << 50, vec![0; 8])]);
-    let pcm: Vec<u8> = (0..32i16).flat_map(|i| (i * 50).to_be_bytes()).collect();
-    let data = [vec![0; 4], pcm].concat();
-    let valid = caf(&[caf_desc(b"lpcm", 2, 1, 1, 16), (b"data", data.len() as i64, data)]);
-    let f = [vec![0u8; 32], malformed, valid].concat();
-    assert!(matches!(probe(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-    assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-}
-
-/// Truncated ID3 bodies, declared tag sizes beyond the file, and a complete tag with no audio after it are malformed
-/// for both probe and decode.
-#[test]
-fn truncated_or_oversized_id3_tags_are_malformed() {
-    let cases = vec![[&id3_header(100)[..], b"xx"].concat(), id3_header(0x0FFF_FFFF).to_vec(), id3_tag(b"tag")];
-    for f in cases {
-        assert!(matches!(probe(&f, None), Err(AudioError::Malformed(_))));
-        assert!(matches!(decode(&f, None), Err(AudioError::Malformed(_))));
-    }
-}
-
-#[test]
-fn wav_info_entries_beyond_the_file_are_refused() {
-    let alaw = |len: u32| {
-        let info = [&b"INFO"[..], b"INAM", &len.to_le_bytes(), b"hi"].concat();
-        riff(&[(b"fmt ", [fmt(6, 1, 8_000, 8), vec![0, 0]].concat()), (b"LIST", info), (b"data", vec![0xD5; 800])])
-    };
-    assert_eq!(decode(&alaw(2), None).unwrap().1.frames(), 800);
-    let mut f = alaw(0x7fff_fff0);
-    f[4..8].copy_from_slice(&u32::MAX.to_le_bytes());
-    let list = f.windows(4).position(|w| w == b"LIST").unwrap();
-    f[list + 4..list + 8].copy_from_slice(&0x7fff_fffcu32.to_le_bytes());
-    assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-}
-
-#[test]
-fn a_wave_behind_another_riff_form_is_checked() {
-    let info = [&b"INFO"[..], b"INAM", &0x7fff_fff0u32.to_le_bytes(), b"hi"].concat();
-    let mut wav = riff(&[(b"fmt ", [fmt(6, 1, 8_000, 8), vec![0, 0]].concat()), (b"LIST", info), (b"data", vec![0xD5; 800])]);
-    wav[4..8].copy_from_slice(&u32::MAX.to_le_bytes());
-    let list = wav.windows(4).position(|w| w == b"LIST").unwrap();
-    wav[list + 4..list + 8].copy_from_slice(&0x7fff_fffcu32.to_le_bytes());
-    // The probe skips the AVI form and reads the WAVE behind it.
-    let f = [&b"RIFF"[..], &4u32.to_le_bytes(), b"AVI ", &wav].concat();
-    assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-}
-
-#[test]
-fn wav_info_entries_are_found_where_symphonia_reads_them() {
-    let list = [&b"LIST"[..], &0x7fff_fffcu32.to_le_bytes(), b"INFO", b"INAM", &0x7fff_fff0u32.to_le_bytes(), b"hi"].concat();
-    let alaw = |extra: u16| (b"fmt ", [fmt(6, 1, 8_000, 8), extra.to_le_bytes().to_vec()].concat());
-    // A-law's extra bytes are read past its chunk; an odd list is padded twice.
-    let files =
-        [riff(&[alaw(12), (b"JUNK", [&[0; 4][..], &list].concat())]), [riff(&[alaw(0), (b"LIST", b"adtl\0".to_vec())]), vec![0], list].concat()];
-    for mut f in files {
-        f[4..8].copy_from_slice(&u32::MAX.to_le_bytes());
-        assert!(matches!(decode(&f, None), Err(AudioError::Malformed(m)) if m.contains("larger than the file")));
-    }
-}
-
-#[test]
-fn many_tiny_chunks_terminate() {
-    let mut chunks: Vec<(&[u8; 4], Vec<u8>)> = vec![(b"fmt ", fmt(1, 1, 8_000, 16))];
-    for _ in 0..200_000 {
-        chunks.push((b"pad ", Vec::new()));
-    }
-    let wav = riff(&chunks);
-    assert!(decode(&wav, None).is_err()); // no data chunk within the scan limit
-}
-
-#[test]
-fn hand_built_wav_variants() {
-    // 8-bit unsigned.
-    let wav = riff(&[(b"fmt ", fmt(1, 1, 8_000, 8)), (b"data", vec![0x80, 0xFF, 0x00])]);
-    let (info, buf) = decode(&wav, None).unwrap();
-    assert_eq!(info.sample_format, SampleFormat::Int8);
-    assert_eq!(buf.channels[0], vec![0.0, 127.0 / 128.0, -1.0]);
-    // 64-bit float, with NaN replaced by silence.
-    let mut data = Vec::new();
-    for v in [0.25f64, -0.5, f64::NAN] {
-        data.extend_from_slice(&v.to_le_bytes());
-    }
-    let wav = riff(&[(b"fmt ", fmt(3, 1, 8_000, 64)), (b"data", data)]);
-    let (info, buf) = decode(&wav, None).unwrap();
-    assert_eq!(info.sample_format, SampleFormat::Float64);
-    assert_eq!(buf.channels[0], vec![0.25, -0.5, 0.0]);
-    // Unsupported PCM width.
-    let wav = riff(&[(b"fmt ", fmt(3, 1, 8_000, 16)), (b"data", vec![0; 4])]);
-    assert!(matches!(decode(&wav, None), Err(AudioError::Unsupported(_))));
-    // No data chunk / no fmt chunk.
-    assert!(decode(&riff(&[(b"fmt ", fmt(1, 1, 8_000, 16))]), None).is_err());
-    assert!(decode(&riff(&[(b"data", vec![0; 4])]), None).is_err());
-    // Short fmt chunk.
-    assert!(decode(&riff(&[(b"fmt ", vec![1, 0, 1]), (b"data", vec![0; 4])]), None).is_err());
-    // Unknown codec tag goes to symphonia and fails cleanly.
-    let wav = riff(&[(b"fmt ", fmt(0x1234, 1, 8_000, 16)), (b"data", vec![0; 4])]);
-    assert!(decode(&wav, None).is_err());
-}
-
-#[test]
-fn aiff_sowt_little_endian() {
-    let be = small(FileFormat::Aiff, BitDepth::Int16, 2);
-    let (_, expect) = decode(&be, None).unwrap();
-    // Rebuild as AIFC/sowt by hand.
-    let comm = be.windows(4).position(|w| w == b"COMM").unwrap();
-    let ssnd = be.windows(4).position(|w| w == b"SSND").unwrap();
-    let mut comm_body = be[comm + 8..comm + 26].to_vec();
-    comm_body.extend_from_slice(b"sowt");
-    comm_body.extend_from_slice(&[0, 0]); // empty pstring, padded
-    let mut ssnd_body = be[ssnd + 8..].to_vec();
-    for pair in ssnd_body[8..].as_chunks_mut::<2>().0 {
-        pair.swap(0, 1);
-    }
-    let mut body = b"AIFC".to_vec();
-    for (id, data) in [(b"COMM", &comm_body), (b"SSND", &ssnd_body)] {
-        body.extend_from_slice(id);
-        body.extend_from_slice(&(data.len() as u32).to_be_bytes());
-        body.extend_from_slice(data);
-    }
-    let mut f = b"FORM".to_vec();
-    f.extend_from_slice(&(body.len() as u32).to_be_bytes());
-    f.extend_from_slice(&body);
-    let (info, got) = decode(&f, None).unwrap();
-    assert_eq!(info.sample_format, SampleFormat::Int16);
-    assert_eq!(got, expect);
-}
-
-#[test]
-fn detect_format_by_magic_and_hint() {
-    assert_eq!(detect_format(&small(FileFormat::Wav, BitDepth::Int16, 1), Some("mp3")), FileFormat::Wav);
-    assert_eq!(detect_format(&small(FileFormat::Aiff, BitDepth::Int16, 1), None), FileFormat::Aiff);
-    assert_eq!(detect_format(&small(FileFormat::Flac, BitDepth::Int16, 1), None), FileFormat::Flac);
-    assert_eq!(detect_format(b"OggS\0\x02rest", None), FileFormat::Ogg);
-    assert_eq!(detect_format(b"caff\0\x01\0\0", None), FileFormat::Caf);
-    assert_eq!(detect_format(b"ID3\x04\0\0\0\0\0\x00", None), FileFormat::Mp3);
-    let mut id3_flac = b"ID3\x04\0\0\0\0\0\x02xx".to_vec();
-    id3_flac.extend_from_slice(b"fLaC");
-    assert_eq!(detect_format(&id3_flac, None), FileFormat::Flac);
-    assert_eq!(detect_format(&[0xFF, 0xFB, 0x90, 0x00], None), FileFormat::Mp3);
-    assert_eq!(detect_format(&[0xFF, 0xF1, 0x50, 0x80], None), FileFormat::Aac);
-    let mut m4a = b"\0\0\0\x20ftypM4A ".to_vec();
-    m4a.extend_from_slice(b"....stsd\0\0\0\0\0\0\0\x01\0\0\0\x24alac");
-    assert_eq!(detect_format(&m4a, None), FileFormat::Alac);
-    assert_eq!(detect_format(b"\0\0\0\x20ftypM4A ", None), FileFormat::Aac);
-    assert_eq!(detect_format(b"", Some(".WAV")), FileFormat::Wav);
-    assert_eq!(detect_format(b"zz", Some("aif")), FileFormat::Aiff);
-    assert_eq!(detect_format(b"zz", Some("m4a")), FileFormat::Aac);
-    assert_eq!(detect_format(b"zz", Some("M4B")), FileFormat::Aac);
-    assert_eq!(detect_format(b"zz", Some("flac")), FileFormat::Flac);
-    assert_eq!(detect_format(b"zz", Some("xyz")), FileFormat::Other);
-    assert_eq!(detect_format(b"zz", None), FileFormat::Other);
-    assert_eq!(detect_format(b"", None), FileFormat::Other);
-}
-
-#[test]
-fn garbage_in_compressed_containers_errors() {
-    let garbage: Vec<u8> = (0..4096u32).map(|i| (i.wrapping_mul(2_654_435_761) >> 13) as u8).collect();
-    for hint in [None, Some("mp3"), Some("ogg"), Some("flac"), Some("m4a"), Some("caf"), Some("aac"), Some("mkv"), Some("wav"), Some("aiff")] {
-        assert!(decode(&garbage, hint).is_err(), "{hint:?}");
-        assert!(probe(&garbage, hint).is_err(), "{hint:?}");
-    }
-    for magic in [&b"fLaC"[..], b"OggS", b"caff", b"ID3\x03\0\0\0\0\0\0", &[0xFF, 0xFB, 0x90, 0x00], b"\0\0\0\x20ftypM4A "] {
-        let mut f = magic.to_vec();
-        f.extend_from_slice(&garbage);
-        let _ = probe(&f, None);
-        assert!(decode(&f, None).map(|(_, b)| b.frames()).unwrap_or(0) < 1_000_000);
-    }
-    assert!(decode(&[], None).is_err());
-}
-
-/// A marker that passes its container check must not let the probe select a different container
-/// without its own checks: the reader is refused when the probed format disagrees.
-#[test]
-fn a_probed_container_that_disagrees_with_the_checked_marker_is_refused() {
-    // The junk byte hides both magics, so the hint picks the marker: the FLAC is checked, but the
-    // probe reads the WAVE before it.
-    let bytes = [vec![0], small(FileFormat::Wav, BitDepth::Int24, 2), small(FileFormat::Flac, BitDepth::Int24, 2)].concat();
-    match decode(&bytes, Some("flac")) {
-        Err(AudioError::Malformed(message)) => assert!(message.contains("probed container"), "unexpected message: {message}"),
-        Err(other) => panic!("unexpected error kind: {other:?}"),
-        Ok(_) => panic!("the mismatched container must be refused"),
-    }
-}
-
-proptest! {
-    #![proptest_config(ProptestConfig { cases: 256, ..ProptestConfig::default() })]
-
-    #[test]
-    fn random_bytes_never_panic(bytes in proptest::collection::vec(any::<u8>(), 0..2048), hint in 0usize..6) {
-        let hint = [None, Some("wav"), Some("aiff"), Some("flac"), Some("mp3"), Some("ogg")][hint];
-        let _ = detect_format(&bytes, hint);
-        let _ = probe(&bytes, hint);
-        let _ = decode(&bytes, hint);
-    }
-
-    #[test]
-    fn random_bodies_behind_valid_headers_never_panic(body in proptest::collection::vec(any::<u8>(), 0..1024), which in 0usize..4) {
-        let mut f = match which {
-            0 => b"RIFF\xff\xff\xff\xffWAVE".to_vec(),
-            1 => b"RF64\xff\xff\xff\xffWAVE".to_vec(),
-            2 => b"FORM\xff\xff\xff\xffAIFC".to_vec(),
-            _ => b"FORM\xff\xff\xff\xffAIFF".to_vec(),
-        };
-        f.extend_from_slice(&body);
-        let _ = probe(&f, None);
-        let _ = decode(&f, None);
-    }
-
-    #[test]
-    fn random_audio_roundtrips_through_flac(samples in proptest::collection::vec(-1.2f32..1.2, 1..3000), channels in 1usize..4) {
-        let buf = AudioBuffer::from_interleaved(48_000, channels, &samples);
-        prop_assume!(buf.frames() > 0);
-        let opts = EncodeOptions { format: FileFormat::Flac, bit_depth: BitDepth::Int24, dither: false, bwf: None };
-        let (_, flac) = decode(&encode(&buf, &opts).unwrap(), None).unwrap();
-        let (_, wav) = decode(&encode(&buf, &EncodeOptions { format: FileFormat::Wav, ..opts }).unwrap(), None).unwrap();
-        prop_assert_eq!(flac, wav);
-    }
-}
-
-/// An extensible `fmt ` chunk: cbSize, valid bits, mask, then the 16-byte subtype GUID.
-fn extensible_fmt(cb_size: u16, valid_bits: u16, guid: &[u8]) -> Vec<u8> {
-    let mut f = fmt(0xFFFE, 1, 44_100, 16);
-    f.extend_from_slice(&cb_size.to_le_bytes());
-    f.extend_from_slice(&valid_bits.to_le_bytes());
-    f.extend_from_slice(&4u32.to_le_bytes());
-    f.extend_from_slice(guid);
-    f
-}
-
-const PCM_GUID: [u8; 16] = [1, 0, 0, 0, 0, 0, 0x10, 0, 0x80, 0, 0, 0xAA, 0, 0x38, 0x9B, 0x71];
-
-#[test]
-fn extensible_fmt_is_checked_in_full() {
-    let data = vec![0u8; 8];
-    let good = riff(&[(b"fmt ", extensible_fmt(22, 16, &PCM_GUID)), (b"data", data.clone())]);
-    assert_eq!(probe(&good, None).unwrap().sample_format, SampleFormat::Int16);
-    // Subtype GUID cut short after the format code.
-    let cut = riff(&[(b"fmt ", extensible_fmt(22, 16, &PCM_GUID[..4])), (b"data", data.clone())]);
-    assert!(matches!(probe(&cut, None), Err(AudioError::Malformed(_))));
-    assert!(matches!(decode(&cut, None), Err(AudioError::Malformed(_))));
-    // cbSize too small for the extension.
-    let small_cb = riff(&[(b"fmt ", extensible_fmt(0, 16, &PCM_GUID)), (b"data", data.clone())]);
-    assert!(matches!(probe(&small_cb, None), Err(AudioError::Malformed(_))));
-    // More valid bits than the 16-bit container holds.
-    let wide = riff(&[(b"fmt ", extensible_fmt(22, 24, &PCM_GUID)), (b"data", data.clone())]);
-    assert!(matches!(probe(&wide, None), Err(AudioError::Malformed(_))));
-    // PCM-like prefix but a foreign GUID tail is not read as native PCM.
-    let mut foreign = PCM_GUID;
-    foreign[15] ^= 0xFF;
-    let foreign = riff(&[(b"fmt ", extensible_fmt(22, 16, &foreign)), (b"data", data)]);
-    assert!(!matches!(probe(&foreign, None), Ok(i) if i.sample_format == SampleFormat::Int16));
-    // The Ambisonic PCM subtype is PCM.
-    let ambi = [1, 0, 0, 0, 0x21, 0x07, 0xD3, 0x11, 0x86, 0x44, 0xC8, 0xC1, 0xCA, 0, 0, 0];
-    let ambi = riff(&[(b"fmt ", extensible_fmt(22, 16, &ambi)), (b"data", vec![0u8; 8])]);
-    assert_eq!(probe(&ambi, None).unwrap().sample_format, SampleFormat::Int16);
-}
@@ -1,61 +0,0 @@
-//! The length `probe` reports for AAC in MP4 is the length `decode` produces (issue #1113).
-
-use soundcraft_audio_io::{decode, probe};
-
-fn atom(kind: &[u8; 4], body: &[u8]) -> Vec<u8> {
-    [&(8 + body.len() as u32).to_be_bytes()[..], kind, body].concat()
-}
-
-/// A full atom (version 0, no flags) whose body is `fields` as big-endian u32s.
-fn full(kind: &[u8; 4], fields: &[u32]) -> Vec<u8> {
-    let body: Vec<u8> = [0].iter().chain(fields).flat_map(|v: &u32| v.to_be_bytes()).collect();
-    atom(kind, &body)
-}
-
-/// An MPEG-4 descriptor with a one-byte length.
-fn descriptor(tag: u8, body: &[u8]) -> Vec<u8> {
-    [&[tag, body.len() as u8][..], body].concat()
-}
-
-/// A silent AAC-LC raw frame for one channel: an SCE with `max_sfb` 0, then ID_END.
-const SILENT_SCE: [u8; 4] = [0x00, 0xC8, 0x00, 0x07];
-
-/// A mono 48 kHz AAC-LC MP4 without an edit list: `packets` frames, the last lasting `last_dur` in stts.
-fn aac_mp4(packets: u32, last_dur: u32) -> Vec<u8> {
-    // AudioSpecificConfig: AAC-LC, 48 kHz, one channel.
-    let dsi = descriptor(5, &[0x11, 0x88]);
-    let dcd = descriptor(4, &[&[0x40, 0x15, 0, 0, 0][..], &[0; 8], &dsi].concat());
-    let es = descriptor(3, &[&[0, 1, 0][..], &dcd, &descriptor(6, &[2])].concat());
-    let esds = atom(b"esds", &[&[0; 4][..], &es].concat());
-    let base = [0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 16, 0, 0, 0, 0];
-    let entry = atom(b"mp4a", &[&base[..], &(48_000u32 << 16).to_be_bytes(), &esds].concat());
-    let total = (packets - 1) * 1024 + last_dur;
-    let moov = |offset: u32| {
-        let stsd = atom(b"stsd", &[&[0, 0, 0, 0, 0, 0, 0, 1][..], &entry].concat());
-        let stbl = [
-            stsd,
-            full(b"stts", &[2, packets - 1, 1024, 1, last_dur]),
-            full(b"stsc", &[1, 1, packets, 1]),
-            full(b"stsz", &[SILENT_SCE.len() as u32, packets]),
-            full(b"stco", &[1, offset]),
-        ];
-        let minf = [full(b"smhd", &[0]), atom(b"stbl", &stbl.concat())].concat();
-        let mdia = [full(b"mdhd", &[0, 0, 48_000, total, 0]), full(b"hdlr", &[0, u32::from_be_bytes(*b"soun"), 0, 0, 0, 0]), atom(b"minf", &minf)];
-        let trak = [full(b"tkhd", &[0; 20]), atom(b"mdia", &mdia.concat())].concat();
-        atom(b"moov", &[full(b"mvhd", &[[0, 0, 48_000, total, 1 << 16].as_slice(), &[0; 18], &[2]].concat()), atom(b"trak", &trak)].concat())
-    };
-    let ftyp = atom(b"ftyp", b"M4A \0\0\0\0M4A isom");
-    let offset = (ftyp.len() + moov(0).len() + 8) as u32;
-    [ftyp, moov(offset), atom(b"mdat", &SILENT_SCE.repeat(packets as usize))].concat()
-}
-
-#[test]
-fn aac_in_mp4_probe_length_matches_the_decoded_length() {
-    // A last sample lasting until the track end (longer than a packet), and a control with a short one.
-    for last_dur in [1145, 546] {
-        let file = aac_mp4(10, last_dur);
-        let (_, buf) = decode(&file, Some("m4a")).unwrap();
-        assert_eq!(buf.frames(), 10 * 1024, "decoded frames, last stts duration {last_dur}");
-        assert_eq!(probe(&file, Some("m4a")).unwrap().frames, buf.frames() as u64, "probed frames, last stts duration {last_dur}");
-    }
-}
@@ -1,328 +0,0 @@
-use soundcraft_audio_io::{
-    AudioBuffer, BitDepth, BwfInfo, EncodeOptions, FileFormat, SampleFormat, decode, detect_format, encode, encode_wav_rf64, probe, wav_float_header,
-};
-
-fn sine(sr: u32, channels: usize, frames: usize) -> AudioBuffer {
-    let mut b = AudioBuffer::new(sr, channels, frames);
-    for (c, ch) in b.channels.iter_mut().enumerate() {
-        let f = 220.0 * (c as f32 + 1.0);
-        for (i, s) in ch.iter_mut().enumerate() {
-            *s = 0.8 * (2.0 * std::f32::consts::PI * f * i as f32 / sr as f32 + c as f32).sin();
-        }
-    }
-    b
-}
-
-fn tolerance(depth: BitDepth, dither: bool) -> f32 {
-    let lsb = match depth {
-        BitDepth::Int16 => 1.0 / 32768.0,
-        BitDepth::Int24 => 1.0 / 8_388_608.0,
-        BitDepth::Int32 => 1e-7,
-        BitDepth::Float32 => 0.0,
-    };
-    lsb * if dither { 1.6 } else { 0.6 } + 1e-7
-}
-
-fn max_err(a: &AudioBuffer, b: &AudioBuffer) -> f32 {
-    assert_eq!(a.num_channels(), b.num_channels());
-    assert_eq!(a.frames(), b.frames());
-    a.channels.iter().zip(&b.channels).flat_map(|(x, y)| x.iter().zip(y).map(|(p, q)| (p - q).abs())).fold(0.0, f32::max)
-}
-
-const DEPTHS: [BitDepth; 4] = [BitDepth::Int16, BitDepth::Int24, BitDepth::Int32, BitDepth::Float32];
-
-fn expected_sf(d: BitDepth) -> SampleFormat {
-    match d {
-        BitDepth::Int16 => SampleFormat::Int16,
-        BitDepth::Int24 => SampleFormat::Int24,
-        BitDepth::Int32 => SampleFormat::Int32,
-        BitDepth::Float32 => SampleFormat::Float32,
-    }
-}
-
-#[test]
-fn wav_and_aiff_roundtrip_all_depths_and_layouts() {
-    for format in [FileFormat::Wav, FileFormat::Aiff] {
-        for depth in DEPTHS {
-            for channels in [1, 2, 6] {
-                for dither in [false, true] {
-                    let src = sine(48_000, channels, 4801);
-                    let opts = EncodeOptions { format, bit_depth: depth, dither, bwf: None };
-                    let bytes = encode(&src, &opts).unwrap();
-                    assert_eq!(detect_format(&bytes, None), format);
-                    let info = probe(&bytes, None).unwrap();
-                    assert_eq!(info.format, format);
-                    assert_eq!(info.sample_rate, 48_000);
-                    assert_eq!(info.channels as usize, channels);
-                    assert_eq!(info.frames, 4801);
-                    assert_eq!(info.sample_format, expected_sf(depth));
-                    let (dinfo, out) = decode(&bytes, None).unwrap();
-                    assert_eq!(dinfo, info);
-                    assert_eq!(out.sample_rate, 48_000);
-                    let err = max_err(&src, &out);
-                    assert!(err <= tolerance(depth, dither), "{format:?} {depth:?} {channels}ch dither={dither}: err {err}");
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn flac_roundtrip_is_lossless_vs_wav() {
-    for depth in [BitDepth::Int16, BitDepth::Int24, BitDepth::Int32] {
-        for channels in [1, 2, 6] {
-            // Spans several blocks plus a short final block.
-            let src = sine(44_100, channels, 4096 * 2 + 17);
-            let wav = encode(&src, &EncodeOptions { format: FileFormat::Wav, bit_depth: depth, dither: false, bwf: None }).unwrap();
-            let flac = encode(&src, &EncodeOptions { format: FileFormat::Flac, bit_depth: depth, dither: false, bwf: None }).unwrap();
-            assert_eq!(detect_format(&flac, None), FileFormat::Flac);
-            let info = probe(&flac, None).unwrap();
-            assert_eq!(info.format, FileFormat::Flac);
-            assert_eq!((info.sample_rate, info.channels as usize, info.frames), (44_100, channels, src.frames() as u64));
-            assert_eq!(info.sample_format, expected_sf(depth));
-            let (_, from_wav) = decode(&wav, None).unwrap();
-            let (finfo, from_flac) = decode(&flac, None).unwrap();
-            assert_eq!(finfo.frames, src.frames() as u64);
-            assert_eq!(from_flac, from_wav, "{depth:?} {channels}ch");
-            if depth != BitDepth::Int32 {
-                assert!(flac.len() < wav.len(), "{depth:?} {channels}ch: flac {} >= wav {}", flac.len(), wav.len());
-            }
-        }
-    }
-}
-
-#[test]
-fn flac_handles_silence_noise_full_scale_and_odd_rates() {
-    let frames = 10_000;
-    let mut b = AudioBuffer::new(37_123, 3, frames);
-    let mut seed = 1u32;
-    for i in 0..frames {
-        seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
-        b.channels[1][i] = (seed as f32 / u32::MAX as f32) * 2.0 - 1.0; // white noise
-        b.channels[2][i] = if i % 2 == 0 { 1.5 } else { -1.5 }; // clipped full-scale square
-    }
-    for depth in [BitDepth::Int16, BitDepth::Int24, BitDepth::Int32] {
-        for dither in [false, true] {
-            let opts = EncodeOptions { format: FileFormat::Flac, bit_depth: depth, dither, bwf: None };
-            let flac = encode(&b, &opts).unwrap();
-            let (info, out) = decode(&flac, None).unwrap();
-            assert_eq!(info.sample_rate, 37_123);
-            let wav = encode(&b, &EncodeOptions { format: FileFormat::Wav, ..opts }).unwrap();
-            let (_, expect) = decode(&wav, None).unwrap();
-            assert_eq!(out, expect, "{depth:?} dither={dither}");
-        }
-    }
-}
-
-#[test]
-fn flac_rejects_unsupported_layouts() {
-    let opts = EncodeOptions { format: FileFormat::Flac, bit_depth: BitDepth::Float32, dither: false, bwf: None };
-    assert!(encode(&sine(48_000, 2, 10), &opts).is_err());
-    let opts = EncodeOptions { bit_depth: BitDepth::Int16, ..opts };
-    assert!(encode(&sine(48_000, 9, 10), &opts).is_err());
-    assert!(encode(&sine(700_000, 1, 10), &opts).is_err());
-    // Tiny buffers still encode and decode.
-    let one = sine(48_000, 2, 1);
-    let (_, out) = decode(&encode(&one, &opts).unwrap(), None).unwrap();
-    assert_eq!(out.frames(), 1);
-}
-
-#[test]
-fn bwf_roundtrip() {
-    let bwf = BwfInfo {
-        description: "Scene 12 take 3".into(),
-        originator: "SoundCraft".into(),
-        originator_reference: "SC-0001".into(),
-        origination_date: "2026-10-06".into(),
-        origination_time: "12:34:56".into(),
-        time_reference: 0x1_2345_6789, // > 32 bits
-    };
-    let src = sine(96_000, 2, 1000);
-    for depth in DEPTHS {
-        let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: depth, dither: false, bwf: Some(bwf.clone()) };
-        let bytes = encode(&src, &opts).unwrap();
-        let info = probe(&bytes, None).unwrap();
-        assert_eq!(info.bwf.as_ref(), Some(&bwf));
-        let (dinfo, _) = decode(&bytes, None).unwrap();
-        assert_eq!(dinfo.bwf, Some(bwf.clone()));
-        // RF64 layout reads back identically.
-        let rf64 = encode_wav_rf64(&src, &opts).unwrap();
-        assert_eq!(&rf64[..4], b"RF64");
-        let (rinfo, rbuf) = decode(&rf64, None).unwrap();
-        assert_eq!(rinfo.bwf, Some(bwf.clone()));
-        assert_eq!(rinfo.frames, 1000);
-        assert_eq!(rbuf, decode(&bytes, None).unwrap().1);
-    }
-    // Overlong strings are truncated to the field width, not an error.
-    let long = BwfInfo { description: "x".repeat(400), ..BwfInfo::default() };
-    let bytes = encode(&src, &EncodeOptions { bwf: Some(long), ..EncodeOptions::default() }).unwrap();
-    assert_eq!(probe(&bytes, None).unwrap().bwf.unwrap().description.len(), 256);
-}
-
-#[test]
-fn wav_header_layout() {
-    let b = encode(&sine(44_100, 2, 10), &EncodeOptions { bit_depth: BitDepth::Int16, ..EncodeOptions::default() }).unwrap();
-    // Plain PCM for 16-bit stereo; extensible otherwise.
-    let fmt = b.windows(4).position(|w| w == b"fmt ").unwrap();
-    assert_eq!(u16::from_le_bytes([b[fmt + 8], b[fmt + 9]]), 1);
-    let b = encode(&sine(44_100, 2, 10), &EncodeOptions::default()).unwrap();
-    let fmt = b.windows(4).position(|w| w == b"fmt ").unwrap();
-    assert_eq!(u16::from_le_bytes([b[fmt + 8], b[fmt + 9]]), 0xFFFE);
-    let riff = u32::from_le_bytes([b[4], b[5], b[6], b[7]]) as usize;
-    assert_eq!(riff + 8, b.len());
-    // Odd data length (24-bit mono, odd frames) gets a pad byte.
-    let b = encode(&sine(44_100, 1, 3), &EncodeOptions::default()).unwrap();
-    assert_eq!(b.len() % 2, 0);
-    assert_eq!(decode(&b, None).unwrap().1.frames(), 3);
-}
-
-#[test]
-fn aiff_float_is_aifc() {
-    let b =
-        encode(&sine(44_100, 2, 10), &EncodeOptions { format: FileFormat::Aiff, bit_depth: BitDepth::Float32, ..EncodeOptions::default() }).unwrap();
-    assert_eq!(&b[8..12], b"AIFC");
-    assert!(b.windows(4).any(|w| w == b"fl32"));
-    let b = encode(&sine(44_100, 2, 10), &EncodeOptions { format: FileFormat::Aiff, ..EncodeOptions::default() }).unwrap();
-    assert_eq!(&b[8..12], b"AIFF");
-    let form = u32::from_be_bytes([b[4], b[5], b[6], b[7]]) as usize;
-    assert_eq!(form + 8, b.len());
-}
-
-#[test]
-fn unusual_sample_rates_roundtrip() {
-    for sr in [1, 8_000, 11_025, 22_050, 44_100, 88_200, 176_400, 192_000, 352_800, 384_000, 768_000] {
-        for format in [FileFormat::Wav, FileFormat::Aiff] {
-            let bytes = encode(&sine(sr, 1, 8), &EncodeOptions { format, ..EncodeOptions::default() }).unwrap();
-            assert_eq!(probe(&bytes, None).unwrap().sample_rate, sr, "{format:?}");
-        }
-    }
-}
-
-#[test]
-fn encode_rejects_bad_buffers_and_formats() {
-    assert!(encode(&AudioBuffer::default(), &EncodeOptions::default()).is_err());
-    assert!(encode(&AudioBuffer::new(0, 2, 10), &EncodeOptions::default()).is_err());
-    for f in [FileFormat::Mp3, FileFormat::Ogg, FileFormat::Aac, FileFormat::Alac, FileFormat::Caf, FileFormat::Other] {
-        assert!(encode(&sine(48_000, 1, 10), &EncodeOptions { format: f, ..EncodeOptions::default() }).is_err());
-    }
-    // Non-finite samples are sanitized; only integer output clips finite samples.
-    let mut b = AudioBuffer::new(48_000, 1, 4);
-    b.channels[0] = vec![f32::NAN, f32::INFINITY, -5.0, 0.5];
-    for format in [FileFormat::Wav, FileFormat::Aiff, FileFormat::Flac] {
-        for depth in DEPTHS {
-            if format == FileFormat::Flac && depth == BitDepth::Float32 {
-                continue;
-            }
-            let bytes = encode(&b, &EncodeOptions { format, bit_depth: depth, ..EncodeOptions::default() }).unwrap();
-            let (_, out) = decode(&bytes, None).unwrap();
-            assert_eq!(out.channels[0][0], 0.0);
-            assert!(out.channels[0][1] > 0.99 && out.channels[0][1] <= 1.0);
-            assert_eq!(out.channels[0][2], if depth == BitDepth::Float32 { -5.0 } else { -1.0 });
-        }
-    }
-    // Ragged buffers encode the common length.
-    let ragged = AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.1; 10], vec![0.2; 7]] };
-    let (_, out) = decode(&encode(&ragged, &EncodeOptions::default()).unwrap(), None).unwrap();
-    assert_eq!(out.frames(), 7);
-}
-
-#[test]
-fn audio_buffer_helpers() {
-    let b = AudioBuffer::from_interleaved(48_000, 2, &[0.1, -0.2, 0.3, -0.4, 0.5]);
-    assert_eq!(b.frames(), 2);
-    assert_eq!(b.num_channels(), 2);
-    assert_eq!(b.interleaved(), vec![0.1, -0.2, 0.3, -0.4]);
-    assert!((b.peak() - 0.4).abs() < 1e-7);
-    assert!((b.duration_secs() - 2.0 / 48_000.0).abs() < 1e-12);
-    assert_eq!(AudioBuffer::from_interleaved(1, 0, &[1.0]).num_channels(), 0);
-    assert_eq!(AudioBuffer::new(0, 1, 5).duration_secs(), 0.0);
-    assert_eq!(AudioBuffer::default().frames(), 0);
-}
-
-#[test]
-fn serde_types_roundtrip() {
-    let opts = EncodeOptions { bwf: Some(BwfInfo { time_reference: 42, ..BwfInfo::default() }), ..EncodeOptions::default() };
-    let s = serde_json::to_string(&opts).unwrap();
-    assert_eq!(serde_json::from_str::<EncodeOptions>(&s).unwrap(), opts);
-    let info = probe(&encode(&sine(48_000, 1, 4), &opts).unwrap(), None).unwrap();
-    let s = serde_json::to_string(&info).unwrap();
-    assert_eq!(serde_json::from_str::<soundcraft_audio_io::AudioInfo>(&s).unwrap(), info);
-}
-
-#[test]
-fn multichannel_wav_speaker_masks() {
-    let buf = |n: usize| AudioBuffer { sample_rate: 48_000, channels: (0..n).map(|c| vec![0.01 * c as f32; 64]).collect() };
-    let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Int24, dither: false, bwf: None };
-    for (n, mask) in [(6usize, 0x3Fu32), (8, 0x63F), (12, 0x2_D63F)] {
-        let bytes = soundcraft_audio_io::encode(&buf(n), &opts).unwrap();
-        assert_eq!(soundcraft_audio_io::wav_channel_mask(&bytes), Some(mask), "{n} channels");
-        assert_eq!(soundcraft_audio_io::decode(&bytes, Some("wav")).unwrap().1.channels.len(), n);
-    }
-    // Explicit masks: 7.0 (sides + rears, no LFE) and Ambisonics (no positions).
-    let bytes = soundcraft_audio_io::encode_with_channel_mask(&buf(7), &opts, 0x637).unwrap();
-    assert_eq!(soundcraft_audio_io::wav_channel_mask(&bytes), Some(0x637));
-    let bytes = soundcraft_audio_io::encode_with_channel_mask(&buf(4), &opts, 0).unwrap();
-    assert_eq!(soundcraft_audio_io::wav_channel_mask(&bytes), Some(0));
-    // Plain 16-bit stereo stays a plain PCM header.
-    let o16 = EncodeOptions { bit_depth: BitDepth::Int16, ..opts };
-    let bytes = soundcraft_audio_io::encode_with_channel_mask(&buf(2), &o16, 0x3).unwrap();
-    assert_eq!(soundcraft_audio_io::wav_channel_mask(&bytes), None);
-}
-
-#[test]
-fn float_wav_header_is_rewritten_in_place_as_the_file_grows() {
-    let take = sine(48_000, 2, 1_000);
-    let mut file = wav_float_header(2, 48_000, 0).unwrap();
-    let len = file.len();
-    file.extend(take.interleaved().iter().flat_map(|s| s.to_le_bytes()));
-    assert_eq!(decode(&file, None).unwrap().1.frames(), 1_000);
-    file[..len].copy_from_slice(&wav_float_header(2, 48_000, 600).unwrap());
-    assert_eq!(decode(&file, None).unwrap().1.frames(), 600);
-    file[..len].copy_from_slice(&wav_float_header(2, 48_000, 1_000).unwrap());
-    assert_eq!(file, encode(&take, &EncodeOptions { bit_depth: BitDepth::Float32, ..EncodeOptions::default() }).unwrap());
-    let big = wav_float_header(2, 48_000, 600_000_000).unwrap();
-    assert_eq!((&big[..4], big.len()), (&b"RF64"[..], len));
-    assert!(wav_float_header(0, 48_000, 0).is_err());
-}
-
-#[test]
-fn zero_frame_flac_round_trips_like_wav_and_aiff() {
-    for format in [FileFormat::Wav, FileFormat::Aiff, FileFormat::Flac] {
-        for depth in [BitDepth::Int16, BitDepth::Int24] {
-            for channels in [1, 2] {
-                let opts = EncodeOptions { format, bit_depth: depth, ..EncodeOptions::default() };
-                let bytes = encode(&AudioBuffer::new(48_000, channels, 0), &opts).unwrap();
-                let info = probe(&bytes, None).unwrap();
-                assert_eq!((info.format, info.sample_format, info.sample_rate, info.frames), (format, expected_sf(depth), 48_000, 0));
-                assert_eq!(usize::from(info.channels), channels);
-                let (info, buf) = decode(&bytes, None).unwrap();
-                assert_eq!((info.frames, buf.frames(), buf.num_channels()), (0, 0, channels));
-            }
-        }
-    }
-}
-
-#[test]
-fn flac_claiming_frames_but_holding_none_still_errors() {
-    let opts = EncodeOptions { format: FileFormat::Flac, bit_depth: BitDepth::Int16, ..EncodeOptions::default() };
-    let mut bytes = encode(&AudioBuffer::new(48_000, 2, 0), &opts).unwrap();
-    bytes[25] = 1; // STREAMINFO total samples (low byte of the 36-bit field) = 1
-    assert!(decode(&bytes, None).is_err());
-}
-
-#[test]
-fn float_wav_header_rejects_a_frame_count_whose_total_size_overflows() {
-    // 4 bytes per frame: the data length fits in u64, but adding the header to it does not.
-    let frames = u64::MAX / 4;
-    assert!(matches!(wav_float_header(1, 48_000, frames), Err(soundcraft_audio_io::AudioError::TooLarge(_))));
-}
-
-#[test]
-fn bwf_truncation_keeps_utf8_boundaries() {
-    let src = sine(48_000, 1, 10);
-    let bwf = BwfInfo { originator: format!("{}é", "a".repeat(31)), description: format!("{}é", "d".repeat(255)), ..BwfInfo::default() };
-    let bytes = encode(&src, &EncodeOptions { format: FileFormat::Wav, bwf: Some(bwf), ..EncodeOptions::default() }).unwrap();
-    let out = probe(&bytes, None).unwrap().bwf.unwrap();
-    assert_eq!(out.originator, "a".repeat(31));
-    assert_eq!(out.description, "d".repeat(255));
-}
@@ -1,110 +0,0 @@
-use soundcraft_audio_io::{AudioBuffer, AudioError, BitDepth, BwfInfo, EncodeOptions, FileEncoder, FileFormat, encode, encode_with_channel_mask};
-use std::io::{Cursor, Seek, SeekFrom, Write};
-
-fn tone(channels: usize, frames: usize) -> AudioBuffer {
-    let channels = (0..channels).map(|c| (0..frames).map(|i| ((i * (c + 3)) as f32 * 0.013).sin() * 1.2).collect()).collect();
-    AudioBuffer { sample_rate: 44_100, channels }
-}
-
-fn streamed(buf: &AudioBuffer, opts: &EncodeOptions, mask: Option<u32>) -> Vec<u8> {
-    let mut out = Cursor::new(b"pre".to_vec());
-    out.set_position(3);
-    let mut enc = FileEncoder::new(out, opts, buf.channels.len(), buf.sample_rate, mask).unwrap();
-    let mut start = 0;
-    for len in [1, 7, 4095, 4097, 333].into_iter().cycle() {
-        if start >= buf.frames() {
-            break;
-        }
-        let len = len.min(buf.frames() - start);
-        let block: Vec<Vec<f32>> = buf.channels.iter().map(|c| c[start..start + len].to_vec()).collect();
-        enc.write(&block, len).unwrap();
-        start += len;
-    }
-    enc.finish().unwrap().into_inner()
-}
-
-#[test]
-fn streamed_files_match_whole_buffer_encodes() {
-    let bwf = BwfInfo { description: "take".into(), time_reference: 123_456, ..Default::default() };
-    let cases = [
-        (FileFormat::Wav, BitDepth::Int24, true, None, None),
-        (FileFormat::Wav, BitDepth::Float32, false, None, None),
-        (FileFormat::Wav, BitDepth::Int16, true, Some(bwf), Some(0x60F)),
-        (FileFormat::Aiff, BitDepth::Int24, true, None, None),
-        (FileFormat::Aiff, BitDepth::Float32, false, None, None),
-        (FileFormat::Flac, BitDepth::Int16, true, None, None),
-        (FileFormat::Flac, BitDepth::Int24, false, None, None),
-    ];
-    for (format, bit_depth, dither, bwf, mask) in cases {
-        let opts = EncodeOptions { format, bit_depth, dither, bwf };
-        for channels in [1, 6] {
-            let buf = tone(channels, 20_001);
-            let whole = match mask {
-                Some(m) => encode_with_channel_mask(&buf, &opts, m),
-                None => encode(&buf, &opts),
-            }
-            .unwrap();
-            assert_eq!(streamed(&buf, &opts, mask), [b"pre".as_slice(), &whole].concat(), "{opts:?}, {channels} channels");
-        }
-    }
-}
-
-/// A `Write + Seek` sink that accepts `budget` bytes in total and then fails every write, so
-/// a `write_all` on it appends a prefix of the block and only then reports the error.
-struct FailAfter {
-    inner: Cursor<Vec<u8>>,
-    budget: usize,
-}
-
-impl Write for FailAfter {
-    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-        if self.budget == 0 {
-            return Err(std::io::Error::other("sink is full"));
-        }
-        let n = buf.len().min(self.budget);
-        self.budget -= n;
-        self.inner.write(&buf[..n])
-    }
-
-    fn flush(&mut self) -> std::io::Result<()> {
-        self.inner.flush()
-    }
-}
-
-impl Seek for FailAfter {
-    fn seek(&mut self, pos: SeekFrom) -> std::io::Result<u64> {
-        self.inner.seek(pos)
-    }
-}
-
-#[test]
-fn a_failed_write_poisons_the_encoder() {
-    let buf = tone(2, 20_001);
-    for format in [FileFormat::Wav, FileFormat::Aiff, FileFormat::Flac] {
-        let opts = EncodeOptions { format, bit_depth: BitDepth::Int16, dither: false, bwf: None };
-        let sink = FailAfter { inner: Cursor::new(Vec::new()), budget: 256 };
-        let mut enc = FileEncoder::new(sink, &opts, 2, buf.sample_rate, None).unwrap();
-        // The sink accepts a prefix of the first block, then fails.
-        assert!(enc.write(&buf.channels, buf.frames()).is_err(), "{format:?}");
-        // Later calls must not claim success: the bytes on the sink no longer match the
-        // encoder's counters (and for FLAC the failed frame's samples are already gone).
-        assert!(matches!(enc.write(&buf.channels, 16), Err(AudioError::Encode(_))), "{format:?}");
-        assert!(matches!(enc.finish(), Err(AudioError::Encode(_))), "{format:?}");
-    }
-}
-
-#[test]
-fn blocks_past_a_format_limit_are_refused_before_anything_is_written() {
-    let buf = tone(2, 100);
-    for (format, limit) in [(FileFormat::Aiff, 1u64 << 30), (FileFormat::Flac, 1u64 << 36)] {
-        let opts = EncodeOptions { format, bit_depth: BitDepth::Int16, dither: false, bwf: None };
-        let mut enc = FileEncoder::new(Cursor::new(Vec::new()), &opts, 2, buf.sample_rate, None).unwrap();
-        enc.write(&buf.channels, 100).unwrap();
-        assert!(enc.check_room(limit / 2).is_ok(), "{format:?}");
-        assert!(matches!(enc.check_room(limit), Err(AudioError::TooLarge(_))), "{format:?}");
-        if let Ok(frames) = usize::try_from(limit) {
-            assert!(matches!(enc.write(&[], frames), Err(AudioError::TooLarge(_))), "{format:?}");
-        }
-        assert_eq!(enc.finish().unwrap().into_inner(), encode(&buf, &opts).unwrap());
-    }
-}
@@ -1,87 +0,0 @@
-//! A WAV whose data chunk is empty and followed by metadata decodes to no audio; a recording
-//! that was never finalised (RIFF and data sizes left at 0) still yields what was written (#466).
-
-use soundcraft_audio_io::{decode, probe};
-
-fn fmt16(channels: u16, sr: u32) -> Vec<u8> {
-    let align = channels * 2;
-    let mut f = Vec::new();
-    f.extend_from_slice(&1u16.to_le_bytes());
-    f.extend_from_slice(&channels.to_le_bytes());
-    f.extend_from_slice(&sr.to_le_bytes());
-    f.extend_from_slice(&(sr * u32::from(align)).to_le_bytes());
-    f.extend_from_slice(&align.to_le_bytes());
-    f.extend_from_slice(&16u16.to_le_bytes());
-    f
-}
-
-fn chunk(id: &[u8; 4], data: &[u8]) -> Vec<u8> {
-    let mut c = id.to_vec();
-    c.extend_from_slice(&(data.len() as u32).to_le_bytes());
-    c.extend_from_slice(data);
-    if data.len() % 2 == 1 {
-        c.push(0);
-    }
-    c
-}
-
-/// A finished file: correct RIFF size, chunks as given.
-fn riff(chunks: &[Vec<u8>]) -> Vec<u8> {
-    let mut body = b"WAVE".to_vec();
-    for c in chunks {
-        body.extend_from_slice(c);
-    }
-    let mut out = b"RIFF".to_vec();
-    out.extend_from_slice(&(body.len() as u32).to_le_bytes());
-    out.extend_from_slice(&body);
-    out
-}
-
-fn list_info() -> Vec<u8> {
-    let mut l = b"INFO".to_vec();
-    l.extend_from_slice(&chunk(b"INAM", b"Silence"));
-    chunk(b"LIST", &l)
-}
-
-#[test]
-fn an_empty_data_chunk_followed_by_metadata_has_no_frames() {
-    let file = riff(&[chunk(b"fmt ", &fmt16(2, 48_000)), chunk(b"data", &[]), list_info(), chunk(b"bext", &[0u8; 602])]);
-    let info = probe(&file, Some("wav")).unwrap();
-    assert_eq!(info.frames, 0, "the LIST and bext chunks are not samples");
-    let (info, buf) = decode(&file, Some("wav")).unwrap();
-    assert_eq!((info.frames, buf.frames()), (0, 0));
-    // The same with the metadata first.
-    let file = riff(&[chunk(b"fmt ", &fmt16(1, 44_100)), list_info(), chunk(b"data", &[])]);
-    assert_eq!(probe(&file, Some("wav")).unwrap().frames, 0);
-    // And with a single trailing chunk of odd size and no pad byte at the very end.
-    let mut file = riff(&[chunk(b"fmt ", &fmt16(1, 44_100)), chunk(b"data", &[]), chunk(b"note", b"abc")]);
-    file.pop();
-    let riff_size = (file.len() - 8) as u32;
-    file[4..8].copy_from_slice(&riff_size.to_le_bytes());
-    assert_eq!(probe(&file, Some("wav")).unwrap().frames, 0);
-}
-
-#[test]
-fn a_recording_that_was_never_finalised_still_gives_its_audio() {
-    let samples: Vec<u8> = (0..400i16).flat_map(|i| (i * 40).to_le_bytes()).collect();
-    // RIFF size and data size both left at 0, as a recorder writes them until it finishes.
-    let mut file = riff(&[chunk(b"fmt ", &fmt16(2, 48_000)), chunk(b"data", &[])]);
-    file.extend_from_slice(&samples);
-    file[4..8].copy_from_slice(&0u32.to_le_bytes());
-    let (info, buf) = decode(&file, Some("wav")).unwrap();
-    assert_eq!(info.frames, 200);
-    assert_eq!(buf.frames(), 200);
-    // Even if the RIFF size is the file's, audio that is not a run of chunks is still audio.
-    let mut file = riff(&[chunk(b"fmt ", &fmt16(2, 48_000)), chunk(b"data", &[])]);
-    file.extend_from_slice(&samples);
-    let riff_size = (file.len() - 8) as u32;
-    file[4..8].copy_from_slice(&riff_size.to_le_bytes());
-    assert_eq!(probe(&file, Some("wav")).unwrap().frames, 200);
-}
-
-#[test]
-fn a_data_chunk_with_audio_is_unchanged() {
-    let samples: Vec<u8> = (0..100i16).flat_map(|i| i.to_le_bytes()).collect();
-    let file = riff(&[chunk(b"fmt ", &fmt16(1, 44_100)), chunk(b"data", &samples), list_info()]);
-    assert_eq!(probe(&file, Some("wav")).unwrap().frames, 100);
-}
@@ -9,7 +9,7 @@ repository.workspace = true

