Mux decrypt/verify redesign, HD DVD first-class, MVC 3D

decrypt:
- decrypt_sectors is now a pure decrypt (apply key, leave plaintext, report
  unverified bytes); TS-structure is a separate primitive (is_clean_ts/ps) used
  only for key selection and read-verify. The mux passes decrypted bytes through
  (the demuxer drops non-conforming packets), ending the NULL-TS conceal loop and
  the per-unit key-server refetch storm. Key-proof floor replaces the 75%
  supermajority.

recovery:
- Removed the post-read decrypt-verify gate (verify.rs) that mis-aligned the
  disc-absolute unit grid against clip-anchored AACS units and false-failed good
  clips (e.g. Dunkirk's orphan-CPS clip). Bad sectors are marked by physical read
  result; decryptability is proven at scan + mux time.

HD DVD (first-class AACS):
- Role-based candidate-list file sourcing so an HD DVD's /ANY!/ files
  (MKBROM.AACS, VTKF000.AACS, CONTENT_CERT.AACS) are found with no disc-type
  branch. parse_vtkf parses VTKF000.AACS into the same UnitKeyFile as a BD
  Unit_Key_RO.inf, so the shared VUK unwrap applies unchanged. set_unit_base
  clip-anchoring. Two decrypt-axis assumptions remain UNVERIFIED-HDDVD-DECRYPT
  (no encrypted disc to test).

mux:
- MVC (Blu-ray 3D) track signals unified into one MVCDecoderConfigurationRecord;
  release-safe track_vint (3-byte VINT) and pid_index (i32) guards.

hardening:
- Container-aware is_clean / encryption detection; bytes_bad_in_title fail-safe
  on a corrupt mapfile; CSS crack gated on DiscFormat::Dvd (HD DVD excluded);
  non-vacuous CSS tests; patch NOT_READY/HARDWARE/ILLEGAL_REQUEST/ABORTED
  sense-path tests.

src/aacs/derive.rs

@@ -463,7 +463,7 @@ pub enum KeyCandidate {
 /// PURE DERIVATION — no unit sampling, no validation. `unit_keys` holds every
 /// CPS-unit key the disc's `Unit_Key_RO.inf` yields from the VUK (paired with
 /// its declared CPS-unit number); the caller runs
-/// [`super::content::unit_key_validates`] to find which one actually opens the
+/// `decrypt_unit` + `is_clean_ts` to find which one actually opens the
 /// disc. Rungs above the candidate are `None`.
 #[derive(Debug, Clone)]
 pub struct ResolvedChain {
@@ -487,7 +487,7 @@ pub struct ResolvedChain {
 ///
 /// PURE DERIVATION: no sampling, no validation, no position recovery. Validate
 /// `unit_keys` against a real encrypted unit with
-/// [`super::content::unit_key_validates`] to prove the candidate opens the disc.
+/// `decrypt_unit` + `is_clean_ts` to prove the candidate opens the disc.
 ///
 /// Returns `None` only when derivation itself cannot proceed: a PK its MKB
 /// rejects, a `Dk` the MKB can't process, a missing VID on a path that needs
@@ -505,7 +505,8 @@ pub fn resolve_candidate(
         let version = mkb_type(mkb)
             .map(|t| t.generation())
             .unwrap_or(AacsVersion::V10);
-        let ukf = parse_unit_key_ro(unit_key_ro, version)?;
+        // BD/UHD Unit_Key_RO.inf or HD DVD VTKF000.AACS — dispatched by magic.
+        let ukf = parse_title_keys(unit_key_ro, version)?;
         if ukf.encrypted_keys.is_empty() {
             return None;
         }

src/aacs/inf.rs

@@ -161,6 +161,87 @@ pub fn parse_unit_key_ro(data: &[u8], version: AacsVersion) -> Option<UnitKeyFil
     })
 }
 
