1.6.0: remove recovery strategy (moved to freemkv-engine) + trim dead surface

The sweep/patch recovery strategy, mapfile, retry-decision state machine,
section-recover, and damage classification move out of libfreemkv into the
new freemkv-engine crate. libfreemkv keeps the raw single-shot read and
SCSI-fact translation (SenseFamily stays in scsi).

- Delete disc/{sweep,patch,mapfile,read_error,section_recover}.rs, the
  Disc::copy/sweep/patch methods, the Copy/Sweep/Patch option+result types,
  classify_damage/DamageSeverity, progress_snapshot_from_mapfile, and the
  three recovery integration tests.
- Trim public surface the recovery deletion orphaned: delete the dead
  READ_PIPELINE_DEPTH const, the write-side SectorSink/FileSectorSink (no
  consumer), and the DriveSpeed enum (its one live use — set max drive
  speed — becomes Drive::SPEED_MAX_KBPS). Make mapfile_path_for,
  decrypt_sectors_mapped pub(crate); gate NoopEvents to test.
- Version 1.6.0.

src/decrypt.rs

@@ -381,7 +381,7 @@ impl AacsKeyMap {
 /// decorator can dispatch uniformly. A map index outside the held pool is a
 /// fail-loud [`Error::DecryptFailed`]: the resolver's job is to guarantee every
 /// selectable index is present, so a gap here is a resolver bug, not silent loss.
-pub fn decrypt_sectors_mapped(
+pub(crate) fn decrypt_sectors_mapped(
     buf: &mut [u8],
     keys: &DecryptKeys,
     base_lba: u32,

src/disc/extract.rs

@@ -1,6 +1,7 @@
 //! `Disc::extract_tree` — decrypted file-tree extraction (`dir://`).
 //!
-//! Sibling of [`Disc::copy`](super::Disc::copy) (disc → ISO sector dump),
+//! Sibling of the disc→ISO sector dump (the sweep/patch recovery passes, which
+//! now live in the `freemkv-engine` crate),
 //! specialized to write **per file** rather than a whole image, applying
 //! decryption on the way out, and **without** any multipass / recovery
 //! orchestration. 1-shot, decrypt-only.