 [dependencies]
 soundcraft-engine.workspace = true
-soundcraft-audio-io.workspace = true
+craft-audio.workspace = true
 soundcraft-time.workspace = true
 serde_json.workspace = true
 log.workspace = true
@@ -2,7 +2,6 @@

 use crate::Backend;
 use serde_json::{Value, json};
-use soundcraft_audio_io::FileFormat;
 use std::io::{BufRead, Write};

 pub const PROTOCOL_VERSION: &str = "2025-06-18";
@@ -71,7 +70,7 @@ pub fn tool_definitions() -> Vec<Value> {
        tool(
            "bounce_mix",
            "Render the mix to an audio file. Returns peak dBFS and integrated LUFS.",
-            json!({"path": {"type": "string"}, "format": {"type": "string", "enum": FileFormat::writable_extensions()}, "bit_depth": {"type": "string"}, "start": {}, "end": {}, "normalize": {"type": "boolean"}}),
+            json!({"path": {"type": "string"}, "format": {"type": "string", "enum": craft_audio::ENCODE_EXTENSIONS}, "bit_depth": {"type": "string"}, "start": {}, "end": {}, "normalize": {"type": "boolean"}}),
            &["path"],
        ),
        tool("parity", "Feature-parity report against the incumbent's menu catalog.", json!({}), &[]),
@@ -310,6 +310,36 @@ fn links_out_of_the_roots_are_refused() {
    ok(&mut via_alias, "file.import_audio", json!({"path": s(f.read.join("tone.wav"))}));
 }