+/// HD DVD Video Title Key File (`VTKF000.AACS`) magic — "DVD HD Video TKF".
+pub const VTKF_MAGIC: &[u8; 12] = b"DVD_HD_V_TKF";
+/// Fixed header length before the first title-key entry.
+const VTKF_HEADER_LEN: usize = 0x80;
+/// Each title-key entry: BE32 flag + 16-byte encrypted key + 12-byte 0xFF pad.
+const VTKF_ENTRY_LEN: usize = 0x20;
+
+/// Parse an HD DVD `VTKF000.AACS` into the SAME [`UnitKeyFile`] a BD/UHD
+/// `Unit_Key_RO.inf` yields — so the shared AACS crypto (`derive_unit_keys` →
+/// `decrypt_unit_key(vuk, …)`) unwraps HD DVD title keys with no change. Only
+/// the on-disc CONTAINER differs between BD and HD DVD; the title-key unwrap is
+/// the identical AES-128 VUK step (`Kt = AES-128D(Kvu, Kte)`).
+///
+/// Layout (grounded in real discs — Shaun of the Dead, Anchorman, Harry Potter):
+/// ```text
+///   [0x00..0x0C] magic "DVD_HD_V_TKF"
+///   [0x0C..0x10] BE32 total file length
+///   [0x10..0x1C] associated playlist name ("VPLST000.XPL")
+///   [0x1C..0x80] reserved (zero)
+///   [0x80..]     32-byte entries: BE32 flag | 16-byte ENCRYPTED title key | 12-byte 0xFF pad
+///                flag bit 31 (0x8000_0000) set = present; a cleared flag ends the table
+///   [tail]       16-byte signature/MAC (never a key — the cleared-flag stop guards it)
+/// ```
+/// Entries number 1..=N as CPS units, matching `Unit_Key_RO`'s 1-based CPS
+/// numbering, so a title's CPS unit indexes this list identically. The
+/// title→CPS mapping itself is playlist-driven (`VPLST000.XPL`) and owned by the
+/// HD DVD enumerator, so `title_cps_unit` is left empty here.
+pub fn parse_vtkf(data: &[u8]) -> Option<UnitKeyFile> {
+    if data.len() < VTKF_HEADER_LEN || &data[..12] != VTKF_MAGIC {
+        return None;
+    }
+    // SHA1 of the WHOLE file — the KEYDB lookup key. BackupHDDVD-family key
+    // databases index an HD DVD disc by SHA1(VTKF000.AACS), the same role the
+    // BD disc_hash plays for `Unit_Key_RO.inf`.
+    let hash = disc_hash(data);
+
+    let mut encrypted_keys = Vec::new();
+    let mut pos = VTKF_HEADER_LEN;
+    let mut cps: u32 = 1;
+    while pos + VTKF_ENTRY_LEN <= data.len() {
+        let flag = u32::from_be_bytes([data[pos], data[pos + 1], data[pos + 2], data[pos + 3]]);
+        // A cleared present-bit terminates the key table. The file's trailing
+        // 16-byte signature then follows and must NOT be read as a key.
+        if flag & 0x8000_0000 == 0 {
+            break;
+        }
+        let mut key = [0u8; 16];
+        key.copy_from_slice(&data[pos + 4..pos + 20]);
+        encrypted_keys.push((cps, key));
+        cps += 1;
+        pos += VTKF_ENTRY_LEN;
+    }
+    if encrypted_keys.is_empty() {
+        return None;
+    }
+
+    Some(UnitKeyFile {
+        disc_hash: hash,
+        app_type: 0,     // HD DVD VTKF carries no BD-ROM app_type
+        num_bdmv_dir: 0, // BD-only concept
+        use_skb_mkb: false,
+        version: AacsVersion::V10, // HD DVD is always AACS 1.0
+        encrypted_keys,
+        title_cps_unit: Vec::new(),
+    })
+}
+
+/// Parse a disc's title-key file, dispatching on the self-describing magic:
+/// an HD DVD `VTKF000.AACS` (`DVD_HD_V_TKF`) → [`parse_vtkf`]; anything else is a
+/// BD/UHD `Unit_Key_RO.inf` → [`parse_unit_key_ro`]. Both return the same
+/// [`UnitKeyFile`], so every downstream AACS derivation stays container-agnostic
+/// — the single seam where BD-vs-HD-DVD key layout is resolved (mirrors the key
+/// service, which classifies HD DVD by the very same magic).
+pub fn parse_title_keys(data: &[u8], version: AacsVersion) -> Option<UnitKeyFile> {
+    if data.len() >= 12 && &data[..12] == VTKF_MAGIC {
+        parse_vtkf(data)
+    } else {
+        parse_unit_key_ro(data, version)
+    }
+}
+
 /// MKB disc structure format code.
 const MKB_DISC_STRUCTURE_FORMAT: u8 = 0x83;
 