src/disc/sweep.rs

@@ -1,218 +0,0 @@
-//! `Disc::sweep`'s consumer-side `Sink<WorkItem>`.
-//!
-//! Background: the original sweep loop runs strictly serialised —
-//! SCSI read → decrypt → seek + write → mapfile.record → next iter.
-//! On a healthy disc the SCSI read costs ~5-12 ms per 64 KB batch and
-//! the post-read work (decrypt 1-3 ms + file write + mapfile fsync
-//! 5-15 ms) adds another batch's worth of latency. The drive idles
-//! during the post-read work; throughput tops out at the *sum* of
-//! both costs.
-//!
-//! A producer/consumer split overlaps the two stages on the generic
-//! [`crate::io::Pipeline`] + [`crate::io::Sink`] primitive. This module
-//! is the sweep-specific `Sink` impl; the producer-side state machine
-//! (read_error context, decrypt, set_speed, halt) stays in
-//! `Disc::sweep` in `disc/mod.rs`.
-//!
-//! Correctness invariants preserved:
-//! - Mapfile is single-writer (consumer-only). No locking.
-//! - All `read_error::ReadCtx` state stays on the producer thread.
-//! - `set_speed` calls happen on the producer thread (same thread that
-//!   owns the `SectorSource`). No new SCSI concurrency.
-//! - Per-iteration ordering of file-write → mapfile-record is kept
-//!   intact in the consumer (write before record), so the on-disk
-//!   invariant "mapfile only marks Finished what the file has
-//!   received" survives a crash mid-pass.
-//! - Only one SCSI command is in flight at a time; error-path timing
-//!   is identical and no new retry logic is introduced.
-
-use std::io::{Seek, SeekFrom, Write};
-use std::sync::mpsc::{Receiver, SyncSender, sync_channel};
-
-use crate::error::Error;
-use crate::io::{Flow, Sink};
-
-use super::mapfile::{MapStats, Mapfile, SectorStatus};
-
-/// Reusable zero buffer for SkipFill / GapFill / BisectBad. 64 KB
-/// matches the existing zero_gap chunk size used by the pre-split
-/// sweep loop.
-const ZERO_CHUNK: usize = 64 * 1024;
-
-/// Producer → Consumer messages. The consumer applies these in FIFO
-/// order; ordering of file writes and mapfile records across items is
-/// preserved.
-pub(super) enum WorkItem {
-    /// Successful batch read. Producer has already decrypted `buf` if
-    /// `opts.decrypt` was set. Consumer writes `buf` at `pos` and
-    /// records the range as `Finished`.
-    Good { pos: u64, buf: Vec<u8> },
-
-    /// Bisect inner-loop good single sector (already decrypted by the
-    /// producer). 2048 bytes.
-    BisectGood { pos: u64, buf: Box<[u8; 2048]> },
-
-    /// Bisect inner-loop bad single sector. Consumer writes 2048
-    /// zeros at `pos` and records the sector as `NonTrimmed`.
-    BisectBad { pos: u64 },
-
-    /// Whole-batch zero-fill (failed batch on `SkipBlock`, or the
-    /// failed batch portion of `JumpAhead`). Consumer streams zeros
-    /// across `[pos, pos+len)` and records the range as `NonTrimmed`.
-    SkipFill { pos: u64, len: u64 },
-
-    /// Gap fill following a `JumpAhead`. Same effect as `SkipFill`;
-    /// distinguished only so future logging / instrumentation can
-    /// tell them apart without parsing a flag.
-    GapFill { pos: u64, len: u64 },
-
-    /// Producer wants the latest mapfile stats for the progress
-    /// callback. Consumer responds on `prog_tx` with a fresh
-    /// [`ProgressSnapshot`]. Best-effort: if the producer hasn't
-    /// drained the previous snapshot, the new one is silently
-    /// dropped — the producer's local cache stays current enough.
-    StatsRequest,
-}
-
-/// Snapshot the consumer sends back to the producer for the progress
-/// callback.
-pub(super) struct ProgressSnapshot {
-    pub stats: MapStats,
-    pub bad_ranges: Vec<(u64, u64)>,
-}
-
-/// Final summary returned by the consumer thread on shutdown — what
-/// `SweepSink::close` produces, surfaced to the producer via
-/// `Pipeline::finish`.
-pub(super) struct ConsumerSummary {
-    pub stats: MapStats,
-}
-
-/// Drain any pending progress snapshots from the consumer. Returns
-/// the most recent one, if any. The producer caches it and uses it
-/// for subsequent progress callbacks until a fresh one arrives.
-pub(super) fn try_recv_progress(rx: &Receiver<ProgressSnapshot>) -> Option<ProgressSnapshot> {
-    let mut latest = None;
-    while let Ok(snap) = rx.try_recv() {
-        latest = Some(snap);
-    }
-    latest
-}
-
-/// `Sink<WorkItem>` for sweep. Owns the writeback file + mapfile +
-/// progress back-channel. `apply` carries the file-write +
-/// mapfile.record per item; `close` drains the writeback pipeline,
-/// fsyncs the ISO, and flushes the mapfile.
-pub(super) struct SweepSink {
-    file: crate::io::WritebackFile,
-    map: Mapfile,