+#[cfg(any(unix, windows))]
+#[test]
+fn exports_refuse_hard_links_without_changing_either_name() {
+    let f = fixture("hard-links");
+    let midi = f.write.join("linked.mid");
+    let preset = f.write.join("linked.json");
+    std::fs::hard_link(f.outside.join("secret.mid"), &midi).unwrap();
+    std::fs::hard_link(f.outside.join("secret.json"), &preset).unwrap();
+    let mut srv = demo_server(Some(&f.read), Some(&f.write));
+    let before = listing(&f.write);
+
+    // Refusal is the safe alternative allowed by #1359: neither the outside inode nor its
+    // in-root alias may be truncated, and no replacement or temporary file may be left behind.
+    refused(&mut srv, "file.export_midi", json!({"path": s(&midi)}), "hard-linked");
+    refused(&mut srv, "track.save_preset", json!({"path": s(&preset), "tracks": ["Kick"]}), "hard-linked");
+    for path in [&midi, &preset, &f.outside.join("secret.mid"), &f.outside.join("secret.json")] {
+        assert_eq!(std::fs::read(path).unwrap(), SECRET.as_bytes());
+    }
+    assert_eq!(listing(&f.write), before);
+
+    // The error offers a new export path; both commands must still work at ordinary paths.
+    let fresh_midi = f.write.join("fresh.mid");
+    ok(&mut srv, "file.export_midi", json!({"path": s(&fresh_midi)}));
+    assert!(std::fs::read(fresh_midi).unwrap().starts_with(b"MThd"));
+    let fresh_preset = f.write.join("fresh.json");
+    ok(&mut srv, "track.save_preset", json!({"path": s(&fresh_preset), "tracks": ["Kick"]}));
+    let preset_json: Value = serde_json::from_slice(&std::fs::read(fresh_preset).unwrap()).unwrap();
+    assert_eq!(preset_json["name"], "Kick");
+}
+
 /// A session file is hostile input too: media it names outside the read root is not loaded,
 /// and the refusal is listed with the other missing media.
 #[test]
@@ -9,7 +9,7 @@ repository.workspace = true

 [dependencies]
 soundcraft-time.workspace = true
-soundcraft-audio-io.workspace = true
+craft-audio.workspace = true
 soundcraft-midi.workspace = true
 soundcraft-dsp.workspace = true
 soundcraft-clap-host.workspace = true
@@ -25,6 +25,9 @@ log.workspace = true
 zip.workspace = true
 craft-docpath.workspace = true

+[target.'cfg(windows)'.dependencies]
+winsafe = { version = "0.0.29", features = ["kernel"] }
+
 [dev-dependencies]
 proptest.workspace = true

@@ -3,7 +3,7 @@

 use crate::io::{Recording, open_session_linked, sanitize_name};
 use crate::{Engine, EngineError, Result};
-use soundcraft_audio_io::{BitDepth, EncodeOptions, FileFormat};
+use craft_audio::{BitDepth, EncodeOptions};
 use soundcraft_model::{Session, SourceAudio, SourceId};
 use std::collections::BTreeMap;
 use std::io::Write;
@@ -248,8 +248,8 @@ impl Autosave {
        crate::io::session_size("the autosave", text.len() as u64, true)?;
        self.next = next;
        for (name, audio) in &fresh {
-            let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Float32, dither: false, bwf: None };
-            let bytes = soundcraft_audio_io::encode(&audio.buffer, &opts).map_err(|err| EngineError::Io(err.to_string()))?;
+            let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(BitDepth::Float32);
+            let bytes = craft_audio::encode(&audio.buffer, &opts).map_err(|err| EngineError::Io(err.to_string()))?;
            create_folder(&audio_dir).and_then(|()| write_synced(&audio_dir.join(name), &bytes)).map_err(|err| io_error(&audio_dir, err))?;
        }
        write_atomically(&self.dir.join(ORIGIN), origin.unwrap_or_default().as_bytes())?;
@@ -404,7 +404,7 @@ fn repair_take(path: &Path, folders: &[PathBuf], channels: usize, rate: u32) ->
    if !folder.is_some_and(|d| folders.contains(&d)) {
        return Err(refuse("not in a folder SoundCraft records into"));
    }
-    let header = |frames| soundcraft_audio_io::wav_float_header(channels, rate, frames).map_err(std::io::Error::other);
+    let header = |frames| craft_audio::wav_float_header(rate, u16::try_from(channels).unwrap_or(u16::MAX), frames).map_err(std::io::Error::other);
    let expected = header(0)?;
    let mut f = std::fs::OpenOptions::new().read(true).write(true).open(path)?;
    let mut head = vec![0u8; expected.len()];
@@ -454,6 +454,32 @@ pub fn create_folder(dir: &Path) -> std::io::Result<()> {
    builder.create(dir)
 }

+/// A new folder directly in `parent`, named `{prefix}-` and 32 random hex digits. It is made
+/// exclusively (it is created by this call or the call fails), so a folder or link another account
+/// put there first is never used, and the name cannot be guessed ahead. On Unix it is owner-only
+/// (`0o700`); on other systems it has the mode `parent` gives it.
+pub fn create_unique_folder(parent: &Path, prefix: &str) -> std::io::Result<PathBuf> {
+    use std::hash::{BuildHasher, Hasher};
+    // One plain name: a prefix like `../x` would make a sibling of `parent`, not a child.
+    let mut parts = Path::new(prefix).components();
+    if !matches!((parts.next(), parts.next()), (Some(std::path::Component::Normal(_)), None)) || prefix.contains(['/', '\\']) {
+        return Err(std::io::Error::new(std::io::ErrorKind::InvalidInput, "the folder prefix must be a single name"));
+    }
+    for _ in 0..16 {
+        let random = |_| std::collections::hash_map::RandomState::new().build_hasher().finish();
+        let dir = parent.join(format!("{prefix}-{:016x}{:016x}", random(0), random(1)));
+        let mut builder = std::fs::DirBuilder::new();
+        #[cfg(unix)]
+        std::os::unix::fs::DirBuilderExt::mode(&mut builder, 0o700);
+        match builder.create(&dir) {
+            Ok(()) => return Ok(dir),
+            Err(err) if err.kind() == std::io::ErrorKind::AlreadyExists => {}
+            Err(err) => return Err(err),
+        }
+    }
+    Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "no unused folder name"))
+}
+
 fn write_synced(path: &Path, bytes: &[u8]) -> std::io::Result<()> {
    let mut f = std::fs::File::create(path)?;
    f.write_all(bytes)?;
@@ -476,9 +502,28 @@ fn io_error(path: &Path, err: std::io::Error) -> EngineError {
 mod tests {
    use super::*;
    use crate::io::open_session;
+    use craft_audio::AudioBuffer;
+
+    #[test]
+    fn unique_folders_are_new_and_owner_only() {
+        let parent = std::env::temp_dir().join(format!("soundcraft-unique-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&parent);
+        std::fs::create_dir_all(&parent).unwrap();
+        let (a, b) = (create_unique_folder(&parent, "T").unwrap(), create_unique_folder(&parent, "T").unwrap());
+        assert_ne!(a, b);
+        assert!(a.is_dir() && a.parent() == Some(parent.as_path()));
+        assert_eq!(a.file_name().unwrap().len(), "T-".len() + 32);
+        #[cfg(unix)]
+        assert_eq!(std::os::unix::fs::PermissionsExt::mode(&std::fs::metadata(&a).unwrap().permissions()) & 0o777, 0o700);
+        assert!(create_unique_folder(&parent.join("missing"), "T").is_err(), "no parents are made");
+        for bad in ["../outside", "a/b", "a\\b", "..", ".", "", "/abs"] {
+            assert!(create_unique_folder(&parent, bad).is_err(), "{bad:?} is not a single name");
+        }
+        let _ = std::fs::remove_dir_all(&parent);
+    }
+
    use serde_json::json;
-    use soundcraft_audio_io::AudioBuffer;
-    use soundcraft_model::{ChannelFormat, Clip, TrackKind};
+    use soundcraft_model::{ChannelFormat, Clip, FileFormat, TrackKind};

    /// Recovery loads document edits without re-enabling live inputs from an autosave.
    #[test]
@@ -674,7 +719,7 @@ mod tests {
        let take = root.join(sanitize_name(&e.session().name)).join("Audio Files/Vox_01.wav");
        std::fs::create_dir_all(take.parent().unwrap()).unwrap();
        let audio: Vec<u8> = (0..480).flat_map(|i| (i as f32 / 1000.0).to_le_bytes()).collect();
-        std::fs::write(&take, [soundcraft_audio_io::wav_float_header(1, 48_000, 100).unwrap(), audio].concat()).unwrap();
+        std::fs::write(&take, [craft_audio::wav_float_header(48_000, 1, 100).unwrap(), audio].concat()).unwrap();
        let plan = Recording { start: 48_000, pass: None, punch: None, rate: 48_000, takes: vec![Take { track, path: take, channels: 1 }] };
        let clips = |e: &Engine| e.session().track(track).unwrap().clips().iter().map(|c| (c.start, c.length)).collect::<Vec<_>>();
        let w = Autosaver::new(root.clone());
@@ -705,7 +750,7 @@ mod tests {
            soundcraft_model::TrackId(e.execute("track.new", &json!({"name": "Vox", "format": "mono"})).unwrap()["tracks"][0].as_u64().unwrap());
        let takes = root.join(sanitize_name(&e.session().name)).join("Audio Files");
        std::fs::create_dir_all(&takes).unwrap();
-        let wav = [soundcraft_audio_io::wav_float_header(1, 48_000, 0).unwrap(), vec![0; 4_000]].concat();
+        let wav = [craft_audio::wav_float_header(48_000, 1, 0).unwrap(), vec![0; 4_000]].concat();
        let text = b"not audio at all, but long enough to be mistaken for a header if nobody looked at it ......".repeat(4);
        let files =
            [(takes.join("notes.wav"), text.clone()), (dir.join("Elsewhere/Vox_01.wav"), wav.clone()), (takes.join("../Vox_02.wav"), wav.clone())];
@@ -5,8 +5,9 @@
 //! as 32-bit float WAVs in a `<name> Audio/` folder next to it.

 use crate::{Engine, EngineError, Result};
+use craft_audio::EncodeOptions;
 use serde::{Deserialize, Serialize};
-use soundcraft_audio_io::{EncodeOptions, FileFormat};
+use soundcraft_model::FileFormat;
 use soundcraft_model::{Clip, ClipContent, ClipId, SourceId, TrackId};
 use soundcraft_time::Samples;
 use std::collections::BTreeMap;
@@ -65,8 +66,8 @@ pub fn export(e: &Engine, ids: &[ClipId], path: &str) -> Result<usize> {
            {
                let rel = format!("{audio_dir_name}/{}_{}.wav", crate::io::sanitize_name(&src.name), source.0);
                crate::io::make_dir(dir.join(&audio_dir_name))?;
-                let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: soundcraft_audio_io::BitDepth::Float32, dither: false, bwf: None };
-                let bytes = soundcraft_audio_io::encode(&buf.buffer, &opts).map_err(|err| EngineError::Io(err.to_string()))?;
+                let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(craft_audio::BitDepth::Float32);
+                let bytes = craft_audio::encode(&buf.buffer, &opts).map_err(|err| EngineError::Io(err.to_string()))?;
                crate::io::write_path(dir.join(&rel), bytes)?;
                slot.insert(rel);
            }
@@ -85,23 +86,30 @@ fn decode_group_audio(
    dir: &Path,
    rate: u32,
    cmd_id: &str,
-) -> Result<(Vec<(String, soundcraft_audio_io::AudioBuffer)>, BTreeMap<u64, usize>)> {
+) -> Result<(Vec<(String, craft_audio::AudioBuffer)>, BTreeMap<u64, usize>)> {
    let (mut decoded, mut index, mut file_of) = (Vec::new(), BTreeMap::new(), BTreeMap::new());
+    // The folder as the file system knows it, so a link among the group's files can't lead out.
+    let dir = if dir.as_os_str().is_empty() { Path::new(".") } else { dir };
+    let root = crate::io::canonical_path(dir)?;
    for (old, rel) in audio_entries {
        let full = dir.join(rel);
+        let escapes = |rel: &str| EngineError::BadParams(cmd_id.into(), format!("audio path escapes the group folder: {rel}"));
        if !full.starts_with(dir)
            || Path::new(rel)
                .components()
                .any(|c| matches!(c, std::path::Component::ParentDir | std::path::Component::RootDir | std::path::Component::Prefix(_)))
        {
-            return Err(EngineError::BadParams(cmd_id.into(), format!("audio path escapes the group folder: {rel}")));
+            return Err(escapes(rel));
+        }
+        let key = crate::io::canonical_path(&full)?;
+        if !key.starts_with(&root) {
+            return Err(escapes(rel));
        }
-        let key = crate::io::file_key(&full);
        let n = match index.get(&key) {
            Some(n) => *n,
            None => {
-                let bytes = crate::io::read_file(&full)?;
-                let (_, buf) = soundcraft_audio_io::decode(&bytes, Some("wav")).map_err(|err| EngineError::Io(format!("{rel}: {err}")))?;
+                let bytes = crate::io::read_file_inside(&full, &root)?;
+                let (_, buf) = craft_audio::decode(&bytes, Some("wav")).map_err(|err| EngineError::Io(format!("{rel}: {err}")))?;
                let buf = crate::io::at_rate(buf, rate, crate::io::MAX_IMPORT_SAMPLES)
                    .map_err(|r| EngineError::Io(format!("{rel}: {}", r.message("too large to import"))))?;
                decoded.push((rel.clone(), buf));
@@ -268,9 +276,59 @@ mod tests {
        std::fs::write(&path, file.to_string()).unwrap();
        let r = e.execute("file.import_clip_groups", &json!({"path": path, "at": 1000, "track": "Bass"}));
        assert!(matches!(r, Err(crate::EngineError::BadParams(..))), "absolute paths are refused: {r:?}");
+        // A link inside the folder that leads out of it is refused once resolved.
+        #[cfg(unix)]
+        {
+            let outside = std::env::temp_dir().join(format!("sc-grp-outside-{}.wav", std::process::id()));
+            std::fs::copy(dir.join("Wait... what_0.wav"), &outside).unwrap();
+            std::os::unix::fs::symlink(&outside, dir.join("link.wav")).unwrap();
+            for rel in file["audio"].as_object_mut().unwrap().values_mut() {
+                *rel = json!("link.wav");
+            }
+            std::fs::write(&path, file.to_string()).unwrap();
+            let r = e.execute("file.import_clip_groups", &json!({"path": path, "at": 1000, "track": "Bass"}));
+            assert!(matches!(r, Err(crate::EngineError::BadParams(..))), "links out of the folder are refused: {r:?}");
+            let _ = std::fs::remove_file(&outside);
+        }
        let _ = std::fs::remove_dir_all(&dir);
    }

+    /// Under a read root, a link in the group folder to a folder outside the root is refused the same way
+    /// whether or not the file asked for exists there, so the group cannot be used to probe for names.
+    #[cfg(unix)]
+    #[test]
+    fn links_out_of_the_read_root_are_refused_alike_for_existing_and_missing_files() {
+        let base = std::env::temp_dir().join(format!("sc-grp-root-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let (dir, outside) = (base.join("group"), base.join("outside"));
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::create_dir_all(&outside).unwrap();
+        let path = dir.join("drums.scgrp").to_string_lossy().to_string();
+        let mut e = crate::demo::demo_engine();
+        let kick = e.session().tracks.iter().find(|t| t.name == "Kick").map(|t| t.id).unwrap();
+        let ids: Vec<_> = e.session().track(kick).unwrap().clips().iter().take(1).map(|c| c.id.0).collect();
+        e.execute("file.export_clip_groups", &json!({"path": path, "clips": ids})).unwrap();
+        let mut file: serde_json::Value = serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
+        let exported = file["audio"].as_object().unwrap().values().next().unwrap().as_str().unwrap().to_string();
+        std::fs::copy(dir.join(&exported), outside.join("real.wav")).unwrap();
+        std::os::unix::fs::symlink(&outside, dir.join("out")).unwrap();
+        let roots = crate::file_access::AutomationRoots::new(&[&dir], &[]).unwrap().unwrap();
+        let mut refusals = Vec::new();
+        for target in ["out/real.wav", "out/missing.wav"] {
+            for rel in file["audio"].as_object_mut().unwrap().values_mut() {
+                *rel = json!(target);
+            }
+            std::fs::write(&path, file.to_string()).unwrap();
+            let r = crate::file_access::confine(Some(&roots), || {
+                e.execute("file.import_clip_groups", &json!({"path": path, "at": 1000, "track": "Bass"}))
+            });
+            refusals.push(r.unwrap_err().to_string());
+        }
+        assert!(refusals[0].contains("outside the read root"), "{}", refusals[0]);
+        assert_eq!(refusals[0].replace("real.wav", "X"), refusals[1].replace("missing.wav", "X"), "existing and missing names are refused alike");
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
    #[test]
    fn imported_clips_carry_no_auto_rename_scheme() {
        let dir = std::env::temp_dir().join(format!("sc-grp-names-{}", std::process::id()));
@@ -357,8 +415,8 @@ mod tests {
    fn a_file_named_by_many_ids_becomes_one_source() {
        let dir = std::env::temp_dir().join(format!("sc-grp-shared-{}", std::process::id()));
        let _ = std::fs::create_dir_all(&dir);
-        let audio = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.25; 480]] };
-        std::fs::write(dir.join("k.wav"), soundcraft_audio_io::encode(&audio, &soundcraft_audio_io::EncodeOptions::default()).unwrap()).unwrap();
+        let audio = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.25; 480]] };
+        std::fs::write(dir.join("k.wav"), craft_audio::encode(&audio, &craft_audio::EncodeOptions::default()).unwrap()).unwrap();
        let clip = |id: u64| json!({"id": id, "name": "k", "start": id * 1000, "length": 480, "content": {"Audio": {"source": id, "offset": 0}}});
        let audio_paths = json!({"1": "k.wav", "2": "./k.wav", "3": "k.wav"});
        let file = json!({"format": "soundcraft.clipgroup", "version": 1, "sample_rate": 48000, "length": 4000, "lanes": [[clip(1), clip(2), clip(3)]], "audio": audio_paths});
@@ -47,7 +47,7 @@ fn audio_as_midi(e: &mut Engine, p: &Value) -> Result<Value> {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use soundcraft_audio_io::AudioBuffer;
+    use craft_audio::AudioBuffer;
    use soundcraft_model::{ChannelFormat, TrackKind};

    #[test]
@@ -59,7 +59,7 @@ mod tests {
        a.extend(tone(330.0));
        let frames = a.len() as i64;
        let s = e.session_mut();
-        let src = crate::io::add_source(s, "mel", AudioBuffer { sample_rate: 48_000, channels: vec![a] }, None, soundcraft_audio_io::FileFormat::Wav);
+        let src = crate::io::add_source(s, "mel", AudioBuffer { sample_rate: 48_000, channels: vec![a] }, None, soundcraft_model::FileFormat::Wav);
        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
        let cid = s.new_clip_id();
        crate::edit::place_clip(s, t, Clip::audio(cid, "mel", src, 0, 0, frames));
@@ -3,9 +3,10 @@ use super::{CommandSpec, bad, clip_ids_param, has_selection, range_param, str_pa
 use soundcraft_time::Range;

 use crate::{Engine, Result, cmd};
+use craft_audio::AudioBuffer;
 use serde_json::{Value, json};
-use soundcraft_audio_io::{AudioBuffer, FileFormat};
 use soundcraft_dsp::offline::{SpeedRampChange, SpeedRampSelection};
+use soundcraft_model::FileFormat;
 use soundcraft_model::{Clip, ClipContent, TrackKind};

 pub fn specs() -> Vec<CommandSpec> {
@@ -214,7 +215,7 @@ fn short(n: &str) -> String {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use soundcraft_audio_io::AudioBuffer;
+    use craft_audio::AudioBuffer;
    use soundcraft_model::{ChannelFormat, Session, TrackKind};

    fn gained_clip() -> (crate::Engine, soundcraft_model::ClipId) {
@@ -464,8 +464,8 @@ mod tests {
        let mut s = Session::default();
        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, Some("Elastic"));
        let samples = (0..source_len).map(|i| if i >= tone_at { (i as f32 * 0.2).sin() * 0.4 } else { 0.0 }).collect();
-        let buf = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![samples] };
-        let src = crate::io::add_source(&mut s, "Tone", buf, None, soundcraft_audio_io::FileFormat::Wav);
+        let buf = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![samples] };
+        let src = crate::io::add_source(&mut s, "Tone", buf, None, soundcraft_model::FileFormat::Wav);
        let cid = s.new_clip_id();
        crate::edit::place_clip(&mut s, t, Clip::audio(cid, "Clip", src, 0, 0, clip_len));
        let mut e = crate::Engine::new(s);
@@ -552,8 +552,8 @@ mod tests {
        use soundcraft_model::{ChannelFormat, Clip, Session, TrackKind};
        let mut s = Session::default();
        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, Some("Dialog"));
-        let buf = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.1; 10_000]] };
-        let src = crate::io::add_source(&mut s, "Line", buf, None, soundcraft_audio_io::FileFormat::Wav);
+        let buf = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.1; 10_000]] };
+        let src = crate::io::add_source(&mut s, "Line", buf, None, soundcraft_model::FileFormat::Wav);
        let ids = [0, 1, 2].map(|k| {
            let cid = s.new_clip_id();
            crate::edit::place_clip(&mut s, t, Clip::audio(cid, "Line", src, 0, k * 12_000, 10_000));
@@ -66,7 +66,8 @@ fn clear(e: &mut Engine, p: &Value) -> Result<Value> {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use soundcraft_audio_io::{AudioBuffer, FileFormat};
+    use craft_audio::AudioBuffer;
+    use soundcraft_model::FileFormat;

    fn kick(e: &Engine) -> (SourceId, Vec<ClipId>) {
        let s = e.session();
@@ -511,8 +511,8 @@ mod tests {
        let mut s = Session::default();
        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
        let tone: Vec<f32> = (0..12_000).map(|i| (i as f32 * 0.07).sin() * 0.5).collect();
-        let buf = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
-        let src = crate::io::add_source(&mut s, "tone", buf, None, soundcraft_audio_io::FileFormat::Wav);
+        let buf = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
+        let src = crate::io::add_source(&mut s, "tone", buf, None, soundcraft_model::FileFormat::Wav);
        let id = s.new_clip_id();
        let mut c = Clip::audio(id, "tone", src, 0, 0, 18_000);
        c.stretch = 1.5;
@@ -544,8 +544,8 @@ mod tests {
                let mut s = Session::default();
                let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
                let tone: Vec<f32> = (0..9_600).map(|i| (i as f32 * 0.05).sin() * 0.4).collect();
-                let buf = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
-                let src = crate::io::add_source(&mut s, "tone", buf, None, soundcraft_audio_io::FileFormat::Wav);
+                let buf = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
+                let src = crate::io::add_source(&mut s, "tone", buf, None, soundcraft_model::FileFormat::Wav);
                let id = s.new_clip_id();
                crate::edit::place_clip(&mut s, t, Clip::audio(id, "tone", src, 0, 0, 9_600));
                s.edit.selected_clips = vec![id];
@@ -575,8 +575,8 @@ mod tests {
        let mut s = Session::default();
        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
        let tone: Vec<f32> = (0..9_600).map(|i| (i as f32 * 0.05).sin() * 0.4).collect();
-        let buf = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
-        let src = crate::io::add_source(&mut s, "tone", buf, None, soundcraft_audio_io::FileFormat::Wav);
+        let buf = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
+        let src = crate::io::add_source(&mut s, "tone", buf, None, soundcraft_model::FileFormat::Wav);
        let id = s.new_clip_id();
        crate::edit::place_clip(&mut s, t, Clip::audio(id, "tone", src, 0, 0, 9_600));
        s.edit.selected_clips = vec![id];
@@ -1228,8 +1228,8 @@ mod tests {
        use soundcraft_model::{ChannelFormat, Clip, TrackKind};
        let mut s = Session::default();
        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
-        let buf = soundcraft_audio_io::AudioBuffer { sample_rate: s.sample_rate.hz(), channels: vec![vec![0.25; 60_000]] };
-        let src = crate::io::add_source(&mut s, "src", buf, None, soundcraft_audio_io::FileFormat::Wav);
+        let buf = craft_audio::AudioBuffer { sample_rate: s.sample_rate.hz(), channels: vec![vec![0.25; 60_000]] };
+        let src = crate::io::add_source(&mut s, "src", buf, None, soundcraft_model::FileFormat::Wav);
        let mut ids = Vec::new();
        for &(start, len, off) in clips {
            let id = s.new_clip_id();
@@ -1158,8 +1158,8 @@ mod tests {
        let mut s = Session::default();
        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
        let tone: Vec<f32> = (0..24_000).map(|i| (i as f32 * 0.05).sin() * 0.5).collect();
-        let buf = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
-        let src = crate::io::add_source(&mut s, "tone", buf, None, soundcraft_audio_io::FileFormat::Wav);
+        let buf = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
+        let src = crate::io::add_source(&mut s, "tone", buf, None, soundcraft_model::FileFormat::Wav);
        let id = s.new_clip_id();
        ops::place_clip(&mut s, t, Clip::audio(id, "tone", src, 0, 0, 24_000));
        s.edit.selected_tracks = vec![t];
@@ -154,6 +154,7 @@ fn insert_time(e: &mut Engine, p: &Value) -> Result<Value> {
    let s = e.session_mut();
    let ids: Vec<_> = s.tracks.iter().map(|t| t.id).collect();
    for t in ids {
+        crate::edit::separate_all_at(s, t, r.start);
        crate::edit::insert_silence(s, t, r);
        if let Some(tr) = s.track_mut(t) {
            for l in &mut tr.automation {
@@ -185,6 +186,8 @@ fn cut_time(e: &mut Engine, p: &Value) -> Result<Value> {
    let s = e.session_mut();
    let ids: Vec<_> = s.tracks.iter().map(|t| t.id).collect();
    for t in ids {
+        crate::edit::separate_all_at(s, t, r.start);
+        crate::edit::separate_all_at(s, t, r.end);
        crate::edit::clear_range(s, t, r, false);
        crate::edit::shift_from(s, t, r.end, -r.len());
        if let Some(tr) = s.track_mut(t) {
@@ -98,17 +98,17 @@ pub fn specs() -> Vec<CommandSpec> {
                None => "wav",
                Some(value) => value.as_str().ok_or_else(|| bad("file.bounce_stems", "`format` must be a string"))?,
            };
-            let format = soundcraft_audio_io::FileFormat::from_write_extension(format_name).ok_or_else(|| {
-                let supported = soundcraft_audio_io::FileFormat::writable_extensions().join(", ");
+            let format = craft_audio::encode_format_for(format_name).ok_or_else(|| {
+                let supported = craft_audio::ENCODE_EXTENSIONS.join(", ");
                bad("file.bounce_stems", format!("cannot write `{format_name}` files (supported: {supported})"))
            })?;
            let bit_depth = match p.get("bit_depth").map(|b| b.to_string().trim_matches('"').to_string()).as_deref() {
-                Some("16") => soundcraft_audio_io::BitDepth::Int16,
-                Some("32") | Some("32f") => soundcraft_audio_io::BitDepth::Float32,
-                _ => soundcraft_audio_io::BitDepth::Int24,
+                Some("16") => craft_audio::BitDepth::Int16,
+                Some("32") | Some("32f") => craft_audio::BitDepth::Float32,
+                _ => craft_audio::BitDepth::Int24,
            };
            let fold = fold_down_param(p, "file.bounce_stems")?;
-            let files = crate::io::bounce_stems_with(e, &dir, r, &soundcraft_audio_io::EncodeOptions { format, bit_depth, dither: bool_or(p, "dither", true), bwf: None }, fold)?;
+            let files = crate::io::bounce_stems_with(e, &dir, r, &craft_audio::EncodeOptions::new(format).with_bit_depth(bit_depth).with_dither(bool_or(p, "dither", true)), fold)?;
            Ok(json!({"files": files}))
        }),
        cmd!(noundo "file.export_midi", "MIDI...", ["File", "Export"], None, "{path, tracks?}", always, |e, p| {
@@ -318,16 +318,16 @@ pub fn bounce_job(e: &Engine, p: &Value) -> Result<crate::io::Bounce> {
    let r = if r.is_empty() { soundcraft_time::Range::new(0, e.session().content_end().max(1)) } else { r };
    let ext = std::path::Path::new(&path).extension().and_then(std::ffi::OsStr::to_str).unwrap_or("wav").to_ascii_lowercase();
    let format_name = str_param(p, "format").unwrap_or(ext.as_str());
-    let format = soundcraft_audio_io::FileFormat::from_write_extension(format_name).ok_or_else(|| {
-        let supported = soundcraft_audio_io::FileFormat::writable_extensions().join(", ");
+    let format = craft_audio::encode_format_for(format_name).ok_or_else(|| {
+        let supported = craft_audio::ENCODE_EXTENSIONS.join(", ");
        bad("file.bounce_mix", format!("cannot write `{format_name}` files (supported: {supported})"))
    })?;
    let bit_depth = match p.get("bit_depth").map(|b| b.to_string().trim_matches('"').to_string()).as_deref() {
-        Some("16") => soundcraft_audio_io::BitDepth::Int16,
-        Some("32") | Some("32f") => soundcraft_audio_io::BitDepth::Float32,
-        _ => soundcraft_audio_io::BitDepth::Int24,
+        Some("16") => craft_audio::BitDepth::Int16,
+        Some("32") | Some("32f") => craft_audio::BitDepth::Float32,
+        _ => craft_audio::BitDepth::Int24,
    };
-    let opts = soundcraft_audio_io::EncodeOptions { format, bit_depth, dither: bool_or(p, "dither", true), bwf: None };
+    let opts = craft_audio::EncodeOptions::new(format).with_bit_depth(bit_depth).with_dither(bool_or(p, "dither", true));
    let normalize = bool_or(p, "normalize", false);
    let fold = fold_down_param(p, "file.bounce_mix")?;
    let bus = bounce_bus(e, p)?;
@@ -1,12 +1,12 @@
 use super::*;
 use crate::Engine;
-use soundcraft_audio_io::{AudioBuffer, EncodeOptions};
+use craft_audio::{AudioBuffer, EncodeOptions};
 use soundcraft_model::ChannelFormat;