@@ -283,3 +364,94 @@ pub fn parse_content_cert(data: &[u8]) -> Option<ContentCert> {
         version,
     })
 }
+
+#[cfg(test)]
+mod vtkf_tests {
+    use super::*;
+
+    /// Build a synthetic `VTKF000.AACS` matching the real on-disc layout
+    /// (Shaun of the Dead / Anchorman): magic, BE32 size, playlist name,
+    /// reserved to 0x80, then 32-byte present-flagged entries, a cleared-flag
+    /// terminator, and a 16-byte trailer.
+    fn synth_vtkf(keys: &[[u8; 16]]) -> Vec<u8> {
+        let mut v = Vec::new();
+        v.extend_from_slice(VTKF_MAGIC); // 0x00
+        v.extend_from_slice(&0u32.to_be_bytes()); // 0x0C size (patched below)
+        v.extend_from_slice(b"VPLST000.XPL"); // 0x10
+        v.resize(0x80, 0); // reserve to first entry
+        for k in keys {
+            v.extend_from_slice(&0x8000_0000u32.to_be_bytes()); // present flag
+            v.extend_from_slice(k); // 16-byte encrypted title key
+            v.extend_from_slice(&[0xFFu8; 12]); // 0xFF pad → 32-byte entry
+        }
+        // Cleared-flag terminator entry (must NOT be read as a key).
+        v.extend_from_slice(&[0u8; VTKF_ENTRY_LEN]);
+        // 16-byte trailing signature (must NOT be read as a key).
+        v.extend_from_slice(&[0xABu8; 16]);
+        let len = v.len() as u32;
+        v[0x0C..0x10].copy_from_slice(&len.to_be_bytes());
+        v
+    }
+
+    #[test]
+    fn parse_vtkf_extracts_present_entries_and_stops_at_terminator() {
+        let k1 = [0x11u8; 16];
+        let k2 = [0x22u8; 16];
+        let k3 = [0x33u8; 16];
+        let data = synth_vtkf(&[k1, k2, k3]);
+
+        let ukf = parse_vtkf(&data).expect("valid VTKF must parse");
+        // Exactly the three present entries — the cleared-flag terminator and
+        // the 16-byte trailer are NOT mistaken for keys.
+        assert_eq!(ukf.encrypted_keys.len(), 3, "must stop at the cleared flag");
+        assert_eq!(ukf.encrypted_keys[0], (1, k1), "CPS units number 1..=N");
+        assert_eq!(ukf.encrypted_keys[1], (2, k2));
+        assert_eq!(ukf.encrypted_keys[2], (3, k3));
+        assert_eq!(ukf.version, AacsVersion::V10, "HD DVD is AACS 1.0");
+        // disc_hash is SHA1 of the whole file (the KEYDB lookup key).
+        assert_eq!(ukf.disc_hash, disc_hash(&data));
+    }
+
+    #[test]
+    fn parse_vtkf_rejects_non_magic() {
+        let mut data = synth_vtkf(&[[0x11u8; 16]]);
+        data[0] = b'X'; // corrupt magic
+        assert!(
+            parse_vtkf(&data).is_none(),
+            "non-VTKF magic must be rejected"
+        );
+        assert!(
+            parse_vtkf(&[0u8; 4]).is_none(),
+            "too short must be rejected"
+        );
+    }
+
+    #[test]
+    fn parse_title_keys_dispatches_by_magic() {
+        // VTKF magic → parse_vtkf.
+        let data = synth_vtkf(&[[0x44u8; 16], [0x55u8; 16]]);
+        let ukf = parse_title_keys(&data, AacsVersion::V10).expect("VTKF dispatch");
+        assert_eq!(ukf.encrypted_keys.len(), 2);
+
+        // Non-VTKF → parse_unit_key_ro (a 2-byte buffer is not a valid inf, so
+        // this proves it ROUTED to the BD parser rather than parse_vtkf).
+        assert!(
+            parse_title_keys(&[0x00, 0x00], AacsVersion::V10).is_none(),
+            "non-magic input must route to parse_unit_key_ro"
+        );
+    }
+
+    /// The whole point of the seam: a parsed VTKF feeds the SHARED VUK→title-key
+    /// crypto (`decrypt_unit_key`) exactly like a BD `Unit_Key_RO.inf` would —
+    /// no HD-DVD-specific crypto path.
+    #[test]
+    fn vtkf_encrypted_keys_feed_shared_vuk_unwrap() {
+        let enc = [0x9Au8; 16];
+        let data = synth_vtkf(&[enc]);
+        let ukf = parse_vtkf(&data).unwrap();
+        let vuk = [0x5Cu8; 16];
+        let derived = super::super::derive::decrypt_unit_key(&vuk, &ukf.encrypted_keys[0].1);
+        // Same as applying the shared unwrap directly to the stored enc key.
+        assert_eq!(derived, super::super::derive::decrypt_unit_key(&vuk, &enc));
+    }
+}