-    /// `sync_all`-on-failure-is-an-error iff the output is a regular
-    /// file. `/dev/null` and pipes always fail `sync_all`; that's not
-    /// a real error.
-    is_regular: bool,
-    /// Back-channel for `StatsRequest` responses. The producer caches
-    /// the latest snapshot and uses it for the progress callback;
-    /// dropped sends on a full channel are by design.
-    prog_tx: SyncSender<ProgressSnapshot>,
-    /// Reusable zero buffer for SkipFill / GapFill / BisectBad. Held
-    /// in the sink so each apply call doesn't reallocate.
-    zero: Box<[u8; ZERO_CHUNK]>,
-}
-
-impl SweepSink {
-    /// Construct a new `SweepSink` plus the matching progress
-    /// receiver. Channel depth on the back-channel is `1` — the
-    /// producer's cache is the source of truth between snapshots.
-    pub(super) fn new(
-        file: crate::io::WritebackFile,
-        map: Mapfile,
-        is_regular: bool,
-    ) -> (Self, Receiver<ProgressSnapshot>) {
-        let (prog_tx, prog_rx) = sync_channel::<ProgressSnapshot>(1);
-        let sink = SweepSink {
-            file,
-            map,
-            is_regular,
-            prog_tx,
-            zero: Box::new([0u8; ZERO_CHUNK]),
-        };
-        (sink, prog_rx)
-    }
-}
-
-impl Sink<WorkItem> for SweepSink {
-    type Output = ConsumerSummary;
-
-    fn apply(&mut self, item: WorkItem) -> Result<Flow, Error> {
-        match item {
-            WorkItem::Good { pos, buf } => {
-                // Decrypt is on the producer; consumer assumes plaintext.
-                let len = buf.len() as u64;
-                self.file.seek(SeekFrom::Start(pos))?;
-                self.file.write_all(&buf)?;
-                self.map.record(pos, len, SectorStatus::Finished)?;
-            }
-            WorkItem::BisectGood { pos, buf } => {
-                self.file.seek(SeekFrom::Start(pos))?;
-                self.file.write_all(&buf[..])?;
-                self.map.record(pos, 2048, SectorStatus::Finished)?;
-            }
-            WorkItem::BisectBad { pos } => {
-                self.file.seek(SeekFrom::Start(pos))?;
-                self.file.write_all(&self.zero[..2048])?;
-                self.map.record(pos, 2048, SectorStatus::NonTrimmed)?;
-            }
-            WorkItem::SkipFill { pos, len } | WorkItem::GapFill { pos, len } => {
-                self.file.seek(SeekFrom::Start(pos))?;
-                // Subsequent writes are sequential; `WritebackFile`'s
-                // seek-elision keeps them on the writeback pipeline path.
-                let mut filled = 0u64;
-                while filled < len {
-                    let chunk = (len - filled).min(self.zero.len() as u64) as usize;
-                    self.file.write_all(&self.zero[..chunk])?;
-                    filled += chunk as u64;
-                }
-                self.map.record(pos, len, SectorStatus::NonTrimmed)?;
-            }
-            WorkItem::StatsRequest => {
-                let stats = self.map.stats();
-                // DAMAGE only — NOT NonTried. NonTried is the unread remainder
-                // ahead of the sweep head, not damage; including it made the live
-                // located drilldown (at-risk movie time + range count) treat the
-                // whole unread disc as confirmed damage, so at sweep start it
-                // showed ~full-movie at-risk and melted to 0 as the sweep
-                // progressed. Matches the one-shot progress path, which already
-                // excludes NonTried.
-                let bad_ranges = self.map.ranges_with(&[
-                    SectorStatus::NonTrimmed,
-                    SectorStatus::Unreadable,
-                    SectorStatus::NonScraped,
-                ]);
-                // Best-effort: drop on backpressure; producer's cache
-                // stays current enough.
-                let _ = self
-                    .prog_tx
-                    .try_send(ProgressSnapshot { stats, bad_ranges });
-            }
-        }
-        Ok(Flow::Continue)
-    }
-
-    fn close(mut self) -> Result<Self::Output, Error> {
-        // Drain the writeback pipeline + fsync the ISO, then persist
-        // any pending mapfile state. Same finalisation order as the
-        // pre-Pipeline consumer loop.
-        if let Err(e) = self.file.sync_all() {
-            if self.is_regular {
-                return Err(Error::IoError { source: e });
-            }
-            // Non-regular outputs (/dev/null, pipes) always fail
-            // sync_all; that's not a real error.
-        }
-        self.map.flush()?;
-
-        Ok(ConsumerSummary {
-            stats: self.map.stats(),
-        })
-    }
-}