 fn tone_wav(dir: &std::path::Path, name: &str) -> String {
    let tone: Vec<f32> = (0..4_800).map(|i| (i as f32 * 0.1).sin() * 0.2).collect();
    let buf = AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
-    let bytes = soundcraft_audio_io::encode(&buf, &EncodeOptions::default()).unwrap();
+    let bytes = craft_audio::encode(&buf, &EncodeOptions::default()).unwrap();
    let path = dir.join(name);
    std::fs::write(&path, bytes).unwrap();
    path.to_string_lossy().into_owned()
@@ -175,10 +175,10 @@ fn bounce_stems_accepts_explicit_wav_format() {
    let path = std::path::Path::new(files[0].as_str().unwrap());
    assert_eq!(path.parent(), Some(stems.as_path()));
    assert_eq!(path.extension().and_then(|extension| extension.to_str()), Some("wav"));
-    let (info, audio) = soundcraft_audio_io::decode(&std::fs::read(path).unwrap(), None).unwrap();
-    assert_eq!(info.format, soundcraft_audio_io::FileFormat::Wav);
+    let (info, audio) = craft_audio::decode(&std::fs::read(path).unwrap(), None).unwrap();
+    assert_eq!(info.container, craft_audio::Container::Wav);
    assert_eq!(audio.frames(), 32);
-    assert_eq!(audio.num_channels(), e.session().main_format().channels());
+    assert_eq!(audio.channels.len(), e.session().main_format().channels());
    assert!(audio.channels.iter().flatten().any(|sample| sample.abs() > 0.01));
    std::fs::remove_dir_all(&dir).unwrap();
 }
@@ -289,7 +289,7 @@ fn tone_engine() -> (Engine, u64) {
    let track = e.session().tracks[0].id;
    let tone: Vec<f32> = (0..4_800).map(|i| (i as f32 * 0.05).sin() * 0.5).collect();
    let buf = AudioBuffer { sample_rate: 48_000, channels: vec![tone] };
-    let src = crate::io::add_source(e.session_mut(), "tone", buf, None, soundcraft_audio_io::FileFormat::Wav);
+    let src = crate::io::add_source(e.session_mut(), "tone", buf, None, soundcraft_model::FileFormat::Wav);
    let id = e.session_mut().new_clip_id();
    crate::edit::place_clip(e.session_mut(), track, soundcraft_model::Clip::audio(id, "tone", src, 0, 0, 4_800));
    e.session_mut().edit.selected_tracks = vec![track];
@@ -392,7 +392,7 @@ fn midi_export_keeps_controllers_and_honours_tracks() {
 fn import_surround_creates_a_matching_track() {
    let channels: Vec<Vec<f32>> = (0..6).map(|ch| vec![0.1 * (ch as f32 + 1.0); 32]).collect();
    let buf = AudioBuffer { sample_rate: 48_000, channels };
-    let bytes = soundcraft_audio_io::encode(&buf, &EncodeOptions::default()).unwrap();
+    let bytes = craft_audio::encode(&buf, &EncodeOptions::default()).unwrap();
    let mut e = Engine::default();
    let v = crate::io::import_audio_bytes(&mut e, "bed.wav", &bytes, None, None, 0).unwrap();
    assert_eq!(v["channels"], 6);
@@ -96,7 +96,7 @@ fn report(e: &mut Engine, _: &Value) -> Result<Value> {
 #[allow(clippy::unwrap_used)]
 mod tests {
    use super::*;
-    use soundcraft_audio_io::AudioBuffer;
+    use craft_audio::AudioBuffer;
    use soundcraft_model::{Clip, ClipId, SourceAudio, SourceId};
    use std::sync::Arc;

@@ -1,5 +1,5 @@
 use super::*;
-use soundcraft_audio_io::AudioBuffer;
+use craft_audio::AudioBuffer;
 use soundcraft_model::{ChannelFormat, Clip, SourceAudio, SourceId, TrackKind};
 use soundcraft_time::Range;
 use std::sync::Arc;
@@ -3,8 +3,9 @@
 use super::bad;
 use crate::{Engine, Result};

+use craft_audio::AudioBuffer;
 use serde_json::{Value, json};
-use soundcraft_audio_io::{AudioBuffer, FileFormat};
+use soundcraft_model::FileFormat;
 use soundcraft_model::{Clip, ClipContent, EditState, Session, SourceId, TrackId};
 use soundcraft_time::Samples;

@@ -227,7 +228,7 @@ mod tests {
        use soundcraft_model::{ChannelFormat, TrackKind};
        let mut s = Session::default();
        let t = s.add_track(TrackKind::Audio, ChannelFormat::Stereo, Some("Long"));
-        let buf = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5]; 2] };
+        let buf = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5]; 2] };
        let src = crate::io::add_source(&mut s, "One", buf, None, FileFormat::Wav);
        let cid = s.new_clip_id();
        let mut clip = Clip::audio(cid, "Clip", src, 0, 0, length);
@@ -70,7 +70,7 @@ pub(crate) fn attach(e: &mut Engine, t: TrackId, name: &str, bytes: &[u8], path:
    }
    let info = soundcraft_dsp::plugin_info(SAMPLER).ok_or_else(|| bad(id, "the sampler is not available"))?;
    let ext = Path::new(name).extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase);
-    let (format, buf) = soundcraft_audio_io::decode(bytes, ext.as_deref()).map_err(|err| EngineError::Io(format!("{name}: {err}")))?;
+    let (file, buf) = craft_audio::decode(bytes, ext.as_deref()).map_err(|err| EngineError::Io(format!("{name}: {err}")))?;
    if buf.frames() == 0 || buf.num_channels() == 0 {
        return Err(EngineError::Io(format!("{name}: no audio")));
    }
@@ -78,7 +78,7 @@ pub(crate) fn attach(e: &mut Engine, t: TrackId, name: &str, bytes: &[u8], path:
        .map_err(|r| EngineError::Io(format!("{name}: {}", r.message("too long for a sample (ten minutes of 192 kHz stereo at most)"))))?;
    let channels = buf.num_channels();
    let s = e.session_mut();
-    let src = crate::io::add_source(s, name, buf, path, format.format);
+    let src = crate::io::add_source(s, name, buf, path, soundcraft_model::FileFormat::of(&file));
    let (frames, rate, stem) = s.source(src).map_or((0, 0, String::new()), |x| (x.frames, x.sample_rate, x.name.clone()));
    let tr = s.track_mut(t).ok_or_else(|| bad(id, "no track"))?;
    let keep = tr.instrument.as_ref().is_some_and(|i| i.plugin == SAMPLER);
@@ -110,8 +110,8 @@ fn clear(e: &mut Engine, p: &Value) -> Result<Value> {
 #[cfg(test)]
 mod tests {
    use crate::Engine;
+    use craft_audio::{AudioBuffer, BitDepth, EncodeFormat, EncodeOptions};
    use serde_json::json;
-    use soundcraft_audio_io::{AudioBuffer, BitDepth, EncodeOptions, FileFormat};
    use soundcraft_midi::{Note, Sequence};
    use soundcraft_model::{Clip, TrackId};
    use soundcraft_time::{Range, TICKS_PER_QUARTER};
@@ -130,8 +130,8 @@ mod tests {
        let n = (rate as f32 * secs) as usize;
        let one: Vec<f32> = (0..n).map(|i| 0.5 * (std::f32::consts::TAU * freq * i as f32 / rate as f32).sin()).collect();
        let buf = AudioBuffer { sample_rate: rate, channels: vec![one; channels] };
-        let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Int16, dither: false, bwf: None };
-        std::fs::write(path, soundcraft_audio_io::encode(&buf, &opts).unwrap()).unwrap();
+        let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(BitDepth::Int16);
+        std::fs::write(path, craft_audio::encode(&buf, &opts).unwrap()).unwrap();
    }

    fn instrument_track(e: &mut Engine) -> TrackId {
@@ -232,11 +232,11 @@ mod tests {
        let buf = AudioBuffer { sample_rate: 96_000, channels: vec![tone.clone(), tone] };
        let mut e = Engine::default();
        let t = instrument_track(&mut e);
-        for format in [FileFormat::Flac, FileFormat::Aiff] {
-            let ext = format.default_extension();
+        for format in [EncodeFormat::Flac, EncodeFormat::Aiff] {
+            let ext = format.extension();
            let path = d.join(format!("tone.{ext}"));
-            let opts = EncodeOptions { format, bit_depth: BitDepth::Int24, dither: false, bwf: None };
-            std::fs::write(&path, soundcraft_audio_io::encode(&buf, &opts).unwrap()).unwrap();
+            let opts = EncodeOptions::new(format);
+            std::fs::write(&path, craft_audio::encode(&buf, &opts).unwrap()).unwrap();
            let r = e.execute("mix.sampler_load", &json!({"track": t.0, "path": path.to_string_lossy()})).unwrap();
            assert_eq!(r["channels"], 2, "{ext}");
            assert_eq!(r["frames"], 2400, "{ext}: 96 kHz resampled to the 48 kHz session");
@@ -320,8 +320,8 @@ mod tests {
        let junk = d.join("junk.wav");
        std::fs::write(&junk, b"definitely not audio").unwrap();
        let empty = d.join("empty.wav");
-        let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Int16, dither: false, bwf: None };
-        std::fs::write(&empty, soundcraft_audio_io::encode(&AudioBuffer { sample_rate: 48_000, channels: vec![vec![]] }, &opts).unwrap()).unwrap();
+        let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(BitDepth::Int16);
+        std::fs::write(&empty, craft_audio::encode(&AudioBuffer { sample_rate: 48_000, channels: vec![vec![]] }, &opts).unwrap()).unwrap();
        let wav = d.join("ok.wav");
        tone_wav(&wav, 440.0, 48_000, 0.1, 1);
        let mut e = Engine::default();
@@ -761,8 +761,8 @@ mod tests {
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();
        let wav = dir.join("hit.wav");
-        let buf = soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5; 4_800]] };
-        std::fs::write(&wav, soundcraft_audio_io::encode(&buf, &soundcraft_audio_io::EncodeOptions::default()).unwrap()).unwrap();
+        let buf = craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5; 4_800]] };
+        std::fs::write(&wav, craft_audio::encode(&buf, &craft_audio::EncodeOptions::default()).unwrap()).unwrap();
        let mut donor = Engine::default();
        donor.execute("track.new", &json!({"count": 1, "name": "Pads", "kind": "instrument"})).unwrap();
        donor.execute("mix.sampler_load", &json!({"track": "Pads", "path": wav.to_string_lossy()})).unwrap();
@@ -145,7 +145,7 @@ fn main_format(e: &mut Engine, p: &Value) -> Result<Value> {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use soundcraft_audio_io::AudioBuffer;
+    use craft_audio::AudioBuffer;
    use soundcraft_model::{Clip, SourceAudio, SourceId};
    use std::sync::Arc;

@@ -211,13 +211,13 @@ mod tests {
        let ps = path.to_string_lossy().to_string();
        e.execute("file.bounce_mix", &json!({"path": ps, "start": 0, "end": 4800, "bit_depth": "32f"})).unwrap();
        let bytes = std::fs::read(&path).unwrap();
-        assert_eq!(soundcraft_audio_io::wav_channel_mask(&bytes), Some(0x63F));
-        let (_, buf) = soundcraft_audio_io::decode(&bytes, Some("wav")).unwrap();
+        assert_eq!(craft_audio::probe(&bytes, None).unwrap().layout.mask(), Some(0x63F));
+        let (_, buf) = craft_audio::decode(&bytes, Some("wav")).unwrap();
        assert_eq!(buf.channels.len(), 8);
        assert!((buf.channels[2][1000] - 0.25).abs() < 1e-5, "front centre lands on C");
        // ITU stereo fold-down.
        e.execute("file.bounce_mix", &json!({"path": ps, "start": 0, "end": 4800, "bit_depth": "32f", "fold_down": "stereo"})).unwrap();
-        let (_, buf) = soundcraft_audio_io::decode(&std::fs::read(&path).unwrap(), Some("wav")).unwrap();
+        let (_, buf) = craft_audio::decode(&std::fs::read(&path).unwrap(), Some("wav")).unwrap();
        assert_eq!(buf.channels.len(), 2);
        assert!((buf.channels[0][1000] - 0.25 * std::f32::consts::FRAC_1_SQRT_2).abs() < 1e-4);
        assert!(e.execute("file.bounce_mix", &json!({"path": ps, "fold_down": "quad"})).is_err());
@@ -225,7 +225,7 @@ mod tests {
        let sdir = dir.join("stems");
        let r = e.execute("file.bounce_stems", &json!({"dir": sdir.to_string_lossy(), "start": 0, "end": 4800})).unwrap();
        let f = r["files"][0].as_str().unwrap().to_string();
-        let (_, buf) = soundcraft_audio_io::decode(&std::fs::read(&f).unwrap(), Some("wav")).unwrap();
+        let (_, buf) = craft_audio::decode(&std::fs::read(&f).unwrap(), Some("wav")).unwrap();
        assert_eq!(buf.channels.len(), 8);
        let _ = std::fs::remove_dir_all(&dir);
    }
@@ -175,9 +175,10 @@ fn analysed(s: &Session, t: TrackId, around: Range) -> Vec<Samples> {
 #[cfg(test)]
 mod tests {
    use crate::Engine;
+    use craft_audio::AudioBuffer;
    use serde_json::json;
-    use soundcraft_audio_io::{AudioBuffer, FileFormat};
    use soundcraft_midi::{Note, Sequence};
+    use soundcraft_model::FileFormat;
    use soundcraft_model::{ChannelFormat, Clip, Session, TrackId, TrackKind};
    use soundcraft_time::{SampleRate, TICKS_PER_QUARTER};

@@ -483,11 +483,11 @@ fn split_mono(e: &mut Engine, p: &Value) -> Result<Value> {
                                .ok_or_else(|| bad("track.split_into_mono", "split would copy too much audio"))?;
                            // Keep the full channel: the cloned clips retain their offsets, stretch,
                            // gain and fades, and every reader sees genuine mono media (including saves).
-                            let buf = soundcraft_audio_io::AudioBuffer { sample_rate: s.sample_rate.hz(), channels: vec![samples.clone()] };
+                            let buf = craft_audio::AudioBuffer { sample_rate: s.sample_rate.hz(), channels: vec![samples.clone()] };
                            let original = s.source(*source);
                            let name = format!("{}.{suffix}.wav", original.map_or(c.name.as_str(), |source| source.name.as_str()));
                            let time_reference = original.map_or(0, |source| source.time_reference);
-                            let id = crate::io::add_source(s, &name, buf, None, soundcraft_audio_io::FileFormat::Wav);
+                            let id = crate::io::add_source(s, &name, buf, None, soundcraft_model::FileFormat::Wav);
                            if let Some(source) = s.sources.iter_mut().find(|source| source.id == id) {
                                source.time_reference = time_reference;
                            }
@@ -135,7 +135,7 @@ mod tests {
        std::fs::create_dir_all(&dir).unwrap();
        let out = dir.join("mix.wav");
        e.execute("file.bounce_mix", &json!({"path": out.to_string_lossy(), "start": 0, "end": 96_000, "dither": false})).unwrap();
-        let (_, buf) = soundcraft_audio_io::decode(&std::fs::read(&out).unwrap(), Some("wav")).unwrap();
+        let (_, buf) = craft_audio::decode(&std::fs::read(&out).unwrap(), Some("wav")).unwrap();
        assert!(buf.channels.iter().flatten().all(|x| *x == 0.0));
        let _ = std::fs::remove_dir_all(dir);
    }
@@ -2,8 +2,9 @@
 //! a 24-bar groove at 104 BPM with drums, bass, keys, pad, lead, a reverb aux and a master.

 use crate::Engine;
-use soundcraft_audio_io::{AudioBuffer, FileFormat};
+use craft_audio::AudioBuffer;
 use soundcraft_midi::{Note, Sequence};
+use soundcraft_model::FileFormat;
 use soundcraft_model::{ChannelFormat, Clip, Fade, FadeShape, Insert, MarkerKind, Route, SendSlot, Session, TrackKind};
 use soundcraft_time::{SampleRate, TICKS_PER_QUARTER};

@@ -313,8 +313,7 @@ mod tests {
        let track = saved.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
        let clip = Clip::audio(saved.new_clip_id(), "Clip", SourceId(900), 0, 0, 100);
        saved.track_mut(track).unwrap().playlist_mut().unwrap().clips.push(clip);
-        let audio =
-            Arc::new(soundcraft_model::SourceAudio::new(soundcraft_audio_io::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5; 100]] }));
+        let audio = Arc::new(soundcraft_model::SourceAudio::new(craft_audio::AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5; 100]] }));
        saved.pool.insert(SourceId(900), audio);
        check(&saved, &saved.clone(), true, "shared decoded audio");
        let mut doc = saved.clone();
@@ -78,9 +78,9 @@ fn rebase_midi_start(clip: &mut Clip, old_start: Samples, t: TimeCtx<'_>) {
    }
 }

-/// Split every clip on a track's active playlist that spans `at`. The piece before `at` keeps the
-/// clip's name. The piece after it is a new clip, and takes the next name of the clip's Auto Rename
-/// scheme when it has one.
+/// Split every clip on a track's active playlist that spans `at`, except time- or edit-locked ones.
+/// The piece before `at` keeps the clip's name. The piece after it is a new clip, and takes the next
+/// name of the clip's Auto Rename scheme when it has one.
 pub fn separate_at(s: &mut Session, track: TrackId, at: Samples) -> usize {
    separate_at_if(s, track, at, |_| true)
 }
@@ -88,11 +88,21 @@ pub fn separate_at(s: &mut Session, track: TrackId, at: Samples) -> usize {
 /// [`separate_at`], giving the piece after `at` the next Auto Rename name only when `auto_name`
 /// returns true for it. Any other piece keeps the clip's name, and its scheme does not count up.
 pub fn separate_at_if(s: &mut Session, track: TrackId, at: Samples, auto_name: impl Fn(&Clip) -> bool) -> usize {
+    split_at(s, track, at, auto_name, true)
+}
+
+/// [`separate_at`], splitting time- and edit-locked clips too. For the Event time operations, which
+/// move the whole timeline, locked clips included.
+pub fn separate_all_at(s: &mut Session, track: TrackId, at: Samples) -> usize {
+    split_at(s, track, at, |_| true, false)
+}
+
+fn split_at(s: &mut Session, track: TrackId, at: Samples, auto_name: impl Fn(&Clip) -> bool, skip_locked: bool) -> usize {
    let tc_tempo = s.tempo.clone();
    let sr = s.sample_rate;
    let t = TimeCtx { tempo: &tc_tempo, sr };
    let mut ids = Vec::new();
-    let n_split = s.track(track).map_or(0, |tr| tr.clips().iter().filter(|c| at > c.start && at < c.end()).count());
+    let n_split = s.track(track).map_or(0, |tr| tr.clips().iter().filter(|c| at > c.start && at < c.end() && !(skip_locked && locked(c))).count());
    for _ in 0..n_split {
        ids.push(s.new_clip_id());
    }
@@ -106,6 +116,7 @@ pub fn separate_at_if(s: &mut Session, track: TrackId, at: Samples, auto_name: i
    for c in pl.clips.drain(..) {
        if at > c.start
            && at < c.end()
+            && !(skip_locked && locked(&c))
            && let Some(id) = ids.pop()
            && let Some((l, mut r)) = split_clip(&c, at, id, t)
        {
@@ -125,6 +136,45 @@ pub fn separate_at_if(s: &mut Session, track: TrackId, at: Samples, auto_name: i
    count
 }

+/// Split every clip on a track's active playlist at each of `points`, in one pass over the
+/// playlist: [`separate_at_if`] once per point with `|_| false` (no piece takes an Auto Rename
+/// name here), without rebuilding the playlist per point. Returns the number of splits.
+/// `points` are sorted and deduplicated first, so the source offsets of stretched audio can differ
+/// from per-point calls given in another order (each trim rounds its own adjustment).
+pub fn separate_at_points(s: &mut Session, track: TrackId, points: &[Samples]) -> usize {
+    let mut pts = points.to_vec();
+    pts.sort_unstable();
+    pts.dedup();
+    let tc_tempo = s.tempo.clone();
+    let t = TimeCtx { tempo: &tc_tempo, sr: s.sample_rate };
+    // The points strictly inside a clip.
+    let within = |c: &Clip| {
+        let (lo, hi) = (pts.partition_point(|p| *p <= c.start), pts.partition_point(|p| *p < c.end()));
+        lo..hi.max(lo)
+    };
+    let n_split: usize = s.track(track).map_or(0, |tr| tr.clips().iter().map(|c| within(c).len()).sum());
+    let mut ids: Vec<ClipId> = (0..n_split).map(|_| s.new_clip_id()).collect();
+    let Some(pl) = s.track_mut(track).and_then(|t| t.playlist_mut()) else { return 0 };
+    let mut out = Vec::with_capacity(pl.clips.len() + n_split);
+    for c in pl.clips.drain(..) {
+        let mut rest = c;
+        for p in &pts[within(&rest)] {
+            let Some(id) = ids.pop() else { break };
+            match split_clip(&rest, *p, id, t) {
+                Some((l, r)) => {
+                    out.push(l);
+                    rest = r;
+                }
+                None => break,
+            }
+        }
+        out.push(rest);
+    }
+    pl.clips = out;
+    pl.sort();
+    n_split
+}
+
 /// Gives `c` the next name of its Auto Rename scheme, when it has one, and counts the scheme up.
 fn take_auto_name(schemes: &mut std::collections::BTreeMap<u64, soundcraft_model::AutoName>, c: &mut Clip) {
    if let Some(scheme) = c.auto_name.and_then(|k| schemes.get_mut(&k)) {
@@ -11,7 +11,7 @@ fn session_with_clip() -> (Session, TrackId) {
        channels: 1,
        frames: 10_000,
        sample_rate: 48_000,
-        format: soundcraft_audio_io::FileFormat::Wav,
+        format: soundcraft_model::FileFormat::Wav,
        time_reference: 0,
        unsaved: false,
    });
@@ -1,8 +1,9 @@
 //! Import, export, save/load, rendering helpers (bounce, consolidate, commit) and analysis.

 use crate::{Engine, EngineError, Result};
+use craft_audio::{AudioBuffer, EncodeOptions};
 use serde_json::{Value, json};
-use soundcraft_audio_io::{AudioBuffer, EncodeOptions, FileFormat};
+use soundcraft_model::FileFormat;
 use soundcraft_model::{BusId, ChannelFormat, Clip, ClipContent, Session, Source, SourceAudio, SourceId, TrackId, TrackKind};
 use soundcraft_time::{Range, Samples};
 use std::ffi::OsStr;
@@ -65,6 +66,69 @@ fn read_file_within(path: &Path, session: bool) -> Result<Vec<u8>> {
    Ok(data)
 }