src/aacs/mod.rs

@@ -40,10 +40,18 @@ pub mod types;
 pub mod variant;
 pub mod variant_select;
 
-/// On-disc UDF paths to the AACS key-input files (with their fallbacks).
-/// Centralised so every reader (`resolve_vid_only`, `read_aacs_inputs`,
-/// `read_mkb_content`, `read_aacs_version`) walks the exact same files — adding
-/// or changing a fallback in one place can then never silently diverge the
+/// On-disc UDF paths to the AACS key-input files.
+///
+/// BD and UHD keep their key material under `/AACS/…`; HD DVD keeps the
+/// equivalents under `/ANY!/…` with different names (`VTKF000.AACS` is the
+/// title-key file — magic `DVD_HD_V_TKF`; `MKBROM.AACS` is the MKB). The
+/// container difference is expressed here purely as DATA: each ROLE
+/// ([`UNIT_KEY_RO_PATHS`], [`MKB_PATHS`], [`CONTENT_CERT_PATHS`]) is an ordered
+/// candidate list, and every reader walks it with [`read_first`] taking the
+/// first that reads. No reader ever branches on disc type — a BD/UHD disc has
+/// the `/AACS/` files so those win; an HD DVD has neither, so it falls through
+/// to the `/ANY!/` entry. Centralised so `resolve_vid_only`, `read_aacs_inputs`,
+/// `read_mkb_content`, and `read_aacs_version` can never silently diverge the
 /// disc_hash / MKB / VID that another reader feeds a key service.
 pub const PATH_UNIT_KEY_RO: &str = "/AACS/Unit_Key_RO.inf";
 pub const PATH_UNIT_KEY_RO_DUPLICATE: &str = "/AACS/DUPLICATE/Unit_Key_RO.inf";
@@ -51,6 +59,46 @@ pub const PATH_MKB_RO: &str = "/AACS/MKB_RO.inf";
 pub const PATH_MKB_RW: &str = "/AACS/MKB_RW.inf";
 pub const PATH_CONTENT_CERT: &str = "/AACS/Content000.cer";
 pub const PATH_CONTENT_CERT_ALT: &str = "/AACS/Content001.cer";
+/// HD DVD title-key file (`/ANY!/`), forwarded as `inf_b64`; the key service
+/// recognises it by its `DVD_HD_V_TKF` magic.
+pub const PATH_VTKF_HDDVD: &str = "/ANY!/VTKF000.AACS";
+/// HD DVD Media Key Block (`/ANY!/`), forwarded as `mkb_b64`.
+pub const PATH_MKBROM_HDDVD: &str = "/ANY!/MKBROM.AACS";
+/// HD DVD content certificate (`/ANY!/`); byte 0 gives the AACS major (0x00 → V10).
+pub const PATH_CONTENT_CERT_HDDVD: &str = "/ANY!/CONTENT_CERT.AACS";
+
+/// Title-key / `Unit_Key_RO.inf` role, in resolution order (BD/UHD, then HD DVD).
+pub const UNIT_KEY_RO_PATHS: &[&str] = &[
+    PATH_UNIT_KEY_RO,
+    PATH_UNIT_KEY_RO_DUPLICATE,
+    PATH_VTKF_HDDVD,
+];
+/// MKB role, in resolution order (BD/UHD RO then RW, then HD DVD).
+pub const MKB_PATHS: &[&str] = &[PATH_MKB_RO, PATH_MKB_RW, PATH_MKBROM_HDDVD];
+/// Content-certificate role, in resolution order (BD/UHD, then HD DVD).
+pub const CONTENT_CERT_PATHS: &[&str] = &[
+    PATH_CONTENT_CERT,
+    PATH_CONTENT_CERT_ALT,
+    PATH_CONTENT_CERT_HDDVD,
+];
+
+/// Walk an AACS role's candidate paths and return the first that reads.
+///
+/// `read` performs the actual per-path read (full file or bounded prefix), so
+/// callers share the same first-present walk regardless of read style. Returns
+/// [`Error::AacsNoKeys`] if no candidate is present. This is the single place
+/// the `/AACS/` (BD/UHD) vs `/ANY!/` (HD DVD) layout difference is resolved.
+pub(crate) fn read_first<F>(candidates: &[&str], mut read: F) -> crate::error::Result<Vec<u8>>
+where
+    F: FnMut(&str) -> crate::error::Result<Vec<u8>>,
+{
+    for path in candidates {
+        if let Ok(buf) = read(path) {
+            return Ok(buf);
+        }
+    }
+    Err(crate::error::Error::AacsNoKeys)
+}
 