src/drive/mod.rs

@@ -483,7 +483,7 @@ impl Drive {
         // the stock riplock). A stock-mode drive with no firmware unlocker still
         // wants max speed. Best-effort: a failure here must NOT fail the rip.
         if r.is_ok() {
-            self.set_speed(crate::speed::DriveSpeed::Max.to_kbps());
+            self.set_speed(Self::SPEED_MAX_KBPS);
             // Ask the drive to REPORT recovered/marginal reads rather than
             // silently commit best-effort data as GOOD (the dirty-disc
             // "passed-clean-but-decodes-with-errors" trap). Best-effort: a drive
@@ -951,6 +951,9 @@ impl Drive {
         decode_read_capacity(&buf, result.bytes_transferred)
     }
 
+    /// SET CD SPEED "use the drive's maximum" sentinel (0xFFFF KB/s per MMC).
+    pub const SPEED_MAX_KBPS: u16 = 0xFFFF;
+
     pub fn set_speed(&mut self, speed_kbs: u16) {
         let cdb = crate::scsi::build_set_cd_speed(speed_kbs);
         let mut dummy = [0u8; 0];

src/io/mod.rs

@@ -43,6 +43,5 @@ pub mod pipeline;
 pub use writeback_file::WritebackFile;
 
 pub use pipeline::{
-    DEFAULT_PIPELINE_DEPTH, Flow, Pipeline, READ_PIPELINE_DEPTH, Sink, WRITE_PIPELINE_DEPTH,
-    WRITE_THROUGH_DEPTH,
+    DEFAULT_PIPELINE_DEPTH, Flow, Pipeline, Sink, WRITE_PIPELINE_DEPTH, WRITE_THROUGH_DEPTH,
 };

src/io/pipeline.rs

@@ -173,14 +173,9 @@ fn finish_with_grace<R: Send + 'static>(
 
 /// Default channel depth for callers without a specific reason to
 /// pick another value. Kept conservative (4) — most callers should
-/// use READ_PIPELINE_DEPTH or WRITE_PIPELINE_DEPTH instead.
+/// use WRITE_PIPELINE_DEPTH instead.
 pub const DEFAULT_PIPELINE_DEPTH: usize = 4;
 
-/// Read pipeline depth. Larger buffer compensates for drive variability
-/// and NFS sync_file_range stalls; keeps ISO reader thread fed even when
-/// consumer blocks on write.
-pub const READ_PIPELINE_DEPTH: usize = 32;
-
 /// Write pipeline depth. Smaller buffer reduces backpressure risk when
 /// sync_file_range blocks; prevents producer from accumulating too much
 /// work while consumer waits for NFS to drain.

src/lib.rs

@@ -126,7 +126,6 @@ pub mod progress;
 pub mod scsi;
 pub mod sector;
 pub mod session;
-pub(crate) mod speed;
 pub(crate) mod udf;
 pub(crate) mod unlock_bridge;
 
@@ -159,25 +158,26 @@ pub use error::{Error, Result, is_disc_level_no_key, is_halt, is_skippable_title
 
 // ─── Cooperative cancellation ───────────────────────────────────────────────
 //
-// One-bit cooperative cancellation token, shared by every long-running loop
-// in libfreemkv (sweep, patch, mux). Clone it cheaply; pass it by value into
-// each component; poll `is_cancelled()` inside the loop body.
+// One-bit cooperative cancellation token, shared by every long-running loop —
+// libfreemkv's mux, and the recovery passes (sweep/patch) that now live in the
+// freemkv-engine crate. Clone it cheaply; pass it by value into each component;
+// poll `is_cancelled()` inside the loop body.
 pub use halt::Halt;
 
-// Generic bounded producer/consumer primitive used by sweep, patch, and
-// mux to overlap reads with writes via a dedicated consumer thread.
+// Generic bounded producer/consumer primitive used by the mux pipeline (and,
+// via this re-export, by the engine's sweep/patch recovery passes) to overlap
+// reads with writes via a dedicated consumer thread.
 // `Pipeline::spawn(name, depth, sink)` spawns a named consumer; `pipe.send(item)`
 // pushes one item with back-pressure; `pipe.finish()` joins the
 // consumer and surfaces its `close()` output. Callers implement `Sink`
 // to define per-item behaviour and end-of-stream finalisation.
 //
 // `DEFAULT_PIPELINE_DEPTH` (=4) is for callers without specific needs;
-// most should use READ_PIPELINE_DEPTH or WRITE_PIPELINE_DEPTH instead.
+// most should use WRITE_PIPELINE_DEPTH instead.
 // Patch uses `WRITE_THROUGH_DEPTH` (=1). Returning `Flow::Stop` from
 // `apply` ends the consumer cleanly (still calls `close()`).
 pub use io::pipeline::{
-    DEFAULT_PIPELINE_DEPTH, Flow, Pipeline, READ_PIPELINE_DEPTH, Sink, WRITE_PIPELINE_DEPTH,
-    WRITE_THROUGH_DEPTH,
+    DEFAULT_PIPELINE_DEPTH, Flow, Pipeline, Sink, WRITE_PIPELINE_DEPTH, WRITE_THROUGH_DEPTH,
 };
 