+/// `O_NONBLOCK` of the platforms that have a FIFO to wait on (std has no name for it, and this crate has no unsafe
+/// code or libc); 0 elsewhere, where a FIFO open still waits for a writer.
+#[cfg(unix)]
+const O_NONBLOCK: i32 = if cfg!(all(
+    any(target_os = "linux", target_os = "android"),
+    not(any(
+        target_arch = "mips",
+        target_arch = "mips32r6",
+        target_arch = "mips64",
+        target_arch = "mips64r6",
+        target_arch = "sparc",
+        target_arch = "sparc64"
+    ))
+)) {
+    0x800
+} else if cfg!(any(
+    target_os = "macos",
+    target_os = "ios",
+    target_os = "freebsd",
+    target_os = "netbsd",
+    target_os = "openbsd",
+    target_os = "dragonfly"
+)) {
+    0x4
+} else {
+    0
+};
+
+/// [`read_file`] for a file that must lie inside `root` (a canonical folder): the file is opened
+/// once, and the bytes come from that handle only after the handle is shown to be the file the
+/// path resolves to inside `root`. A file swapped in for the path after a check by name is
+/// refused instead of read. Where the handle's identity can't be read (non-Unix targets) the
+/// resolved path is checked against `root` alone.
+pub(crate) fn read_file_inside(path: &Path, root: &Path) -> Result<Vec<u8>> {
+    use std::io::Read;
+    crate::file_access::check_read(path).map_err(EngineError::Io)?;
+    let err = |err: std::io::Error| EngineError::Io(format!("{}: {err}", path.display()));
+    // opened without waiting for a FIFO's writer (the type is checked on the opened handle, below)
+    let mut options = std::fs::OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    std::os::unix::fs::OpenOptionsExt::custom_flags(&mut options, O_NONBLOCK);
+    let mut file = options.open(path).map_err(err)?;
+    if !file.metadata().map_err(err)?.is_file() {
+        return Err(EngineError::Io(format!("{}: not a regular file", path.display())));
+    }
+    let key = canonical_path(path)?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        let (a, b) = (file.metadata().map_err(err)?, std::fs::metadata(&key).map_err(err)?);
+        if (a.dev(), a.ino()) != (b.dev(), b.ino()) {
+            return Err(EngineError::Io(format!("{}: changed while it was opened", path.display())));
+        }
+    }
+    if !key.starts_with(root) {
+        return Err(EngineError::Io(format!("{}: outside the folder it must stay in", path.display())));
+    }
+    let mut bytes = Vec::new();
+    file.read_to_end(&mut bytes).map_err(err)?;
+    Ok(bytes)
+}
+
 /// [`read_file`] as UTF-8 text.
 pub fn read_text(path: impl AsRef<Path>) -> Result<String> {
    let path = path.as_ref();
@@ -192,6 +256,17 @@ pub(crate) fn make_dir(dir: impl AsRef<Path>) -> Result<()> {
    std::fs::create_dir_all(dir).map_err(|err| EngineError::Io(format!("{}: {err}", dir.display())))
 }

+/// `path` with its links followed, inside the automation read root when there is one. The root is
+/// checked on the path as named (links followed, a missing tail resolved by its nearest folder)
+/// before anything is resolved, so a name that leads out of the root is refused the same way
+/// whether or not it exists there.
+pub(crate) fn canonical_path(path: impl AsRef<Path>) -> Result<PathBuf> {
+    let path = path.as_ref();
+    let checked = if path.as_os_str().is_empty() { Path::new(".") } else { path };
+    crate::file_access::check_read(checked).map_err(EngineError::Io)?;
+    std::fs::canonicalize(path).map_err(|err| EngineError::Io(format!("{}: {err}", path.display())))
+}
+
 /// Write `bytes` to the file at `path`, inside the automation write root when there is one.
 pub(crate) fn write_path(path: impl AsRef<Path>, bytes: impl AsRef<[u8]>) -> Result<()> {
    let path = path.as_ref();
@@ -282,14 +357,14 @@ pub struct Bounce {
    gain: f32,
    peak: f32,
    meter: soundcraft_dsp::meter::LoudnessMeter,
-    enc: Option<soundcraft_audio_io::FileEncoder<Out>>,
+    enc: Option<craft_audio::FileEncoder<Out>>,
 }

 /// The Broadcast Wave stamp of timeline position `at`: the session's timecode start plus `at`, in
 /// samples since midnight (`bext` TimeReference; 0 before midnight).
-fn time_stamp(s: &Session, at: Samples) -> soundcraft_audio_io::BwfInfo {
+fn time_stamp(s: &Session, at: Samples) -> craft_audio::BwfInfo {
    let time_reference = u64::try_from(s.timecode_start.saturating_add(at)).unwrap_or(0);
-    soundcraft_audio_io::BwfInfo { time_reference, ..Default::default() }
+    craft_audio::BwfInfo::default().with_time_reference(time_reference)
 }

 /// A finished bounce: the size of its file and its levels.
@@ -324,9 +399,13 @@ impl Bounce {
        crate::file_access::check_write(&part).map_err(EngineError::Io)?;
        // A WAV bounce says where it starts on the session's timecode, as other DAWs' bounces do,
        // so post and broadcast tools can place it (only WAV has a `bext` chunk to say it in).
-        let opts = &EncodeOptions { bwf: opts.bwf.clone().or_else(|| Some(time_stamp(&s, r.start))), ..opts.clone() };
-        let enc = (|| -> std::result::Result<_, soundcraft_audio_io::AudioError> {
-            let enc = soundcraft_audio_io::FileEncoder::new(Out::create(&part)?, opts, channels, s.sample_rate.hz(), Some(fmt.channel_mask()))?;
+        let mut opts = opts.clone();
+        opts.bwf.get_or_insert_with(|| time_stamp(&s, r.start));
+        // The speakers of the format's channels (none for Ambisonics), for the WAV speaker mask.
+        let wide = u16::try_from(channels).unwrap_or(u16::MAX);
+        let opts = &opts.with_layout(craft_audio::ChannelLayout::from_mask_and_channels(fmt.channel_mask(), wide));
+        let enc = (|| -> std::result::Result<_, craft_audio::AudioError> {
+            let enc = craft_audio::FileEncoder::new(Out::create(&part)?, opts, s.sample_rate.hz(), wide)?;
            enc.check_room(u64::try_from(r.len()).unwrap_or(0))?;
            Ok(enc)
        })()
@@ -446,7 +525,7 @@ impl Out {
        if cfg!(target_arch = "wasm32") {
            return Ok(Out::Memory(std::io::Cursor::new(Vec::new())));
        }
-        Ok(Out::File(std::io::BufWriter::with_capacity(1 << 20, std::fs::File::create(part)?)))
+        Ok(Out::File(std::io::BufWriter::with_capacity(1 << 20, create_new(part)?)))
    }

    /// Puts the finished file at `path` and returns its size: the part file is synced and renamed
@@ -541,7 +620,7 @@ pub fn bounce_stems_with(e: &Engine, dir: &str, r: Range, opts: &EncodeOptions,
        return Err(EngineError::BadParams("file.bounce_stems".into(), "bounces are limited to 4 hours".into()));
    }
    make_dir(dir)?;
-    let ext = opts.format.default_extension();
+    let ext = opts.format.extension();
    let mut out = Vec::new();
    let stems: Vec<(TrackId, String)> = s
        .tracks
@@ -577,9 +656,29 @@ pub fn export_clips(e: &Engine, ids: &[soundcraft_model::ClipId], dir: &str) ->
        let Some((t, c)) = s.find_clip(*id) else { continue };
        let audio = soundcraft_mix::render_clips(s, t, c.range());
        let buf = AudioBuffer { sample_rate: s.sample_rate.hz(), channels: audio };
-        let bytes = soundcraft_audio_io::encode(&buf, &EncodeOptions::default()).map_err(|err| EngineError::Io(err.to_string()))?;
-        let path = clip_file(dir, &sanitize_name(&c.name), &mut names, Path::exists)?;
-        write_file(&path.to_string_lossy(), &bytes)?;
+        let bytes = craft_audio::encode(&buf, &EncodeOptions::default()).map_err(|err| EngineError::Io(err.to_string()))?;
+        let stem = sanitize_name(&c.name);
+        if cfg!(target_arch = "wasm32") {
+            let path = clip_file(dir, &stem, &mut names, Path::exists)?;
+            write_file(&path.to_string_lossy(), &bytes)?;
+            continue;
+        }
+        // The name is taken by creating the file, so whatever entry already has it (a link
+        // to elsewhere included) is left alone rather than written through. An occupied name is
+        // taken whatever it is (a link whose target is outside the write root too): it is only
+        // looked at, never resolved, so the root check does not stop the search for a free name.
+        // The folder itself was checked above.
+        let (mut file, path) = loop {
+            let path = clip_file(dir, &stem, &mut names, |p| std::fs::symlink_metadata(p).is_ok())?;
+            crate::file_access::check_write(&path).map_err(EngineError::Io)?;
+            match std::fs::OpenOptions::new().write(true).create_new(true).open(&path) {
+                Ok(f) => break (f, path),
+                // taken since it was looked at: `names` has it now, so the next name is tried
+                Err(err) if err.kind() == std::io::ErrorKind::AlreadyExists => {}
+                Err(err) => return Err(EngineError::Io(format!("{}: {err}", path.display()))),
+            }
+        };
+        std::io::Write::write_all(&mut file, &bytes).map_err(|err| EngineError::Io(format!("{}: {err}", path.display())))?;
    }
    Ok(names.taken.len())
 }
@@ -644,13 +743,13 @@ fn write_session(session: &Session, path: &str, overwrite: bool) -> Result<(Sess
        {
            src.path = f.join(&src.path).to_string_lossy().into_owned();
        }
-        let exists_rel = same_dir && !Path::new(&src.path).is_absolute() && dir.join(&src.path).exists();
+        let exists_rel = same_dir && !Path::new(&src.path).is_absolute() && file_found(dir.join(&src.path));
        let shared = shared_paths.get(i).copied().unwrap_or(false);
        if exists_rel && !src.unsaved && !shared {
            continue;
        }
        let in_folder = Path::new(&src.path).strip_prefix(&audio_dir).ok().and_then(Path::to_str).map(str::to_string);
-        if let Some(f) = in_folder.filter(|_| !src.unsaved && Path::new(&src.path).is_file()) {
+        if let Some(f) = in_folder.filter(|_| !src.unsaved && file_found(&src.path)) {
            src.path = format!("Audio Files/{f}");
            continue;
        }
@@ -672,8 +771,11 @@ fn write_session(session: &Session, path: &str, overwrite: bool) -> Result<(Sess
        let mut stem = sanitize_name(&src.name);
        if overwrite {
            // One file per source id so autosaves never collide or pile up.
+            // (With only an automation write root, `file_found` cannot read an existing file, so each save
+            // writes a new numbered WAV: reuse never reads a file the roots do not allow, which keeps a save
+            // from revealing whether an unreadable file matches the audio.)
            stem = format!("{stem}_{}", src.id.0);
-            if audio_dir.join(format!("{stem}.wav")).exists() {
+            if file_found(audio_dir.join(format!("{stem}.wav"))) {
                src.path = format!("Audio Files/{stem}.wav");
                src.unsaved = false;
                files.insert(Arc::as_ptr(audio), src.path.clone());
@@ -703,8 +805,8 @@ fn write_session(session: &Session, path: &str, overwrite: bool) -> Result<(Sess
    let mut written = 0;
    for (stem, audio, sources) in &pending {
        make_dir(&audio_dir)?;
-        let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: soundcraft_audio_io::BitDepth::Float32, dither: false, bwf: None };
-        let bytes = soundcraft_audio_io::encode(&audio.buffer, &opts).map_err(|err| EngineError::Io(err.to_string()))?;
+        let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(craft_audio::BitDepth::Float32);
+        let bytes = craft_audio::encode(&audio.buffer, &opts).map_err(|err| EngineError::Io(err.to_string()))?;
        let (name, new) = store_wav(&audio_dir, stem, &bytes)?;
        for &i in sources {
            if let Some(src) = s.sources.get_mut(i) {
@@ -756,11 +858,22 @@ fn sync_dir(dir: &Path) {

 fn write_synced(path: &Path, bytes: &[u8]) -> std::io::Result<()> {
    use std::io::Write;
-    let mut f = std::fs::File::create(path)?;
+    let mut f = create_new(path)?;
    f.write_all(bytes)?;
    f.sync_all()
 }

+/// Creates `path` as a new file. A leftover of that name (a part file from an interrupted write)
+/// is removed first, but an existing entry is never opened: a link planted at a predictable name
+/// in the destination folder can't redirect the write elsewhere.
+fn create_new(path: &Path) -> std::io::Result<std::fs::File> {
+    match std::fs::remove_file(path) {
+        Err(err) if err.kind() != std::io::ErrorKind::NotFound => return Err(err),
+        _ => {}
+    }
+    std::fs::OpenOptions::new().write(true).create_new(true).open(path)
+}
+
 /// Copies `from` to `to`, which must not exist yet; an existing entry, even a link, is never followed.
 fn copy_new(from: &Path, to: &Path) -> std::io::Result<()> {
    let mut src = std::fs::File::open(from)?;
@@ -840,7 +953,8 @@ fn same_path(a: &Path, b: &Path) -> bool {

 /// Store `bytes` as the first of `<stem>.wav`, `<stem>_01.wav`, … in `dir` that is free or already
 /// holds exactly these bytes, so saving never replaces audio; returns the name and whether it was
-/// written.
+/// written. Where the automation roots allow writing in `dir` but not reading (only a write root),
+/// an existing file is never compared, so each save writes a new numbered WAV.
 fn store_wav(dir: &Path, stem: &str, bytes: &[u8]) -> Result<(String, bool)> {
    use std::io::Write;
    for k in 0..10_000u32 {
@@ -855,7 +969,12 @@ fn store_wav(dir: &Path, stem: &str, bytes: &[u8]) -> Result<(String, bool)> {
                return Ok((name, true));
            }
            Err(err) if err.kind() == std::io::ErrorKind::AlreadyExists => {
-                if std::fs::metadata(&path).is_ok_and(|m| m.len() == bytes.len() as u64) && std::fs::read(&path).is_ok_and(|b| b == bytes) {
+                // Reused only when it may be read: whether it equals the audio must not be
+                // learnt about a file the roots allow writing beside but not reading.
+                if crate::file_access::check_read(&path).is_ok()
+                    && std::fs::metadata(&path).is_ok_and(|m| m.len() == bytes.len() as u64)
+                    && std::fs::read(&path).is_ok_and(|b| b == bytes)
+                {
                    return Ok((name, false));
                }
            }
@@ -891,7 +1010,99 @@ pub fn write_file(path: &str, bytes: &[u8]) -> Result<()> {
        return deliver(name, bytes).map_err(EngineError::Io);
    }
    crate::file_access::check_write(path).map_err(EngineError::Io)?;
-    std::fs::write(path, bytes).map_err(|err| EngineError::Io(format!("{path}: {err}")))
+    // Follow existing symlinks, and refuse dangling links even without automation roots.
+    let named = Path::new(path);
+    let path = match std::fs::symlink_metadata(named) {
+        Ok(m) if m.file_type().is_symlink() => std::fs::canonicalize(named).map_err(|err| EngineError::Io(format!("{path}: {err}")))?,
+        Ok(_) => named.to_path_buf(),
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => named.to_path_buf(),
+        Err(err) => return Err(EngineError::Io(format!("{path}: {err}"))),
+    };
+    crate::file_access::check_write(&path).map_err(EngineError::Io)?;
+    let metadata = match std::fs::metadata(&path) {
+        Ok(m) if m.is_file() => Some(m),
+        Ok(_) => return Err(EngineError::Io(format!("{}: not a regular file", path.display()))),
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => None,
+        Err(err) => return Err(EngineError::Io(format!("{}: {err}", path.display()))),
+    };
+    let err = |err: std::io::Error| EngineError::Io(format!("{}: {err}", path.display()));
+    if metadata.as_ref().is_some_and(|m| m.permissions().readonly()) {
+        return Err(err(std::io::ErrorKind::PermissionDenied.into()));
+    }
+    write_export_checked(&path, bytes).map_err(err)
+}
+
+/// Keep the original file and its security metadata. Refuse hard links before truncation: a
+/// link inside an automation root can name a file outside it (#1359).
+#[cfg(unix)]
+fn write_export_checked(path: &Path, bytes: &[u8]) -> std::io::Result<()> {
+    use std::io::Write as _;
+    use std::os::unix::fs::{MetadataExt as _, OpenOptionsExt as _};
+    let mut file = std::fs::OpenOptions::new().write(true).create(true).truncate(false).mode(0o600).open(path)?;
+    let opened = file.metadata()?;
+    if !opened.is_file() {
+        return Err(std::io::Error::other("not a regular file"));
+    }
+    if opened.nlink() > 1 {
+        return Err(hard_link_export_error());
+    }
+    file.set_len(0)?;
+    file.write_all(bytes)?;
+    file.sync_all()
+}
+
+#[cfg(any(unix, windows))]
+fn hard_link_export_error() -> std::io::Error {
+    std::io::Error::other("refusing to overwrite a hard-linked file; choose a new export path")
+}
+
+#[cfg(not(any(unix, windows)))]
+fn write_export_checked(_path: &Path, _bytes: &[u8]) -> std::io::Result<()> {
+    Err(std::io::ErrorKind::Unsupported.into())
+}
+
+/// Windows' stable std metadata API does not expose the link count. Use a safe kernel wrapper
+/// and the same handle for the check and write; no replacement means the destination DACL stays.
+#[cfg(windows)]
+fn write_export_checked(path: &Path, mut bytes: &[u8]) -> std::io::Result<()> {
+    use winsafe::{HFILE, co};
+    // Let std retain its Windows filename normalization and create missing destinations without
+    // truncation. Canonicalization then supplies a verbatim path, including long and UNC paths,
+    // to the raw Win32 wrapper. The handle below is checked before any existing bytes change.
+    let _opened = std::fs::OpenOptions::new().write(true).create(true).truncate(false).open(path)?;
+    let absolute = std::fs::canonicalize(path)?;
+    let path = absolute.to_str().filter(|p| !p.contains('\0')).ok_or(std::io::ErrorKind::InvalidInput)?;
+    let io_error = |err: winsafe::co::ERROR| std::io::Error::other(err.to_string());
+    let (file, _) = HFILE::CreateFile(
+        path,
+        co::GENERIC::WRITE,
+        Some(co::FILE_SHARE::READ | co::FILE_SHARE::WRITE | co::FILE_SHARE::DELETE),
+        None,
+        co::DISPOSITION::OPEN_EXISTING,
+        co::FILE_ATTRIBUTE::NORMAL,
+        Some(co::FILE_FLAG::WRITE_THROUGH),
+        None,
+        None,
+    )
+    .map_err(io_error)?;
+    if file.GetFileType().map_err(io_error)? != co::FILE_TYPE::DISK {
+        return Err(std::io::Error::other("not a regular file"));
+    }
+    match file.GetFileInformationByHandle().map_err(io_error)?.nNumberOfLinks {
+        1 => {}
+        0 => return Err(std::io::ErrorKind::Unsupported.into()),
+        _ => return Err(hard_link_export_error()),
+    }
+    file.SetEndOfFile().map_err(io_error)?;
+    while !bytes.is_empty() {
+        // Win32 takes a DWORD length. Small bounded writes also handle short writes correctly.
+        let count = file.WriteFile(&bytes[..bytes.len().min(64 * 1024)]).map_err(io_error)? as usize;
+        if count == 0 {
+            return Err(std::io::ErrorKind::WriteZero.into());
+        }
+        bytes = &bytes[count..];
+    }
+    Ok(())
 }

 /// Unpack a bundle: the one `.scraft` at its top level and the files beside it, by relative path.
@@ -962,6 +1173,89 @@ pub fn plan_takes(e: &Engine, unsaved_dir: &Path, input_channels: usize) -> Vec<
        .collect()
 }

+#[cfg(test)]
+mod exclusive_tests {
+    use super::*;
+
+    fn scratch(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("soundcraft-io-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_planted_link_at_the_part_name_is_not_written_through() {
+        let dir = scratch("part-link");
+        let (target, part) = (dir.join("elsewhere"), dir.join("session.scraft.tmp"));
+        std::os::unix::fs::symlink(&target, &part).unwrap();
+        write_synced(&part, b"new").unwrap();
+        assert!(!target.exists(), "the link's target was created");
+        assert_eq!(std::fs::read(&part).unwrap(), b"new", "the link itself was replaced by the file");
+        // A leftover regular part file is still replaced.
+        write_synced(&part, b"newer").unwrap();
+        assert_eq!(std::fs::read(&part).unwrap(), b"newer");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_file_read_within_a_root_must_resolve_inside_it() {
+        let dir = scratch("within");
+        let (inside, outside) = (dir.join("group"), dir.join("elsewhere"));
+        std::fs::create_dir_all(&inside).unwrap();
+        std::fs::create_dir_all(&outside).unwrap();
+        std::fs::write(inside.join("a.wav"), b"a").unwrap();
+        std::fs::write(outside.join("b.wav"), b"b").unwrap();
+        std::os::unix::fs::symlink(outside.join("b.wav"), inside.join("link.wav")).unwrap();
+        let root = canonical_path(&inside).unwrap();
+        assert_eq!(read_file_inside(&inside.join("a.wav"), &root).unwrap(), b"a");
+        assert!(read_file_inside(&inside.join("link.wav"), &root).is_err());
+        // a FIFO with no writer is refused, not waited on (Linux: the coreutils tool makes it)
+        #[cfg(target_os = "linux")]
+        if std::process::Command::new("mkfifo").arg(inside.join("pipe.wav")).status().is_ok_and(|s| s.success()) {
+            let err = read_file_inside(&inside.join("pipe.wav"), &root).unwrap_err().to_string();
+            assert!(err.contains("not a regular file"), "{err}");
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn export_skips_a_name_held_by_a_dangling_link() {
+        let dir = scratch("export-link");
+        let e = crate::demo::demo_engine();
+        let (t, c) = e.session().tracks.iter().find_map(|t| t.clips().iter().find(|c| c.is_audio()).map(|c| (t.id, c.clone()))).unwrap();
+        let _ = t;
+        let target = dir.join("elsewhere.wav");
+        std::os::unix::fs::symlink(&target, dir.join(format!("{}.wav", sanitize_name(&c.name)))).unwrap();
+        assert_eq!(export_clips(&e, &[c.id], &dir.to_string_lossy()).unwrap(), 1);
+        assert!(!target.exists(), "the export followed the link");
+        assert!(dir.join(format!("{}-2.wav", sanitize_name(&c.name))).is_file(), "the next free name was used");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// With a write root, a link out of it that holds the name is still just an occupied name.
+    #[cfg(unix)]
+    #[test]
+    fn export_skips_a_link_out_of_the_write_root_too() {
+        let dir = scratch("export-root-link");
+        let e = crate::demo::demo_engine();
+        let c = e.session().tracks.iter().find_map(|t| t.clips().iter().find(|c| c.is_audio()).cloned()).unwrap();
+        let elsewhere = scratch("export-root-elsewhere");
+        let target = elsewhere.join("target.wav");
+        std::os::unix::fs::symlink(&target, dir.join(format!("{}.wav", sanitize_name(&c.name)))).unwrap();
+        let roots = crate::file_access::AutomationRoots::new(&[], &[&dir]).unwrap().unwrap();
+        let n = crate::file_access::confine(Some(&roots), || export_clips(&e, &[c.id], &dir.to_string_lossy())).unwrap();
+        assert_eq!(n, 1);
+        assert!(!target.exists(), "the export followed the link out of the root");
+        assert!(dir.join(format!("{}-2.wav", sanitize_name(&c.name))).is_file(), "the next free name was used");
+        let _ = std::fs::remove_dir_all(&dir);
+        let _ = std::fs::remove_dir_all(&elsewhere);
+    }
+}
+
 #[cfg(test)]
 mod stem_tests {
    #[test]
@@ -983,8 +1277,8 @@ mod stem_tests {
        names.sort();
        assert!(!names.is_empty());
        for name in names {
-            let (_, float) = soundcraft_audio_io::decode(&std::fs::read(dir32.join(&name)).unwrap(), None).unwrap();
-            let (_, int) = soundcraft_audio_io::decode(&std::fs::read(dir16.join(&name)).unwrap(), None).unwrap();
+            let (_, float) = craft_audio::decode(&std::fs::read(dir32.join(&name)).unwrap(), None).unwrap();
+            let (_, int) = craft_audio::decode(&std::fs::read(dir16.join(&name)).unwrap(), None).unwrap();
            for (f, i) in float.channels.iter().zip(&int.channels) {
                for (a, b) in f.iter().zip(i) {
                    worst = worst.max((f64::from(a.clamp(-1.0, 1.0)) - f64::from(*b)).abs() * 32768.0);
@@ -1019,6 +1313,164 @@ mod stem_tests {
        let _ = std::fs::remove_dir_all(&root);
    }
 }
+#[cfg(test)]
+mod export_replacement_tests {
+    use super::*;
+    #[cfg(unix)]
+    use std::os::unix::fs::{PermissionsExt, symlink};
+    fn scratch(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("soundcraft-export-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+    #[test]
+    fn export_refuses_hard_links_before_truncating_and_refuses_nonfiles() {
+        let dir = scratch("hard-links");
+        let original = dir.join("original.mid");
+        let write_root = dir.join("write");
+        std::fs::create_dir(&write_root).unwrap();
+        let destination = write_root.join("export.mid");
+        std::fs::write(&original, b"old").unwrap();
+        std::fs::hard_link(&original, &destination).unwrap();
+        for confined in [false, true] {
+            let roots = if confined { crate::file_access::AutomationRoots::new(&[], &[&write_root]).unwrap() } else { None };
+            let result = crate::file_access::confine(roots.as_ref(), || write_file(destination.to_str().unwrap(), b"new"));
+            assert!(result.unwrap_err().to_string().contains("hard-linked"));
+        }
+        assert_eq!(std::fs::read(&original).unwrap(), b"old");
+        assert_eq!(std::fs::read(&destination).unwrap(), b"old");
+        let folder = dir.join("folder");
+        std::fs::create_dir(&folder).unwrap();
+        assert!(write_file(folder.to_str().unwrap(), b"new").is_err());
+        assert!(folder.is_dir());
+        assert!(!std::fs::read_dir(&dir).unwrap().any(|e| e.unwrap().file_name().to_string_lossy().starts_with(".soundcraft-")));
+        let _ = std::fs::remove_dir_all(dir);
+    }
+    #[cfg(windows)]
+    #[test]
+    fn export_supports_paths_longer_than_max_path() {
+        let root = scratch("long-path");
+        let mut dir = root.clone();
+        while dir.as_os_str().len() < 280 {
+            dir.push("long-folder-component");
+        }
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("export.mid");
+        write_file(path.to_str().unwrap(), b"new").unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), b"new");
+        write_file(path.to_str().unwrap(), b"replacement").unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), b"replacement");
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn export_writes_all_chunks_and_truncates_an_existing_file() {
+        let dir = scratch("chunks");
+        let path = dir.join("export.mid");
+        let bytes = vec![0x5a; 128 * 1024 + 17];
+        write_file(path.to_str().unwrap(), &bytes).unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), bytes);
+        write_file(path.to_str().unwrap(), b"").unwrap();
+        assert_eq!(std::fs::metadata(&path).unwrap().len(), 0);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+    #[test]
+    fn export_refuses_readonly_files_without_changing_their_bytes() {
+        let dir = scratch("readonly");
+        let path = dir.join("readonly.mid");
+        std::fs::write(&path, b"old contents").unwrap();
+        let original = std::fs::metadata(&path).unwrap().permissions();
+        let mut readonly = original.clone();
+        readonly.set_readonly(true);
+        std::fs::set_permissions(&path, readonly).unwrap();
+        let result = write_file(path.to_str().unwrap(), b"new");
+        let bytes = std::fs::read(&path).unwrap();
+        std::fs::set_permissions(&path, original).unwrap();
+        assert!(result.is_err());
+        assert_eq!(bytes, b"old contents");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+    #[cfg(any(unix, windows))]
+    #[test]
+    fn export_preserves_the_existing_file_identity_and_security_metadata() {
+        let dir = scratch("identity");
+        let path = dir.join("existing.mid");
+        std::fs::write(&path, b"long old contents").unwrap();
+        #[cfg(unix)]
+        let identity = |p: &Path| {
+            use std::os::unix::fs::MetadataExt as _;
+            let m = std::fs::metadata(p).unwrap();
+            (m.dev(), m.ino(), m.uid(), m.gid())
+        };
+        #[cfg(windows)]
+        let identity = |p: &Path| {
+            use winsafe::{HFILE, co};
+            let (file, _) = HFILE::CreateFile(
+                p.to_str().unwrap(),
+                co::GENERIC::READ,
+                None,
+                None,
+                co::DISPOSITION::OPEN_EXISTING,
+                co::FILE_ATTRIBUTE::NORMAL,
+                None,
+                None,
+                None,
+            )
+            .unwrap();
+            let i = file.GetFileInformationByHandle().unwrap();
+            (i.dwVolumeSerialNumber, i.nFileIndex())
+        };
+        let before = identity(&path);
+        write_file(path.to_str().unwrap(), b"new").unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), b"new");
+        // No inode/file-record replacement: owner, group and access-control lists stay attached
+        // to the same file rather than being inherited anew from the parent directory.
+        assert_eq!(identity(&path), before);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+    #[cfg(unix)]
+    #[test]
+    fn export_replacement_preserves_existing_permissions_and_new_files_are_private() {
+        let dir = scratch("permissions");
+        for mode in [0o600, 0o640] {
+            let path = dir.join(format!("{mode:o}.mid"));
+            std::fs::write(&path, b"old").unwrap();
+            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(mode)).unwrap();
+            write_file(path.to_str().unwrap(), b"new").unwrap();
+            assert_eq!(std::fs::read(&path).unwrap(), b"new");
+            assert_eq!(std::fs::metadata(&path).unwrap().permissions().mode() & 0o777, mode);
+        }
+        let path = dir.join("new.mid");
+        write_file(path.to_str().unwrap(), b"new").unwrap();
+        assert_eq!(std::fs::metadata(&path).unwrap().permissions().mode() & 0o077, 0);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+    #[cfg(unix)]
+    #[test]
+    fn export_replacement_preserves_a_symlink_and_refuses_a_dangling_one() {
+        let dir = scratch("symlinks");
+        let target = dir.join("target.mid");
+        let link = dir.join("link.mid");
+        std::fs::write(&target, b"old").unwrap();
+        std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o600)).unwrap();
+        symlink("target.mid", &link).unwrap();
+        for confined in [false, true] {
+            let roots = if confined { crate::file_access::AutomationRoots::new(&[], &[&dir]).unwrap() } else { None };
+            crate::file_access::confine(roots.as_ref(), || write_file(link.to_str().unwrap(), b"new")).unwrap();
+            assert!(std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink());
+            assert_eq!(std::fs::read(&target).unwrap(), b"new");
+            assert_eq!(std::fs::metadata(&target).unwrap().permissions().mode() & 0o777, 0o600);
+        }
+        let missing = dir.join("missing.mid");
+        let dangling = dir.join("dangling.mid");
+        symlink(&missing, &dangling).unwrap();
+        assert!(write_file(dangling.to_str().unwrap(), b"new").is_err());
+        assert!(std::fs::symlink_metadata(&dangling).unwrap().file_type().is_symlink());
+        assert!(!missing.exists());
+        assert!(!std::fs::read_dir(&dir).unwrap().any(|e| e.unwrap().file_name().to_string_lossy().starts_with(".soundcraft-")));
+        let _ = std::fs::remove_dir_all(dir);
+    }
+}