 // The module structure IS the public API — consumers import from the owning
 // module directly (e.g. `aacs::content::decrypt_unit`, `aacs::mkb::MkbType`,
@@ -61,7 +109,7 @@ pub const PATH_CONTENT_CERT_ALT: &str = "/AACS/Content001.cer";
 // content-decrypt entry points that downstream key-source crates import through
 // the `aacs::` path. These are the stable, load-bearing names; keeping them here
 // lets those crates track the module refactor without a lockstep re-pin.
-pub use content::{ALIGNED_UNIT_LEN, decrypt_unit_try_keys};
+pub use content::ALIGNED_UNIT_LEN;
 pub use derive::derive_vuk;
 pub use types::{DeviceKey, HostCert, MediaKey, ProcessingKey, UnitKey, Vid, Vuk};
 

src/aacs/resolve.rs

@@ -156,7 +156,7 @@ pub fn resolve_keys_v2(ctx: &ResolveContext<'_>) -> Option<ResolvedKeys> {
 /// equivalent of path 2 — there's no host-side PK derivation against a
 /// Variant MKB.)
 pub fn resolve_keys_v21(ctx: &ResolveContext<'_>) -> Option<ResolvedKeys> {
-    let uk_file = parse_unit_key_ro(ctx.unit_key_ro, AacsVersion::V20)?;
+    let uk_file = parse_title_keys(ctx.unit_key_ro, AacsVersion::V20)?;
     let hash_hex = disc_hash_hex(&uk_file.disc_hash);
     let bus_encryption = ctx
         .content_cert
@@ -280,8 +280,9 @@ fn resolve_keys_classical(ctx: &ResolveContext<'_>, version: AacsVersion) -> Opt
         .map(|cc| cc.bus_encryption)
         .unwrap_or(false);
 
-    // Parse Unit_Key_RO.inf at the version-appropriate stride.
-    let uk_file = parse_unit_key_ro(ctx.unit_key_ro, version)?;
+    // Parse the disc's title-key file (BD/UHD Unit_Key_RO.inf at the
+    // version-appropriate stride, or HD DVD VTKF000.AACS) → common UnitKeyFile.
+    let uk_file = parse_title_keys(ctx.unit_key_ro, version)?;
 
     let hash_hex = disc_hash_hex(&uk_file.disc_hash);
     let has_vid = *ctx.volume_id != [0u8; 16];