 // ─── Bounded-cache buffered file writer ─────────────────────────────────────
@@ -206,10 +206,7 @@ pub use identity::DriveId;
 // don't touch `DecryptKeys` directly — `DiscStream::new(reader, title, keys, …)`
 // accepts whatever `Disc::decrypt_keys()` returned. `decrypt_sectors()` is
 // for callers that operate on raw sector buffers (e.g. ISO patching).
-pub use decrypt::{
-    AacsKeyMap, DecryptKeys, decrypt_sectors, decrypt_sectors_mapped, decrypt_threads,
-    set_decrypt_threads,
-};
+pub use decrypt::{AacsKeyMap, DecryptKeys, decrypt_sectors, decrypt_threads, set_decrypt_threads};
 
 // ─── Disc structure ─────────────────────────────────────────────────────────
 //
@@ -223,11 +220,10 @@ pub use decrypt::{
 // different concepts, the same short name; the trait gets the `Pes`
 // prefix at the crate root to keep both addressable.
 pub use disc::{
-    AacsState, AudioChannels, AudioStream, Clip, Codec, ColorSpace, ContentFormat, DamageSeverity,
-    Disc, DiscFormat, DiscId, DiscTitle, DriveCredentials, Extent, ExtractOptions, ExtractResult,
-    FileResult, FrameRate, HdrFormat, Key, KeyOrigin, LabelPurpose, LabelQualifier, PatchOptions,
-    PatchOutcome, Resolution, SampleRate, ScanOptions, Stream, SubtitleStream, SweepOptions,
-    VideoStream, classify_damage,
+    AacsState, AudioChannels, AudioStream, Clip, Codec, ColorSpace, ContentFormat, Disc,
+    DiscFormat, DiscId, DiscTitle, DriveCredentials, Extent, ExtractOptions, ExtractResult,
+    FileResult, FrameRate, HdrFormat, Key, KeyOrigin, LabelPurpose, LabelQualifier, Resolution,
+    SampleRate, ScanOptions, Stream, SubtitleStream, VideoStream,
 };
 pub use keysource::{DiscInputs, KeySource, read_encrypted_units, resolve_and_apply};
 
@@ -273,11 +269,9 @@ pub use mux::{Mp4FitReport, Mp4SkipReason, mp4_fit_report};
 pub use mux::build_iso_pipeline;
 pub use mux::resolve_mux_key_map;
 pub use mux::select::{PidFilter, StreamSelection};
-pub use mux::{MuxEvents, MuxInput, MuxOptions, MuxOutcome, NoopEvents, mux_stream};
+pub use mux::{MuxEvents, MuxInput, MuxOptions, MuxOutcome, mux_stream};
 pub use scsi::{DriveInfo, ScsiSense, ScsiTransport, SenseFamily, drive_has_disc, list_drives};
 pub use sector::{
-    DecryptingSectorSource, FileSectorSink, FileSectorSource, KeyFetch, PrefetchedSectorSource,
-    SectorSink, SectorSource,
+    DecryptingSectorSource, FileSectorSource, KeyFetch, PrefetchedSectorSource, SectorSource,
 };
-pub use speed::DriveSpeed;
 pub use udf::{UdfFs, read_filesystem};

src/mux/driver.rs

@@ -223,9 +223,11 @@ pub trait MuxEvents: Send + Sync + 'static {
     fn on_read_error(&self, _lba: u32) {}
 }
 
-/// A [`MuxEvents`] that ignores everything — for callers that render no
-/// progress.
-pub struct NoopEvents;
+/// A [`MuxEvents`] that ignores everything — test-only (production callers
+/// supply their own events sink).
+#[cfg(test)]
+pub(crate) struct NoopEvents;
+#[cfg(test)]
 impl MuxEvents for NoopEvents {}
 
 /// The result of a [`mux_stream`] run.