 #[cfg(test)]
 mod clip_tests {
@@ -58,8 +58,8 @@ fn session_bundle_within(session: &Session, limits: BundleLimits) -> Result<(Vec
            target = format!("Audio Files/{base}_{k:02}.wav");
            k += 1;
        }
-        let opts_wav = EncodeOptions { format: FileFormat::Wav, bit_depth: soundcraft_audio_io::BitDepth::Float32, dither: false, bwf: None };
-        let bytes = soundcraft_audio_io::encode(&audio.buffer, &opts_wav).map_err(|err| EngineError::Io(err.to_string()))?;
+        let opts_wav = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(craft_audio::BitDepth::Float32);
+        let bytes = craft_audio::encode(&audio.buffer, &opts_wav).map_err(|err| EngineError::Io(err.to_string()))?;
        fits(bytes.len())?;
        w.start_file(target.as_str(), opts).map_err(zerr)?;
        w.write_all(&bytes).map_err(ioerr)?;
@@ -94,7 +94,7 @@ fn add_source_audio(s: &mut Session, name: &str, audio: Arc<SourceAudio>, path:
        id,
        name: stem.clone(),
        path: stored,
-        channels: u16::try_from(audio.buffer.num_channels()).unwrap_or(u16::MAX),
+        channels: audio.buffer.num_channels(),
        frames: audio.frames() as u64,
        sample_rate: s.sample_rate.hz(),
        format,
@@ -122,7 +122,7 @@ fn stamp_at_rate(stamp: u64, file_rate: u32, session_rate: u32) -> u64 {
 pub struct DecodedImport {
    pub(crate) key: PathBuf,
    pub(crate) rate: u32,
-    info: soundcraft_audio_io::AudioInfo,
+    info: craft_audio::AudioInfo,
    audio: Arc<SourceAudio>,
 }

@@ -142,9 +142,9 @@ pub fn decode_import(path: &str, rate: u32) -> Result<DecodedImport> {
    Ok(DecodedImport { key: file_key(Path::new(path)), rate, info, audio })
 }

-fn decode_import_bytes(name: &str, bytes: &[u8], rate: u32) -> Result<(soundcraft_audio_io::AudioInfo, Arc<SourceAudio>)> {
+fn decode_import_bytes(name: &str, bytes: &[u8], rate: u32) -> Result<(craft_audio::AudioInfo, Arc<SourceAudio>)> {
    let ext = Path::new(name).extension().and_then(OsStr::to_str).map(str::to_ascii_lowercase);
-    let (info, buf) = soundcraft_audio_io::decode(bytes, ext.as_deref()).map_err(|err| EngineError::Io(format!("{name}: {err}")))?;
+    let (info, buf) = craft_audio::decode(bytes, ext.as_deref()).map_err(|err| EngineError::Io(format!("{name}: {err}")))?;
    let buf = at_rate(buf, rate, MAX_IMPORT_SAMPLES).map_err(|e| EngineError::Io(format!("{name}: {}", e.message("file is too large to import"))))?;
    if buf.frames() == 0 {
        return Err(EngineError::Io(format!("{name}: no audio")));
@@ -166,17 +166,17 @@ pub(crate) fn place_decoded(e: &mut Engine, name: &str, d: DecodedImport, path:
 fn place_import(
    e: &mut Engine,
    name: &str,
-    info: &soundcraft_audio_io::AudioInfo,
+    info: &craft_audio::AudioInfo,
    audio: Arc<SourceAudio>,
    path: Option<&str>,
    target: Option<TrackId>,
    at: Samples,
 ) -> Result<Value> {
-    let channels = audio.buffer.num_channels();
+    let channels = audio.buffer.channels.len();
    let file_rate = info.sample_rate;
    let s = e.session_mut();
    let session_rate = s.sample_rate.hz();
-    let src = add_source_audio(s, name, audio, path, info.format);
+    let src = add_source_audio(s, name, audio, path, FileFormat::of(info));
    if let (Some(bwf), Some(sx)) = (info.bwf.as_ref(), s.sources.last_mut()) {
        sx.time_reference = stamp_at_rate(bwf.time_reference, file_rate, session_rate);
    }
@@ -48,8 +48,7 @@ fn add_recording_in(
    let before = e.session_arc();
    let mut out = Vec::new();
    for (tid, path) in takes {
-        let read =
-            read_file(&path).and_then(|b| soundcraft_audio_io::decode(&b, None).map_err(|err| EngineError::Io(format!("{}: {err}", path.display()))));
+        let read = read_file(&path).and_then(|b| craft_audio::decode(&b, None).map_err(|err| EngineError::Io(format!("{}: {err}", path.display()))));
        let Ok((_, buf)) = read.inspect_err(|err| e.message(err.to_string())) else { continue };
        let s = e.session_mut();
        if s.track(tid).is_none() {
@@ -129,7 +128,7 @@ mod record_tests {
    }

    fn write_take(path: &Path, frames: usize) {
-        let mut bytes = soundcraft_audio_io::wav_float_header(1, 48_000, frames as u64).unwrap();
+        let mut bytes = craft_audio::wav_float_header(48_000, 1, frames as u64).unwrap();
        bytes.extend((0..frames).flat_map(|i| (i as f32 / frames as f32 - 0.5).to_le_bytes()));
        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
        std::fs::write(path, bytes).unwrap();
@@ -71,7 +71,7 @@ pub(crate) fn open_session_linked(e: &mut Engine, path: &Path, links: &Path) ->

 /// Decode one source's audio file at the session rate.
 pub(super) fn decode_source(bytes: &[u8], ext: Option<&str>, rate: u32) -> std::result::Result<Arc<SourceAudio>, String> {
-    let (_, buf) = soundcraft_audio_io::decode(bytes, ext).map_err(|err| err.to_string())?;
+    let (_, buf) = craft_audio::decode(bytes, ext).map_err(|err| err.to_string())?;
    let buf = at_rate(buf, rate, MAX_IMPORT_SAMPLES).map_err(|e| e.message("too large to load"))?;
    Ok(Arc::new(SourceAudio::new(buf)))
 }
@@ -419,7 +419,7 @@ mod open_tests {
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();
        let audio = AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.25; 480]] };
-        std::fs::write(dir.join("k.wav"), soundcraft_audio_io::encode(&audio, &EncodeOptions::default()).unwrap()).unwrap();
+        std::fs::write(dir.join("k.wav"), craft_audio::encode(&audio, &EncodeOptions::default()).unwrap()).unwrap();
        let mut s = Session::default();
        for _ in 0..3 {
            add_source(&mut s, "k", audio.clone(), Some("k.wav"), FileFormat::Wav);
@@ -440,7 +440,7 @@ mod open_tests {
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(dir.join("Audio Files")).unwrap();
        let audio = AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.25; 480]] };
-        std::fs::write(dir.join("Audio Files/k.wav"), soundcraft_audio_io::encode(&audio, &EncodeOptions::default()).unwrap()).unwrap();
+        std::fs::write(dir.join("Audio Files/k.wav"), craft_audio::encode(&audio, &EncodeOptions::default()).unwrap()).unwrap();
        let mut s = Session::default();
        for _ in 0..3 {
            add_source(&mut s, "k", audio.clone(), Some("Audio Files/k.wav"), FileFormat::Wav);
@@ -472,7 +472,7 @@ mod open_tests {
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();
        let audio = AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.25; 480]] };
-        std::fs::write(dir.join("k.wav"), soundcraft_audio_io::encode(&audio, &EncodeOptions::default()).unwrap()).unwrap();
+        std::fs::write(dir.join("k.wav"), craft_audio::encode(&audio, &EncodeOptions::default()).unwrap()).unwrap();
        let mut saved = Session::default();
        let t = saved.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
        let src = add_source(&mut saved, "k", audio, Some("../k.wav"), FileFormat::Wav);
@@ -117,9 +117,7 @@ pub fn strip_silence(
    }
    cut_points.push(r.end);
    let old: std::collections::HashSet<_> = s.track(t).map(|x| x.clips().iter().map(|c| c.id).collect()).unwrap_or_default();
-    for p in &cut_points {
-        crate::edit::separate_at_if(s, t, *p, |_| false);
-    }
+    crate::edit::separate_at_points(s, t, &cut_points);
    let kept = strip_pieces(s, t, r, &keep, mode);
    crate::edit::auto_name_new_clips(s, t, &old, |c| !(named && c.is_audio() && c.start >= r.start && c.end() <= r.end));
    Ok(kept)
@@ -144,10 +142,24 @@ fn strip_pieces(s: &mut Session, t: TrackId, r: Range, keep: &[(Samples, Samples
    let audio: Vec<Range> = keep.iter().map(|(a, b)| Range::new(*a, *b)).collect();
    let remove = if mode == StripMode::Extract { &audio } else { &gaps };
    let inside = |c: &Clip, g: &Range| c.start >= g.start && c.end() <= g.end;
+    // The range of `rs` holding `c`: by binary search when `rs` is ascending and disjoint (the
+    // usual case, checked once by the caller), by scan otherwise.
+    let holder = |rs: &[Range], sorted: bool, c: &Clip| {
+        if sorted {
+            let i = rs.partition_point(|g| g.end < c.end());
+            rs.get(i).filter(|g| inside(c, g)).map(|_| i)
+        } else {
+            rs.iter().position(|g| inside(c, g))
+        }
+    };
+    let ordered = |rs: &[Range]| rs.windows(2).all(|w| w[0].end <= w[1].start);
    let Some(pl) = s.track_mut(t).and_then(|x| x.playlist_mut()) else { return if mode == StripMode::Extract { 0 } else { keep.len() } };
-    pl.clips.retain(|c| !remove.iter().any(|g| inside(c, g)));
+    let sorted = ordered(remove);
+    pl.clips.retain(|c| holder(remove, sorted, c).is_none());
    if mode == StripMode::Extract {
-        return gaps.iter().filter(|g| pl.clips.iter().any(|c| inside(c, g))).count();
+        let sorted = ordered(&gaps);
+        let held: std::collections::HashSet<usize> = pl.clips.iter().filter_map(|c| holder(&gaps, sorted, c)).collect();
+        return held.len();
    }
    keep.len()
 }
@@ -294,6 +306,57 @@ mod strip_tests {
        (r, e.session().track(t).unwrap().clips().iter().map(|c| (c.start, c.end())).collect())
    }

+    #[test]
+    fn cutting_at_many_points_in_one_pass_equals_cutting_at_each() {
+        let spans = |e: &Engine, t: TrackId| {
+            let mut v: Vec<_> = e.session().track(t).unwrap().clips().iter().map(|c| (c.start, c.end())).collect();
+            v.sort_unstable();
+            v
+        };
+        let points = [30_000, 10, 5_000, 30_000, 120_000, 0, 20_000, 1_000_000];
+        let (mut one, t) = tones(&[0, 20_000, 100_000], 40_000);
+        let (mut each, _) = tones(&[0, 20_000, 100_000], 40_000);
+        crate::edit::separate_at_points(one.session_mut(), t, &points);
+        for p in points {
+            crate::edit::separate_at_if(each.session_mut(), t, p, |_| false);
+        }
+        assert_eq!(spans(&one, t), spans(&each, t));
+        assert!(spans(&one, t).len() > 3);
+        let ids: std::collections::HashSet<_> = one.session().track(t).unwrap().clips().iter().map(|c| c.id).collect();
+        assert_eq!(ids.len(), spans(&one, t).len(), "new pieces have distinct ids");
+    }
+
+    #[test]
+    fn cutting_stretched_audio_at_ascending_points_matches_cutting_at_each() {
+        let pieces = |e: &Engine, t: TrackId| {
+            let mut v: Vec<_> = e
+                .session()
+                .track(t)
+                .unwrap()
+                .clips()
+                .iter()
+                .map(|c| (c.start, c.end(), if let soundcraft_model::ClipContent::Audio { offset, .. } = c.content { offset } else { -1 }))
+                .collect();
+            v.sort_unstable();
+            v
+        };
+        let stretched = || {
+            let (mut e, t) = tones(&[0], 40_000);
+            for c in &mut e.session_mut().track_mut(t).unwrap().playlist_mut().unwrap().clips {
+                c.stretch = 2.0;
+            }
+            (e, t)
+        };
+        let points = [1, 2, 3_001, 12_345];
+        let ((mut one, t), (mut each, _)) = (stretched(), stretched());
+        crate::edit::separate_at_points(one.session_mut(), t, &points);
+        for p in points {
+            crate::edit::separate_at_if(each.session_mut(), t, p, |_| false);
+        }
+        assert_eq!(pieces(&one, t), pieces(&each, t));
+        assert_eq!(pieces(&one, t).len(), points.len() + 1);
+    }
+
    #[test]
    fn strip_keeps_the_audio_and_removes_the_silence() {
        let (r, clips) = strip_mode("strip");
@@ -1,7 +1,9 @@
 //! Bounces stream the main mix or a bus to their file, exactly as rendered in memory.

-use soundcraft_audio_io::{BitDepth, EncodeOptions, FileFormat};
+use craft_audio::{BitDepth, EncodeOptions};
+
 use soundcraft_engine::io::{Bounce, bounce_stems};
+use soundcraft_model::FileFormat;
 use soundcraft_time::Range;
 use std::path::PathBuf;

@@ -11,7 +13,7 @@ fn float_bounce_preserves_headroom_and_reports_the_written_levels() {
    let sr = e.session().sample_rate.hz();
    let frames = sr as usize + 17;
    let samples: Vec<f32> = (0..frames).map(|i| 1.5 * (std::f32::consts::TAU * 440.0 * i as f32 / sr as f32).sin()).collect();
-    let audio = soundcraft_audio_io::AudioBuffer { sample_rate: sr, channels: vec![samples.clone(), samples] };
+    let audio = craft_audio::AudioBuffer { sample_rate: sr, channels: vec![samples.clone(), samples] };
    let s = e.session_mut();
    // A new track has no inserts, so no limiter can mask encoder clipping.
    let track = s.add_track(soundcraft_model::TrackKind::Audio, soundcraft_model::ChannelFormat::Stereo, Some("Headroom"));
@@ -34,7 +36,7 @@ fn float_bounce_preserves_headroom_and_reports_the_written_levels() {
                )
                .unwrap();
            let bytes = std::fs::read(&path).unwrap();
-            let (_, file) = soundcraft_audio_io::decode(&bytes, None).unwrap();
+            let (_, file) = craft_audio::decode(&bytes, None).unwrap();
            let mut expected = mix.clone();
            if normalize {
                soundcraft_dsp::offline::normalize(&mut expected, -0.1, false);
@@ -43,7 +45,7 @@ fn float_bounce_preserves_headroom_and_reports_the_written_levels() {
                assert!(file.peak() > 1.0, "{extension}: headroom was clipped");
            }
            assert_eq!(file.channels, expected, "{extension}, normalize={normalize}");
-            let mut meter = soundcraft_dsp::meter::LoudnessMeter::new(sr as f32, file.num_channels());
+            let mut meter = soundcraft_dsp::meter::LoudnessMeter::new(sr as f32, file.channels.len());
            meter.process(&file.channels, file.frames());
            for (key, value) in [
                ("peak_db", soundcraft_dsp::offline::peak_db(&file.channels)),
@@ -71,7 +73,7 @@ fn bounces_write_exactly_the_mix_and_report_its_levels() {
    let dir = scratch("bounce-exact");
    let path = dir.join("Mix.wav");
    let r = Range::new(s.sample_rate.samples(10.0) + 7, s.sample_rate.samples(13.0));
-    let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Float32, dither: false, bwf: None };
+    let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(BitDepth::Float32);
    let verb = s.bus_by_name("Verb").unwrap().id;
    for bus in [None, Some(verb)] {
        let mut mix = match bus {
@@ -94,7 +96,7 @@ fn bounces_write_exactly_the_mix_and_report_its_levels() {
                soundcraft_dsp::offline::normalize(&mut mix, -0.1, false);
            }
            let bytes = std::fs::read(&path).unwrap();
-            let (_, file) = soundcraft_audio_io::decode(&bytes, None).unwrap();
+            let (_, file) = craft_audio::decode(&bytes, None).unwrap();
            assert_eq!(file.channels, mix, "{bus:?} normalize: {normalize}");
            let mut lm = soundcraft_dsp::meter::LoudnessMeter::new(s.sample_rate.as_f64() as f32, mix.len());
            lm.process(&mix, mix[0].len());
@@ -113,7 +115,7 @@ fn a_bounce_too_big_for_its_format_fails_and_keeps_the_old_file() {
    let dir = scratch("bounce-too-big");
    let path = dir.join("Mix.aif");
    std::fs::write(&path, b"old").unwrap();
-    let opts = EncodeOptions { format: FileFormat::Aiff, bit_depth: BitDepth::Float32, dither: false, bwf: None };
+    let opts = EncodeOptions::new(craft_audio::EncodeFormat::Aiff).with_bit_depth(BitDepth::Float32);
    let err = Bounce::new(e.session_arc(), &path, Range::new(0, s.sample_rate.samples(3.9 * 3600.0)), &opts, None, false, false).err().unwrap();
    assert!(err.to_string().contains("4 GiB"), "{err}");
    assert_eq!(std::fs::read(&path).unwrap(), b"old");
@@ -135,7 +137,7 @@ fn wav_bounces_carry_their_timecode_position_as_a_bwf_time_reference() {
    let dir = scratch("bounce-bext");
    let stamp = |path: &std::path::Path| {
        let ext = path.extension().and_then(|x| x.to_str());
-        soundcraft_audio_io::probe(&std::fs::read(path).unwrap(), ext).unwrap().bwf.map(|b| b.time_reference)
+        craft_audio::probe(&std::fs::read(path).unwrap(), ext).unwrap().bwf.map(|b| b.time_reference)
    };
    let mix = dir.join("Mix.wav");
    e.execute("file.bounce_mix", &serde_json::json!({"path": mix, "start": start, "end": end})).unwrap();
@@ -2,8 +2,8 @@
 //! `clap:` id and the mix engine renders through it. Uses the test plugin built from
 //! `crates/clap-host/tests/fixture` (a gain whose param "7" is linear gain).

+use craft_audio::AudioBuffer;
 use serde_json::json;
-use soundcraft_audio_io::AudioBuffer;
 use soundcraft_engine::Engine;
 use soundcraft_model::{ChannelFormat, Clip, SourceAudio, SourceId, TrackKind};
 use soundcraft_time::Range;
@@ -1,6 +1,7 @@
+use craft_audio::{AudioBuffer, BitDepth, EncodeOptions};
 use serde_json::json;
-use soundcraft_audio_io::{AudioBuffer, BitDepth, EncodeOptions, FileFormat};
 use soundcraft_engine::{Engine, io};
+use soundcraft_model::FileFormat;
 use soundcraft_model::{ChannelFormat, Clip, ClipContent, Insert, Route, SendSlot, Session, TrackId, TrackKind};
 use soundcraft_time::{Range, SampleRate};
 use std::sync::Arc;
@@ -52,7 +53,7 @@ fn commit_keeps_every_renderable_exact_format_and_processed_channel_order() {
        let committed = commit(&mut e, track);
        assert_eq!(e.session().track(committed).unwrap().format, format, "{}", format.label());
        let audio = committed_audio(&e, committed);
-        assert_eq!(audio.num_channels(), format.channels(), "{}", format.label());
+        assert_eq!(audio.channels.len(), format.channels(), "{}", format.label());
        assert_eq!(audio.frames(), SIGNAL_FRAMES + 16_000);
        // Existing mono rendering uses a -3 dB center pan followed by SQRT_2 compensation.
        // Model that small baseline gain explicitly, retaining the same strict signal tolerance.
@@ -106,11 +107,11 @@ fn commit_preserves_bus_and_send_audio_after_undo_reopen_and_wav_export() {
        assert_audio_eq(&committed_audio(&reopened, committed).channels, &committed_audio(&e, committed).channels);
        assert_audio_eq(&soundcraft_mix::render_range(reopened.session(), range, 64), &before);

-        let opts = EncodeOptions { format: FileFormat::Wav, bit_depth: BitDepth::Float32, dither: false, bwf: None };
+        let opts = EncodeOptions::new(craft_audio::EncodeFormat::Wav).with_bit_depth(BitDepth::Float32);
        let wav_path = dir.join("mix.wav");
        io::Bounce::new(reopened.session_arc(), &wav_path, range, &opts, None, false, false).unwrap().run().unwrap();
        let wav = std::fs::read(&wav_path).unwrap();
-        let (_, decoded) = soundcraft_audio_io::decode(&wav, Some("wav")).unwrap();
+        let (_, decoded) = craft_audio::decode(&wav, Some("wav")).unwrap();
        assert_audio_eq(&decoded.channels, &before);
        // The WAV extensible mask must describe this layout, not another layout of equal width.
        let fmt_at = wav.windows(4).position(|tag| tag == b"fmt ").unwrap();
@@ -1,8 +1,9 @@
 //! Consolidate makes one clip per track that covers exactly the edit selection (#164).