src/mux/mod.rs

@@ -116,7 +116,7 @@ pub(crate) mod videomap;
 // direct `super::demux_sink::` / `super::fvi_sink::` paths — no re-export needed,
 // and no consumer names these types, so they are not public API.
 pub use disc::DiscStream;
-pub use driver::{MuxEvents, MuxInput, MuxOptions, MuxOutcome, NoopEvents, mux_stream};
+pub use driver::{MuxEvents, MuxInput, MuxOptions, MuxOutcome, mux_stream};
 pub use m2ts::M2tsStream;
 pub use mkvstream::MkvStream;
 pub use mp4::{Mp4FitReport, Mp4SkipReason, fit_report as mp4_fit_report};

src/sector/file.rs

@@ -1,180 +0,0 @@
-//! File-backed sector sink — write 2048-byte sectors to an ISO image
-//! on disk.
-//!
-//! The read-side counterpart ([`crate::io::file_sector_source::FileSectorSource`])
-//! lives under `io/` because its internals (read-ahead buffer, per-OS
-//! `fadvise`/`F_RDADVISE` hints) are I/O infrastructure rather than
-//! sector-trait business logic. Both types remain re-exported at
-//! [`crate::sector`] for ergonomic imports.
-
-use std::fs::OpenOptions;
-use std::io::{Seek, SeekFrom, Write};
-use std::path::Path;
-
-use crate::error::{Error, Result};
-
-use super::SectorSink;
-
-/// SectorSink backed by a file (ISO image).
-///
-/// Writes go through [`crate::io::WritebackFile`], which on Linux drives
-/// continuous `sync_file_range` + `posix_fadvise(DONTNEED)` to keep
-/// the kernel dirty page cache bounded during multi-GB sequential
-/// writes. macOS / Windows fall through to a no-op pipeline.
-///
-/// `finish` runs `sync_all` before dropping the underlying file.
-pub struct FileSectorSink {
-    inner: crate::io::WritebackFile,
-}
-
-impl FileSectorSink {
-    /// Create a new ISO file at `path`, truncating any existing
-    /// file. The file is opened read-write so the same handle can
-    /// later be reused for verification reads if needed (sweep
-    /// doesn't, but it costs nothing here).
-    pub fn create(path: &Path) -> std::io::Result<Self> {
-        let file = OpenOptions::new()
-            .read(true)
-            .write(true)
-            .create(true)
-            .truncate(true)
-            .open(path)?;
-        Ok(Self {
-            inner: crate::io::WritebackFile::new(file)?,
-        })
-    }
-
-    /// Open an existing ISO file for in-place updates (e.g. patch
-    /// pass writing recovered sectors over zero-filled holes).
-    /// Does not truncate.
-    pub fn open(path: &Path) -> std::io::Result<Self> {
-        let file = OpenOptions::new().read(true).write(true).open(path)?;
-        Ok(Self {
-            inner: crate::io::WritebackFile::new(file)?,
-        })
-    }
-}
-
-impl SectorSink for FileSectorSink {
-    fn write_sectors(&mut self, lba: u32, buf: &[u8]) -> Result<()> {
-        // SectorSink's contract requires a 2048-multiple buffer. Enforce
-        // it in all build modes (a `debug_assert!` is a no-op in release):
-        // a misaligned buffer would `write_all` partial bytes at
-        // lba*2048 and silently corrupt the ISO. Current in-tree callers
-        // always pass aligned buffers; this guards the public trait
-        // contract against any (including future external) caller.
-        if buf.len() % 2048 != 0 {
-            return Err(Error::IoError {
-                source: std::io::Error::from(std::io::ErrorKind::InvalidInput),
-            });
-        }
-        let offset = lba as u64 * 2048;
-        self.inner
-            .seek(SeekFrom::Start(offset))
-            .map_err(|e| Error::IoError { source: e })?;
-        self.inner
-            .write_all(buf)
-            .map_err(|e| Error::IoError { source: e })?;
-        Ok(())
-    }
-
-    fn finish(mut self: Box<Self>) -> Result<()> {
-        self.inner
-            .sync_all()
-            .map_err(|e| Error::IoError { source: e })?;
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::FileSectorSink;
-    use crate::io::file_sector_source::FileSectorSource;
-    use crate::sector::{SectorSink, SectorSource};
-    use tempfile::tempdir;
-
-    #[test]
-    fn round_trip_single_sector() {
-        let dir = tempdir().unwrap();
-        let path = dir.path().join("rt.iso");
-
-        let mut sink = FileSectorSink::create(&path).unwrap();
-        // Pre-extend the file to 4 sectors of zeros so we can write
-        // sector 2 in place. Easiest way: write zeros first.
-        let zeros = [0u8; 4 * 2048];
-        sink.write_sectors(0, &zeros).unwrap();
-
-        let mut payload = [0u8; 2048];
-        for (i, b) in payload.iter_mut().enumerate() {
-            *b = (i as u8).wrapping_mul(17);
-        }
-        sink.write_sectors(2, &payload).unwrap();
-        Box::new(sink).finish().unwrap();
-
-        let mut src = FileSectorSource::open(&path).unwrap();
-        assert_eq!(src.capacity_sectors(), 4);
-
-        let mut got = [0u8; 2048];
-        let n = src.read_sectors(2, 1, &mut got, false).unwrap();
-        assert_eq!(n, 2048);
-        assert_eq!(got, payload);
-
-        // Sectors 0,1,3 still zero.
-        let mut z = [0xffu8; 2048];
-        src.read_sectors(0, 1, &mut z, false).unwrap();
-        assert!(z.iter().all(|b| *b == 0));
-    }
-
-    #[test]
-    fn round_trip_multi_sector() {
-        let dir = tempdir().unwrap();
-        let path = dir.path().join("multi.iso");
-
-        let mut sink = FileSectorSink::create(&path).unwrap();
-        let mut payload = vec![0u8; 8 * 2048];
-        for (i, b) in payload.iter_mut().enumerate() {
-            *b = ((i * 31) ^ (i >> 7)) as u8;
-        }
-        sink.write_sectors(0, &payload).unwrap();
-        Box::new(sink).finish().unwrap();
-
-        let mut src = FileSectorSource::open(&path).unwrap();
-        assert_eq!(src.capacity_sectors(), 8);
-
-        let mut got = vec![0u8; 8 * 2048];
-        let n = src.read_sectors(0, 8, &mut got, false).unwrap();
-        assert_eq!(n, 8 * 2048);
-        assert_eq!(got, payload);
-    }
-
-    #[test]
-    fn open_existing_does_not_truncate() {
-        let dir = tempdir().unwrap();
-        let path = dir.path().join("open.iso");
-
-        // Create with 4 sectors of pattern A.
-        let mut sink = FileSectorSink::create(&path).unwrap();
-        let pat_a = [0xaau8; 4 * 2048];
-        sink.write_sectors(0, &pat_a).unwrap();
-        Box::new(sink).finish().unwrap();
-
-        // Reopen and overwrite sector 1 only.
-        let mut sink = FileSectorSink::open(&path).unwrap();
-        let pat_b = [0xbbu8; 2048];
-        sink.write_sectors(1, &pat_b).unwrap();
-        Box::new(sink).finish().unwrap();
-
-        let mut src = FileSectorSource::open(&path).unwrap();
-        assert_eq!(src.capacity_sectors(), 4);
-        let mut got = [0u8; 2048];
-
-        src.read_sectors(0, 1, &mut got, false).unwrap();
-        assert_eq!(got, [0xaau8; 2048]);
-
-        src.read_sectors(1, 1, &mut got, false).unwrap();
-        assert_eq!(got, [0xbbu8; 2048]);
-
-        src.read_sectors(2, 1, &mut got, false).unwrap();
-        assert_eq!(got, [0xaau8; 2048]);
-    }
-}