+use craft_audio::AudioBuffer;
 use serde_json::json;
-use soundcraft_audio_io::{AudioBuffer, FileFormat};
 use soundcraft_engine::{Engine, EngineError};
+use soundcraft_model::FileFormat;
 use soundcraft_model::{Clip, TrackId};
 use soundcraft_time::Range;

@@ -11,7 +11,7 @@ fn source(id: u64, frames: u64) -> Source {
        channels: 1,
        frames,
        sample_rate: 48_000,
-        format: soundcraft_audio_io::FileFormat::Wav,
+        format: soundcraft_model::FileFormat::Wav,
        time_reference: 0,
        unsaved: false,
    }
@@ -467,11 +467,10 @@ fn start_trims_keep_the_sync_point_on_its_audio() {

 #[test]
 fn imported_time_stamps_count_at_the_session_rate() {
-    use soundcraft_audio_io::{AudioBuffer, BwfInfo, EncodeOptions, FileFormat};
+    use craft_audio::{AudioBuffer, BwfInfo, EncodeOptions};
    let mut e = Engine::default();
-    let bwf = BwfInfo { time_reference: 1_587_600_000, ..BwfInfo::default() };
-    let opts = EncodeOptions { format: FileFormat::Wav, bwf: Some(bwf), ..EncodeOptions::default() };
-    let bytes = soundcraft_audio_io::encode(&AudioBuffer::new(44_100, 1, 441), &opts).unwrap();
+    let opts = EncodeOptions::default().with_bwf(BwfInfo::default().with_time_reference(1_587_600_000));
+    let bytes = craft_audio::encode(&AudioBuffer::new(44_100, 1, 441), &opts).unwrap();
    soundcraft_engine::io::import_audio_bytes(&mut e, "stamped.wav", &bytes, None, None, 0).unwrap();
    assert_eq!(e.session().sources[0].time_reference, 1_728_000_000);
 }
@@ -579,3 +578,48 @@ fn moving_a_group_left_past_zero_keeps_its_spacing() {
    run(&mut e, "edit.move_clips", json!({"clips": [ids[0].0, ids[1].0], "by": -1000}));
    assert_eq!(clips(&e, t), [(0, 100), (1500, 100)]);
 }
+
+#[test]
+fn separate_and_range_edits_leave_locked_clips_whole() {
+    let edits = [
+        ("edit.separate", json!({"at": 24_000})),
+        ("edit.separate", json!({"start": 12_000, "end": 36_000})),
+        ("edit.separate_on_grid", json!({"start": 12_000, "end": 36_000})),
+        ("edit.clear", json!({"start": 12_000, "end": 36_000})),
+        ("edit.insert_silence", json!({"start": 24_000, "end": 25_000})),
+    ];
+    for lock in [None, Some("clip.edit_lock"), Some("clip.time_lock")] {
+        for (cmd, p) in &edits {
+            let (mut e, t, ids) = long("slip", &[(0, 48_000, 0)]);
+            if let Some(lock) = lock {
+                run(&mut e, lock, json!({"clips": [ids[0].0]}));
+            }
+            let mut p = p.clone();
+            p["tracks"] = json!([t.0]);
+            run(&mut e, cmd, p);
+            if lock.is_some() {
+                assert_eq!(clips(&e, t), vec![(0, 48_000)], "{lock:?} {cmd}");
+            } else {
+                assert_ne!(clips(&e, t), vec![(0, 48_000)], "unlocked control {cmd}");
+            }
+        }
+    }
+}
+
+/// Event time edits move the entire timeline, including clips protected from ordinary edits.
+#[test]
+fn event_time_edits_split_and_move_locked_clips() {
+    for lock in ["clip.edit_lock", "clip.time_lock"] {
+        for (command, expected) in [
+            ("event.insert_time", vec![(0, 12_000, 0), (36_000, 36_000, 12_000)]),
+            ("event.cut_time", vec![(0, 12_000, 0), (12_000, 12_000, 36_000)]),
+        ] {
+            let (mut e, t, ids) = long("slip", &[(0, 48_000, 0)]);
+            run(&mut e, lock, json!({"clips": [ids[0].0]}));
+            run(&mut e, command, json!({"start": 12_000, "end": 36_000}));
+            let actual: Vec<_> = e.session().track(t).unwrap().clips().iter().map(|c| (c.start, c.length, c.source_offset())).collect();
+            assert_eq!(actual, expected, "{lock} {command}");
+            assert!(e.session().track(t).unwrap().clips().iter().all(soundcraft_engine::edit::locked));
+        }
+    }
+}
@@ -1,10 +1,11 @@
 //! Renders longer than one offline buffer holds are refused, rather than cut short and kept.

+use craft_audio::AudioBuffer;
 use serde_json::{Value, json};
-use soundcraft_audio_io::{AudioBuffer, FileFormat};
 use soundcraft_dsp::offline::MAX_OFFLINE_SAMPLES;
 use soundcraft_engine::Engine;
 use soundcraft_mix::MAX_RENDER_SAMPLES;
+use soundcraft_model::FileFormat;
 use soundcraft_model::{ChannelFormat, Clip, ClipId, Session, TrackKind};

 /// A stereo track "Talk" with one clip `frames` long. Its source is one second: the commands
@@ -1,8 +1,9 @@
 //! Split tracks into mono without replacing the right/surround channels with channel zero.

+use craft_audio::AudioBuffer;
 use serde_json::json;
-use soundcraft_audio_io::{AudioBuffer, FileFormat};
 use soundcraft_engine::{Engine, io};
+use soundcraft_model::FileFormat;
 use soundcraft_model::{ChannelFormat, Clip, Session, SourceAudio, SourceId, TrackId, TrackKind};
 use soundcraft_time::Range;
 use std::sync::Arc;
@@ -8,12 +8,10 @@ rust-version.workspace = true
 repository.workspace = true

 [dependencies]
-serde.workspace = true
-thiserror.workspace = true
+craft-midi.workspace = true

 [dev-dependencies]
 proptest.workspace = true
-serde_json.workspace = true

 [lints]
 workspace = true
@@ -1,10 +1,9 @@
 //! SoundCraft MIDI.
 //!
 //! - [`Note`], [`CtrlEvent`] and [`Sequence`]: the MIDI content of a region / track, in ticks at
-//!   [`PPQ`] (960) ticks per quarter note.
-//! - [`read_smf`] / [`write_smf`]: Standard MIDI File import (format 0/1, format 2 best-effort) and
-//!   export (format 1, 960 PPQ). The reader treats its input as hostile: every length is checked,
-//!   variable-length quantities are bounded and event counts are capped.
+//!   [`PPQ`] (960) ticks per quarter note; [`read_smf`] / [`write_smf`]: Standard MIDI File import
+//!   and export. These come from `craft-midi` in craft-libs, shared with the other Craft apps, and
+//!   are re-exported so the rest of SoundCraft names them from here.
 //! - [`ops`]: MIDI editing operations (quantize, transpose, velocity, duration, split).
 //! - [`note_name`], [`gm_drum_name`], [`gm_program_name`]: display names.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
@@ -12,36 +11,7 @@
 mod names;
 pub mod ops;
 mod rng;
-mod sequence;
-mod smf;

+pub use craft_midi::{CtrlEvent, CtrlKind, MAX_EVENTS, MAX_TRACKS, MidiError, Note, PPQ, Sequence, Smf, SmfTrack, read_smf, write_smf};
 pub use names::{gm_drum_name, gm_program_name, note_name};
 pub use rng::XorShift;
-pub use sequence::{CtrlEvent, CtrlKind, Note, Sequence};
-pub use smf::{MAX_EVENTS, MAX_TRACKS, Smf, SmfTrack, read_smf, write_smf};
-
-/// Ticks per quarter note used throughout the model.
-pub const PPQ: u32 = 960;
-
-/// Errors from reading or writing MIDI data.
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
-pub enum MidiError {
-    #[error("not a Standard MIDI File (missing MThd header)")]
-    NotSmf,
-    #[error("unexpected end of data at byte {0}")]
-    Truncated(usize),
-    #[error("variable-length quantity longer than 4 bytes at byte {0}")]
-    VlqTooLong(usize),
-    #[error("chunk length {len} at byte {offset} exceeds the remaining data")]
-    BadChunkLength { offset: usize, len: u64 },
-    #[error("invalid MIDI data at byte {offset}: {reason}")]
-    Invalid { offset: usize, reason: &'static str },
-    #[error("unsupported MIDI file: {0}")]
-    Unsupported(&'static str),
-    #[error("too many events (limit {0})")]
-    TooManyEvents(usize),
-    #[error("too many tracks (limit {0})")]
-    TooManyTracks(usize),
-    #[error("cannot write MIDI file: {0}")]
-    Write(String),
-}
@@ -1,141 +0,0 @@
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::collections::hash_map::Entry;
-
-/// A MIDI note. Times are in model ticks ([`crate::PPQ`] per quarter note).
-#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
-pub struct Note {
-    /// MIDI pitch 0..=127 (60 = middle C, shown as "C3").
-    pub pitch: u8,
-    /// Note-on velocity 1..=127.
-    pub velocity: u8,
-    /// Note-off (release) velocity 0..=127; 64 when the source had none.
-    pub release_velocity: u8,
-    /// MIDI channel 0..=15.
-    pub channel: u8,
-    /// Start in ticks.
-    pub start: i64,
-    /// Length in ticks; always > 0.
-    pub length: i64,
-}
-
-impl Note {
-    /// Tick at which the note ends (`start + length`, saturating).
-    pub fn end(&self) -> i64 {
-        self.start.saturating_add(self.length)
-    }
-}
-
-/// Kind of a continuous / channel controller event.
-#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
-pub enum CtrlKind {
-    /// Control change with the controller number 0..=127. Value 0..=127.
-    Cc(u8),
-    /// Pitch bend. Value is centred: -8192..=8191 (0 = no bend).
-    PitchBend,
-    /// Channel (mono) aftertouch. Value 0..=127.
-    ChannelPressure,
-    /// Polyphonic aftertouch for the given pitch. Value 0..=127.
-    PolyPressure(u8),
-    /// Program change. Value is the program number 0..=127.
-    Program,
-}
-
-/// A controller / channel event at a tick.
-#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
-pub struct CtrlEvent {
-    pub tick: i64,
-    pub channel: u8,
-    pub kind: CtrlKind,
-    pub value: i32,
-}
-
-/// The MIDI content of a region or track.
-#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
-pub struct Sequence {
-    /// Notes, sorted by `(start, pitch)` after [`Sequence::sort`].
-    pub notes: Vec<Note>,
-    /// Controller events, sorted by tick after [`Sequence::sort`].
-    pub ctrls: Vec<CtrlEvent>,
-}
-
-fn kind_key(k: CtrlKind) -> (u8, u8) {
-    match k {
-        CtrlKind::Cc(n) => (0, n),
-        CtrlKind::PitchBend => (1, 0),
-        CtrlKind::ChannelPressure => (2, 0),
-        CtrlKind::PolyPressure(p) => (3, p),
-        CtrlKind::Program => (4, 0),
-    }
-}
-
-impl Sequence {
-    /// Sorts notes by `(start, pitch, channel, length, velocity)` and controller events by tick
-    /// (stable, so same-tick events keep their order).
-    pub fn sort(&mut self) {
-        self.notes.sort_by_key(|a| (a.start, a.pitch, a.channel, a.length, a.velocity));
-        self.ctrls.sort_by_key(|c| c.tick);
-    }
-
-    /// The last tick covered by any note end or controller event (0 when empty).
-    pub fn end_tick(&self) -> i64 {
-        let n = self.notes.iter().map(Note::end).max();
-        let c = self.ctrls.iter().map(|c| c.tick).max();
-        match (n, c) {
-            (Some(a), Some(b)) => a.max(b),
-            (Some(a), None) | (None, Some(a)) => a,
-            (None, None) => 0,
-        }
-    }
-
-    /// Notes whose start lies in the half-open range `[start, end)`.
-    pub fn notes_in(&self, start: i64, end: i64) -> impl Iterator<Item = &Note> + '_ {
-        self.notes.iter().filter(move |n| n.start >= start && n.start < end)
-    }
-
-    /// Notes that sound anywhere inside the half-open range `[start, end)`.
-    pub fn notes_overlapping(&self, start: i64, end: i64) -> impl Iterator<Item = &Note> + '_ {
-        self.notes.iter().filter(move |n| n.start < end && n.end() > start)
-    }
-
-    /// Removes duplicate notes (same channel, pitch and start; the longest one is kept) and
-    /// duplicate controller events (same tick, channel and kind; the last one is kept, matching
-    /// what a synth would end up with). Returns how many events were removed. The sequence is
-    /// left sorted.
-    pub fn remove_duplicates(&mut self) -> usize {
-        let before = self.notes.len() + self.ctrls.len();
-        // Longest first within each (start, pitch, channel) group, then keep the first.
-        self.notes.sort_by(|a, b| (a.start, a.pitch, a.channel, b.length).cmp(&(b.start, b.pitch, b.channel, a.length)));
-        self.notes.dedup_by(|later, kept| later.start == kept.start && later.pitch == kept.pitch && later.channel == kept.channel);
-
-        self.ctrls.sort_by_key(|c| c.tick);
-        let mut kept: Vec<CtrlEvent> = Vec::with_capacity(self.ctrls.len());
-        // The latest tick and `kept` index of each channel+kind, so a same-tick repeat is found
-        // without rescanning the tick's events (a tick can hold many thousands of distinct keys).
-        // An entry from an earlier tick counts as absent; keeping the tick instead of clearing the
-        // map per tick keeps the work per event constant after a dense tick.
-        let mut last_at: HashMap<(u8, (u8, u8)), (i64, usize)> = HashMap::new();
-        for c in self.ctrls.drain(..) {
-            // Within a tick, replace an earlier event of the same channel+kind.
-            match last_at.entry((c.channel, kind_key(c.kind))) {
-                Entry::Occupied(mut e) => {
-                    let (tick, idx) = *e.get();
-                    match kept.get_mut(idx) {
-                        Some(slot) if tick == c.tick => *slot = c,
-                        _ => {
-                            e.insert((c.tick, kept.len()));
-                            kept.push(c);
-                        }
-                    }
-                }
-                Entry::Vacant(e) => {
-                    e.insert((c.tick, kept.len()));
-                    kept.push(c);
-                }
-            }
-        }
-        self.ctrls = kept;
-        self.sort();
-        before - (self.notes.len() + self.ctrls.len())
-    }
-}
@@ -1,635 +0,0 @@
-//! Standard MIDI File reading and writing (from the public SMF 1.0 specification).
-
-use std::collections::VecDeque;
-
-use crate::{CtrlEvent, CtrlKind, MidiError, Note, PPQ, Sequence};
-
-/// Maximum number of events (across all tracks) [`read_smf`] will parse.
-pub const MAX_EVENTS: usize = 5_000_000;
-/// Maximum number of track chunks [`read_smf`] will accept.
-pub const MAX_TRACKS: usize = 4096;
-
-/// Release velocity used when a note ends with a note-on of velocity 0 (per the spec, a
-/// note-on with velocity 0 is a note-off with velocity 64).
-const DEFAULT_RELEASE: u8 = 64;
-
-/// One track of a Standard MIDI File.
-#[derive(Debug, Clone, Default, PartialEq)]
-pub struct SmfTrack {
-    /// Name from the first Sequence/Track Name meta event (empty if none).
-    pub name: String,
-    pub sequence: Sequence,
-}
-
-/// A Standard MIDI File in model terms. All ticks are at [`PPQ`] (960) per quarter note.
-#[derive(Debug, Clone, Default, PartialEq)]
-pub struct Smf {
-    /// Format of the source file (0, 1 or 2). [`write_smf`] always writes format 1.
-    pub format: u16,
-    pub tracks: Vec<SmfTrack>,
-    /// `(tick, beats per minute)`.
-    pub tempos: Vec<(i64, f64)>,
-    /// `(tick, numerator, denominator)`, e.g. `(0, 6, 8)`.
-    pub meters: Vec<(i64, u8, u8)>,
-    /// `(tick, text)` from Marker meta events.
-    pub markers: Vec<(i64, String)>,
-    /// `(tick, sharps (+) / flats (-) -7..=7, is_minor)`.
-    pub key_sigs: Vec<(i64, i8, bool)>,
-}
-
-// ---------------------------------------------------------------------------------------------
-// Reading
-// ---------------------------------------------------------------------------------------------
-
-struct Cursor<'a> {
-    data: &'a [u8],
-    pos: usize,
-    /// Absolute offset of `data[0]` in the file, for error messages.
-    base: usize,
-}
-
-impl<'a> Cursor<'a> {
-    fn at(&self) -> usize {
-        self.base.saturating_add(self.pos)
-    }
-
-    fn is_empty(&self) -> bool {
-        self.pos >= self.data.len()
-    }
-
-    fn u8(&mut self) -> Result<u8, MidiError> {
-        let b = *self.data.get(self.pos).ok_or(MidiError::Truncated(self.at()))?;
-        self.pos += 1;
-        Ok(b)
-    }
-
-    fn peek(&self) -> Result<u8, MidiError> {
-        self.data.get(self.pos).copied().ok_or(MidiError::Truncated(self.at()))
-    }
-
-    fn bytes(&mut self, n: usize) -> Result<&'a [u8], MidiError> {
-        let end = self.pos.checked_add(n).ok_or(MidiError::Truncated(self.at()))?;
-        let s = self.data.get(self.pos..end).ok_or(MidiError::Truncated(self.at()))?;
-        self.pos = end;
-        Ok(s)
-    }
-
-    fn u16(&mut self) -> Result<u16, MidiError> {
-        let b = self.bytes(2)?;
-        Ok(u16::from_be_bytes([b.first().copied().unwrap_or(0), b.get(1).copied().unwrap_or(0)]))
-    }
-
-    fn u32(&mut self) -> Result<u32, MidiError> {
-        let b = self.bytes(4)?;
-        let mut a = [0u8; 4];
-        a.copy_from_slice(b);
-        Ok(u32::from_be_bytes(a))
-    }
-
-    /// Variable-length quantity: at most 4 bytes (28 bits) per the spec.
-    fn vlq(&mut self) -> Result<u32, MidiError> {
-        let start = self.at();
-        let mut v: u32 = 0;
-        for _ in 0..4 {
-            let b = self.u8()?;
-            v = (v << 7) | u32::from(b & 0x7F);
-            if b & 0x80 == 0 {
-                return Ok(v);
-            }
-        }
-        Err(MidiError::VlqTooLong(start))
-    }
-}
-
-/// Converts file ticks to model ticks: `model = file * num / den` (rounded).
-#[derive(Clone, Copy)]
-struct TickConv {
-    num: i128,
-    den: i128,
-}
-
-impl TickConv {
-    fn from_division(division: u16, offset: usize) -> Result<Self, MidiError> {
-        if division & 0x8000 == 0 {
-            if division == 0 {
-                return Err(MidiError::Invalid { offset, reason: "division of 0 ticks per quarter note" });
-            }
-            Ok(Self { num: i128::from(PPQ), den: i128::from(division) })
-        } else {
-            // SMPTE: high byte is negative frames/sec (two's complement), low byte ticks/frame.
-            // Approximated at 120 bpm: one quarter note = 0.5 s, so
-            // model = file / ticks_per_sec * 2 * PPQ.
-            let [hi, lo] = division.to_be_bytes();
-            let fps = -i128::from(hi as i8);
-            let tpf = i128::from(lo);
-            if !matches!(fps, 24 | 25 | 29 | 30) || tpf == 0 {
-                return Err(MidiError::Invalid { offset, reason: "invalid SMPTE division" });
-            }
-            let two_ppq = 2 * i128::from(PPQ);
-            if fps == 29 {
-                // 29.97 drop-frame: ticks/sec = 30000/1001 * tpf
-                Ok(Self { num: two_ppq * 1001, den: 30000 * tpf })
-            } else {
-                Ok(Self { num: two_ppq, den: fps * tpf })
-            }
-        }
-    }
-
-    fn convert(&self, file_tick: u64) -> i64 {
-        let v = (i128::from(file_tick) * self.num + self.den / 2) / self.den;
-        i64::try_from(v).unwrap_or(i64::MAX)
-    }
-}
-
-struct Globals {
-    tempos: Vec<(i64, f64)>,
-    meters: Vec<(i64, u8, u8)>,
-    markers: Vec<(i64, String)>,
-    key_sigs: Vec<(i64, i8, bool)>,
-}
-
-/// Parses a Standard MIDI File.
-///
-/// - Formats 0 and 1 are fully supported; format 2 is read best-effort (all tracks share one
-///   timeline). Each `MTrk` chunk becomes one [`SmfTrack`]; for format 1 a leading conductor
-///   track without notes or controllers is folded into the global tempo/meter/marker lists.
-/// - Ticks are converted to [`PPQ`]; an SMPTE division is approximated at 120 bpm.
-/// - Running status, note-on velocity 0 as note-off, unmatched note-offs (ignored), overlapping
-///   same-pitch notes (matched first-in first-out) and hanging notes (closed at the end of the
-///   track) are handled. Zero-length notes get a length of 1 tick.
-/// - Unknown chunks and meta events are skipped. Any malformed structure (bad header, truncated
-///   chunk, VLQ longer than 4 bytes, data byte without running status, ...) returns an error.
-pub fn read_smf(bytes: &[u8]) -> Result<Smf, MidiError> {
-    let mut cur = Cursor { data: bytes, pos: 0, base: 0 };
-    if cur.bytes(4).map_err(|_| MidiError::NotSmf)? != b"MThd" {
-        return Err(MidiError::NotSmf);
-    }
-    let header_len = cur.u32()?;
-    if header_len < 6 {
-        return Err(MidiError::Invalid { offset: 4, reason: "header chunk shorter than 6 bytes" });
-    }
-    let header_len = usize::try_from(header_len).map_err(|_| MidiError::BadChunkLength { offset: 4, len: u64::from(header_len) })?;
-    let header = cur.bytes(header_len).map_err(|_| MidiError::BadChunkLength { offset: 4, len: u64::try_from(header_len).unwrap_or(u64::MAX) })?;
-    let mut hc = Cursor { data: header, pos: 0, base: 8 };
-    let format = hc.u16()?;
-    let _ntrks = hc.u16()?;
-    let division = hc.u16()?;
-    if format > 2 {
-        return Err(MidiError::Unsupported("SMF format greater than 2"));
-    }
-    let conv = TickConv::from_division(division, 12)?;
-
-    let mut globals = Globals { tempos: Vec::new(), meters: Vec::new(), markers: Vec::new(), key_sigs: Vec::new() };
-    let mut tracks = Vec::new();
-    let mut event_budget = MAX_EVENTS;
-
-    while !cur.is_empty() {
-        let chunk_at = cur.at();
-        let id = cur.bytes(4)?;
-        let len = cur.u32()?;
-        let remaining = bytes.len().saturating_sub(cur.pos);
-        let len_usize = usize::try_from(len).unwrap_or(usize::MAX);
-        if len_usize > remaining {
-            return Err(MidiError::BadChunkLength { offset: chunk_at, len: u64::from(len) });
-        }
-        let body_at = cur.at();
-        let body = cur.bytes(len_usize)?;
-        if id != b"MTrk" {
-            continue; // unknown chunk types must be ignored
-        }
-        if tracks.len() >= MAX_TRACKS {
-            return Err(MidiError::TooManyTracks(MAX_TRACKS));
-        }
-        let track = read_track(body, body_at, conv, &mut globals, &mut event_budget)?;
-        tracks.push(track);
-    }
-
-    // A lone track is only a conductor track if it carried global data and has no name; otherwise it is kept.
-    let globals_present = !(globals.tempos.is_empty() && globals.meters.is_empty() && globals.markers.is_empty() && globals.key_sigs.is_empty());
-    if format == 1
-        && (tracks.len() > 1 || globals_present)
-        && tracks.first().is_some_and(|t| t.sequence.notes.is_empty() && t.sequence.ctrls.is_empty() && (tracks.len() > 1 || t.name.is_empty()))
-    {
-        tracks.remove(0);
-    }
-
-    // Keep global lists ordered by tick (stable: file order within a tick).
-    globals.tempos.sort_by_key(|t| t.0);
-    globals.meters.sort_by_key(|t| t.0);
-    globals.markers.sort_by_key(|t| t.0);
-    globals.key_sigs.sort_by_key(|t| t.0);
-
-    Ok(Smf { format, tracks, tempos: globals.tempos, meters: globals.meters, markers: globals.markers, key_sigs: globals.key_sigs })
-}
-
-/// Open note-ons for one (channel, pitch), oldest first: `(model tick, velocity)`.
-type OpenNotes = Vec<VecDeque<(i64, u8)>>;
-
-fn close_note(open: &mut OpenNotes, notes: &mut Vec<Note>, channel: u8, pitch: u8, tick: i64, release: u8) {
-    let key = usize::from(channel & 0x0F) * 128 + usize::from(pitch & 0x7F);
-    let Some(stack) = open.get_mut(key) else { return };
-    if stack.is_empty() {
-        return; // unmatched note-off: ignored
-    }
-    let Some((start, velocity)) = stack.pop_front() else { return };
-    let length = tick.saturating_sub(start).max(1);
-    notes.push(Note { pitch, velocity, release_velocity: release, channel, start, length });
-}
-
-fn read_track(body: &[u8], base: usize, conv: TickConv, g: &mut Globals, budget: &mut usize) -> Result<SmfTrack, MidiError> {
-    let mut cur = Cursor { data: body, pos: 0, base };
-    let mut name: Option<String> = None;
-    let mut seq = Sequence::default();
-    let mut open: OpenNotes = vec![VecDeque::new(); 16 * 128];
-    let mut file_tick: u64 = 0;
-    let mut tick: i64 = 0;
-    let mut running: Option<u8> = None;
-
-    while !cur.is_empty() {
-        if *budget == 0 {
-            return Err(MidiError::TooManyEvents(MAX_EVENTS));
-        }
-        *budget -= 1;
-
-        let delta = cur.vlq()?;
-        file_tick = file_tick.saturating_add(u64::from(delta));
-        tick = conv.convert(file_tick);
-
-        let event_at = cur.at();
-        let first = cur.peek()?;
-        let status = if first & 0x80 != 0 {
-            cur.pos += 1;
-            first
-        } else {
-            running.ok_or(MidiError::Invalid { offset: event_at, reason: "data byte without running status" })?
-        };
-
-        match status {
-            0xFF => {
-                running = None;
-                let kind = cur.u8()?;
-                let len = cur.vlq()?;
-                let data = cur.bytes(usize::try_from(len).unwrap_or(usize::MAX))?;
-                match kind {
-                    0x2F => break, // End of Track
-                    0x03 if name.is_none() => {
-                        name = Some(String::from_utf8_lossy(data).into_owned());
-                    }
-                    0x06 => g.markers.push((tick, String::from_utf8_lossy(data).into_owned())),
-                    0x51 => {
-                        if let [a, b, c] = data {
-                            let us = (u32::from(*a) << 16) | (u32::from(*b) << 8) | u32::from(*c);
-                            if us > 0 {
-                                g.tempos.push((tick, 60_000_000.0 / f64::from(us)));
-                            }
-                        }
-                    }
-                    0x58 => {
-                        if let [nn, dd, ..] = data
-                            && *nn > 0
-                            && *dd <= 7
-                        {
-                            g.meters.push((tick, *nn, 1u8 << *dd));
-                        }
-                    }
-                    0x59 => {
-                        if let [sf, mi, ..] = data {
-                            let sf = *sf as i8;
-                            if (-7..=7).contains(&sf) {
-                                g.key_sigs.push((tick, sf, *mi == 1));
-                            }
-                        }
-                    }
-                    _ => {}
-                }
-            }
-            0xF0 | 0xF7 => {
-                running = None;
-                let len = cur.vlq()?;
-                cur.bytes(usize::try_from(len).unwrap_or(usize::MAX))?;
-            }
-            0x80..=0xEF => {
-                running = Some(status);
-                let channel = status & 0x0F;
-                let d1 = cur.u8()?;
-                if d1 & 0x80 != 0 {
-                    return Err(MidiError::Invalid { offset: event_at, reason: "status byte where a data byte was expected" });
-                }
-                let needs_two = !matches!(status & 0xF0, 0xC0 | 0xD0);
-                let d2 = if needs_two {
-                    let d = cur.u8()?;
-                    if d & 0x80 != 0 {
-                        return Err(MidiError::Invalid { offset: event_at, reason: "status byte where a data byte was expected" });
-                    }
-                    d
-                } else {
-                    0
-                };
-                match status & 0xF0 {
-                    0x80 => close_note(&mut open, &mut seq.notes, channel, d1, tick, d2),
-                    0x90 if d2 == 0 => close_note(&mut open, &mut seq.notes, channel, d1, tick, DEFAULT_RELEASE),
-                    0x90 => {
-                        if let Some(stack) = open.get_mut(usize::from(channel) * 128 + usize::from(d1)) {
-                            stack.push_back((tick, d2));
-                        }
-                    }
-                    0xA0 => seq.ctrls.push(CtrlEvent { tick, channel, kind: CtrlKind::PolyPressure(d1), value: i32::from(d2) }),
-                    0xB0 => seq.ctrls.push(CtrlEvent { tick, channel, kind: CtrlKind::Cc(d1), value: i32::from(d2) }),
-                    0xC0 => seq.ctrls.push(CtrlEvent { tick, channel, kind: CtrlKind::Program, value: i32::from(d1) }),
-                    0xD0 => seq.ctrls.push(CtrlEvent { tick, channel, kind: CtrlKind::ChannelPressure, value: i32::from(d1) }),
-                    _ => {
-                        // 0xE0 pitch bend: LSB then MSB, centred on 8192.
-                        let v = (i32::from(d2) << 7 | i32::from(d1)) - 8192;
-                        seq.ctrls.push(CtrlEvent { tick, channel, kind: CtrlKind::PitchBend, value: v });
-                    }
-                }
-            }
-            _ => return Err(MidiError::Invalid { offset: event_at, reason: "system real-time/common status in a track" }),
-        }
-    }
-
-    // Close hanging notes at the end of the track.
-    for (key, stack) in open.iter_mut().enumerate() {
-        let channel = u8::try_from(key / 128).unwrap_or(0);
-        let pitch = u8::try_from(key % 128).unwrap_or(0);
-        for (start, velocity) in stack.drain(..) {
-            let length = tick.saturating_sub(start).max(1);
-            seq.notes.push(Note { pitch, velocity, release_velocity: DEFAULT_RELEASE, channel, start, length });
-        }
-    }
-    seq.sort();
-    Ok(SmfTrack { name: name.unwrap_or_default(), sequence: seq })
-}
-
-// ---------------------------------------------------------------------------------------------
-// Writing
-// ---------------------------------------------------------------------------------------------
-
-const MAX_VLQ: u64 = 0x0FFF_FFFF;
-
-fn push_vlq(out: &mut Vec<u8>, v: u64) -> Result<(), MidiError> {
-    if v > MAX_VLQ {
-        return Err(MidiError::Write(format!("value {v} does not fit in a MIDI variable-length quantity")));
-    }
-    let mut buf = [0u8; 4];
-    let mut n = 0;
-    let mut x = v;
-    loop {
-        if let Some(slot) = buf.get_mut(n) {
-            *slot = (x & 0x7F) as u8;
-        }
-        n += 1;
-        x >>= 7;
-        if x == 0 || n == 4 {
-            break;
-        }
-    }
-    for i in (0..n).rev() {
-        let b = buf.get(i).copied().unwrap_or(0);
-        out.push(if i > 0 { b | 0x80 } else { b });
-    }
-    Ok(())
-}
-
-/// An event ready to be serialised: `(tick, order, bytes)`. `order` breaks ties at one tick.
-struct WEvent {
-    tick: u64,
-    order: u8,
-    bytes: Vec<u8>,
-}
-
-fn clamp_tick(t: i64) -> u64 {
-    u64::try_from(t.max(0)).unwrap_or(0)
-}
-
-fn meta(kind: u8, data: &[u8]) -> Result<Vec<u8>, MidiError> {
-    let mut b = vec![0xFF, kind];
-    push_vlq(&mut b, u64::try_from(data.len()).unwrap_or(u64::MAX))?;
-    b.extend_from_slice(data);
-    Ok(b)
-}
-
-fn write_track(out: &mut Vec<u8>, mut events: Vec<WEvent>) -> Result<(), MidiError> {
-    events.sort_by_key(|e| (e.tick, e.order));
-    let mut body = Vec::new();
-    let mut last_tick = 0u64;
-    let mut running: Option<u8> = None;
-    for e in &events {
-        push_vlq(&mut body, e.tick - last_tick)?;
-        last_tick = e.tick;
-        let status = e.bytes.first().copied().unwrap_or(0);
-        if (0x80..=0xEF).contains(&status) {
-            if running == Some(status) {
-                body.extend_from_slice(e.bytes.get(1..).unwrap_or(&[]));
-            } else {
-                body.extend_from_slice(&e.bytes);
-            }
-            running = Some(status);
-        } else {
-            running = None;
-            body.extend_from_slice(&e.bytes);
-        }
-    }
-    // End of Track.
-    body.extend_from_slice(&[0x00, 0xFF, 0x2F, 0x00]);
-    let len = u32::try_from(body.len()).map_err(|_| MidiError::Write("track larger than 4 GiB".into()))?;
-    out.extend_from_slice(b"MTrk");
-    out.extend_from_slice(&len.to_be_bytes());
-    out.extend_from_slice(&body);
-    Ok(())
-}
-
-/// The conductor track: tempos, meters, key signatures and markers.
-fn conductor_events(smf: &Smf) -> Result<Vec<WEvent>, MidiError> {
-    let mut ev = Vec::new();
-    for &(t, bpm) in &smf.tempos {
-        if !bpm.is_finite() || bpm <= 0.0 {
-            return Err(MidiError::Write(format!("invalid tempo {bpm} bpm")));
-        }
-        let us = (60_000_000.0 / bpm).round().clamp(1.0, f64::from(0x00FF_FFFFu32)) as u32;
-        let [_, a, b, c] = us.to_be_bytes();
-        ev.push(WEvent { tick: clamp_tick(t), order: 0, bytes: meta(0x51, &[a, b, c])? });
-    }
-    for &(t, num, den) in &smf.meters {
-        if den == 0 || !den.is_power_of_two() {
-            return Err(MidiError::Write(format!("meter denominator {den} is not a power of two")));
-        }
-        let dd = den.trailing_zeros() as u8;
-        ev.push(WEvent { tick: clamp_tick(t), order: 1, bytes: meta(0x58, &[num, dd, 24, 8])? });
-    }
-    for &(t, sf, minor) in &smf.key_sigs {
-        let sf = sf.clamp(-7, 7);
-        ev.push(WEvent { tick: clamp_tick(t), order: 2, bytes: meta(0x59, &[sf as u8, u8::from(minor)])? });
-    }
-    for (t, text) in &smf.markers {
-        ev.push(WEvent { tick: clamp_tick(*t), order: 3, bytes: meta(0x06, text.as_bytes())? });
-    }
-    Ok(ev)
-}
-
-/// Trim notes still sounding when the next same-pitch note starts, and drop duplicates.
-fn trim_overlaps(notes: &[Note], ends: &mut [u64], dropped: &mut [bool]) {
-    // The reader pairs offs with ons first-in first-out, so a note still sounding when the next
-    // same-pitch note starts would swap ends with it: trim it to that start. When two same-pitch
-    // notes start on the same tick they cannot be told apart, so only the longer one is written.
-    let mut order: Vec<usize> = (0..notes.len()).collect();
-    order.sort_by_key(|&i| {
-        notes.get(i).map_or((0, 0, 0, std::cmp::Reverse(0)), |n| {
-            (n.channel & 0x0F, n.pitch.min(127), clamp_tick(n.start), std::cmp::Reverse(ends.get(i).copied().unwrap_or(0)))
-        })
-    });
-    let mut prev: Option<usize> = None;
-    for &b in &order {
-        let Some(nb) = notes.get(b) else { continue };
-        if let Some(a) = prev
-            && let Some(na) = notes.get(a)
-            && na.channel & 0x0F == nb.channel & 0x0F
-            && na.pitch.min(127) == nb.pitch.min(127)
-        {
-            let (sa, sb) = (clamp_tick(na.start), clamp_tick(nb.start));
-            if sa == sb {
-                if let Some(d) = dropped.get_mut(b) {
-                    *d = true;
-                }
-                continue;
-            }
-            if let Some(ea) = ends.get_mut(a)
-                && sb < *ea
-            {
-                *ea = sb;
-            }
-        }
-        prev = Some(b);
-    }
-}
-
-/// Writes a format-1 Standard MIDI File at [`PPQ`] (960) ticks per quarter note.
-///
-/// Track 1 is a conductor track holding tempos, meters, key signatures and markers; every
-/// [`SmfTrack`] follows as its own track. Negative ticks are clamped to 0, data values are
-/// clamped to their MIDI ranges, and note-on velocity 0 is written as 1 (0 would mean
-/// note-off). At each tick note-offs are written before controllers, then note-ons.
-///
-/// Errors: invalid tempo (non-finite or <= 0 bpm), meter denominator that is not a power of two
-/// (1..=128), more than 65535 tracks, or a gap between events beyond the 28-bit delta limit.
-pub fn write_smf(smf: &Smf) -> Result<Vec<u8>, MidiError> {
-    // The conductor track is omitted when there is nothing to put in it and no content tracks, so an
-    // empty `Smf` is written as a file with zero tracks and reads back as zero tracks.
-    let has_conductor =
-        !(smf.tempos.is_empty() && smf.meters.is_empty() && smf.key_sigs.is_empty() && smf.markers.is_empty() && smf.tracks.is_empty());
-    let ntrks =
-        u16::try_from(smf.tracks.len().saturating_add(usize::from(has_conductor))).map_err(|_| MidiError::Write("more than 65535 tracks".into()))?;
-    let mut out = Vec::new();
-    out.extend_from_slice(b"MThd");
-    out.extend_from_slice(&6u32.to_be_bytes());
-    out.extend_from_slice(&1u16.to_be_bytes());
-    out.extend_from_slice(&ntrks.to_be_bytes());
-    out.extend_from_slice(&u16::try_from(PPQ).unwrap_or(960).to_be_bytes());
-
-    // Conductor track.
-    let ev = conductor_events(smf)?;
-    if has_conductor {
-        write_track(&mut out, ev)?;
-    }
-
-    for track in &smf.tracks {
-        let mut ev = Vec::new();
-        if !track.name.is_empty() {
-            ev.push(WEvent { tick: 0, order: 0, bytes: meta(0x03, track.name.as_bytes())? });
-        }
-        let notes = &track.sequence.notes;
-        let mut ends: Vec<u64> = notes.iter().map(|n| clamp_tick(n.end()).max(clamp_tick(n.start).saturating_add(1))).collect();
-        let mut dropped = vec![false; notes.len()];
-        trim_overlaps(notes, &mut ends, &mut dropped);
-        for (i, n) in notes.iter().enumerate() {
-            if dropped.get(i).copied().unwrap_or(false) {
-                continue;
-            }
-            let ch = n.channel & 0x0F;
-            let pitch = n.pitch.min(127);
-            let start = clamp_tick(n.start);
-            let end = ends.get(i).copied().unwrap_or(start.saturating_add(1));
-            ev.push(WEvent { tick: start, order: 3, bytes: vec![0x90 | ch, pitch, n.velocity.clamp(1, 127)] });
-            ev.push(WEvent { tick: end, order: 1, bytes: vec![0x80 | ch, pitch, n.release_velocity.min(127)] });
-        }
-        for c in &track.sequence.ctrls {
-            let ch = c.channel & 0x0F;
-            let v7 = c.value.clamp(0, 127) as u8;
-            let bytes = match c.kind {
-                CtrlKind::Cc(num) => vec![0xB0 | ch, num.min(127), v7],
-                CtrlKind::Program => vec![0xC0 | ch, v7],
-                CtrlKind::ChannelPressure => vec![0xD0 | ch, v7],
-                CtrlKind::PolyPressure(p) => vec![0xA0 | ch, p.min(127), v7],
-                CtrlKind::PitchBend => {
-                    let v = (c.value.saturating_add(8192)).clamp(0, 16383);
-                    vec![0xE0 | ch, (v & 0x7F) as u8, ((v >> 7) & 0x7F) as u8]
-                }
-            };
-            ev.push(WEvent { tick: clamp_tick(c.tick), order: 2, bytes });
-        }
-        write_track(&mut out, ev)?;
-    }
-    Ok(out)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn vlq_round_trip() {
-        for v in [0u64, 0x40, 0x7F, 0x80, 0x2000, 0x3FFF, 0x4000, 0x1F_FFFF, 0x20_0000, MAX_VLQ] {
-            let mut b = Vec::new();
-            push_vlq(&mut b, v).unwrap();
-            let mut c = Cursor { data: &b, pos: 0, base: 0 };
-            assert_eq!(u64::from(c.vlq().unwrap()), v);
-            assert!(c.is_empty());
-        }
-        assert!(push_vlq(&mut Vec::new(), MAX_VLQ + 1).is_err());
-    }
-
-    #[test]
-    fn empty_smf_round_trips_with_no_tracks() {
-        let r = read_smf(&write_smf(&Smf::default()).unwrap()).unwrap();
-        assert_eq!(r.tracks.len(), 0);
-        let one = Smf { tracks: vec![SmfTrack::default()], ..Smf::default() };
-        let r = read_smf(&write_smf(&one).unwrap()).unwrap();
-        assert_eq!(r.tracks.len(), 1);
-        let cond = Smf { tempos: vec![(0, 90.0)], ..Smf::default() };
-        let r = read_smf(&write_smf(&cond).unwrap()).unwrap();
-        assert_eq!(r.tracks.len(), 0);
-        assert_eq!(r.tempos.len(), 1);
-    }
-
-    #[test]
-    fn spec_vlq_examples() {
-        let mut b = Vec::new();
-        push_vlq(&mut b, 0x0800_0000).unwrap();
-        assert_eq!(b, [0xC0, 0x80, 0x80, 0x00]);
-        let mut b = Vec::new();
-        push_vlq(&mut b, 0x2000).unwrap();
-        assert_eq!(b, [0xC0, 0x00]);
-    }
-
-    #[test]
-    fn same_pitch_overlaps_do_not_swap_ends() {
-        let mk = |start, length| Note { pitch: 60, velocity: 100, release_velocity: 64, channel: 0, start, length };
-        let smf = Smf {
-            format: 1,
-            tracks: vec![SmfTrack {
-                name: String::new(),
-                sequence: Sequence { notes: vec![mk(0, 1000), mk(100, 200), mk(1000, 100), mk(2000, 500), mk(2000, 900)], ..Sequence::default() },
-            }],
-            tempos: vec![],
-            meters: vec![],
-            markers: vec![],
-            key_sigs: vec![],
-        };
-        let back = read_smf(&write_smf(&smf).unwrap()).unwrap();
-        let mut got: Vec<(i64, i64)> = back.tracks.iter().flat_map(|t| t.sequence.notes.iter().map(|n| (n.start, n.length))).collect();
-        got.sort_unstable();
-        // The earlier note is trimmed to the start of the next same-pitch note; later notes keep their length;
-        // of two notes starting together only the longer survives.
-        assert_eq!(got, vec![(0, 100), (100, 200), (1000, 100), (2000, 900)]);
-    }
-}
@@ -1,4 +1,3 @@
 //! Integration tests, built as one test binary: each file is a module.