src/sector/mod.rs

@@ -1,20 +1,14 @@
-//! Sector-level I/O traits.
+//! Sector-level read I/O traits.
 //!
-//! The sector layer is direction-typed: [`SectorSource`] reads
-//! 2048-byte sectors, [`SectorSink`] writes them. Concrete impls
-//! never do both — physical drives are read-only, file-backed
-//! ISO images are opened for read OR write at construction time.
+//! [`SectorSource`] reads 2048-byte sectors from a disc.
 //!
 //! - [`SectorSource`] is implemented by `Drive` (hardware) and
 //!   [`FileSectorSource`] (file-backed).
-//! - [`SectorSink`] is implemented by [`FileSectorSink`]
-//!   (ISO-backed).
 //! - [`DecryptingSectorSource`] is a decorator that wraps any
 //!   `SectorSource` and applies AACS / CSS in-place decrypt to
 //!   yield plaintext sectors.
 
 pub mod decrypting;
-pub mod file;
 pub mod prefetched;
 
 use crate::error::Result;
@@ -169,27 +163,8 @@ impl SectorSource for &mut (dyn SectorSource + '_) {
     }
 }
 
-/// Write 2048-byte sectors to a disc image or composed sink.
-///
-/// The terminal [`finish`] takes `Box<Self>` so it can run on `dyn
-/// SectorSink` and consume the sink (`fsync` + close).
-///
-/// [`finish`]: SectorSink::finish
-pub trait SectorSink: Send {
-    /// Write the sectors in `buf` starting at `lba`. `buf.len()`
-    /// must be a multiple of 2048; the implementation seeks to
-    /// `lba as u64 * 2048` before writing (the `u64` cast is required —
-    /// a bare `u32` `lba * 2048` wraps past ~4 GB on UHD-scale images).
-    fn write_sectors(&mut self, lba: u32, buf: &[u8]) -> Result<()>;
-
-    /// Flush, fsync, and close. Consumes the sink. Always called
-    /// last; subsequent operations are not defined.
-    fn finish(self: Box<Self>) -> Result<()>;
-}
-
 pub use crate::io::file_sector_source::FileSectorSource;
 pub use decrypting::{DecryptingSectorSource, KeyFetch, KeyFetchFn};
-pub use file::FileSectorSink;
 pub use prefetched::PrefetchedSectorSource;
 
 #[cfg(test)]

src/speed.rs

@@ -1,91 +0,0 @@
-//! Drive speed constants.
-
-/// Common optical drive speeds with KB/s values for SET_CD_SPEED.
-///
-/// Ordering is by [`to_kbps`](Self::to_kbps) throughput, not declaration
-/// order — `PartialOrd`/`Ord` are implemented manually so e.g.
-/// `DVD1x < BD1x` (1385 < 4500 KB/s) holds. A naive derive would have
-/// ordered by variant position, making the slow DVD speeds sort above the
-/// fast BD speeds. `Max` (0xFFFF) sorts highest, as intended.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum DriveSpeed {
-    BD1x,
-    BD2x,
-    BD4x,
-    BD6x,
-    BD8x,
-    BD10x,
-    BD12x,
-    DVD1x,
-    DVD2x,
-    DVD4x,
-    DVD8x,
-    DVD16x,
-    Max,
-}
-
-impl DriveSpeed {
-    /// Throughput in KB/s for the SET_CD_SPEED CDB. `Max` maps to the
-    /// 0xFFFF sentinel that tells the drive to use its maximum speed.
-    pub fn to_kbps(self) -> u16 {
-        match self {
-            DriveSpeed::BD1x => 4_500,
-            DriveSpeed::BD2x => 9_000,
-            DriveSpeed::BD4x => 18_000,
-            DriveSpeed::BD6x => 27_000,
-            DriveSpeed::BD8x => 36_000,
-            DriveSpeed::BD10x => 45_000,
-            DriveSpeed::BD12x => 54_000,
-            DriveSpeed::DVD1x => 1_385,
-            DriveSpeed::DVD2x => 2_770,
-            DriveSpeed::DVD4x => 5_540,
-            DriveSpeed::DVD8x => 11_080,
-            DriveSpeed::DVD16x => 22_160,
-            DriveSpeed::Max => 0xFFFF,
-        }
-    }
-}
-
-impl PartialOrd for DriveSpeed {
-    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-impl Ord for DriveSpeed {
-    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
-        self.to_kbps().cmp(&other.to_kbps())
-    }
-}
-
-impl std::fmt::Display for DriveSpeed {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        // `Max` is the "let the drive pick its maximum" sentinel; printing
-        // its 0xFFFF KB/s value would read as a real (absurd) throughput.
-        match self {
-            DriveSpeed::Max => write!(f, "Max"),
-            _ => write!(f, "{:?} ({} KB/s)", self, self.to_kbps()),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn ordering_is_by_throughput_not_declaration() {
-        assert!(DriveSpeed::DVD1x < DriveSpeed::BD1x);
-        assert!(DriveSpeed::DVD16x < DriveSpeed::BD8x);
-        assert!(DriveSpeed::BD12x < DriveSpeed::Max);
-        let mut v = [DriveSpeed::Max, DriveSpeed::DVD1x, DriveSpeed::BD4x];
-        v.sort();
-        assert_eq!(v, [DriveSpeed::DVD1x, DriveSpeed::BD4x, DriveSpeed::Max]);
-    }
-
-    #[test]
-    fn max_display_omits_sentinel_value() {
-        assert_eq!(DriveSpeed::Max.to_string(), "Max");
-        assert!(DriveSpeed::BD1x.to_string().contains("4500 KB/s"));
-    }
-}