 mod ops;
-mod smf;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Dylan M. Taylor	0a166a5d00	ci: verify the actions lockfile in CI Fails the build when .github/workflows/actions.lock stops matching the workflows, or when a locked pin no longer verifies upstream, so a stale or tampered lockfile cannot go unnoticed between dependency updates.	2026-11-12 07:23:19 -05:00
Dylan M. Taylor	220b42773d	ci: lock workflow actions through an actions.lock lockfile Mutable action tags are a supply-chain risk: a moved tag runs different code without a diff. Every workflow action is now pinned through .github/workflows/actions.lock, and CI verifies the lockfile so an out-of-sync or tampered one fails instead of running.	2026-11-12 07:18:10 -05:00
Dylan M. Taylor	6a0949d9d0	Review fixes after the craft-audio switch; MIDI files from craft-midi (#1513 ) * Review fixes after the craft-audio switch; pin craft-audio at craft-libs main Follow-up to #1506, for its review comments: - convert: a decode that concealed damaged packets is reported as a warning, and --in-place refuses to replace the source with it. - convert: the decoded speaker layout goes to the encoder, so 5.1 with side surrounds stays side surrounds in WAV and FLAC. - FileFormat::of names an MP4 or QuickTime file by its codec: AAC or HE-AAC is Aac, ALAC is Alac, anything else (Opus, AC-3, PCM) is Other. - Bounce keeps a picked extension that already names the format (Mix.aifc, Mix.AIFF), so the file written is the one the save dialog confirmed. - rust-version is 1.95: craft-audio, craft-media and craft-ui declare it, so 1.90 was not a version the workspace builds with. craft-audio and craft-media move to craft-libs main 7db4645d. * MIDI: take Standard MIDI Files and the sequence model from craft-midi craft-midi in craft-libs was moved from this crate (storytold/craft-libs#884): smf.rs, sequence.rs, the error type and their tests. soundcraft-midi now re-exports them, so every caller keeps its imports, and keeps what is SoundCraft's own: the editing operations, the display names and XorShift. The SMF and Sequence tests are deleted here; they run in craft-midi, which also adds one for the track limit. The serde names do not change (the same derives behind craft-midi's serde feature), so sessions read as before.	2026-11-11 19:51:41 -05:00
Dylan M. Taylor	4782cfa600	chore: bump to 0.20.1 for the Flatpak updater patch release (#1512 )	2026-11-11 19:16:01 -05:00
Dylan M. Taylor	91952090ec	Take audio file formats from craft-audio; remove crates/audio-io (#1506 ) craft-audio in craft-libs was built from audio-io and FilmCraft's codecs, so each format has one implementation that every Craft app shares. Call sites use its API directly: EncodeOptions::new(format).with_*(), EncodeFormat, DECODE_EXTENSIONS, ENCODE_EXTENSIONS, encode_format_for, AudioInfo's container, codec and layout. soundcraft_model::FileFormat stays as the kind of file a session records for each source: its variant names are part of the session format. It maps from craft-audio's AudioInfo. craft-audio and craft-media are pinned to the craft-libs branch of storytold/craft-libs#824, which adds the extension tables SoundCraft had in FileFormat and fixes the quadratic WAV chunk scan (#893). Behaviour that changes: AAC, ALAC, Opus, AC-3/E-AC-3 and MP2 decode with craft-audio's own decoders; MP4 and Matroska tracks import at their presentation length; .opus, .ac3, .eac3, .ec3, .mov, .mka and .mpa are importable names; .aifc is a writable name; FLAC files come from craft-audio's encoder.	2026-11-11 18:46:56 -05:00
FredAppsandFredApps	55c89b364d	Release: SoundCraft v0.20.0 on main (#1511 ) Co-authored-by: FredApps <FredApps@users.noreply.github.com>	2026-11-11 23:20:08 +01:00
FredApps	eeb5d653a5	CI: nightly release dry run (#1508 ) release.yml also runs nightly on main with craft-common-actions' dry-run: every release build except macOS, with nothing signed, pushed or drafted. Breakage that only the release build hits (riscv64, Flatpak, FreeBSD, packaging) then shows up the next morning instead of on release day, as it did on 11 Nov 2026.	2026-11-11 23:04:40 +01:00
Dylan M. Taylor	c25b12ba46	Engine I/O: exclusive output files, read-checked probes, resolved clip-group paths (#1328 ) * fix(engine): create output files exclusively and check read access before probing * address review: canonicalize through the checked io gateway, treat any occupied export name as taken * address review: read group audio through the validated file handle * address review: document that a write-only root writes a new numbered WAV per save * address review: clip-group audio is opened without waiting for a FIFO writer	2026-11-11 16:15:08 -05:00
Dylan M. Taylor	296bfbb2e1	Strip Silence: cut and remove pieces in one pass over the playlist (#1349 ) * Strip Silence: cut and remove pieces in one pass over the playlist * address review: document the sorted-points order and test stretched audio offsets	2026-11-11 16:14:42 -05:00
Dylan M. Taylor	f7a5adb474	ui: read-check movie paths, regular files only, private take folder (#1337 ) * fix(ui): check movie read access and file type; private take folder without settings * address review: make the fallback take folder exclusively under an unguessable name; qualify the owner-only claim to Unix * address review: unique folder prefix must be one name; no fallback take folder for a saved session * add tests for the take folder and the movie open checks	2026-11-11 16:14:17 -05:00
Dylan M. Taylor	23242338a6	ui: bound MIDI grid lines and Video Universe thumbnails per repaint (#1336 ) * fix(ui): bound MIDI grid lines and Video Universe thumbnails per repaint * address review: grid fallback stays on snap positions and bars; thumbnail positions in f64 * address review: no thumbnails for an empty shown span	2026-11-11 16:13:52 -05:00
Dylan M. Taylor	e01ea00cdd	audio-io: cap decoder packet samples and MP4 audio timing runs (#1332 ) * fix(audio-io): bound packet samples and MP4 audio timing runs * address review: decide MP4 audio timing bound from the stsd entry and bound PCM packets by their byte size * address review: the last stsd in a stbl decides whether the stts bound applies	2026-11-11 16:13:28 -05:00
Dylan M. Taylor	659ec7a8e2	Video: check MJPEG frame size before decoding; budget each H.264 frame request (#1326 ) * fix(video): check MJPEG frame size from its header and budget H.264 frame requests * address review: check the sample budget before reading, keep the decoder from skipping a refused sample, stop on a failed read * address review: restore lenient MJPEG sizing and unreadable-sample skipping; per-request sample cap 2 GiB * address review: an unreadable sample counts toward the no-picture budget	2026-11-11 16:13:03 -05:00
FredApps	90e069f626	Merge pull request #1492 from istefp/fix/io-menu-search I/O menus: the search finds the hardware inputs, the main output and no route, not just buses	2026-11-11 21:06:43 +01:00
FredApps	7a4f9c911d	Merge pull request #1490 from istefp/fix/long-menu-scroll Main menu: a menu taller than the window scrolls	2026-11-11 21:06:25 +01:00
Dylan M. Taylor	60f97a99a5	chore: bump version to 0.19.1 for the Flatpak update fix (#1507 )	2026-11-11 14:56:05 -05:00
FredApps	d255ca4fe9	Merge pull request #1436 from Silvertree2010/fix/1433-separate-splits-locked-clips-edi Keep time- and edit-locked clips whole on separate and range edits	2026-11-11 20:37:20 +01:00
FredApps	1fe1d06073	test: cover Event time edits on locked clips	2026-11-11 20:24:33 +01:00
Dylan M. Taylor	10e4bc7b87	Fix Flatpak permissions for update checks and self-updates (#1504 ) * fix(flatpak): allow release checks and self-update helpers * test: keep Flatpak permission parsing within strict Clippy rules	2026-11-11 14:19:10 -05:00
Max Mittelstädt GPT-6-Luna FredApps	1d696bb3ef	Replace hard-linked export destinations (#1360 ) * Replace hard-linked export destinations Fixes #1359 Co-Authored-By: GPT-6-Luna <noreply@openai.com> * fix(engine): preserve export links and private permissions * fix(io): preserve export security by refusing hard-linked destinations * test(automation): require safe hard-link export refusal on Windows and Unix --------- Co-authored-by: GPT-6-Luna <noreply@openai.com> Co-authored-by: FredApps <FredApps@users.noreply.github.com>	2026-11-11 20:04:44 +01:00
istefpandPatrick Istefanidis	f780dcab37	Main menu test: scroll to the Options menu's last entry, not its last submenu (#1482 ) Co-Authored-By: Patrick Istefanidis <smallroomproductionsfl@gmail.com>	2026-11-11 14:37:44 +00:00
istefpandPatrick Istefanidis	2c042c599f	I/O menus: the search finds the hardware inputs, the main output and no route, not just buses (#1491 ) Co-Authored-By: Patrick Istefanidis <smallroomproductionsfl@gmail.com>	2026-11-11 05:21:27 +00:00
istefpandPatrick Istefanidis	e94a7875d3	Main menu: a menu taller than the window scrolls (#1482 ) Co-Authored-By: Patrick Istefanidis <smallroomproductionsfl@gmail.com>	2026-11-11 05:06:26 +00:00
NetterSilverandClaude Opus 5.5	654deabd54	Keep time- and edit-locked clips whole on separate and range edits Fixes #1433 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 02:41:54 +00:00